{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,9]],"date-time":"2024-07-09T01:10:24Z","timestamp":1720487424351},"reference-count":57,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2021,3,3]],"date-time":"2021-03-03T00:00:00Z","timestamp":1614729600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003407","name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca","doi-asserted-by":"publisher","award":["Crosslab Project (Departments of Excellence)"],"id":[{"id":"10.13039\/501100003407","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"One of the most challenging tasks for network operators is implementing accurate per-packet monitoring, looking for signs of performance degradation, security threats, and so on. Upon critical event detection, corrective actions must be taken to keep the network running smoothly. Implementing this mechanism requires the analysis of packet streams in a real-time (or close to) fashion. In a softwarized network context, Stream Processing Systems (SPSs) can be adopted for this purpose. Recent solutions based on traditional SPSs, such as Storm and Flink, can support the definition of general complex queries, but they show poor performance at scale. To handle input data rates in the order of gigabits per seconds, programmable switch platforms are typically used, although they offer limited expressiveness. With the proposed approach, we intend to offer high performance and expressive power in a unified framework by solely relying on SPSs for multicores. Captured packets are translated into a proper tuple format, and network monitoring queries are applied to tuple streams. Packet analysis tasks are expressed as streaming pipelines, running on general-purpose programmable network devices, and a second stage of elaboration can process aggregated statistics from different devices. Experiments carried out with an example monitoring application show that the system is able to handle realistic traffic at a 10 Gb\/s speed. The same application scales almost up to 20 Gb\/s speed thanks to the simple optimizations of the underlying framework. Hence, the approach proves to be viable and calls for the investigation of more extensive optimizations to support more complex elaborations and higher data rates.<\/jats:p>","DOI":"10.3390\/s21051735","type":"journal-article","created":{"date-parts":[[2021,3,4]],"date-time":"2021-03-04T01:33:57Z","timestamp":1614821637000},"page":"1735","source":"Crossref","is-referenced-by-count":2,"title":["Data Stream Processing for Packet-Level Analytics"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"http:\/\/orcid.org\/0000-0003-3824-5655","authenticated-orcid":false,"given":"Alessandra","family":"Fais","sequence":"first","affiliation":[{"name":"Dipartimento di Ingegneria dell\u2019Informazione, Universit\u00e0 di Pisa, 56122 Pisa, Italy"}]},{"ORCID":"http:\/\/orcid.org\/0000-0003-1005-7441","authenticated-orcid":false,"given":"Giuseppe","family":"Lettieri","sequence":"additional","affiliation":[{"name":"Dipartimento di Ingegneria dell\u2019Informazione, Universit\u00e0 di Pisa, 56122 Pisa, Italy"}]},{"ORCID":"http:\/\/orcid.org\/0000-0001-5604-6129","authenticated-orcid":false,"given":"Gregorio","family":"Procissi","sequence":"additional","affiliation":[{"name":"Dipartimento di Ingegneria dell\u2019Informazione, Universit\u00e0 di Pisa, 56122 Pisa, Italy"}]},{"given":"Stefano","family":"Giordano","sequence":"additional","affiliation":[{"name":"Dipartimento di Ingegneria dell\u2019Informazione, Universit\u00e0 di Pisa, 56122 Pisa, Italy"}]},{"given":"Francesco","family":"Oppedisano","sequence":"additional","affiliation":[{"name":"NetResults S.r.l., 56121 Pisa, Italy"}]}],"member":"1968","published-online":{"date-parts":[[2021,3,3]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"131944","DOI":"10.1109\/ACCESS.2019.2941183","article-title":"Raising the Parallel Abstraction Level for Streaming Analytics Applications","volume":"7","author":"Mencagli","year":"2019","journal-title":"IEEE Access"},{"key":"ref_2","unstructured":"(2021, January 24). WindFlow: A C++17 Data Stream Processing Parallel Library for Multicores and GPUs. Available online: https:\/\/paragroup.github.io\/WindFlow\/."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fais, A., Procissi, G., Giordano, S., and Oppedisano, F. (2020, January 14\u201316). Data Stream Processing in Software Defined Networks: Perspectives and Challenges. Proceedings of the 2020 IEEE 25th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), Pisa, Italy.","DOI":"10.1109\/CAMAD50429.2020.9209303"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"OpenFlow: Enabling Innovation in Campus Networks","volume":"38","author":"McKeown","year":"2008","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1145\/2656877.2656890","article-title":"P4: Programming Protocol-independent Packet Processors","volume":"44","author":"Bosshart","year":"2014","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_6","unstructured":"Barefoot (2020, June 26). Tofino: World\u2019s Fastest P4-Programmable Ethernet Switch ASICs. Available online: https:\/\/www.barefootnetworks.com\/products\/brief-tofino\/."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Moln\u00e1r, L., Pongr\u00e1cz, G., Enyedi, G., Kis, Z.L., Csikor, L., Juh\u00e1sz, F., K\u0151r\u00f6si, A., and R\u00e9tv\u00e1ri, G. (2016, January 22\u201326). Dataplane Specialization for High-Performance OpenFlow Software Switching. Proceedings of the 2016 Conference of the Association for Computing Machinery (ACM) Special Interest Group on Data Communication (SIGCOMM), Florianopolis, Brazil.","DOI":"10.1145\/2934872.2934887"},{"key":"ref_8","unstructured":"DPDK (2020, June 15). Available online: http:\/\/dpdk.org."},{"key":"ref_9","unstructured":"Open vSwitch (2021, February 16). Available online: https:\/\/www.openvswitch.org\/."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"24004","DOI":"10.1109\/ACCESS.2017.2767640","article-title":"Design and Demonstration of High-Throughput Protocol Oblivious Packet Forwarding to Support Software-Defined Vehicular Networks","volume":"5","author":"Sun","year":"2017","journal-title":"IEEE Access"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1145\/2602204.2602211","article-title":"OpenState: Programming Platform-independent Stateful Openflow Applications Inside the Switch","volume":"44","author":"Bianchi","year":"2014","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Bonola, M., Bifulco, R., Petrucci, L., Pontarelli, S., Tulumello, A., and Bianchi, G. (2017, January 12\u201314). Implementing advanced network functions for datacenters with stateful programmable data planes. Proceedings of the 2017 IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN), Osaka, Japan.","DOI":"10.1109\/LANMAN.2017.7972130"},{"key":"ref_13","unstructured":"Pontarelli, S., Bifulco, R., Bonola, M., Cascone, C., Spaziani, M., Bruschi, V., Sanvito, D., Siracusano, G., Capone, A., and Honda, M. (2019, January 26\u201328). FlowBlaze: Stateful Packet Processing in Hardware. Proceedings of the 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19), Boston, MA, USA."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bonelli, N., Giordano, S., and Procissi, G. (2018). Enif-Lang: A Specialized Language for Programming Network Functions on Commodity Hardware. J. Sens. Actuator Netw., 7.","DOI":"10.3390\/jsan7030034"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Bonelli, N., Giordano, S., Procissi, G., and Abeni, L. (2014, January 20\u201321). A Purely Functional Approach to Packet Processing. Proceedings of the Tenth ACM\/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS \u201914), Los Angeles, CA, USA.","DOI":"10.1145\/2658260.2658269"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1819","DOI":"10.1109\/JSAC.2016.2558998","article-title":"Network Traffic Processing With PFQ","volume":"34","author":"Bonelli","year":"2016","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_17","unstructured":"Monsanto, C., Reich, J., Foster, N., Rexford, J., and Walker, D. (2013, January 2\u20135). Composing Software-defined Networks. Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation, Lombard, IL, USA."},{"key":"ref_18","unstructured":"(2020, June 15). The Frenetic Project. Available online: http:\/\/frenetic-lang.org\/."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1963559.1963562","article-title":"Application-Tailored I\/O with Streamline","volume":"29","author":"Bos","year":"2011","journal-title":"ACM Trans. Comput. Syst."},{"key":"ref_20","unstructured":"(2020, June 15). VPP. Available online: https:\/\/wiki.fd.io\/view\/VPP."},{"key":"ref_21","unstructured":"(2020, June 24). Extended Berkeley Packet Filter. Available online: https:\/\/www.iovisor.org\/technology\/ebpf."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Braun, L., Didebulidze, A., Kammenhuber, N., and Carle, G. (2010, January 1\u20133). Comparing and improving current packet capturing solutions based on commodity hardware. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement (IMC \u201910), Melbourne, Australia.","DOI":"10.1145\/1879141.1879168"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1364","DOI":"10.1109\/COMST.2015.2424887","article-title":"Commodity Packet Capture Engines: Tutorial, Cookbook and Applicability","volume":"17","author":"Moreno","year":"2015","journal-title":"Commun. Surv. Tutor. IEEE"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Gallenm\u00fcller, S., Emmerich, P., Wohlfart, F., Raumer, D., and Carle, G. (2015, January 7\u20138). Comparison of Frameworks for High-Performance Packet IO. Proceedings of the Eleventh ACM\/IEEE Symposium on Architectures for Networking and Communications Systems, Oakland, CA, USA.","DOI":"10.1109\/ANCS.2015.7110118"},{"key":"ref_25","unstructured":"Rizzo, L. (2012, January 8\u201310). Netmap: A novel framework for fast packet I\/O. Proceedings of the 21st USENIX Conference on Security Symposium (USENIX Security 12), Bellevue, WA, USA."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Fusco, F., and Deri, L. (2010, January 1\u20133). High speed network traffic analysis with commodity multi\u2013core systems. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement (IMC \u201910), Melbourne, Australia.","DOI":"10.1145\/1879141.1879169"},{"key":"ref_27","unstructured":"Deri, L. (2020, June 15). PF_RING ZC (Zero Copy). Available online: http:\/\/www.ntop.org\/products\/packet-capture\/pf_ring\/pf_ring-zc-zero-copy\/."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"H\u00f8iland-J\u00f8rgensen, T., Brouer, J.D., Borkmann, D., Fastabend, J., Herbert, T., Ahern, D., and Miller, D. (2018, January 4\u20137). The eXpress Data Path: Fast programmable packet processing in the Operating System Kernel. Proceedings of the CoNEXT \u201918: International Conference on Emerging Networking EXperiments and Technologies, Heraklion, Greece.","DOI":"10.1145\/3281411.3281443"},{"key":"ref_29","unstructured":"Linux Kernel Contributors (2020, June 15). PACKET_MMAP. Available online: https:\/\/www.kernel.org\/doc\/Documentation\/networking\/packet_mmap.txt."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"976","DOI":"10.1109\/TNSM.2018.2828939","article-title":"Packet Fan\u2014Out Extension for the pcap Library","volume":"15","author":"Bonelli","year":"2018","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_31","unstructured":"Kim, C., Sivaraman, A., Katta, N., Bas, A., Dixit, A., and Wobker, L.J. (2015, January 17\u201321). In-band Network Telemetry via Programmable Dataplanes. Proceedings of the 2015 Conference of the Association for Computing Machinery (ACM) Special Interest Group on Data Communication (SIGCOMM), London, UK."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"708","DOI":"10.1109\/TNSM.2019.2953327","article-title":"Sel-INT: A Runtime-Programmable Selective In-Band Network Telemetry System","volume":"17","author":"Tang","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Liu, Z., Manousis, A., Vorsanger, G., Sekar, V., and Braverman, V. (2016, January 22\u201326). One Sketch to Rule Them All: Rethinking Network Flow Monitoring with UnivMon. Proceedings of the 2016 Conference of the Association for Computing Machinery (ACM) Special Interest Group on Data Communication (SIGCOMM), Florianopolis, Brazil.","DOI":"10.1145\/2934872.2934906"},{"key":"ref_34","unstructured":"Yu, M., Jose, L., and Miao, R. (2013, January 2\u20135). Software Defined Traffic Measurements with OpenSketch. Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation, Lombard, IL, USA."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Narayana, S., Sivaraman, A., Nathan, V., Alizadeh, M., Walker, D., Rexford, J., Jeyakumar, V., and Kim, C. (2016, January 9\u201310). Hardware-Software Co-Design for Network Performance Measurement. Proceedings of the 15th ACM Workshop on Hot Topics in Networks (HotNets \u201916), Atlanta, GA, USA.","DOI":"10.1145\/3005745.3005775"},{"key":"ref_36","unstructured":"Huang, D., Koh, Y.S., and Dobbie, G. (2012, January 3\u20136). Rare Pattern Mining on Data Streams. Proceedings of the 14th International Conference on Data Warehousing and Knowledge Discovery (DaWaK\u201912), Vienna, Austria."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"233","DOI":"10.1016\/j.is.2012.01.005","article-title":"Mining frequent itemsets in a stream","volume":"39","author":"Calders","year":"2014","journal-title":"Inf. Syst."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1016\/j.datak.2013.10.002","article-title":"Mining frequent itemsets in data streams within a time horizon","volume":"89","author":"Troiano","year":"2014","journal-title":"Data Know. Eng."},{"key":"ref_39","unstructured":"Borders, K., Springer, J., and Burnside, M. (2012, January 8\u201310). Chimera: A Declarative Language for Streaming Network Traffic Analysis. Proceedings of the 21st USENIX Conference on Security Symposium (USENIX Security 12), Bellevue, WA, USA."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Cranor, C., Johnson, T., Spataschek, O., and Shkapenyuk, V. (2003, January 9\u201312). Gigascope: A Stream Database for Network Applications. Proceedings of the 2003 International Conference of the Association for Computing Machinery (ACM) Special Interest Group on Management of Data (SIGMOD), San Diego, CA, USA.","DOI":"10.1145\/872757.872838"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Yuan, Y., Lin, D., Mishra, A., Marwaha, S., Alur, R., and Loo, B.T. (2017, January 21\u201325). Quantitative Network Monitoring with NetQRE. Proceedings of the 2017 Conference of the Association for Computing Machinery (ACM) Special Interest Group on Data Communication (SIGCOMM), Los Angeles, CA, USA.","DOI":"10.1145\/3098822.3098830"},{"key":"ref_42","unstructured":"(2020, June 26). OpenSOC. Available online: https:\/\/github.com\/OpenSOC\/opensoc."},{"key":"ref_43","unstructured":"Apache Metron (2020, June 26). Available online: http:\/\/metron.apache.org\/."},{"key":"ref_44","unstructured":"(2020, June 22). Apache Storm. Available online: https:\/\/storm.apache.org\/."},{"key":"ref_45","unstructured":"(2020, June 22). Apache Flink. Available online: https:\/\/flink.apache.org\/."},{"key":"ref_46","unstructured":"Apache Spark Streaming (2020, June 22). Available online: https:\/\/spark.apache.org\/streaming\/."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"516","DOI":"10.14778\/3303753.3303758","article-title":"Analyzing Efficient Stream Processing on Modern Hardware","volume":"12","author":"Zeuch","year":"2019","journal-title":"Proc. VLDB Endow."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Zhang, S., He, B., Dahlmeier, D., Zhou, A.C., and Heinze, T. (2017, January 19\u201322). Revisiting the Design of Data Stream Processing Systems on Multi-Core Processors. Proceedings of the 2017 IEEE 33rd International Conference on Data Engineering (ICDE), San Diego, CA, USA.","DOI":"10.1109\/ICDE.2017.119"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Gupta, A., Birkner, R., Canini, M., Feamster, N., Mac-Stoker, C., and Willinger, W. (2016, January 9\u201310). Network Monitoring as a Streaming Analytics Problem. Proceedings of the 15th ACM Workshop on Hot Topics in Networks (HotNets \u201916), Atlanta, GA, USA.","DOI":"10.1145\/3005745.3005748"},{"key":"ref_50","unstructured":"Gupta, A., Harrison, R., Canini, M., Feamster, N., Rexford, J., and Willinger, W. (2018, January 20\u201325). Sonata: Query-Driven Streaming Network Telemetry. Proceedings of the 2018 Conference of the Association for Computing Machinery (ACM) Special Interest Group on Data Communication (SIGCOMM), Budapest, Hungary."},{"key":"ref_51","unstructured":"Fais, A. (2019). Benchmarking Data Stream Processing Frameworks on Multicores, Universit\u00e0 di Pisa. Available online: https:\/\/etd.adm.unipi.it\/t\/etd-09162019-220730."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"382","DOI":"10.1007\/s10766-016-0413-x","article-title":"Parallel Patterns for Window-Based Stateful Operators on Data Streams: An Algorithmic Skeleton Approach","volume":"45","author":"Mencagli","year":"2017","journal-title":"Int. J. Parallel Program."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Fais, A., Giordano, S., and Procissi, G. (2020, January 9\u201312). On the Design of Fast and Scalable Network Applications Through Data Stream Processing. Proceedings of the 2020 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Leganes, Madrid, Spain.","DOI":"10.1109\/NFV-SDN50289.2020.9289855"},{"key":"ref_54","unstructured":"Al-Mansoori, A., Yu, S., Xiang, Y., and Sood, K. (February, January 30). A Survey on Big Data Stream Processing in SDN Supported Cloud Environment. Proceedings of the Australasian Computer Science Week Multiconference (ACSW \u201918), Brisbane, Queensland, Australia."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Pllana, S., and Xhafa, F. (2017). Fastflow: High-Level and Efficient Streaming on Multicores. Programming Multi-Core and Many-Core Computing Systems, Wiley Publishing.","DOI":"10.1002\/9781119332015"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"748","DOI":"10.1002\/spe.2675","article-title":"Cache-aware design of general-purpose Single-Producer\u2013Single-Consumer queues","volume":"49","author":"Maffione","year":"2019","journal-title":"J. Softw. Pract. Exp."},{"key":"ref_57","unstructured":"The kernel development community (2020, January 31). Reducing OS Jitter Due to Per-Cpu Kthreads. Available online: https:\/\/www.kernel.org\/doc\/html\/latest\/admin-guide\/kernel-per-CPU-kthreads.html."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/5\/1735\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,9]],"date-time":"2024-07-09T00:36:30Z","timestamp":1720485390000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/5\/1735"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,3]]},"references-count":57,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2021,3]]}},"alternative-id":["s21051735"],"URL":"https:\/\/doi.org\/10.3390\/s21051735","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,3,3]]}}}