Scaling-out traffic management in the cloud

Managing cloud traffic is challenging due to its large and constantly growing traffic in scale and traffic anomalies. Network infrastructure and traffic management need to scale their capacity to such traffic growth and anomalies, otherwise the application performance will suffer. Existing traffic management functions have so far focused on proprietary hardware appliances and software servers. However, with limited capacity and fixed functionality per box, those solutions incur a high cost, low performance and high management complexity. ❧ In this thesis, we argue that we should scale-out traffic management functions for the support of increasing traffic scale and anomalies. By scaling-out, we mean those traffic management functions should support the full throughput of datacenter networks. The key idea of this thesis is to leverage the hardware switches with line-rate packet processing and the emerging programmability to directly build advanced functionaries. We have identified three major traffic management functions: load balancing, attack mitigation, and congestion control. We present SilkRoad, a load balancer built directly in hardware switching ASICs, which provides a load balancing function at line-rate while keeps tracking of millions of connections. We then discuss the large-scale measurement study on the characteristics of network attacks for both coming towards and from the cloud. After we systematically analyze nine types of attacks and quantified their prevalence, intensive, and patterns, we advocate a cloud attack detection service called Nimbus to leverage hardware switches to select and filter traffic for accurate attack detection in virtual machines. Last, we present DIBS, a mechanism that allows switches to share their buffer for large buffer absorbing. We demonstrate that it reduces the 99th percentile of delay-sensitive query completion time by up to 85%, with very little impact on other traffic.云流量管理颇具挑战，原因在于其流量规模庞大且持续增长，同时还存在流量异常问题。网络基础设施与流量管理系统需针对此类流量增长与异常情况扩容，否则应用性能将受损。现有流量管理功能目前多聚焦于专有硬件设备与软件服务器。然而，由于单台设备的容量有限且功能固定，此类方案存在成本高昂、性能低下以及管理复杂度高等问题。 本论文主张，应针对不断增长的流量规模与异常情况横向扩展流量管理功能。所谓横向扩展，即此类流量管理功能需支持数据中心网络的全线吞吐量。本论文的核心思路是，依托具备线速数据包处理能力的硬件交换机与新兴的可编程技术，直接搭建高级流量管理功能。我们已确定三大核心流量管理功能：负载均衡、攻击缓解与拥塞控制。我们提出了SilkRoad，一款直接部署于硬件交换专用集成电路（Application-Specific Integrated Circuit，ASIC）中的负载均衡器，其可在实现线速负载均衡功能的同时，追踪数百万条网络连接。随后，我们针对云内与云外的网络攻击特征开展了大规模测量研究。在系统分析九类攻击的流行程度、攻击强度与攻击模式并完成量化后，我们提出了名为Nimbus的云攻击检测服务，该服务借助硬件交换机选择并过滤流量，以在虚拟机（Virtual Machines）中实现精准的攻击检测。最后，我们提出了DIBS机制，该机制允许交换机共享自身缓冲区以实现大流量突发缓冲。实验证明，该机制可将延迟敏感型查询完成时间的第99百分位数最多降低85%，同时对其他流量的影响极小。