Commodity Servers Research Articles

Take the Blue Pill: Pursuing Mobile App Testing Fidelity, Efficiency, and Accessibility with Virtual Device Farms

For more than a decade, researchers have been extensively exploring mobile app testing on virtual devices [1-9], which are software-emulated mobile devices running on commodity servers, in a similar vein as virtual machines (VM) in the cloud. Building on server virtualization, virtual devices naturally inherit the benefits of VM, such as scalability, elasticity, and cost efficiency. Moreover, virtualization enables useful features not offered by physical devices, such as service instrumentation [3], whole-system snapshot [9], and memory introspection [1,2], atop which a series of advanced testing and debugging techniques are developed.

FELIX: First operational experience with the new ATLAS readout system and perspectives for HL-LHC

The Front-End Link eXchange (FELIX) readout system is deployed as the new interface connecting detector front-end electronics with the data acquisition and Timing, Trigger and Control (TTC) systems. FELIX functions as a router between custom serial links from front-end ASICs and FPGAs to data collection and processing components via a commodity switched network. FELIX uses commodity server technology in combination with FPGA-based PCIe I/O cards. FELIX servers run a software routing platform serving data to network clients performing a number of data preparation, monitoring and control functions. This paper covers the design of FELIX as well as the first operational experience gained during the Run 3 start, including the challenges faced commissioning the system for each ATLAS sub-detector. Over the next decade, the ATLAS detector will be required to operate in an increasingly harsh collision environment and challenging data taking conditions. To maintain physics performance, the detector will undergo a series of upgrades. In particular, the readout system capabilities will be improved. The planned evolution of FELIX for High-Luminosity LHC will be described, including architectural changes and status of early integration with detector development projects.

Programmable device deployment for efficient network function offloading

Network functions (NFs) play an important role in ensuring network security and performance. To improve the NF throughput performance, an emerging method is to offload NFs on programmable devices, bringing orders-of-magnitude improvements. A primary task for efficient NF offloading is how to deploy programmable devices (e.g., programmable switches) for network upgrades. Although programmable switches have powerful computing resources, their memory resources are usually limited, which poses a challenge of offloading stateful NFs (e.g., load balancer, NAT) with a large-size memory requirement. A promising solution to break the memory limitation is using external memory (e.g., on commodity servers) with the help of remote direct memory access (RDMA) supported by SmartNIC. Therefore, this paper studies the problem of upgrading networks by replacing legacy switches with programmable switches and equipping commodity servers with SmartNICs so that NFs can be offloaded on programmable switches with external memory expansion. We prove that this problem is NP-Hard, and there is no polynomial-time algorithm with an approximation ratio of (1−ϵ)⋅lnh, where ϵ is an arbitrarily small value, and h is the total number of requests in the network. Then we design an efficient algorithm with an approximation ratio of 2.5⋅H(m⋅n), where m is the number of NF types, n is the maximum number of requests through a switch, and H(m⋅n) is the (m⋅n)-th harmonic number. The simulation results show that our solution can reduce the upgrade cost by about 70% compared with the state-of-the-art approaches while preserving the same system throughput.

NFVPermit: Toward Ensuring Performance Isolation in NFV-Based Systems

Network Functions Virtualization (NFV) promises programmability and cost savings by replacing hardware middleboxes with more flexible Virtual Network Functions (VNFs) on commodity servers. But, the current virtualization technologies do not fully isolate the system resources like Last Level Cache (LLC) and Memory Bandwidth (MB); therefore, co-location of VNFs on the same commodity server causes interference effects which might severely impact the performance of VNFs in terms of throughput, latency, etc. Contention at LLC is one of the root causes of this performance degradation and it is addressed by LLC resource partitioning. But, it remains unexplored the impact of both LLC and MB on VNF performance. In this work, we investigate the importance of MB partitioning along with LLC partitioning to achieve performance isolation in NFV-based systems. Allocating these system resources among co-located VNFs to meet Service Level Agreements (SLAs) is challenging due to the dynamic nature of traffic and varying functionality of VNFs. In this work, we formulate the resource allocation problem as an Integer Linear Programming (ILP) for maximizing the number of accepted VNF requests with SLA guarantees. Since the problem is NP-hard, we present a polynomial time -approximation scheme. Further, we propose a heuristic approach named NFVPermit, a resource manager for NFV-based systems that tries to ensure performance isolation among co-located VNFs based on their current traffic rates and SLA requirements. Through extensive experiments, we show how NFVPermit outperforms state-of-the-art and baseline approaches.

Empowering DDoS Attack Mitigation with Programmable Switches

Distributed denial-of-service (DDoS) attacks have long been the most severe and destructive attack on modern networks. Some solutions place several middleboxes that run security-oriented network functions (SNFs) in the network to defend against DDoS attacks. However, middleboxes are proprietary and fixed-function, making them costly and inflexible when handling attack dynamics. Another class of solutions exploits the capability of software-defined networking (SDN) and network function virtualization (NFV) to run virtualized SNFs on commodity servers. This reduces the cost of DDoS attack mitigation while enabling high flexibility by dynamically removing or adding SNF instances. However, this class of solutions sacrifices packet processing performance and incurs non-trivial end-to-end latency, which is unacceptable for many latency-sensitive Internet services. Recently, the emergence of programmable switches brings a promising alternative solution: arbitrary SNFs can be directly performed in line-rate ASIC pipelines of programmable switches, enabling low-cost, flexible, and high-performance DDoS attack mitigation. In this article, we present an illustrative survey of recent solutions that leverage programmable switches to provide DDoS attack mitigation. Our survey can help understand how to make full use of the benefits of programmable switches to defend against DDoS attacks.

Empowering Network Security With Programmable Switches: A Comprehensive Survey

With the growth of network applications such as 5G and artificial intelligence, network security techniques, i.e., the techniques that detect various attacks (e.g., well-known denial-of service (DDoS) attacks) and prevent production networks (e.g., data center networks) from being attacked, become increasingly essential for network management and have gained great popularity in the networking community. Generally, these techniques are built on proprietary hardware appliances, i.e., middleboxes, or the paradigm that combines both software-defined networking (SDN) and network function virtualization (NFV) to implement security functions. However, the techniques built on middleboxes are proven to be hard-to-manage, costly, and inflexible, thereby making them an out-of-date choice in network security. For the techniques built on SDN and NFV, they virtualize and softwarize security functions on commodity servers, leading to non-trivial performance degradation. Fortunately, the recent emergence of programmable switches brings new opportunities of empowering network security techniques with the characteristics of easy-tomanage, low cost, high flexibility, and Tbps-level performance. In this survey, we focus on this promising trend in network security. More precisely, this survey first presents the preliminaries of programmable switches, which are the primary driver of next-generation network security techniques. Next, we comprehensively review existing techniques built on programmable switches, classify these techniques, and discuss their background, motivation, design, implementation, and limitations case-by-case. Finally, we summarize open issues and future research directions in this promising research topic of network security.

Overlay-Based Android Malware Detection at Market Scales: Systematically Adapting to the New Technological Landscape

Android <i>overlay</i> enables one app to draw over other apps by creating an extra <monospace>View</monospace> layer atop the host <monospace>View</monospace> , which nevertheless can be exploited by malicious apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level while sacrificing overlays’ usability; recently, the overlay mechanism has been substantially updated to prevent a variety of attacks, which however can still be evaded by considerable adversaries. To address these shortcomings, a more pragmatic approach is to enable <i>early detection</i> of overlay-based malware during the app market review process, so that all the capabilities of overlays can stay unchanged. For this purpose, in this paper we first conduct a large-scale comparative study of overlay characteristics in benign and malicious apps, and then implement the OverlayChecker system to automatically detect overlay-based malware for one of the world’s largest Android app stores. In particular, we have made systematic efforts in feature engineering, UI exploration, emulation architecture, and run-time environment, thus maintaining high detection accuracy (97 percent precision and 97 percent recall) and short per-app scan time ( <inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 1.7 minutes) with only two commodity servers, under an intensive workload of <inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 10K newly submitted apps per day.

Blockchain Function Virtualization: A New Approach for Mobile Networks Beyond 5G

Many of the key enabling technologies of the fifth-generation (5G), such as network slicing, spectrum sharing, and federated learning, rely on a centralized authority. This may lead to pitfalls in terms of security or single point of failure. Distributed ledger technology, specifically blockchain, is currently employed by different applications related to the Internet of Things (IoT) and 5G to address the drawbacks of centralized systems. For this reason, mobile blockchain networks (MBNs) have recently attracted a great deal of attention. To add a transaction to the blockchain in MBNs, mobile or IoT users must perform various tasks like encryption, decryption, and mining. These tasks require energy and processing power, which impose limitations on mobile and IoT users' performance because they are usually battery powered and have a low processing power. One possible solution is to perform the tasks virtually on commodity servers provided by mobile edge computing (MEC) or cloud computing. To do so, all tasks needed to add a transaction to the blockchain can be treated as virtual blockchain functions that can be executed on commodity servers. We introduce a blockchain virtualization framework called blockchain function virtualization (BFV), through which all blockchain functions can be performed virtually by MEC or cloud computing. Furthermore, we describe applications of the BFV framework and resource allocation challenges brought by the BFV framework in mobile networks. In addition, to illustrate the advantages of BFV, we define an optimization problem to simultaneously minimize the energy consumption cost and maximize miners' rewards. Finally, simulation results show the performance of the proposed framework in terms of total energy consumption, transaction confirmation rate, and miners' average profit.

Cassandra is a Better Option for Handling Big Data in a No-SQL Database

With no single point of failure and the flexibility to handle enormous volumes of data across numerous commodity servers, Apache Cassandra is an opensource distributed database management system. With asynchronous master less replication, Cassandra provides strong support for clusters spanning several datacenters and enables low latency operations for all clients. Like skilled carpenters, data engineers are aware that certain tasks call for various tools. Choosing the appropriate equipment and being knowledgeable about their use can be the most crucial aspects of any job. A distributed information system for managing massive amounts of structured data across multiple goods servers, Apache Cassandra, a top-level Apache project developed at Facebook and based on Google's Big Table and Amazon's Generator, offers extremely offered service and has no single point of failure. In comparison to other NoSQL databases and relational databases, Cassandra offers features including continuous availability, linear scale performance, operational simplicity, and straightforward knowledge distribution over various knowledge centers and cloud availability zones. Cassandra's capacity to scale, perform, and supply continuous time period is due to its design. Cassandra uses an attractive, simple-to-setup, and simple-to-maintain lordless "ring" design rather than a traditional master-slave or a manual and labor-intensive shared system. With continuous availability, linear scale performance, operational simplicity, and simple data distribution over numerous data centers and cloud availability zones, Apache Cassandra is a massively scalable open-source non-relational database. Cassandra was initially created at Facebook; it was open sourced in 2008; and in 2010, it was elevated to the status of a top-level Apache project.

Scalable, ultra-fast, and low-memory construction of compacted de Bruijn graphs with Cuttlefish 2

The de Bruijn graph is a key data structure in modern computational genomics, and construction of its compacted variant resides upstream of many genomic analyses. As the quantity of genomic data grows rapidly, this often forms a computational bottleneck. We present Cuttlefish 2, significantly advancing the state-of-the-art for this problem. On a commodity server, it reduces the graph construction time for 661K bacterial genomes, of size 2.58Tbp, from 4.5 days to 17–23 h; and it constructs the graph for 1.52Tbp white spruce reads in approximately 10 h, while the closest competitor requires 54–58 h, using considerably more memory.

Metered Boot: Trusted Framework for Application Usage Rights Management in Virtualized Ecosystems

The adoption of virtualization and cloud computing technologies have revolutionized how services and applications can be developed, deployed, and operated to achieve better elasticity, flexibility, and scalability. Multiple stakeholders can be involved for providing online services; each of them plays one or more roles (i.e., service operator, application vendor, and infrastructure provider) to create a customized operating model based on the business requirements. The operating model changes from one business to another, and it may even change at different stages of the same business. A trusted relationship among stakeholders for secure information exchange is the key to enable such flexibility. However, traditional usage compliance methods (e.g., in-person audit, dynamic licensing, and subscription) lack explicit trust among involved parties and the flexibility and scalability to support dynamic sizing of services and applications with low overhead. In this work, we argue the need for a new trust framework to manage application usage rights and propose Metered Boot to provide trusted, capacity/usage-based usage rights management for services and applications deployed in virtualized environments. Metered Boot decouples application workload instantiation for service operators, usage rights governance for application vendors, and resource provisioning for infrastructure providers. We leverage cryptoprocessors (e.g., Trusted Platform Module (TPM)) on commodity servers to generate trusted proofs which are managed by efficient cryptographic construction, Merkle hash tree, for usage rights compliance. We integrated our framework with OpenStack and demonstrate that Metered Boot is able to achieve high scalability and low overhead for instantiating virtual network functions (VNFs).

PowerMorph: QoS-Aware Server Power Reshaping for Data Center Regulation Service

Adoption of renewable energy in power grids introduces stability challenges in regulating the operation frequency of the electricity grid. Thus, electrical grid operators call for provisioning of frequency regulation services from end-user customers, such as data centers, to help balance the power grid’s stability by dynamically adjusting their energy consumption based on the power grid’s need. As renewable energy adoption grows, the average reward price of frequency regulation services has become much higher than that of the electricity cost. Therefore, there is a great cost incentive for data centers to provide frequency regulation service. Many existing techniques modulating data center power result in significant performance slowdown or provide a low amount of frequency regulation provision. We present PowerMorph , a tight QoS-aware data center power-reshaping framework, which enables commodity servers to provide practical frequency regulation service. The key behind PowerMorph is using “complementary workload” as an additional knob to modulate server power, which provides high provision capacity while satisfying tight QoS constraints of latency-critical workloads. We achieve up to 58% improvement to TCO under common conditions, and in certain cases can even completely eliminate the data center electricity bill and provide a net profit.

Completely Independent Spanning Trees on BCCC Data Center Networks With an Application to Fault-Tolerant Routing

A set of <inline-formula><tex-math notation="LaTeX">$k$</tex-math></inline-formula> spanning trees in a graph <inline-formula><tex-math notation="LaTeX">$G$</tex-math></inline-formula> are called completely independent spanning trees (CISTs for short) if the paths joining every pair of vertices <inline-formula><tex-math notation="LaTeX">$x$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$y$</tex-math></inline-formula> in any two trees have neither vertex nor edge in common, except for <inline-formula><tex-math notation="LaTeX">$x$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$y$</tex-math></inline-formula> . The existence of multiple CISTs in the underlying graph of a network has applications in fault-tolerant broadcasting and secure message distribution. In this paper, we investigate the construction of CISTs in a server-centric data center network called BCube connected crossbars (BCCC), which can provide good network performance using inexpensive commodity off-the-shelf switches and commodity servers with only two network interface card (NIC) ports. The significant advantages of BCCC are its good expandability, lower communication latency, and higher robustness in component failure. Based on the structure of compound graphs of BCCC, we provide efficient algorithms to construct <inline-formula><tex-math notation="LaTeX">$\lceil \frac{n}{4}\rceil$</tex-math></inline-formula> CISTs in the logical graph of BCCC, denoted by <inline-formula><tex-math notation="LaTeX">$L$</tex-math></inline-formula> - <inline-formula><tex-math notation="LaTeX">$BCCC(n,k)$</tex-math></inline-formula> , for <inline-formula><tex-math notation="LaTeX">$n\geqslant 5$</tex-math></inline-formula> . As a by-product, we obtain a fault-tolerant routing that takes the constructed CISTs as its routing table. We then evaluate the performance of the fault-tolerant routing through simulation results.

Virtualizing GPU direct packet I/O on commodity Ethernet to accelerate GPU-NFV

Network functions (NFs) play an important role in the rapid and dynamic deployment of various services. Network function virtualization (NFV) on commodity servers is becoming popular; and is associated with benefits in terms of cost, elasticity, and liveness, instead of dedicated hardware middleboxes. In this recent trend, graphics processing units (GPUs) have been shown to be highly suitable for NF acceleration, owing to their high parallelism and memory bandwidth. This paper proposes a new GPU-NFV architecture called Janus to accelerate NFs in virtualized environments. Janus is an extension of a previous study conducted by the present authors and involves GPU direct packet input/output (I/O) on commodity Ethernet, to a virtualization environment. Janus uses single-root I/O virtualization (SR-IOV) to enable high-performance NIC sharing between the host and guest virtual machine running GPU direct packet I/O. Internally, the received packets for GPU-NFV are transferred to the GPU memory directly through a combination of SR-IOV and peer-to-peer DMA. The evaluation results show that Janus’ GPU-NFV performance is up to 2.3x higher than that of the state-of-the-art data-plane development kit (DPDK).

Harmony

Deep neural networks (DNNs) have grown exponentially in size over the past decade, leaving only those who have massive datacenter-based resources with the ability to develop and train such models. One of the main challenges for the long tail of researchers who might have only limited resources (e.g., a single multi-GPU server) is limited GPU memory capacity compared to model size. The problem is so acute that the memory requirement of training massive DNN models can often exceed the aggregate capacity of all available GPUs on a single server; this problem only gets worse with the trend of ever-growing model sizes. Current solutions that rely on virtualizing GPU memory (by swapping to/from CPU memory) incur excessive swapping overhead. In this paper, we present a new training framework, Harmony, and advocate rethinking how DNN frameworks schedule computation and move data to push the boundaries of training massive models efficiently on a single commodity server. Across various massive DNN models, Harmony is able to reduce swap load by up to two orders of magnitude and obtain a training throughput speedup of up to 7.6x over highly optimized baselines with virtualized memory.

On Efficient Service Function Chaining in Hybrid Software Defined Networks

To minimize operating expenses (OPEX) and enhance flexibility for network service provisioning, network function virtualization (NFV) is used to chain an ordered sequence of virtualized network functions (VNFs), also known as service function chain (SFC), which can be placed on commodity servers. As a highly complementary to NFV, software-defined networking (SDN) can offer an agile way of VNF orchestration with the capability of fine-granularity network control over flows. However, one-step migration to SDN is impossible in ISP networks. Thus, in this paper we resort to hybrid SDN to implement SFC provisioning. By jointly optimizing SDN deployment that largely determines capital expenditures (CAPEX) and VNF placement that decides OPEX, we manage to make a tradeoff between CAPEX and OPEX, and to find out an appropriate SDN deployment rate for network operator. We first formulate the problem as an integer linear programming (ILP) model <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> , then, reformulate it with column generation technique and decomposition theory to develop a distributed approximation algorithm CGPD which obtains a tight upper bound of optimal solution to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> . In order to better decrease CAPEX, a dynamic programming-based heuristic EOES giving importance to effective resource sharing is further designed based on a hidden Markov model. The simulation results indicate that, the difference between <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> and CGPD is marginal. CGPD outperforms EOES in terms of total cost, average delay and bandwidth utilization, and EOES on the other hand demands 20% SDN deployment rate which is half of that of CGPD.

A Survey of NFV Network Acceleration from ETSI Perspective

Network function virtualization (NFV) enables network operators to save costs and flexibility by replacing dedicated hardware with software network functions running on commodity servers. There is a high need for network acceleration to achieve performance comparable to hardware, which is vital for the implementation of NFV. The necessity of NFV acceleration stems from the lengthy packet delivery path following virtualization and the unavailability of generic operating system designs to serve network-specific scenarios. Therefore, the software approach alters the operating system’s processing architecture through Kernel Bypass or offload packet processing to hardware. A typical classification scheme divides it into two main categories based on technology with software and hardware. Only these two categories can be utilized to rapidly and easily establish a classification system. However, it is difficult to suggest the specifics and peculiarities of any acceleration approach during real-world operation. For a more comprehensive classification of NFV acceleration, we refer to the ETSI NFV architectural framework in this research. As the framework clearly illustrates, the technical infrastructure layer of NFV and the corresponding management roles provides a comprehensive and intuitive view of the differences between these acceleration technologies, solutions, and initiatives. Additionally, we conducted an analysis to identify opportunities for improvement in existing solutions and propose new research programs. We expect that NFV will increasingly rely on cloud services in the future. Since cloud services do not offer a choice of hardware, our acceleration method will be primarily software-based.

Programming socket-independent network functions with nethuns

Software data planes running on commodity servers are very popular in real deployments. However, to attain top class performance, the software approach requires the adoption of accelerated network I/O frameworks, each of them characterized by its own programming model and API. As a result, network applications are often closely tied to the underlying technology, with obvious issues of portability over different systems. This is especially true in cloud scenarios where different I/O frameworks could be installed depending on the configuration of the physical servers in the infrastructure. The nethuns library proposes a unified programming abstraction to access and manage network operations over different I/O frameworks. The library is freely available to the community under the BSD license and currently supports AF_XDP and netmap for fast packet handling along with the classic AF_PACKET and the pcap library. Network applications based on nethuns need only to be re-compiled to run over a different network API. The experiments prove that the overhead introduced by nethuns is negligible, hence making it a convenient programming platform that eases the coding process while guaranteeing high performance and portability. As proofs of concept, a handy traffic generator as well as the popular Open vSwitch application have been successfully ported and tested over nethuns.

Simulation-based optimization and sensibility analysis of MPI applications: Variability matters

Finely tuning MPI applications and understanding the influence of key parameters (number of processes, granularity, collective operation algorithms, virtual topology, and process placement) is critical to obtain good performance on supercomputers. With the high consumption of running applications at scale, doing so solely to optimize their performance is particularly costly. Having inexpensive but faithful predictions of expected performance could be a great help for researchers and system administrators. The methodology we propose decouples the complexity of the platform, which is captured through statistical models of the performance of its main components (MPI communications, BLAS operations), from the complexity of adaptive applications by emulating the application and skipping regular non-MPI parts of the code. We demonstrate the capability of our method with High-Performance Linpack (HPL), the benchmark used to rank supercomputers in the TOP500, which requires careful tuning. We briefly present (1) how the open-source version of HPL can be slightly modified to allow a fast emulation on a single commodity server at the scale of a supercomputer. Then we present (2) an extensive (in)validation study that compares simulation with real experiments and demonstrates our ability to predict the performance of HPL within a few percent consistently. This study allows us to identify the main modeling pitfalls (e.g., spatial and temporal node variability or network heterogeneity and irregular behavior) that need to be considered. Last, we show (3) how our “surrogate” allows studying several subtle HPL parameter optimization problems while accounting for uncertainty on the platform.

Active Computing Toward 5G Internet of Things

The Internet of Things (IoT) contains enormous computing resources. How to fully and efficiently use computing power is a very important research issue. This article proposes an active computing (AC) concept toward IoT. AC achieves the computing power integration by the means of actively pulling computing tasks; then a network is established with the provisioning of computing power as the core. Not limited to the emerging cloud computing and edge computing, AC can dig the fragmented computing power on the embedded devices and on the stand-alone commodity server, even if the mode of rich client and thin server is acceptable. Considering the characteristics of AC and compatibility with existing protocol stacks, a comprehensive architecture is given. The novel architecture can adapt to both wireless and wire networks that need integration of computing power. After comparing with the related computing mode through the validating experiment, this article also examines potential research and addresses some opportunities.