Recent advances in network traffic capturing techniques have made it feasible to record full traffic traces, often for extended periods of time. Among the applications enabled by full traffic captures, being able to automatically reconstruct user-browser interactions from archived web traffic traces would be helpful in a number of scenarios, such as aiding the forensic analysis of network security incidents. Unfortunately, the modern web is becoming increasingly complex, serving highly dynamic pages that make heavy use of scripting languages, a variety of browser plugins, and asynchronous content requests. Consequently, the semantic gap between user-browser interactions and the network traces has grown significantly, making it challenging to analyze the web traffic produced by even a single user.

In many computing domains, hardware accelerators can improve throughput and lower power consumption, instead of executing functionally equivalent software on the general-purpose micro-processors cores. While hardware accelerators often are stateless, network processing exemplifies the need for stateful hardware acceleration. The packet oriented streaming nature of current networks enables data processing as soon as packets arrive rather than when the data of the whole network flow is available. Due to the concurrence of many flows, an accelerator must maintain and switch contexts between many states of the various accelerated streams embodied in the flows, which increases overhead associated with acceleration. We propose and evaluate dynamic reordering of requests of different accelerated streams in a hybrid on-chip/memory based request queue in order to reduce the associated overhead.

We propose a scale-out solution for deep packet processing (DPP) appliances, which uses a standard Ethernet switch in combination with a load balancing controller. The majority of the data-plane traffic is distributed via the switch's built-in traffic distribution function and no connection state is kept. If the load balancing controller detects a skew in the load of the DPP appliances, it updates the traffic rules in the switch to redirect new connections to less busy DPP appliances. This adaptive solution is beneficial for load-balancing at high data rates because state is kept for only the redirected connections. For typical traffic patterns, our solution reduces the packet drops with minimal connection redirection. We show an example capture, where we are able to improve the packet drop rate by 94.8% with only 3% of the connections being redirected.

Multi-core architectures are commonly used for network applications because the workload is highly parallelizable. Packet scheduling is a critical performance component of these applications and significantly impacts how well they scale. Deep packet inspection (DPI) applications are more complex than most network applications. This makes packet scheduling more difficult, but it can have a larger impact on performance. Also, packet latency and ordering requirements differ depending on whether the DPI application is deployed inline. Therefore, different packet scheduling tradeoffs can be made based on the deployment.

Compression and Decompression can significantly lower the network bandwidth requirements for common internet traffic. Driven by the demands of an enterprise network intrusion system, this paper defines and examines the requirements of popular dictionary-based decompression in the real-time network processing scenario. In particular, a "stateful" decompression is required that arises out of the packet oriented nature of current networks, where the decompression of the data of a packet depends on the decompressed contents of its preceeding packets composing the same data stream. We propose an effective hardware decompression acceleration engine, which fetches the history data into the accelerator's fast memory on-demand and hides the associated latency by exploring the parallelism of the dictionary-based decompression process. We specify and evaluate various design and implementation options of the fetch-on-demand mechanism, i.e. prefetch most frequently used history, on-accelerator history buffer management, and reuse of fetched history data. Through simulation-based performance study, we show the effectiveness of the proposed mechanism on hiding the overhead of stateful decompression. We further show the effects of the design options and the impact on the overall performance of the network service stack of an intrusion prevension system.