[talks] Fwd: Robert Harrison General Exam Presentation TODAY Wednesday, May 23, 2018 at 1:00 pm CS402

[Barbara A. Mooring]

Robert Harrison will present his General Exam Presentation on Wednesday, May 23, 2018 at 1:00 pm in CS402.

Committee:
Jennifer Rexford (Adviser)
Nick Feamster
Mike Freedman

Title: Query-Driven, Network-Wide Monitoring with Sonata

Abstract:

Managing and securing modern networks requires collecting and analyzing network traffic in real time.  This collection and analysis
allows operators to identify conditions that might indicate attack, misconfiguration, or failure.  Some approaches for performing this
collection and analysis scale well to high traffic rates by relying on the high-throughput, but limited, packet processing available on network
switches; other approaches can support a wider range of analyses by relying on the lower-throughput, but rich, packet processing available on general
purpose servers. We present Sonata, an expressive and scalable network telemetry system that performs the collection and analysis of network
traffic using the compute resources of both network switches and stream-processing servers.  Sonata provides a declarative interface to
express queries using dataflow operators for a wide range of common telemetry tasks.  To enable real-time execution, Sonata partitions queries
across a stream processor and a switch data plane, running as much of the query as it can on the network switch, at line rate. To optimize the use of
limited switch memory, Sonata models the constraints of Protocol Independent Switch Architecture (PISA) targets and solves an optimization
problem to compile high-level dataflow operators to low-level PISA primitives. To generalize this compilation for network-wide query
execution, we also describe the challenges inherent to distributed query execution and techniques for overcoming those challenges.  Our evaluation
shows that, for the single-switch case, Sonata can support a wide range of monitoring tasks while reducing the workload on the stream processor by as
much as seven orders of magnitude compared to existing telemetry systems.



Barbara A. Mooring
Interim Graduate Coordinator
Computer Science Department
Princeton University