Policies for network traffic handling define packet routes through networks, enforce required quality of service, and protect networks from security threats. When expressing a policy, one needs to characterise the traffic to which the policy applies by traffic identifiers. Low level traffic identifiers, such as IP addresses and port numbers, are available in each packet. Indeed, low level traffic identifiers are perfect for data plane routing and switching. However, high level traffic identifiers, such as user name and application name, are better for the readability and clarity of a policy. In this paper, we extend software defined networks with high level traffic identifiers. We propose to add additional interface to SDN controllers for collecting traffic meta data and high level traffic identifiers. The controller maintains a database that maps high level traffic identifiers to a set of flows defined by low level traffic identifiers. SDN applications can apply policies based on both high level and low level traffic identifiers. We leave the southbound protocols intact. This paper provides two examples of High Level SDN paradigms – Application-Aware Networks and Identity-Aware Networks. The first paradigm enables policies depending on application names and characteristics. The latter allows policies based on user names and their roles.

As the number of network services and applications increases, each one of them showing different requirements in terms of bandwidth and latency, it becomes critical for network operators to identify these applications. This paper builds up on the principles of Software Defined Networking, proposing a novel Application-Aware Network architecture, which is able to directly handle applications and their requirements; abstracting the complexity of dealing with network flows. Since metadata about applications are signalled either directly from the endpoints or from application managers, the information is precise and the approach can also be used for encrypted traffic. The benefits of the Application-Aware Approach for the network flow management is demonstrated in real network by two proof-of-concept services: aimed on quality of experience and load balancing.

Modern network devices need to perform deep packet inspection at high speed for security and application- specific services. For this purpose, regular expressions are used, due to their high expressive power, and Deterministic Finite Automata (DFAs) are adopted to match them. Many works have been proposed to improve DFAs, especially in terms of memory consumption and speed. Instead, we address another issue: the scalability of DFAs to parallel systems and their buffer requirements. To our knowledge, a single attempt to parallelize DFA walk on regular multicore systems (which ex- ploits speculation with limited efficiency) has been proposed in literature. We propose a solution in which a number of processing units are committed to walk in parallel a DFA for the same packet; at this aim, sampling techniques on both text and regular expressions are adopted. This scheme is the first in literature that proposes effective parallelization of DFA walk, hence allowing for packet processing time reduction and less memory for reordering buffers. The result is that speed scales as the number of processing units.

In this paper we propose a novel hardware-software co-design vision that aims at enhancing flexibility and reusability of hardware based packet forwarding engines. In particular, we move on the path of the well-known OpenFlow architecture that allows the user to decide the action to be performed over the packet (drop, forward through a given port etc.) upon interaction with a software control plane. Although such an approach is certainly powerful and is gaining more and more attention in both academia and industry, it is biased towards routing application: its main goal is to allow the software control plane to arbitrarily route a packet flow. However, we think that a similar paradigm, encompassing high performance packet forwarding hardware driven by a flexible software control plane, may be beneficial even to other kinds of applications, like monitoring and measurements. However, the primitives that the OpenFlow protocol provides are not flexible enough for such purposes. For this reason, we propose a flexible packet forwarding architecture based on regular expression that, besides enabling standard-compliant OpenFlow switching, can be easily reconfigured through its control plane to support other kinds of applications.

Modern network devices need to perform deep packet inspection at high speed for security and application-specific services. Finite Automata (FAs) are used to implement regular expressions matching, but they require a large amount of memory. Many recent works have proposed improvements to address this issue. This paper presents a new representation for deterministic finite automata (orthogonal to previous solutions), called Delta Finite Automata (δFA), which considerably reduces states and transitions and requires a transition per character only, thus allowing fast matching. Moreover, a new state encoding scheme is proposed and the comprehensive algorithm is tested for use in the packet classification area.

A Bloom Filter is an efficient randomized data structure for membership queries on a set with a certain known false positive probability. Bloom Filters (BFs) are very attractive for their limited memory requirements and their easy construction which make them a popular choice for many tasks in network devices. However, in a number of network applications, more than simple probabilistic membership queries is required, and BFs can be adopted as a coarse filtering stage, leaving the ultimate filtering and classification process to other techniques, such as hash tables or tree-like structures. In this paper we propose a scheme to extend BFs with ``indexing'' features so that when an element $x$ is queried, an univocal index of that element is returned, which in turn can be used as an address for a table, just as a perfect hashing scheme. This extension, called indexed Bloom Filter (iBF), comes at the cost of a small increment of false positive probability and simply fits in existing BF-based applications.

Bloom Filters are efficient randomized data structures for membership queries on a set with a certain known false positive probability. Counting Bloom Filters (CBFs) allow the same operation on dynamic sets that can be updated via insertions and deletions with larger memory requirements. This paper first presents a simple tight upper bound for counters overflow probability in CBFs, which is adopted in the design of more efficient CBFs. On the basis of such theoretical achievements, we introduce the idea of a hierarchical structure as well as the use of Huffman code to improve standard CBFs in terms of fast access and limited memory consumption (up to 50% of memory saving). The target could be the implementation of the compressed data structures in the small (but fast) local memory or "on-chip SRAM" of devices such as network processors. As an application of our algorithms, an anti-evasion system is finally proposed.

The process of categorizing packets into flows in an Internet router is called packet classification. All packets belonging to the same flow obey a predefined rule and are processed in a similar manner by the router itself. For example, all packets with the same destination IP address and protocol may be defined as a flow. Packet classification is the foundation of many Internet functions such as Quality of Service enforcement, monitoring applications, security, and so on. This paper presents a novel classification scheme designed for NetFPGA boards which takes advantage of a very compressed version of Deterministic Finite Automata (DFA) in order to process packets at line rate.

Because of the rapid growth of both traffic and links capacity, the time budget to perform IP address lookup on a packet continues to decrease and lookup tables of routers unceasingly grow. Therefore, new lookup algorithms and new hardware platform are required to perform fast IP lookup. This paper presents a new scheme on top of the NetFPGA board which takes advantage of parallel queries made on perfect hash functions. Such functions are built by using a very compact and fast data structure called Blooming Trees, thus allowing the vast majority of memory accesses to involve small and fast on-chip memories only.

Modern network devices need to perform deep packet inspection at high speed for security and application-specific services. Instead of standard strings to represent the dataset to be matched, state-of-the-art systems adopt regular expressions, due to their high expressive power. The current trend is to use Deterministic Finite Automata (DFAs) to match regular expressions. However, while the problem of the large memory consumption of DFAs has been solved in many different ways, only a few works have focused on increasing the lookup speed. This paper introduces a novel yet simple idea to accelerate DFAs for security applications: payload sampling. Our approach allows to skip a large portion of the text, thus processing less bytes. The price to pay is a slight number of false alarms which require a confirmation stage. Therefore, we propose a double-stage matching scheme providing two new different automata. Results show a significant speed-up in regular traffic processing, thus confirming the effectiveness of the approach.

Tomographic techniques allow the reconstruction of network topologies with no need for cooperation from internal routers. However, most of such mechanisms adopt a method of node clustering producing trees that reveal only a partial structure of the network. Therefore, we have proposed a novel approach to topology discovery based on packet sandwich probes and decision theory allowing to retrieve a complete picture of the network, which includes the detection of all the internal nodes along with the values of capacities of the interconnecting links. Such an approach, as well as all the standard techniques of topology discovery, reconstructs the spanning tree of the probe sender only. Hence, in this paper a specific technique is presented for merging the spanning trees associated to all different roots, in order to provide a complete representation of the network. Such a method does not require further probing traffic and is specifically designed to merge topology reconstructions where all the nodes of the network (not only the branching nodes) are revealed, along with link capacities. Our algorithm performs quite well on a wide set of both synthetic and realistic topologies, and in many cases provides a picture of the network which is exactly equivalent to the original one.