Reading SBAR SDN flow-Based monitoring and Application Recognition

概要

在sdn下，控制平面基于网络测量的的数据控制网络，而细粒度的管理得益于细粒度的测量数据。针对sdn环境下的细粒度测量（识别具体应用程序），可以实现对细粒度的流量管控。
设计了识别系统SBAR，对数据流进行测量，识别出具体应用程序并得到它们的网络数据。针对流分类，SBAR以应用程序协议为参照，使用了机器学习的算法。针对web和加密流量，使用深度包检测检测包的负载以识别应用程序。同时SBAR利用了OpenFlow提供的测量数据识别应用，交换机利用南向接口向控制器传输数据。最后使用GUI对得到的数据进行整合处理得到全网测量数据。经过验证，SBAR检测的准确率可以达到90%以上（由于使用DPI和ML可能有较大的资源开销和时延）。

Background

In the Software-Defined Networking (SDN) paradigm, it is essential to perform comprehensive traffic monitoring in order to provide the control plane with an accurate view of the network state.
This enables to perform such an effective fine-grained network management
with different purposes (e.g., traffic engineering, security).

NetFlow/IPFIX:There are a plenty of tools based on Netflow that harness the flow-level measurement.
Flows are often labeled (e.g., by protocol)
using port-based classification techniques which is gradually obsoleted beacause it is quite common to find very diverse applications operating over
the same application protocols（无法从端口号分辨出具体的应用程序）
QoE:the QoE perceived by end-users significantly depends on the type of application and the QoS level provided by the network (e.g., bandwidth, delay).（QoE感知取决于应用程序类型以及QoS级别）
Deep Packet Inspection (DPI)
typically achieves very accurate traffic classification by inspecting the packet payloads. However, applying DPI over all the packets traversing a network is often too resource consuming （根据负载分类，资源开销过大）
Machine Learning (ML) classifiers were proposed with the aim of alleviating the
processing burden.Use **features* up to the transport layer to classify the traffic, useless when applied to distinguish among different applications generating traffic over the same protocol（根据特征分类，无法从相同协议分辨出不同程序）

We present SBAR, a monitoring system compliant with OpenFlow that provides flow-level measurement
Classify the traffic at two different levels:In the Software-Defined Networking (SDN) paradigm, it is essential to perform comprehensive traffic monitoring in order to provide the control plane with an accurate view of the network state. This
enables to perform such an effective fine-grained network management with different purposes (e.g., traffic engineering, security).
(i) every monitored flow is classified by application protocol,
(ii) for web and encrypted traffic, we apply specific DPI techniques to identify the applications （端口号相同要通过负载分辨出具体的应用程序）
generating each flow
Reduce the processing overhead in the controller(s) and the memory consumption in switches to maintain the measurements

Leverage the particularities of OpenFlow networks to efficiently implement a combination of techniques based on ML and DPI to accurately classify the traffic in the controller.
Leverage the support of OpenFlow to maintain the flow measurements (# of
packets and bytes, and duration) in the flow tables of the switches
OpenFlow provides an interface that permits to report the measurements to the controller(s) when some predefined timeouts (idle and hard) expire
Make use of ultiple tables of OpenFlow
to decouple the operation of this module from other modules executing
different network tasks (e.g., forwarding) in the controller.

Flow sampling using only native features of OpenFlow, which enables to address
common scalability issues in OpenFlow-based networks.

Per-flow classification by application protocols (e.g., SMTP, SSH) using a ML model
For web and encrypted flows, it applies specific DPI techniques [1, 2] to identify the applications (e.g., Netflix, Facebook) generating traffic.