References [1]Sherry,Justine,etal."Blindbox:Deeppacketinspectionoverencryptedtraffic."ACMSIGCOMMComputerCommunicationReview45.4(2015):213-226. [2]Symantec’sEncryptedTrafficManagement(ETM).https://www.symantec.com/products/encrypted-traffic-management. [3]Conti,Mauro,etal."Analyzingandroidencryptednetworktraffictoidentifyuseractions."IEEETransactionsonInformationForensicsandSecurity11.1(2016):114-125. [4]Papadogiannaki,Eva,etal."OTTer:AScalableHigh-ResolutionEncryptedTrafficIdentificationEngine."InternationalSymposiumonResearchinAttacks,Intrusions,andDefenses.Springer,Cham,2018. [5]Cisco’sEncryptedTrafficAnalytics(ETA).https://www.cisco.com/c/en/us/solutions/enterprise-networks/enterprise-network-security/eta.html. [6]Rizzo,Luigi."Netmap:anovelframeworkforfastpacketI/O."21stUSENIXSecuritySymposium(USENIXSecurity12).2012. By 2019, 80% of all network traffic will be encrypted. Are we prepared for handling fully encrypted network traffic? 80% 2019 Encrypted Unencrypted 90% 2020 Encrypted Unencrypted 70% 2018 Encrypted Unencrypted High performance encrypted network traffic inspection using hardware accelerators Eva Papadogiannaki Giorgos Vasiliadis Sotiris Ioannidis FORTH-ICS FORTH-ICS FORTH-ICS This work has been partially supported by the European Commission under the Horizon 2020 Program through the I-BiDaaS project under Grant Agreement 780787. Example applications based on DPI Application domain Firewall, Antivirus Network security Intrusion detection and prevention system Network security Network usage characterization Network analytics Traffic monitoring and classification Network analytics Network optimization Network performance Use of GPUs • Thousands of cores • Highly parallelhardwarearchitecture • Low power consumption • Up to 11GBGDDR6memory • High memorybandwidth (upto 616GB/s) • Inexpensivecommodityhardware Background Internet traffic analysis is commonly based on techniques like deep packet inspection (DPI). The core of traditional DPI implementations is based on pattern matching, that enables searching for specific strings or regular expressions inside the packet content. With the widespread adoption of network encryption, DPI tools that rely on plain text pattern matching become less effective, demanding the development of more sophisticated techniques. Traditional DPI implementations can only extract very coarse grained information for themajority of such traffic. State of the art • Trafficdecryption andinspection • BlindBox [1],Symantec’sETM [2] • Could causeprivacy violations/ Expensiveprocessing • Traffic classification using ML techniques that examine accuracy focusing on packet metadata(e.g. packetsizes, timestamps,direction). • Contietal. [3] • Noreal implementation • Realimplementationof encryptednetworkinspectionsystemsusing packetmetadata. • OTTer [4],Cisco’sETA[5] • Proprietarysource code Our solution Motivation A framework that offers the functionality of a pattern matching engine tailored for packet metadata, such as packet sizes. This framework can be used to build different network related applications, such as firewalls, L7 filtering, or an Intrusion Detection System. The signatures are processed into an automaton. The generation of the automaton is based on the Aho- Corasick algorithm that offers simultaneous multi- pattern matching. The implementation of the automaton is DFA-based and refactored to search for integers. Why Aho-Corasick? • Preprocesses patterns to build a state machine • Simultaneousmultipattern searching • Processes theinputin asingle pass • Pattern searching can be transferred to GPU to achieve high throughput and real timeresults A high-level overview Packet processing and parallelization • Assign one network traffic flow to one thread • Packet batching to hide expensive transfers throughPCIe • Flow hashing to avoidpacketreordering • Filter outpacketretransmissions • Avoid costly packet copies and context switches with the netmap [6] module that operates in the user space (sing