Abstract: With the rapidly increasing number of mobile devices being used as essential terminals or platforms for communication, security threats now target the whole telecommunication infrastructure and become increasingly serious. Network probing tools, which are deployed as a bypass device at a mobile core network gateway, can collect and analyze all the traffic for security detection. However, due to the ever-increasing link speed, it is of vital importance to offload the processing pressure of the detection system. In this paper, we design and evaluate a real-time pre-processing system, which includes a hardware accelerator and a multi-core processor. The implemented prototype can quickly restore each encapsulated packet and effectively distribute traffic to multiple back-end detection systems. We demonstrate the prototype in a well-deployed network environment with large volumes of real data. Experimental results show that our system can achieve at least 18 Gb/s with no packet loss with all kinds of communication protocols.

基于硬件加速的移动核心网实时预处理系统

[1]Cavigelli, L., Gschwend, D., Mayer, C., et al., 2015. Origami: a convolutional network accelerator. Proc. 25th Edition on Great Lakes Symp. on VLSI, p.199-204.

[2]Cheng, M., Sun, Y., Su, J., 2016. A real-time pre-processing system for mobile core network measurement. Proc. 6th Int. Conf. on Instrumentation, Measurement, Computer, Communication adn Control, p.298-302.

[3]China Communications Standards Association, Inc., 2006. Third Generation Partnership Project 2.

[4]Cisco Systems, Inc., 2013. Cisco ASR 5000 Series Aggregation Services Router Installation and Administration Guide Version 10.0.

[5]Go, Y., Jamshed, M.A., Moon, Y., et al., 2017. APUNet: revitalizing GPU as packet processing accelerator. Proc. USENIX Symp. on Networked Systems Design and Implementation, p.83-96.

[6]Han, S., Jang, K., Park, K., et al., 2010. PacketShader: a GPU-accelerated software router. ACM SIGCOMM Comput. Commun. Rev., 40(4):195-206.

[7]Intel Products, Inc., 2010. Crystal Forest Platform: Product Overview.

[8]Internet Society, Inc., 2014. Request For Comments No. 1661.

[9]Kekely, L., Puš, V., Benáček, P., et al., 2014. Trade-offs and progressive adoption of FPGA acceleration in network traffic monitoring. Proc. 24th Int. Conf. on Field Programmable Logic and Applications, p.1-4.

[10]Lavasani, M., Angepat, H., Chiou, D., 2014. An FPGA-based in-line accelerator for memcached. IEEE Comput. Archit. Lett., 13(2):57-60.

[11]Neil, D., Liu, S.C., 2014. Minitaur, an event-driven FPGA-based spiking network accelerator. IEEE Trans. VLSI Syst., 22(12):2621-2628.

[12]Peemen, M., Setio, A.A., Mesman, B., et al., 2013. Memory-centric accelerator design for convolutional neural networks. Proc. IEEE 31st Int. Conf. on Computer Design, p.13-19.

[13]Rizzo, L., 2012. Netmap: a novel framework for fast packet I/O. Proc. 21st USENIX Security Symp., p.101-112.

[14]Vallentin, M., Sommer, R., Lee, J., et al., 2007. The NIDS cluster: scalable, stateful network intrusion detection on commodity hardware. Proc. Int. Workshop on Recent Advances in Intrusion Detection, p.107-126.

[15]Vasiliadis, G., Polychronakis, M., Ioannidis, S., 2011. MIDeA: a multi-parallel intrusion detection architecture. Proc. 18th ACM Conf. on Computer and Communications Security, p.297-308.

[16]Zhang, C., Li, P., Sun, G., et al., 2015. Optimizing FPGA-based accelerator design for deep convolutional neural networks. Proc. ACM/SIGDA Int. Symp. on Field-Programmable Gate Arrays, p.161-170.