It is notoriously difficult to verify that a network is behaving as intended, especially at scale. This paper presents Hydra, a system that uses ideas from runtime verification to check that every packet is correctly processed with respect to a specification in real time. We propose a domain-specific language for writing properties, called Indus, and we develop a compiler that turns properties thus specified into executable P4 code that runs alongside the forwarding code at line rate. To evaluate our approach, we used Indus to model a range of properties, showing that it is expressive enough to capture examples studied in prior work. We also deployed Hydra checkers for validating paths in source routing and for enforcing slice isolation in Aether, an open-source cellular platform. We confirmed a subtle bug in Aether's 5G mobile core that would have been hard to detect using static techniques. We also evaluated the overheads of Hydra on hardware, finding that it does not significantly increase latency and often does not require additional pipeline stages.

Network Function Virtualization has dramatically increased the flexibility in the deployment of network services, however the execution of virtual functions on compute nodes equipped with general purpose hardware can result in worse performance compared to the middleboxes they aim to replace. The use of programmable network hardware to perform part of the processing at line rate can drastically increase the throughput while retaining the flexibility.This work presents a new framework, called CHIMA, which extends the capabilities of other frameworks proposed in the literature for the deployment of heterogeneous Service Function Chains (SFCs). Heterogeneous SFCs comprise a combination of virtual functions meant to be executed in containers running on general purpose hardware and of functions for programmable switches written using the P4 language. CHIMA exploits programmable data planes to perform real time monitoring of the services through In-band Network Telemetry and uses the collected information to guarantee the requested levels of performance by redeploying and rerouting sections that are affected by adverse conditions, allowing applications with critical requirements to be deployed as SFCs.The solution has been tested by emulating various topologies and services on the FOP4 platform with bmv2 switches. The analysis shows that the system is capable of detecting faults in the order of hundreds of milliseconds, and the overhead it causes in the process of redeployment is negligible compared to the startup time of functions. Measurements also reveal that the current bottleneck for the runtime relocation of heterogeneous functions is the redeployment and reconfiguration of P4 programs.

Programmable network hardware is emerging as a viable option for offloading and thus accelerating network functions. However, the heterogeneous resources available in the network calls for a disaggregated deployment approach. Programmable switches, programmable Network Interface Cards (NICs), and in-network compute nodes exposes different peculiar resources and capabilities that can be maximally exploited only if the network functions are decomposed into multiple smaller network functions. This work presents a framework for the automatic deployment of disaggregated and decomposed network functions. The framework comprises an orchestrator capable of deploying the decomposed network functions on programmable network hardware and software switches running in containers. The orchestrator exploits an optimization model for choosing the best decomposition according to the traffic demands, the network topology, and other constraints. An improved seamless deployment model and heuristic also accounts for the necessity of rerouting traffic when hardware nodes need to be re-programmed. Furthermore, the framework provides a tool to combine multiple functions into a single P4 program via a template pipeline that can be deployed to a programmable switch. Numerical results highlight the advantages of offloading decomposed network functions to programmable network hardware. Furthermore, we show how the seamless deployment model and heuristic have negligible effects on the allocation time and accepted traffic requests while guaranteeing the rerouting of traffic when switches are put in maintenance mode.

Extended Finite State Machines (EFSMs) are a very promising abstraction to describe stateful networking applications. However, the community currently lacks a fast prototyping environment to experiment with EFSM-based data plane applications. In this demonstration, we present FlowBlaze.p4, an EFSM executor based on P4. The executor can be run on Mininet and BMv2, helping to prototype new use cases with a small turnaround time. We provide a set of tools, including a GUI, to simplify the development by interactively drawing the state machines. We demonstrate FlowBlaze.p4 with two example scenarios, showing how developers can exploit the proposed library to implement their own use cases.

Advances in data plane programmability enable the offloading and acceleration of complex network functions. FlowBlaze architecture for data planes has shown that Extended Finite State Machines can be efficiently supported in hardware enabling stateful packet processing at line-rate through a powerful abstraction for application programming. A recent proposal tries to simplify the development of FlowBlaze applications on top of its hardware and software prototypes with a domainspecific language, however, the community is currently missing a fast prototyping environment to experiment with EFSM-based applications using the P4 language, recognized as the de-facto standard for data plane programmability. This paper presents FlowBlaze.p4, a library developed in P4 that implements a FlowBlaze executor. The library maps the FlowBlaze elements into P4-native components and can be integrated into existing P4 programs. FlowBlaze.p4 can be easily configured by means of five configuration parameters. A GUI is also provided to enable the developer to simply draw the EFSM, skipping its manual mapping to the corresponding lowlevel run-time configuration. We present a functional evaluation of our library with two use cases that demonstrate how easily and quickly FlowBlaze.p4 and the GUI can be used to develop new stateful data plane applications.

Network Function Virtualization (NFV) enables fast provisioning of packet processing logic on general purpose CPUs. This approach, however, does not scale well to very high speed traffic. Programmable hardware solutions, including those based on programmable switches, are emerging as an option for accelerating and scaling network functions. Unfortunately, every type of programmable hardware has specific characteristics that do not make it suitable for running all possible functions. We argue that an efficient strategy is decomposing network functions into components that can run on CPUs or that can be offloaded to specific programmable hardware depending on their characteristics. This paper presents a preliminary work on a framework for automating the decomposition and deployment of network functions. The framework includes an orchestrator that chooses the best decomposition according to the traffic demands, the network topology and other constraints. It also provides a tool to combine multiple functions into a single P4 program that can be deployed to a programmable switch. Finally, the framework comprises a set of tools to deploy the network functions either as containers running in a data center or as programs loaded in a programmable switch. We present numerical results to highlight the advantages of partially offloading decomposed VNFs to programmable hardware over a pure software solution. We also highlight the robustness of the approach showing how the model reacts in case of network failures.

Stateful networking functions that can be offloaded on programmable data planes are gaining interest for their potential efficiency in using hardware resources and their ability to process large traffic volumes at high speed. However, the success of this function virtualization paradigm largely depends on the availability of fast prototyping environments for the developer community and the integration with state of the art SDN controllers. In this demo, we present FlowBlaze.p4 and its integration with the ONOS SDN controller. FlowBlaze.p4 is an Extended Finite State Machines (EFSM) executor implemented in P4 that can run on BMv2, helping to prototype new use cases with a small turnaround time. We integrated FlowBlaze.p4 with ONOS and Trellis to deploy stateful network applications within full SDN-based data-center fabrics. We demonstrate the platform with two scenarios showing the workflow to use and deploy the proposed library to implement new use cases.

Offloading packet processing tasks to programmable switches and/or to programmable network interfaces, so called “SmartNICs”, is one of the key concepts to prepare softwarized networks for the high traffic demands of the future. However, implementing network functions that make use of those offloading technologies is still challenging and usually requires the availability of specialized hardware. It becomes even harder if heterogeneous services, making use of different offloading and network virtualization technologies, should be developed. In this paper, we introduce FOP4 (Function Offloading Prototyping with P4), a novel prototyping platform that allows to prototype heterogeneous software network scenarios, including container-based, P4-switch-based, and SmartNIC-based network functions. The presented work substantially extends our existing Containernet platform with the means to prototype offloading scenarios. Besides presenting the platform's system design, we evaluate its scalability and show that it can run scenarios with more than 64 P4 switch or SmartNIC nodes on a single laptop. Finally, we presented a case study in which we use the presented platform to prototype an extended in-band network telemetry use case.

Emulation platforms supporting Virtual Network Functions (VNFs) allow developers to rapidly prototype network services. None of the available platforms, however, supports experimenting with programmable data planes to enable VNF offloading. In this demonstration, we show FOP4, a flexible platform that provides support for Docker-based VNFs, and VNF offloading, by means of P4-enabled switches. The platform provides interfaces to program the P4 devices and to deploy network functions. We demonstrate FOP4 with two complex example scenarios, demonstrating how developers can exploit data plane programmability to implement network functions.

FullWaveform Inversion and Reverse Time Migration are usually based on the adjoint state method and rely on the ready availability of wavefield snapshots. Therefore, standard algorithms store the full source wavefield on disk. This makes Full Waveform Inversion and Reverse Time Migration techniques particularly demanding in terms of disk input/output performance. To face this issue, a common solution is to compress wavefield information in order to reduce input/output operations overhead. In this paper we propose a couple of wavefield compression methods based on Convolutional Neural Networks (CNNs). Specifically, a convolutional autoencoder is trained to compress wavefield snapshots and a specifically designed U-net is trained to reconstruct (i.e. interpolate) the wavefield in the temporal dimension. Results show that these promising techniques could help decreasing storage needs for wavefield snapshots. This makes it possible to balance the required signal-to-noise ratio and compression gain. Presentation Date: Monday, September 16, 2019 Session Start Time: 1:50 PM Presentation Time: 3:55 PM Location: 221D Presentation Type: Oral

The rise of adblockers is creating lots of concerns to the online content publishing industry, as it severely affects the possibility to offer free-content to end-users by subsidizing the fruition costs with advertisements.While many detection techniques have been proposed as a countermeasure to the diffusion of adblocks, they either rely on the injection of code in the served web pages, or require to perform passive measurements for a long time, thus leading to high costs and delays before collecting the desired information. Motivated by these reasons, in this paper we propose a novel technique to conduct in-network adblock usage measurements, inspecting only few minutes of network traffic. Our approach relies on network traffic inspection, and classification with machine learning techniques to detect whether the user is blocking, or not, the advertisements.Key findings obtained show that by inspecting only few minutes of network traffic, we can reliably perform the detection with an accuracy up to 99%, with a negligible computational overhead.

SDN intent-based networking allows programmers to specify high-level policies without worrying about the low-level configurations which are compiled by the controller. Our Intent Monitor and Reroute service (IMR) extends the capabilities of ONOS Intent Framework by allowing to both compile multiple intents together and to re-optimize their paths, according to the network state and their flow statistics, via off-platform applications (OPA). In this demo we show two examples of intent-based ONOS application whose network performance can be improved, with no modifications to their code, exploiting the IMR service.

Software-Defined Networking (SDN) brought an unprecedented flexibility and programmability into computer networks. In order to simplify the management of an SDN network, several high-level languages have been proposed. The Intent Framework provided by Open Network Operating System (ONOS), for example, allows programmers to specify high-level policies without worrying about low-level device details, which are inferred by the controller. In addition, the Intent Framework ensures that the objective is met by transparently re-compiling the intents as a consequence of environment changes (e.g. link failures). In this work we extend the Intent Framework to make it able to both compile multiple intents together and to re-optimize their paths according to the network state based on flow statistics. We present Intent Monitor and Reroute service, a new ONOS module to optimize traffic forwarding of any ONOS applications based on intents, via an external plug&play routing logic with no modifications to ONOS applications at all. Finally we evaluate the benefits by enhancing the ONOS SDN-IP application with an adaptive Robust Traffic Engineering algorithm.

Traffic classification allows network operators to gain important insights to better characterize packet flows, enabling fundamental applications such as traffic engineering, network analytics and Quality of Service (QoS) enforcing. A common approach adopted for flow classification is based on Deep Packet Inspection (DPI): all the traffic is processed by a middlebox whose task is the association of a network flow to the application-level information by inspecting the entire content of the packets. The increased volume of encrypted traffic limits the type of analysis performed by network middleboxes. However, an important amount of information can still be extracted from packets belonging to the very initial phase of a connection which are transmitted in clear (e.g. DNS and TLS handshake). Furthermore, recent research work has shown that it is possible to reduce the burden on the DPI without a significant loss in classification accuracy, by limiting the amount of data processed per flow. In this paper, we propose to exploit the programmability of new stateful SDN data planes to offload down to the network the process of filtering traffic to the DPI. We show that it is jointly possible to reduce the required computing power of the DPI, as well as the network bandwidth between the switches and the DPI. By taking advantage of the flexibility of stateful data planes we also manage to delegate to switches the computation of useful network analytics metrics (such as number of packets, number of bytes and duration) which would otherwise require the DPI to inspect the entire traffic flow.