Modern network management requires dynamically reacting to a broad set of events occurring in the network. Detecting the traffic behaviors associated with these events requires identifying patterns and computing metrics over high-velocity streams of network packets flowing through a link, router, or switch. To facilitate performing computations, a number of traffic query languages have been proposed in the network systems community. However, existing traffic query languages primarily focus on expressing computations that can be efficiently implemented on particular hardware or software platforms (such as programmable switch ASICs or multi-core CPUs) and do not support the full range of behaviors required by modern network management tasks. For example, languages like Sonata efficiently support count-based metrics on switch ASICs, but fail to support complex inter-packet pattern identification, whereas a language like FLM can identify patterns on switch ASICs but cannot compute quantitative metrics.

LEO Satellite Networks (LSNs) are revolutionizing global connectivity, but their reliance on tens of thousands of satellites raises pressing concerns over sustainability and survivability. In this work, we argue that the inefficiencies in present-day LSN designs stem from ignoring the strong spatiotemporal structure of Internet traffic demand (which impacts sustainability) and the physical realities of the near-Earth space environment (which affects survivability). We propose a novel design approach based on sun-synchronous (SS) orbits called SS-plane, which aligns satellite coverage with the Earth's diurnal cycle. We demonstrate that SS-plane constellations can reduce the number of satellites required by up to an order of magnitude and cut radiation exposure by ~23% compared to traditional Walker-delta constellations. These findings suggest a paradigm shift in LSN research from large, disposable megaconstellations to more sustainable, targeted LEO constellations.

As increasingly complex and dynamic volumetric DDoS attacks continue to wreak havoc on edge networks, two recent developments promise to bolster DDoS defense at the edge. First, programmable switches have emerged as promising means for achieving scalable and cost-effective attack signature detection. However, their practical application in edge networks remains a challenging open problem. Second, machine learning (ML)-based solutions have demonstrated potential in accurately detecting attack signatures based on per-flow traffic features. Yet, their inability to effectively scale to the traffic volumes and number of flows in actual production edge networks has largely excluded them from practical considerations.In this paper, we introduce ZAPDOS, a novel approach to accurately, quickly, and scalably detect volumetric DDoS attack signatures at the source prefix level. ZAPDOS is the first to utilize a key characteristic of the observed structure of measured attack and benign source prefixes (i.e., a pronounced cluster-within-cluster property) and effectively apply it in practice against modern attacks. ZAPDOS operates by monitoring aggregate prefix-level features in switch hardware, employing a learning model to identify prefixes suspected of containing attack sources, and using several innovative algorithmic methods to pinpoint attack sources efficiently. We have built a hardware prototype of ZAPDOS and a packet-level software simulator which achieve comparable accuracy results. Since existing datasets are inadequate for training and evaluating prefix-level models, we have developed a new data-fusion methodology for training and evaluating ZAPDOS. We use our prototype and simulator to show that ZAPDOS can detect volumetric DDoS attack signatures with orders of magnitude lower error rates than state-of-the-art under comparable monitoring resource budgets and for a range of different attack scenarios.

Network telemetry systems provide critical visibility into the state of network traffic. By leveraging modern programmable switch hardware, significant progress has been made to scale these systems to production network traffic workloads. Less attention has been paid towards efficiently utilizing these hardware targets’ limited resources in the face of dynamics such as the composition of the traffic workload as well as the number and types of queries running at any given point in time. However, both of these dynamics have implications on resource requirements and query accuracy. Building on our prior work DynATOS, which argues that this dynamics problem motivates reframing telemetry systems as resource schedulers, we present in this paper the design, implementation, and evaluation of DynATOS+. DynATOS+ relies on the same efficient time-division approximation and scheduling algorithm that DynATOS uses and that allows for user-defined query accuracy and latency specifications that are intended to result in tradeoffs with respect to query execution to reduce hardware resource usage. However, unlike DynATOS, DynATOS+ significantly reduces the burden on end users to express their queries by allowing them to use simple-to-state accuracy goals. For example, the method for specifying per-query accuracy goals in DynATOS+ no longer requires end users to either know the average range of query results in advance or to submit multiple trial queries to tune their accuracy goal specifications. We perform extensive simulation-based evaluations that (i) show that this new functionality of DynATOS+ works in practice, (ii) illustrate in detail the tradeoffs that result with respect to query execution and hardware resource usage for a wide range of systems parameters, and (iii) allow for an assessment of system performance under changing query workloads on top of changes in the composition of traffic workloads that has eluded previous work in this area.