Programmable Data Planes Research Articles

Computing Precise Control Interface Specifications

Verifying network programs is challenging because of how they divide labor: the control plane computes high level routes through the network and compiles them to device configurations, while the data plane uses these configurations to realize the desired forwarding behavior. In practice, the correctness of the data plane often assumes that the configurations generated by the control plane will satisfy complex specifications. Consequently, validation tools such as program verifiers, runtime monitors, fuzzers, and test-case generators must be aware of these control interface specifications (ci-specs) to avoid raising false alarms. In this paper, we propose the first algorithm for computing precise ci-specs for network data planes. Our specifications are designed to be efficiently monitorable —concretely, checking that a fixed configuration satisfies a ci-spec can be done in polynomial time. Our algorithm, based on modular program instrumentation, quantifier elimination, and a path-based analysis, is more expressive than prior work, and is applicable to practical network programs. We describe an implementation and show that ci-specs computed by our tool are useful for finding real bugs in real-world data plane programs.

On DGA Detection and Classification Using P4 Programmable Switches

Domain Generation Algorithms (DGAs) are highly effective strategies employed by malware to establish connections with Command and Control (C2) servers. Mitigating DGAs in high-speed networks can be challenging, as it often requires resource-intensive tasks such as extracting high-dimensional features from domain names or collecting extensive network heuristics. In this paper, we propose an innovative framework leveraging the flexibility, per-packet granularity, and Terabits per second (Tbps) processing capabilities of P4 programmable data plane switches for the rapid and accurate detection and classification of DGA families. Specifically, we use P4 switches to extract a combination of unique network heuristics and domain name features through shallow and Deep Packet Inspection (DPI) with minimal impact on throughput. We employ a two-fold approach, comprising a line-rate compact Machine Learning (ML) classifier in the data plane for DGA detection and a more comprehensive classifier in the control plane for DGA detection and classification. To validate our approach, we collected malware samples totaling hundreds of Gigabytes (GBs), representing over 50 DGA families, and utilized campus traffic from normal benign users. Our results demonstrate that our proposed approach can swiftly and accurately detect DGAs with an accuracy of 97% and 99% in the data plane and the control plane, respectively. Furthermore, we present promising findings and preliminary results for detecting DGAs in encrypted Domain Name System (DNS) traffic. Our framework enables the immediate halting of malicious communications, empowering network operators to implement effective mitigation, incident management, and provisioning strategies.

EXCLF: A LDoS attack detection & mitigation model based on programmable data plane

The SDN architecture decouples control plane from data plane, making it more susceptible to various abnormal traffic and network attacks, with LDoS attack being one of them. LDoS attackers periodically send short-duration pulses with high rate to bottleneck links to preempt legitimate TCP traffic bandwidth, severely disrupting the transmission of TCP traffic. Current researches on LDoS attacks are mostly implemented in SDN environments, making them exhibit poor portability during deployment and unavoidable time delays. This paper proposes EXCLF, a LDoS attack detection and mitigation model fully deployed on programmable data plane. To identify LDoS attacks, the model gathers features of the traffic going through the switch and feeds them into a decision tree. Once LDoS attack happens, the model collects data at flow level to pinpoint the attacker and initiates corresponding mitigation measures. Extensive experiments were conducted to evaluate the proposed model, and the results indicate that EXCLF achieves a correct rate of 96.39%, with false positive and false negative rates both below 3%. Additionally, the model demonstrates low detection latency and can quickly respond to attacks. The model proves to be an attack detection and mitigation method with good portability and efficiency.

Synchronizing real-time and high-precision LDoS defense of learning model-based in AIoT with programmable data plane, SDN

The availability of SD-AIoT is currently under complicated and serious cyber threats, especially Low-rate Denial-of-Service attacks. However, traditional defense schemes for such attacks with characteristics of high concealability and periodicity suffer from serious challenges with high detection difficulty, low accuracy of detection models, and inefficiency of mitigation approaches. In this paper, one novel cooperative defense scheme against hybrid LDoS attacks is proposed, which consists of a timely-response hardware-based Renyi Entropy edge checkpoint intent detection algorithm, the high-precision detection mechanism based on a hybrid deep learning model, and a Markov-chain-based differential rate-limiting mitigation strategy. The detection algorithm deployed at the edge checkpoint activates a hybrid CNN-RF-based deep learning model after filtering the intent information of the flows to detect which are malicious LDoS flows with high accuracy, where the multi-stage detection scheme not only extracts and learns the hidden features of the flow data, but also has better representation capabilities. Enhanced dynamic threshold-based whitelisting automatically adapts to the real-time state of the network environment to improve mitigation flexibility. Markov chain-based differential rate-limiting mitigation strategy reduces the packet loss error rate to mitigate network attacks promptly and ensures the continuation of network services. The results of several comparative experiments show that the proposed scheme detects LDoS attacks more accurately and mitigates them more effectively than traditional schemes.

HOL4P4: Mechanized Small-Step Semantics for P4

We present the first semantics of the network data plane programming language P4 able to adequately capture all key features of P4 16 , the most recent version of P4, including external functions (externs) and concurrency. These features are intimately related since, in P4, extern invocations are the only points at which one execution thread can affect another. Reflecting P4’s lack of a general-purpose memory and the presence of multithreading the semantics is given in small-step style and eschews the use of a heap. In addition to the P4 language itself, we provide an architectural level semantics, which allows the composition of P4-programmed blocks, models end-to-end packet processing, and can take into account features such as arbitration and packet recirculation. A corresponding type system is provided with attendant progress, preservation, and type-soundness theorems. Semantics, type system, and meta-theory are formalized in the HOL4 theorem prover. From this formalization, we derive a HOL4 executable semantics that supports verified execution of programs with partially symbolic packets able to validate simple end-to-end program properties.

Congestion Control Mechanism Based on Backpressure Feedback in Data Center Networks

In order to solve the congestion problem caused by the dramatic growth of traffic in data centers, many end-to-end congestion controls have been proposed to respond to congestion in one round-trip time (RTT). In this paper, we propose a new congestion control mechanism based on backpressure feedback (BFCC), which is designed with the primary goal of switch-to-switch congestion control to resolve congestion in a one-hop RTT. This approach utilizes a programmable data plane to continuously monitor network congestion in real time and identify real-congested flows. In addition, it employs targeted flow control through backpressure feedback. We validate the feasibility of this mechanism on BMV2, a programmable virtual switch based on programming protocol-independent packet processors (P4). Simulation results demonstrate that BFCC greatly enhances flow completion times (FCTs) compared to other end-to-end congestion control mechanisms. It achieves 1.2–2× faster average completion times than other mechanisms.

Leveraging Data Plane Programmability to enhance service orchestration at the edge: A focus on industrial security

The Edge Computing paradigm is increasingly gaining traction in modern telecommunication scenarios, as it enables the offloading of computational tasks from end devices to a variety of nodes located in close proximity to them. This approach is essential for meeting the ever-stricter Quality of Service requirements imposed by modern applications. Concurrently, the advent of Data Plane Programmability allows for unmatched flexibility on the networking plane, supporting processing of multiple protocols in a logically centralized fashion with simple in-line computation, and offering the possibility to offload additional services to networking equipment. Reaping those benefits necessitates heedful management of resources and infrastructure. This, in turn, calls for the introduction of a service orchestration entity, capable of taking advantage of device heterogeneity to enable efficient and swift service provisioning. This work delves into the potential of introducing an orchestration system able to cope with the challenges of offloading security tasks at the Edge. This effort involves developing and implementing novel architectural components that capitalize on the heterogeneous nature of the Edge infrastructure as well as of the Programmable Data Plane as a potential tool for service offloading. To establish the feasibility and performance of this approach, an industrial scenario is considered, where the integrity of data from legacy devices must be ensured. Following an evaluation of the hashing performance of the Programmable Data Plane in comparison to general-purpose devices, a simulation study is conducted on the overall orchestration system, demonstrating the viability of the proposed approach.

IN3: A Framework for In-Network Computation of Neural Networks in the Programmable Data Plane

IN3: A Framework for In-Network Computation of Neural Networks in the Programmable Data Plane

Multi-Agent Deep Reinforcement Learning-Based Fine-Grained Traffic Scheduling in Data Center Networks

In data center networks, when facing challenges such as traffic volatility, low resource utilization, and the difficulty of a single traffic scheduling strategy to meet demands, it is necessary to introduce intelligent traffic scheduling mechanisms to improve network resource utilization, optimize network performance, and adapt to the traffic scheduling requirements in a dynamic environment. This paper proposes a fine-grained traffic scheduling scheme based on multi-agent deep reinforcement learning (MAFS). This approach utilizes In-Band Network Telemetry to collect real-time network states on the programmable data plane, establishes the mapping relationship between real-time network state information and the forwarding efficiency on the control plane, and designs a multi-agent deep reinforcement learning algorithm to calculate the optimal routing strategy under the current network state. The experimental results demonstrate that compared to other traffic scheduling methods, MAFS can effectively enhance network throughput. It achieves a 1.2× better average throughput and achieves a 1.4–1.7× lower packet loss rate.

Query Planning for Robust and Scalable Hybrid Network Telemetry Systems

Network telemetry systems have become hybrid combinations of state-of-the-art stream processors and modern programmable data-plane devices. However, the existing designs of such systems have not focused on ensuring that these systems are also deployable in practice, i.e., able to scale and deal with the dynamics in real-world traffic and query workloads. Unfortunately, efforts to scale these hybrid systems are hampered by severe constraints on available compute resources in the data plane (e.g., memory, ALUs). Similarly, the limited runtime programmability of existing hardware data-plane targets critically affects efforts to make these systems robust. This paper presents the design and implementation of DynaMap, a new hybrid telemetry system that is both robust and scalable. By planning for telemetry queries dynamically, DynaMap allows the remapping of stateful dataflow operators to data-plane registers at runtime. We model the problem of mapping dataflow operators to data-plane targets formally and develop a new heuristic algorithm for solving this problem. We implement our algorithm in prototype and demonstrate its feasibility with existing hardware targets based on Intel Tofino. Using traffic workloads from different real-world production networks, we show that our prototype of DynaMap improves performance on average by 1-2 orders of magnitude over state-of-the-art hybrid systems that use only static query planning.

Building Scalable and Flexible Virtual Networks on Programmable Data Plane

Network virtualization allows multiple logical networks to coexist on the same physical infrastructure. However, existing virtualization techniques do not work well for data plane. Software-based virtualization techniques suffer from poor performance due to high virtualization overhead while hardware-based virtualization techniques are not flexible due to limited programmability. In this paper, we present Virtualizing Programmable Data Plane (VirtPDP), an architecture to achieve scalability, flexibility, and isolation simultaneously. Specifically, VirtPDP proposes a parallel pipeline structure by extending programmable data plane to parallelly execute multiple virtual networks on a programmable switch. With VirtPDP, each virtual network runs independently to guarantee performance isolation. Additionally, VirtPDP uses a multi-controller control plane structure to independently manage virtual networks on the programmable switch. We implement the VirtPDP prototype both on BMv2 target and Tofino target. The experimental results show that compared to existing work, VirtPDP not only realizes parallel operation of multiple virtual networks with low performance loss, but also provides better flexibility and scalability. Meanwhile, Tofino-based VirtPDP performs much better than DPDK-based NativeP4 while realizing the coexistence of multiple virtual networks.

Planter: Rapid Prototyping of In-Network Machine Learning Inference

In-network machine learning inference provides high throughput and low latency. It is ideally located within the network, power efficient, and improves applications' performance. Despite its advantages, the bar to in-network machine learning research is high, requiring significant expertise in programmable data planes, in addition to knowledge of machine learning and the application area. Existing solutions are mostly one-time efforts, hard to reproduce, change, or port across platforms. In this paper, we present Planter: a modular and efficient open-source framework for rapid prototyping of in-network machine learning models across a range of platforms and pipeline architectures. By identifying general mapping methodologies for machine learning algorithms, Planter introduces new machine learning mappings and improves existing ones. It provides users with several example use cases and supports different datasets, and was already extended by users to new fields and applications. Our evaluation shows that Planter improves machine learning performance compared with previous model-tailored works, while significantly reducing resource consumption and co-existing with network functionality. Planter-supported algorithms run at line rate on unmodified commodity hardware, providing billions of inference decisions per second.

Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN

The availability of SD-IoT is now under complex and serious cyber threats, especially distributed denial-of-service attacks. However, traditional defense schemes suffer from coarse-grained centralized sampling approaches, low accuracy of detection models, and inefficient mitigation methods. In this paper, a novel DDoS defense scheme is proposed, which consists of a high-accuracy detection mechanism based on a Graph Convolutional Neural Network learning model and a mitigation mechanism based on fast traffic migration. In the detection stage, a fine-grained INT sampling approach is utilized to obtain multidimensional network topology and status information. The Graph Convolutional Neural Network learning model detects switches containing DDoS attack traffic with high accuracy because the detection model not only extracts and utilizes multiple temporal and spatial features of the collected information, but also has a better learning and representation capability. In the mitigation stage, the enhanced whitelist with dynamic threshold-based values is automatically adapted to the real-time state of the network environment for enhanced mitigation flexibility. The fast programmable segment rerouting strategy can block attack traffic in time and ensure the continuity of network services. The results of several comparison experiments show that the proposed scheme can detect DDoS attacks more accurately and mitigate them more effectively than traditional schemes.

Introducing packet-level analysis in programmable data planes to advance Network Intrusion Detection

Programmable data planes offer precise control over the low-level processing steps applied to network packets, serving as a valuable tool for analysing malicious flows in the field of intrusion detection. Albeit with limitations on physical resources and capabilities, they allow for the efficient extraction of detailed traffic information, which can then be utilised by Machine Learning (ML) algorithms responsible for identifying security threats. In addressing resource constraints, existing solutions in the literature rely on compressing network data through the collection of statistical traffic features in the data plane. While this compression saves memory resources in switches and minimises the burden on the control channel between the data and the control plane, it also results in a loss of information available to the Network Intrusion Detection System (NIDS), limiting access to packet payload, categorical features, and the semantic understanding of network communications, such as the behaviour of packets within traffic flows. This paper proposes P4DDLe, a framework that exploits the flexibility of P4-based programmable data planes for packet-level feature extraction and pre-processing. P4DDLe leverages the programmable data plane to extract raw packet features from the network traffic, categorical features included, and to organise them in a way that the semantics of traffic flows are preserved. To minimise memory and control channel overheads, P4DDLe selectively processes and filters packet-level data, so that only the features required by the NIDS are collected. The experimental evaluation with recent Distributed Denial of Service (DDoS) attack data demonstrates that the proposed approach is very efficient in collecting compact and high-quality representations of network flows, ensuring precise detection of DDoS attacks.

P4toNFV: Offloading from P4 switches to NFV in programmable data planes

SummaryP4 combines the benefits of hardware‐based networking with the adaptability of software‐based network operations. However, when faced with intricate network functions, P4 switches reveal constraints in memory and processing primitives. To address these, we advocate offloading traffic demanding intricate processing from the programmable data plane to network function virtualization (NFV). By leveraging this approach, P4 switches handle the core data plane, ensuring maximum performance, whereas virtualized network functions (VNF) cater to the intricate processing. Central to our research is the optimization of this offloading process, specifically considering delay constraints. We developed an analytical model that examines a P4 switch overseen by an SDN controller, integrating an offloading capability to NFV. The principal objective was to determine an offloading rate that minimizes packet processing delay. To this end, we employed a Bounded method, an advancement from Brent's method, to determine this optimal rate. The findings indicate that offloading approximately 66% of packets to the VNF achieves the lowest total delay, registering at 0.1505 s. This strategy of optimal offloading can notably reduce the system's average delay as the demand for network functions increases. The optimization technique we adopted exhibited rapid convergence in our experiments, reflecting the method's efficacy. Furthermore, a rigorous parametric sensitivity analysis spanning no offloading, full offloading, and optimal offloading strategies underscores that optimal offloading to NFV consistently augments system performance, particularly in terms of delay reduction. Conclusively, our study furnishes valuable insights into offloading strategies, augmenting the narrative on resource allocation in both PNFs and VNFs.

Quantitative measurement of link failure reaction time for devices with P4-programmable data planes

Quick handling of link failures remains a challenging issue in current communication networks, although it is crucial to many routing algorithms. Link failures are the leading cause of packet losses and delays, therefore, failure recovery is tied to stringent requirements for certain services, such as the sub-50 millisecond completion time for carrier-grade networks, which is sometimes difficult to achieve in traditional routing schemes. For this reason, fast recovery strategies are key pillars of modern communication networks. In this paper, we demonstrate the benefits of the devices with Programmable Data Planes (PDP) for fast reacting to link failures. We first review the link failure detection, reaction and recovery procedures and then we discuss the main fast failure recovery mechanisms employed by different types of devices in current communication networks. In addition, we present a novel method to measure the link failure reaction time of an Intel Tofino switch with PDP, as well as the results obtained when measuring such time using real hardware equipment. Our results show that such hardware devices provide a failure reaction time in the order of microseconds, with an average of 472.88μ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\upmu $$\\end{document}s, which poses PDP as a key technology to achieve zero packet loss and zero delay failure recovery.

On Orchestration of Segment Routing and In-Band Network Telemetry

With the rapid development of programmable data plane (PDP), both segment routing (SR) and in-band network telemetry (INT) have attracted intensive interests. Hence, we have previously proposed the technique of SR-INT, which explores the benefits of SR and INT simultaneously and gets rid of the hassle of the accumulated overheads of them. In this work, we further expand the advantage of SR-INT by studying how to plan the SR-INT schemes of flows at the network level to balance the tradeoff between bandwidth usage and coverage of network monitoring, namely, the problem of “SR-INT orchestration". A mixed integer linear programming model (MILP) is first formulated for the problem, and we prove its NP-hardness. Then, to reduce the time complexity of problem-solving, we propose a novel greedy algorithm based on path ranking and a column generation (CG) based approximation algorithm. Extensive simulations verify the performance of our proposed algorithms.

P4SQA: A P4 Switch-Based QoS Assurance Mechanism for SDN

Data center networks include a wide variety of service categories, which leads to a complex network topology. As a result, the QoS of different service flows cannot be guaranteed. In this paper, we propose a QoS assurance mechanism based on P4 switches (P4SQA) to make full use of network resources. P4SQA includes two functions: in-network traffic classification and in-network queue management. To reduce the communication overhead and computational pressure on the Software Defined Network (SDN) controller, we offload part of the neural computation from the control plane to the data plane. A fully connected neural network-based traffic classification method is deployed in the programmable data plane to classify different traffic types. In addition, the optimized active queue management algorithm CoDeL is integrated into the P4 switch (PCoDeL) to prevent network congestion while guaranteeing QoS more effectively. The evaluation results show that traffic classification accuracy has improved, especially in terms of the F1_score, which reached 0.97, significantly better than other state-of-the-art methods. Moreover, compared to traditional queue management algorithms, PCoDeL can improve network throughput and reduce transmission delay, which verifies the effectiveness and superiority of P4SQA in ensuring QoS.

RED-SP-CoDel: Random early detection with static priority scheduling and controlled delay AQM in programmable data planes

Emerging network application paradigms, such as the Tactile Internet, re-emphasize the need for different Quality of Service (QoS) levels. Due to the large packet buffers in the underlying network data plane, Active Queue Management (AQM) is generally required to curtail packet latencies for flows requiring high QoS levels. At the same time, programmable data planes, such as P4, enable packet processing at line-speed, albeit with limited packet processing functionalities. However, the existing AQM mechanisms that support QoS differentiation are too complex to readily run on P4, while the existing AQM mechanisms that run on P4 do generally not support effective QoS differentiation. We address this gap by developing to the best of our knowledge the first AQM mechanism that supports effective QoS differentiation while running on P4. Specifically, we propose SP-CoDel, which combines the well-known Controlled Delay (CoDel) AQM mechanism with Static Priority (SP) scheduling for QoS differentiation. Also, we propose RED-SP-CoDel, which adds a RED AQM component to SP-CoDel so as to make the AQM with priorities essentially parameterless. As a community resource contribution, we substantially extend the existing P4Simulator to the novel fused P4-NS3 Simulator so as to enable the evaluation of packet processing mechanisms through the combined functionalities of P4 device emulation and NS3 packet simulation. Evaluations conducted with the P4 reference switch model in the P4-NS3 Simulator indicate that SP-CoDel and RED-SP-CoDel provide high QoS to high-priority data streams, i.e., significantly reduce latency and packet loss compared to CoDel, while effectively mitigating bufferbloat.

In‐network computing—challenges and opportunities

AbstractThe rapid growth of new applications with high resource demands leads to the need for more computing power. Datacenter servers may not be the most efficient way to run the necessary software. The introduction of programmable dataplanes opens up the possibility to run software directly in the dataplane with lower latency and higher energy efficiency than general purpose servers. Thus, the concept of in‐network computing is introduced. This paper addresses the challenges associated with executing software resorting to programmable networking devices while presenting a high level conceptual architecture including three layers of computing. The paper ends by taking the evaluated challenges into consideration and proposing future research directions for the evolution of the in‐network computing technology.