Reposting is the basic and key behavior for information diffusion in online social networks. It would be beneficial to understand the influence factors of reposting behavior and predict future reposting status, which could be practically applied in breaking news detection, marketing, social media researches and so on. Existing reposting analytics and prediction approaches mainly focus on factors related to the original information content and the social influence of the information publishers. However, online information diffuses by viral cascades instead of single-source broadcast in social network, which means some reposting behavior actually occurs in information propagators rather than the original publishers. In some social networks, users are allowed to comment when they repost, which represents their views and attitudes to the information they propagate. In this paper, we evaluate how emotional tendencies of information propagators influence future reposting. We first propose a modified sentiment analysis method and present emotional analysis on the user-generated content in online diffusion. Experiments are conducted with a real-world dataset and the results indicate the effectiveness of our fine-grained emotional features in reposting prediction.

The thousands of streaming data overwhelmingly provide for Internet users on Twitter every day, especially for those Twitter users with many friends. However, the useful tweets that users are really interested in personally could be covered by massive other uninformative and uninteresting information. Therefore, how to bring immediately the interesting tweets for users is always a challenging issue. In this paper, we consider the user friendships in detail and build an effective and practical model to calculate the friendships among users. Certainly, we also take user interests to tweets into account. We then propose a personalized approach for tweets ranking, which focus on the user friendships and the personal interests to tweets. The experimental results demonstrate that our proposed method greatly outperforms several baselines and the user friendships have really important effect on tweets ranking.

Although the spiral of silence theory has been studied thoroughly in the traditional dissemination field, to our best knowledge, no one has clearly verified the applicability of the spiral of silence theory in social networks based on the real information propagation datasets. In this paper, we focus on the disparity between majority and minority opinions, we verify the applicability of the spiral of silence theory in social networks by taking into account 4 factors, including the propagation width, the propagation depth, the message sentiment and the modularity through a large amount of data-driven experiments based on the real-world information propagation datasets which collected on Sina Weibo. We also investigate the applicability of tweets with different categories, our data-driven experimental results show that the spiral of silence theory is still applicable in social networks but different tweets with different categories have different applicability of the spiral of silence theory.

As many malicious apps have been distributed in Android markets, it is urgent to fix the vulnerabilities exploited by these apps and develop effective mitigation methods. In this paper, we identify a common vulnerability in many Android apps. This vulnerability is rooted in an unprotected Android component, called "Activity". Utilizing this vulnerability, a malicious app can stealthily and cannily collect sensitive user data. To better understand this issue, we have built "ActivityHijacker", an app that can detect the right moment to hijack the Activity component and intercept a user's password while it is being inputted in real time. To assess the prevalence of this vulnerability, we further analyzed 8 Android OSs (version 2.x to 5.x) and 22 banking apps collected in January 2016 from various Android markets. Our results show that all these Android OSs and apps are susceptible to the vulnerability; 14 out of 22 banking apps can be hijacked without any prompts. We further present a mitigation mechanism that restricts the Activity component to authorized apps.

Retweet has become one of the most prominent feature on social networks and an important mean for secondary content promotion. Most existing investigations of retweet behaviors on social networks are conducted based on empirical studies or information diffusion models (such as stochastic process or cascading model). To the best of our knowledge, such a retweet process has not been investigated as a chaotic process. In this paper, we have first examined that retweet time series by 0-1 test where the results provide identification of chaotic behaviors. Furthermore, taking into account of the proven chaotic characteristic, chaos LS-SVM prediction method is applied to form predictions using only a small fraction of the retweet time series. Our evaluation on Sina Weibo dataset and comparisons with a bayesian model and strawman modal show that this nonlinear prediction method can translate to good step ahead forecasts and perform high accuracy in retweet prediction.

Traditionally, signatures used for traffic classification are constructed at the byte-level. However, as more and more data-transfer formats of network protocols and applications are encoded at the bit-level, byte-level signatures are losing their effectiveness in traffic classification. In this poster, we creatively construct bit-level signatures by associating the bit-values with their bit-positions in each traffic flow. Furthermore, we present BitMiner, an automated traffic mining tool that can mine application signatures at the most fine-grained bit-level granularity. Our preliminary test on popular peer-to-peer (P2P) applications, e.g. Skype, Google Hangouts, PPTV, eMule, Xunlei and QQDownload, reveals that although they all have no byte-level signatures, there are significant bit-level signatures hidden in their traffic.

Although cascading failures have occurred on many real-world networks, to our best knowledge, no one has clearly identified this issue on a social network. In this paper, we identify this potential issue on social networks, and develop a theoretical model to analyze related issues. Note that highly-influential “super” users play critical roles on a social network. When they are suddenly unavailable, a large portion of the social network may be seriously disrupted. The proposed model captures this dynamic process and helps us better understand related issues. Furthermore, we evaluate the proposed model under four attack strategies based on real social network datasets collected on Twitter and Sina Weibo. We also analyze the connectivity, the persistent time, and the cascade effect of a social network under these attacks. Our results show that social network service providers have to pay closer attention to super users to avoid dramatic failures.

As smartphones and mobile devices are rapidly becoming indispensable for many network users, mobile malware has become a serious threat in the network security and privacy. Especially on the popular Android platform, many malicious apps are hiding in a large number of normal apps, which makes the malware detection more challenging. In this paper, we propose a ML-based method that utilizes more than 200 features extracted from both static analysis and dynamic analysis of Android app for malware detection. The comparison of modeling results demonstrates that the deep learning technique is especially suitable for Android malware detection and can achieve a high level of 96% accuracy with real-world Android application sets.

Multituple packet classification is one of the key technologies, and often the performance bottleneck in modern network devices. Devices such as firewalls demand fast packet classification on very complicated rule sets of large size, which is still challenging today. This paper proposes a practical packet classification algorithm named dynamic discrete bit selection (D2BS), which achieves high classification speed while requiring low storage. D2BS employs dynamic heuristic schemes at bit level, to explore the inherent characteristics of the rule sets. D2BS has been implemented on various platforms including Intel-architecture, multicore network processor, and FPGA, and is compared with the state-of-the-art solutions. Experimental results on real-life rule sets show that the memory storage required by D2BS is at least one to two orders of magnitude lower than that of the existing work, while the speed is much higher. With 64-byte Ethernet packet and 10K size ACL rule set, D2BS achieves a throughput over 10 Gbps on Cavium OCTEON CN5860 multicore network processor and over 135 Gbps on Xilinx Virtex-5 FPGA, which outperforms the existing work under the same test environment. All results promise that D2BS is a highly practical solution to satisfy vigorous requirements.

Precise Web page identification has always been a research hotspot in the areas of network management and security. However, previous works generally focused on statistical or probabilistic approaches and could not exactly calculate the length of encrypted data under different conditions, which makes them hardly cover all the cases. In this poster, we propose an exact fingerprint derivation method for encrypted Web-browsing traffic and thereby implementing a prototype system for precise page identification (PPI). Our experiments show that PPI not only can be employed for early page identification at individual-flow level but also can achieve very high accuracy at aggregate-traffic level.

In this paper, we propose a new SPNR model and identify the concrete propagation relationships and obtain the spreading threshold. We evaluate the proposed model with simulations and compare the simulation results with real data on Sina Weibo, the largest micro-blogging tool in China. The results show that the new model is effective for capturing the rumor spreading in real social networks. To obtain effective rumor control strategy, we further analyze the key factors that affect the maximum value of steady state, the point of decline, and the life cycle of a rumor. These results help us develop new rumor control strategies.

We propose Proximity-Aware cache Replication (PAR), an LLC replication technique that elegantly integrates an intelligent cache replication placement mechanism and a hierarchical directory-based coherence protocol into one cost-effective and scalable design. PAR dynamically allocates replicas of either shared or private data to a few predefined and fixed locations that are calculated at chip design time. Therefore, PAR fits well to future many-core CMPs thanks to its scalable on-chip storage and coherence design. Simulation results on a 64-core CMP show that PAR can achieve 12% speedup over the baseline shared cache design with SPLASH2 and PARSEC workloads. It also provides around 5% speedup over a couple contemporary approaches with much simpler and scalable support. Translating this speedup to cache performance, PAR achieves 40% and 70% reduction over the baseline in average L1 miss latency and on-chip network traffic, respectively. Furthermore, PAR shows good speedup with multiprogrammed workloads.

In a Chip MultiProcessor(CMP) with shared caches, the last level cache is distributed across all the cores. This increases the on-chip communication delay and thus influence the processor's performance. Replication can be provided in shared caches to reduce the on-chip communication delay. However, current proposals do not take into account replicating blocks's access characteristics and how to make the best of replicas, which have limited performance benefit. In this paper, we observe that reusability of cache blocks influences the availability of replication scheme severely. Based on this observation, we propose Dynamic Reusability-based Replication (DRR), a novel cache design to exploit efficient replicas management using blocks's reuse pattern. DRR monitors the recent referenced cache blocks' access pattern, and replicates the blocks with high reusability to appropriate L2 slices, and the replicated copies can be shared by their nearby cores. We evaluate DRR for 16-core system using splash-2 and parsec benchmarks. DRR improves performance by 30% on average over conventional shared cache design, 16% over Victim Replication(VR), 8% over Adaptive Selected Replication (ASR), and 25% over R-NUCA.

As one of the most popular low-latency anonymous communication systems, Tor has been a great success but still faces some challenges, e.g., subject to low-resource attacks and no explicit mechanisms to explore tradeoffs between anonymity and performance. In this paper, we propose a Relay Recommendation System (RRS) for Tor to provide reliable relay information for building paths with better performance, mitigate low-resource attacks, and enable users to explore the tradeoffs between performance and anonymity based on their needs. We first present the design of RRS, and show its performance improvement and resistance to low-resource, high-resource, and reputation attacks. We further analyze the potential anonymity decrease, and propose new path selection schemes to enable selective anonymity based on user needs. We have evaluated RRS via both analysis and experiments on a Tor simulation platform. Our results show that RRS achieves significant performance improvement with a small decrease of anonymity.

We propose Proximity-Aware cache Replication (PAR), an LLC replication technique that elegantly integrates an intelligent cache replication placement mechanism and a hierarchical directory-based coherence protocol into one cost-effective and scalable design. Simulation results on a 64-core CMP show that PAR can achieve 12% speedup over the baseline shared cache design with SPLASH2 and PARSEC workloads. It also provides around 5% speedup over a couple contemporary approaches with much simpler and scalable support.

Tor (the second generation onion routing) is arguably the most popular low-lateney anonymous communication system now. In this paper, we reexamine the anonymity of Tor based on our observation of "super nodes". These nodes are more available and reliable than other nodes and provide high bandwidth for assisting the system in both performance and stability. We first confirm their existence by analyzing the life cycles of node IP addresses and node bandwidth contributions via two correlation approaches, on a set of self-collected data and a set of real data from the Tor official collection. We then analyze the effect of super nodes on the anonymity of Tor, discuss attacks that exploit such knowledge, and verify our analysis with real data to show potential damages. Furthermore, we investigate new attacks that exploit the knowledge of super nodes. Our simulation results show that these attacks can greatly damage the anonymity of Tor.

Network traffic classification is extremely important in numerous network functions today. However, most of the current approaches based on port number or payload detection are becoming increasingly impractical with the appearance of dynamic or encrypted applications. Even though some supervised learning based work were proposed, it is difficult to collect sufficient flow-labeled traces for training. On the other hand, online classification needs an early identification, which is still challenging for most well-known approaches. In this paper, we propose a semi-supervised learning based traffic classification approach named SMILER, which supports an early classification from the sizes of the first few packets (empirically 5 packets) of a flow. Experiments in real networks demonstrate that SMILER achieves 94% precision and 96% recall on average for all tested applications, even with disordered packets SMILER still works well. With a hybrid scheme, the performance is further improved. Meanwhile, SMILER performs fast in both classification and updating. All experimental results show that SMILER is practical for fast and accurate online traffic classification.

Flow-based traffic processing systems have been widely deployed on multi-core systems for performance purpose. However, the current flow table design cannot balance parallel processing performance and memory usage of locks, and is unable to automatically adapt to different network settings. To address these issues, in this paper we propose a Hypercube Flow Table (HFT) based on multi- dimension hash tables. HFT supports different lock granularities to allow multiple cores to process packets in parallel and reduce memory usage by assigning a lock for a group of buckets, instead of one lock per bucket as many current designs. Furthermore, HFT can adapt to various network situations by dynamically adjusting buckets assignment. We have tested HFT on a traffic classification system with two Intel Xeon E5504 processors. The results show that HFT can effectively balance memory usage and parallel processing performance, and further adapt to various network settings by adjusting buckets assignment.

In a Chip Multiprocessor(CMP) with shared caches, the last level cache (LLC) is distributed across all the cores. This increases the on-chip communication delay and thus influence the pr ocessor's performance. The LLC is also quite inefficient due to plenty of dead blocks. Replication can be provided in shared caches by replicating cache blocks evicted from cores to the local LLC slices to minimize access latency through utilizing the cache space of dead blocks which will not be referenced again before they are evicted. However, naively allowing all evicted blocks to be replicated have limited performance benefit as such replicating does not take into account reuse probability of replicated blocks. This paper proposes Adaptive Probability Replication (APR), a mechanism that counts each block's accesses in L2 cache slices, and monitors the number of evicted blocks with different number of accesses, to estimate the Re-Reference Probability of blocks in their lifetime at runtime. Using predicted re-reference probability, APR adopts probability replication policy and probability insertion policy to replicate blocks at corresponding probabilities, and insert them at appropriate position, according to their re-reference probability. We evaluate APR for a 16-core tiled CMP using splash-2 and parsec benchmarks. APR improves performance by 21% on average compared to conventional shared cache design, by 17% over Victim Replication (VR), by 10% over Adaptive Selective Replication (ASR), and by 15% over Reactive NUCA (R-NUCA). The additional hardware cost of APR is well under 1% of L2 cache slice.

Regular expression matching has become a critical yet challenging technique in content-aware network processing, such as application identification and deep inspection. To meet the requirement for processing heavy network traffic at line rate, Deterministic Finite Automata (DFA) is widely used to accelerate regular expression matching at the expense of large memory usage. In this paper, we propose a DFA-based algorithm named RCDFA (Reorganized and Compact DFA), which dramatically reduces the memory usage while maintaining fast and deterministic lookup speed. Based on the dissection of real-life DFA tables, we observe that almost every state has multiple similar states, i.e. they share identical next-state transitions for most input characters. However, these similar states often distribute at nonadjacent positions in the original DFA table. RCDFA aims at reorganizing all similar states into adjacent entries, so that identical transitions become consecutive along the state dimension, then compresses the reorganized DFA table utilizing bitmap technique. Coupled with mapping along the character dimension, RCDFA is not only efficient in DFA compression, but also effective for hardware implementation. Experiment results show, RCDFA has superior performance in terms of high processing speed, low memory usage and short preprocessing time. RCDFA consistently achieves over 95% compression ratio for existing real-life rule sets. Implemented in a single Xilinx Virtex-6 FPGA platform, RCDFA matching engine achieved 12Gbps throughput.

Modern networks are increasingly becoming content aware to improve data delivery and security via content-based network processing. Content-aware processing at the front end of distributed network systems, such as application identification for datacenter load-balancers and deep packet inspection for security gateways, is more challenging due to the wire-speed and low-latency requirement. Existing work focuses on algorithm-level solutions while lacking system-level design to meet the critical requirement for front-end content processing. In this paper, we propose a system-level solution named FEACAN for front-end acceleration of content-aware network processing. FEACAN employs a software-hardware co-design supporting both signature matching and regular expression matching for content-aware network processing. A two-dimensional DFA compression algorithm is designed to reduce the memory usage and a hardware lookup engine is proposed for high-performance lookup. Experimental results show that FEACAN achieves better performance than existing work in terms of processing speed, resource utilization, and update time.

Inline stateful and deep inspection for network intrusion prevention system (NIPS) is progressively challenging to cope with the fast growing volume and ever increasing complexity of network traffic. Traditional cluster-based architectures provide a solution for scalable and high performance NIPS, but with some common limitations. This paper proposed yet another cluster-based architecture (YACA) with a stateful traffic splitter. As an architectural approach for building a high performance NIPS, we present a novel design of stateful traffic splitter. The performance of its network processor implemented prototype demonstrates that such a design is suitable for the proposed architecture.

Thunder (also called Xunlei) is the most popular P2P file sharing application in China and probably the most popular P2P software in term of traffic volume and number of users. Precisely identifying Thunder traffic can help network administrators to efficiently manage their networks. Traditional methods of identifying P2P traffic such as port-based or content-based approaches are ineffective to Thunder traffic, because of its dynamic packet format, flexible port numbers, and payload encryption. In this paper, we developed a novel Heuristic Message Clustering approach (HMC) to identify Thunder traffic, and obtain its state machine and key transaction cycles, thus identifying Thunder traffic fast and accurately. We first evaluate our method in a controlled environment and then with real campus traces. The results show that HMC is able to identify Thunder flows with high precision and low error rate.

With the continual growth of network speed and the increasing sophistication of network applications, keeping network operations efficient and secure becomes more challenging. Pattern matching is one of the key technologies for content-ware network processing, such as traffic classification, application identification and intrusion prevention. In this paper, we propose a hybrid pattern matching algorithm optimized for multi-core network processing platforms. As a system-level solution, our scheme focuses on both performance stability and hardware/software co-design. To verify the effectiveness of our design, the proposed algorithm is implemented on a state-of-art 16-MIPS-core network processing platform and evaluated with real-life data sets. Experimental results show that, when compared with the traditional Aho-Corasick algorithm, our hybrid solution saves 60~95% memory space while guarantees stable performance on large pattern sets and against adverse test traffic.

Classifying encrypted traffic is critical to effective network analysis and management. While traditional payload- based methods are powerless to deal with encrypted traffic, machine learning methods have been proposed to address this issue. However, these methods often bring heavy overhead into the system. In this paper, we propose a hybrid method that combines signature-based methods and statistical analysis methods to address this issue. We first identify SSL/TLS traffic with signature matching methods, and then apply statistical analysis to determine concrete application protocols. Our experimental results show that the proposed method is able to recognize over 99% of SSL/TLS traffic and achieve 94.52% in F-score for protocols identification.

As more processing cores are integrated into one chip and the feature size continues to shrink, the increasing on-chip access latency complicates the design of the on-chip last-level cache for chip multiprocessors. At the same time, the overhead of maintaining on-chip directory cannot be ignored as the number of processing cores increasing. There is an urgent need for scalable organization of on-chip last-level cache. In this work, we propose fast hierarchical cache directory for tiled CMP, which divides CMP tiles into multiple regions hierarchically, and combines it with data replication. Multi-level directory is used to record the share information within a region and assist the regional home node to complete operation efficiently. Fast directory is used to get lower L2 slice access latency at the same time. Most cache requests to last-level cache can be handled within the local level-1 region. Evaluation indicates this architecture is highly scalable. Simulation results show that for a 16-core CMP, hierarchical cache directory reduces average access latency to last-level cache by 46.35% and average on-chip network traffic by 19.25% respectively. The system performance is increased by 20.82% at the same time.

Inline stateful and deep inspection for intrusion prevention is becoming more challenging due to the increase in both the volume of network traffic and the complexity of the analysis requirements. In this work, we pursue a novel architectural approach, named SANS, which takes both the advantage of new generation network processors for packet-header-based processing and the advantage of commodity x86 platforms for packet payload data processing. A session table scheme is designed for the stateful frontend in SANS to achieve wire speed inline processing.

In this paper, we propose an extensible Open-Architecture Services platform (OASis) for high-performance network processing. OASis embraces recent advances of open technologies, including open source software, open system standards and open network architectures. Three programming models are proposed for target-specific processing modules: a multi-granularity packet processing model for network processing; a thread-isolated parallel programming model for service processing; and a message-based management model for centralized system administration. As an application example of OASis, a Unified Threat Management (UTM) prototype is implemented. This prototype provides multiple network security services, including stateful firewall, intrusion detection, and virus scanning. Experimental results show that, the OASis-UTM prototype can achieve 40Gbps stateful firewall performance together with 4--8Gbps intrusion detection and anti-virus performance on a 12U 14-slot ATCA platform.

Data De-duplication has become a commodity component in data-intensive storage systems. But compared with other traditional storage paradigms, de-duplication system achieves elimination of data duplications or redundancies at the cost of bringing several additional layers or function components into the I/O path, and these additional components are either CPU-intensive or I/O intensive, largely hindering the overall system performance. Direct against the above potential system bottlenecks, this paper quantitatively analyzes the overhead of each main component introduced by de-duplication, and then proposes two performance optimization methods. The one is parallel calculation of content aware chunk identifiers, which fully utilizes the parallelism both inter and intra chunks by using a certain task partition and chunk content distribution algorithm. Experiments demonstrate that it can improve up to 150% of the system throughput, and at the same time much better utilize the multiprocessor resources. The other one is storage pipelining, which overlaps the CPU-bound, I/O-bound and network communication tasks. Through a dedicated five-stage storage pipeline design for file archival operations, experimental results show that the system throughput can increase up to 25% according to our workloads.

Network intrusion prevention system (NIPS) becomes more complex due to the rapid growth of network bandwidth and requirement of network security. However existing solutions, either hardware-based or software-based cannot obtain a good tradeoff between performance and flexibility. In this paper, we propose a parallel NIPS architecture using emerging network services processor. To resolve the problems and bottlenecks of high-speed processing, we investigate the main design aspects which have dramatic impacts on most parallel network security system implementations: efficient and flexible pipeline and parallel processing, flow-level packet-order preserving, and latency hiding of deep packet inspection. To these key points, we address several optimizations and modifications with an architecture-aware design principle to guarantee high performance and flexibility of the NIPS on a network services processor implementation. Performance evaluation shows that, our prototype NIPS on Cavium OCTEON3860 processor can reach line-rate stateful inspection and multi-Gbps deep inspection performance.

Packet classification is one of the most critical techniques in many network devices such as firewall, IDS and IPS, etc. In order to meet the performance requirement for high speed Internet (even higher than 10 Gbps), practical algorithms must keep better spatial and temporal performance. Moreover, as the size of rule set is increasing to tens of thousands, novel packet classification algorithms must have good scalability. In this paper, we propose a novel packet classification algorithm named DBS (discrete bit selection) which takes a bit level heuristic design to partition the rule set effectively. To the best of our knowledge, DBS is the first try to design a heuristic classification algorithm at bit-level. To evaluate the performance of our algorithm, DBS is deployed on a popular multi-core network processor platform, compared with two existing well-known algorithms. Experimental results show that DBS achieves 300% higher throughput than HiCuts and HSM, while the memory requirement is reduced to about 10% averagely. DBS works well especially with large rule set (10K), which trends a good scalability.

During the past decade, the packet classification problem has been widely studied to accelerate network applications such as access control, traffic engineering and intrusion detection. In our research, we found that although a great number of packet classification algorithms have been proposed in recent years, unfortunately most of them stagnate in mathematical analysis or software simulation stages and few of them have been implemented in commercial products as a generic solution. To fill the gap between theory and practice, in this paper, we propose a novel packet classification algorithm named HyperSplit. Compared to the well-known HiCuts and HSM algorithms, HyperSplit achieves superior performance in terms of classification speed, memory usage and preprocessing time. The practicability of the proposed algorithm is manifested by two facts in our test: HyperSplit is the only algorithm that can successfully handle all the rule sets; HyperSplit is also the only algorithm that reaches more than 6Gbps throughput on the Octeon3860 multi-core platform when tested with 64-byte Ethernet packets against 10K ACL rules.

The large working sets of commercial and scientific workloads favor a shared L2 cache design that maximizes the aggregate cache capacity and minimizes off-chip memory requests in Chip Multiprocessors (CMP). There are two important hurdles that restrict the scalability of these chip multiprocessors: the on-chip memory cost of directory and the long L1 miss latencies. This work presents network caching architecture aimed at facing these two important problems. Network caching takes advantage of on-chip networks to manage shared data blocks and directory information in chip multiprocessors. The network caching architecture removes the directory structure from shared L2 caches and stores directory information for the blocks recently cached by L1 caches in the network interface components decreasing on-chip directory memory overhead and improves the scalability. The saved memory space is used as shared data caches or victim caches which are embedded into the network interface components to reduce L1 miss latencies further. This paper develops three network caching designs to reduce L1 miss latencies. The proposed architecture is evaluated based on simulations of a 16-core tiled CMP. First, we demonstrate that network caching architecture provides good scalability. Second, network caching architecture also provides robust performance. Third, different network caching designs have distinct impacts on performance of CMP. Against over the traditional shared L2 cache design, Network Victim Cache (NVC) design improves performance by 23% on average, and up to 34% at best. Network Shared Cache (NSC) design provides performance improvement by 6% on average, and up to 16% at best. Network Directory Cache (NDC) design achieves performance improvement by 4% on average, and up to 11% at best.

To build high-performance network devices with holistic security protection, a large number of algorithms have been proposed. However, multi-core implementation of the existing algorithms suffers from three limitations: performance instability, data-structure heterogeneity, and hardware dependency. In this paper, we propose three principles for effective network processing on multi-core network processors. To verify the effectiveness of these principles, algorithms for two typical network processing tasks are redesigned and implemented on the Cavium Octeon3860 network processor. Test results show that our schemes achieve superior performance in comparison with existing best-known algorithms.

The security gateways today are required not only to block unauthorized accesses by authenticating packet headers, but also by inspecting connection states to defend against malicious intrusions. Hence session creation rate plays a key role in determining the overall performance of stateful intrusion prevention systems. In this paper, we propose a high-speed session creation scheme optimized for network processors. Main contribution includes: a) A high-performance flow classification algorithm on network processors; b) An efficient TCP three-way handshake scheme designed for fast-path processing using a two-stage intelligent hashing. Experimental results show that: a) The presented parallel optimized flow classification algorithm, Parallel Search Cross-Producting, outperforms the original Cross-Producting and Binary Search Cross-Producting algorithms with 300% and 60% increase of classification speed; b) The proposed fast path three-way handshake scheme, IntelliHash, achieves a TCP connection creation rate over 2M connections per second.

Pattern matching is one of the most important components for the content inspection based applications of network security, and it requires well designed algorithms and architectures to keep up with the increasing network speed. For most of the solutions, AC and its derivative algorithms are widely used. They are based on the DFA model but utilize large amount of memory because of so many transition rules. An algorithm, called ACC, is presented in this paper for multiple pattern matching. It uses a novel model, namely cached deterministic finite automate (CDFA). In ACC, by using CDFA, only 4.1% transition rules for ClamAV (20.8% for Snort) are needed to represent the same function using DFA built by AC. This paper also proposes a new scheme named next-state addressing (NSA) to store and access transition rules of DFA in memory. Using this method, transition rules can be efficiently stored and directly accessed. Finally the architecture for multiple pattern matching is optimized by several approaches. Experiments show our architecture can achieve matching speed faster than 10 Gbps with very efficient memory utilization, i.e., 81KB memory for 1.8 K Snort rules with total 29 K characters, and 9.5 MB memory for 50 K ClamAV rules with total 4.44 M characters. A single architecture is memory efficient for large pattern set, and it is possible to support more than 10 M patterns with at most half amount of the memory utilization compared to the state-of-the-art architectures.

The distribution of copyright content over peer-to-peer (P2P) networks facilitates misuse of protected digital property and severely violates the rights of creators and owners. Besides, the anonymity and other features of latest P2P applications make law enforcement almost impractical. Unfortunately, current technology efforts attempting to block unauthorized files depend on manually predefined keywords which can be easily modified by the application, and they fail to distinguish between authorized and unauthorized files. In this context, we present PIFF, an intelligent file filtering mechanism for peer-to-peer network, which effectively blocks illegal file distribution based on file signatures automatically generated and deployed by the system. With a hierarchy infrastructure and decision algorithm, our solution discovers and identifies the file signatures much faster than manual analysis, and spreads it among system nodes to perform filtering immediately. Experiment results suggest that compared with unprotected environment, PIFF can reduce over 85% peers for unauthorized files without any affect on the distribution of authorized files