CT-T:Exploiting Multi-Core CPUs for Parallelizing Network Intrusion Prevention

实施有效的网络安全监控的性能压力在多个维度上急剧增长，超过了CPU性能的提高。随着单CPU摩尔定律的终结，情况现在变得严峻起来。总体而言，硬件供应商现在转向并行执行-多核和多线程--以维持性能增长。但是，使网络安全监控适应这种并行性带来了一系列具有挑战性的问题。该项目旨在开发有效并行化深度网络活动安全分析的方法。要做到这一点，需要将处理结构化为适合并发执行的单独的低级线程，为此必须解决几个关键问题：仅当所有相关线程完成审查时才转发分组；在全局分析算法存在的情况下最小化线程间通信；针对局部优化内存访问模式；以及提供有效的性能调试工具。工作中心围绕面向事件的底层体系结构，由于事件引入分析流的去耦合异步，因此允许暴露许多并发执行的机会。此外，通过将事件与最终刺激它们的分组相关联，系统可以做出合理的决策，以解决转发挂起的分组是否变得安全以及何时变得安全的问题。最终，该努力的目的是使网络入侵防御能够获得在通用商用硬件上执行的好处，以及摩尔定律承诺的未来并行处理器的指数扩展。

The performance pressures on implementing effective network security monitoring are growing fiercely in multiple dimensions, outpacing improvements in CPU performance. The situation has now become dire with the end of Moore's Law for single CPUs. In general, hardware vendors now turn to parallel execution---many cores and many threads---to sustain performance growth. But adapting network security monitoring to such parallelism raises a host of challenging issues.This project seeks to develop methodologies for effectively parallelizing in-depth security analysis of network activity. Doing so requires structuring the processing into separate, low-level threads suitable for concurrent execution, for which several key issues must be addressed: forwarding packets only when all relevant threads have finished their vetting; minimizing inter-thread communication in the presence of global analysis algorithms; optimizing memory access patterns for locality; and providing effective performance debugging tools.The work centers around an event-oriented underlying architecture, which allows for exposing many opportunities for concurrent execution due to the decoupled asynchrony that events introduce into the flow of analysis. In addition, by associating events with the packets that ultimately stimulated them, the system can make sound decisions for resolving whether and when it becomes safe to forward pending packets.Ultimately, the effort aims to enable network intrusion prevention to reap both the benefits of executing on general purpose commodity hardware, as well as the exponential scaling that Moore's Law promises for future parallel processors.