DDoS attacks are a significant threat to internet service or infrastructure providers. This poster presents an FPGA-accelerated device and DDoS mitigation technique to overcome such attacks. Our work addresses amplification attacks whose goal is to generate enough traffic to saturate the victims links. The main idea of the device is to efficiently filter malicious traffic at high-speeds directly in the backbone infrastructure before it even reaches the victim's network. We implemented our solution for two FPGA platforms using the high-level description in P4, and we report on its performance in terms of throughput and hardware resources.

The P4 language is a language suitable for the description of packet processing inside a network device. The typical P4 device consists of three main building blocks: Parser, Match+Action Tables and Deparser. The deparsing is the most challenging block because the main task of this block is to assemble the output packet based on changes in Match+Action Tables. This operation can be quite complicated in the case of high-speed networks. In this work, we present the scalable architecture (in term of the throughput) of a deparsing circuit which is suitable for implementation in FPGAs.

As throughput of computer networks is on a constant rise, there is a need for ever-faster packet parsing modules at all points of the networking infrastructure. Parsing is a crucial operation which has an influence on the final throughput of a network device. Moreover, this operation must precede any kind of further traffic processing like filtering/classification, deep packet inspection, and so on. This paper presents a parser architecture which is capable to currently scale up to a terabit throughput in a single FPGA, while the overall processing speed is sustained even on the shortest frame lengths and for an arbitrary number of supported protocols. The architecture of our parser can be also automatically generated from a high-level description of a protocol stack in the P4 language which makes the rapid deployment of new protocols considerably easier. The results presented in the paper confirm that our automatically generated parsers are capable of reaching an effective throughput of over 1 Tbps (or more than 2000 Mpps) on the Xilinx UltraScale+ FPGAs and around 800 Gbps (or more than 1200 Mpps) on their previous generation Virtex-7 FPGAs.

The P4 is a general and platform agnostic language for the description of packet processing functionality. So far it is being supported by a number of technology companies which provided a way for programming of their devices using the P4 language. One of possible platforms is a SmartNIC - a Field Programmable Gate Array (FPGA) device which connects flexibility with high performance into a compact package. FPGA circuits are typically programmed in a Hardware Description Language (HDL) like VHDL or Verilog. These languages are hard to learn for novices and the development of a network device is very time consuming. Therefore, researchers around the world are finding a way how to automate the translation process from P4 to HDL language because such approach allows easy and fast programming of FPGA SmartNICs to a big audience of network experts. There are currently available three main compilers for the translation of P4 source to HDL - SDNet P4FPGA and P4-to-VHDL. In our best knowledge, all mentioned compilers don't provide any automated test environment which can be used repeatedly for different P4 programs. In other words, the verification environment has to be written by hand for each P4 program. Our work demonstrates a possible solution for automated verification of generated Register Transfer Level (RTL) description of a packet processing device from provided P4 source code.

The P4 language provides a way to describe a custom network packet processing behavior that involves header parsing, matching and assembling modified packets. Such abstraction represents a significant step towards removing the limitation of fixed-function networking devices. Our live demonstration shows a straightforward usage of an algorithm and tool that maps a P4 program to a general architecture of FPGA-based networking device. Network traffic is received, parsed, filtered and modified by the generated circuit at the full line rate of 100 Gbps Ethernet. The results of our ongoing joint research project NFV200 show that the FPGA technology can be used to improve network flexibility without the usual burden of tedious and error-prone HDL coding.

Software Defined Networking and OpenFlow offer an elegant way to decouple network control plane from data plane. This decoupling has led to great innovation in the control plane, yet the data plane changes come at much slower pace, mainly due to the hard-wired implementation of network switches. The P4 language aims to overcome this obstacle by providing a description of a customized packet processing functionality for configurable switches. That enables a new generation of possibly heterogeneous networking hardware that can be runtime tailored for the needs of particular applications from various domains. In this paper we contribute to the idea of P4 by presenting design, analysis and experimental results of our packet parser generator. The generator converts a parse graph description of P4 to a synthetizable VHDL code suitable for FPGA implementation. Our results show that the generated circuit is able to parse 100 Gbps traffic with fairly complex protocol structure at line rate on a Xilinx Virtex-7 FPGA. The approach can be used not only in switches, but also in other appliances, such as application accelerators and smart NICs. We compare the generated output to a hand-written parser to show that the price for configurability is only a slightly larger and slower circuit.

This paper deals with hardware acceleration of statistical methods for detection of anomalies on 100 Gb/s Ethernet. The approach is demonstrated by implementing a sequential Non-Parametric Cumulative Sum (NP-CUSUM) procedure. We use high-level synthesis in combination with emerging software defined monitoring (SDM) methodology for rapid development of FPGA-based hardware-accelerated network monitoring applications. The implemented method offloads detection of network attacks and anomalies directly into an FPGA chip. The parallel nature of FPGA allows for simultaneous detection of various kinds of anomalies. Our results show that hardware acceleration of statistical methods using the SDM concept with high-level synthesis from C/C++ is possible and very promising for traffic analysis and anomaly detection in high-speed 100 Gb/s networks.

This paper deals with the architecture for effective merging of high-speed network streams into one communication line. Networking hardware typically has more than one Ethernet port and if we want to transfer data via single communication bus (PCI-Express, for example) we need to merge all the Ethernet lines into one wide data stream. This paper discusses various approaches of dealing with the emerging issues related to very wide data busses and their alignment. The main contribution of this paper is the introduction of the architecture for merging of high-speed network streams as effective as possible. We use Virtex-7 equipped FPGA card to implement and test our architecture.

The paper deals with the design of application-specific processor which uses high level synthesized instruction engines. This approach is demonstrated on the instance of high speed network flow measurement processor for FPGA. Our newly proposed concept called Software Defined Monitoring (SDM) relies on advanced monitoring tasks implemented in the software supported by a configurable hardware accelerator. The monitoring tasks reside in the software and can easily control the level of detail retained by the hardware for each flow. This way, the measurement of bulk/uninteresting traffic is offloaded to the hardware, while the interesting traffic is processed in the software. SDM enables creation of flexible monitoring systems capable of deep packet inspection at high throughput. We introduce the processor architecture and a workflow that allows to create hardware accelerated measurement modules (instructions) from the description in C/C++ language. The processor offloads various aggregations and statistics from the main system CPU. The basic type of offload is the NetFlow statistics aggregation. We create and evaluate three more aggregation instructions to demonstrate the flexibility of our system. Compared to the hand-written instructions, the high level synthesized instructions are slightly worse in terms of both FPGA resources consumption and frequency. However, the time needed for development is approximately half.

Current hardware acceleration cores for network traffic processing are often well optimized for one particular task and therefore provide high level of hardware acceleration. But for many applications, such as network traffic monitoring and security, it is also necessary to achieve rapid development cycle to provide fast response to security threats.We propose and evaluate a new concept of hardware acceleration for flexible flow-based network traffic monitoring with support of application protocol analysis. The concept is called Software Defined Monitoring (SDM) and it relies on a configurable hardware accelerator implemented in FPGA, coupled with smart monitoring tasks running as software on general CPU. The monitoring tasks in the software control the level of detail and type of information retained during the hardware processing. This arrangement allows rapid application prototyping in the software, followed by further shifting of the timing critical parts of the processing to the hardware accelerator. The concept is proposed with the scalability in mind, therefore it is suitable for different FPGA based platforms ranging from embedded single-chip solutions (such as Zynq or CycloneV) to high-speed backbone network monitoring boxes. Our pilot high-speed implementation using FPGA acceleration board in a commodity server performs a 100Gb/s flow traffic measurement augmented by a selected application protocol analysis.