Cost-Based Placement of Virtualized Deep Packet Inspection Functions in SDN

Abstract

In today's IT systems, cyber security requires fine-grained, flexible, adaptable and cost optimized monitoring mechanisms. The emergence of new networking technologies, like Network Function Virtualization (NFV) and Software Defined Networking (SDN), opens up new venues for large scale adoption of these cyber security tools. In particular, Deep Packet Inspection (DPI) engines can be virtualized and dynamically deployed as pieces of software on commodity hardware. Deploying such software DPI engines is costly in terms of license fees and power consumption. Designing cost effective DPI engine deployment strategies that meet the cybersecurity operational constraints is thus mandatory for the adoption of this approach. For this purpose, we propose a method, based on genetic algorithms, that optimizes the cost of DPI engine deployment, minimizing their number, the global network load and the number of unanalyzed flows. We conduct several experiments with different types of traffic and different cost structures. The results show that the method is able to reach a trade-off between the number of DPI engines and network load. Furthermore, the global cost can be reduced up to 58% when relaxing the constraint on the used link capacity, that is the provisioning rate.