E-Replacement: Efficient scanner data collection method in P4-based software-defined networks

Yun Zhan Cai, Ting Yu Lin, Yu Ting Wang, Ya Pei Tuan, Meng Hsun Tsai

研究成果: Article同行評審

5 引文 斯高帕斯(Scopus)


Internet of things (IoT) botnets such as Mirai are rampant in the past years. Port scanning is a well-known behavior of botnets for searching targets in networks. To detect port scanning, a detector requires network statistics with high discriminatory power. In P4-based software-defined network (SDN), switches take charge of recording characteristics about scanning behaviors, and controllers pull the statistics from the switches periodically for anomaly detection. Given storage resources in switches are limited, we proposed a scanner data collection method, 0-Replacement, in P4-based SDN to efficiently collect scanner data and improve the detection rate. 0-Replacement, however, does not consider performance degradation caused by the hash collision. In this paper, we combine the conception of Hashpipe with 0-Replacement and propose a new scanner data collection method named E-Replacement. By leveraging the conception of Hashpipe, E-Replacement can mitigate the performance degradation caused by the hash collision. Through simulations, we show that E-Replacement improves the detection rate by up to 6.73% and 210.82% compared to 0-Replacement and the traditional sample and hold method, respectively. Besides, E-Replacement improves the precision by around 528.2% compared to the count-min sketch and k-ary sketch methods. The memory usage in E-Replacement is the same as 0-Replacement. In simulations, E-Replacement can detect around 93.4% of scanners in a class B network with only 4.02-Mb SRAM. After implementing E-Replacement on a software P4 switch, BMv2, we observe the extra forwarding latency for E-Replacement is not greater than a millisecond.

期刊International Journal of Network Management
出版狀態Published - 2021 11月 1

All Science Journal Classification (ASJC) codes

  • 電腦科學應用
  • 電腦網路與通信


深入研究「E-Replacement: Efficient scanner data collection method in P4-based software-defined networks」主題。共同形成了獨特的指紋。