bwNetFlow: A Customizable MultiTenant Flow Processing Platform for Transit Providers In times of increasing bandwidth demands, network operators strive for increased visibility of their networku0027s utilization as well as an indication of the legitimacy of traffic processed across network nodes. Additionally, the detection and mitigation of illegitimate or malicious traffic such as denial of service attacks remains a current and persistently active field of research. Flowbased network monitoring can provide this information live from any network interface. This paper introduces a flow processing platform meant to receive flow information from border interfaces and distribute the acquired information to specialized applications. Transit providers deploying our platform can use this information directly, but also provide all interested customers or network entities with the specific subset concerning them. Between collecting and redistributing the flow information, our platform offers different methods of enrichment using a variety of sources allowing for views superior to plain Netflow records. However, a provided tool can reencode and reexport standard Netflow to ensure compatibility and allow for seamless integration of customerspecific streams into preexisting setups. This platformu0027s components allow the enrichment, division and anonymization of flow data to a number of highly customized streams for any type of application, either on a customerspecific or a networkwide provider level. Applications include the conversion of flow data for timeseries databases and the accompanying dashboards, the detection of DDoS attacks or other hightraffic situation on any network level, the identification of faulty network routing policies, or any other use case conceivable on regular flow data, but within an arbitrary network scope.

Practical Verifiable Innetwork Filtering for DDoS defense In light of everincreasing scale and sophistication of modern DDoS attacks, it is time to revisit innetwork filtering or the idea of empowering DDoS victims to install innetwork traffic filters in the upstream transit networks. Recent proposals show that filtering DDoS traffic at a handful of large transit networks can handle volumetric DDoS attacks effectively. However, the innetwork filtering primitive can also be misused. Transit networks can use the innetwork filtering service as an excuse for any arbitrary packet drops made for their own benefit. For example, transit networks may intentionally execute filtering services poorly or unfairly to discriminate their competing neighbor ASes while claiming that they drop packets for the sake of DDoS defense. We argue that it is due to the lack of verifiable filtering  i.e., no one can check if a transit network executes the filter rules correctly as requested by the DDoS victims. To make innetwork filtering a more robust defense primitive, in this paper, we propose a verifiable innetwork filtering, called VIF, that exploits emerging hardwarebased trusted execution environments (TEEs) and offers filtering verifiability to DDoS victims and neighbor ASes. Our proof of concept demonstrates that a VIF filter implementation on commodity servers with TEE support can handle traffic at line rate (e.g., 10 Gbs) and execute up to 3,000 filter rules. We show that VIF can easily scale to handle larger traffic volume (e.g., 500 Gbs) and more complex filtering operations (e.g., 150,000 filter rules) by parallelizing the TEEbased filters. As a practical deployment model, we suggest that Internet exchange points (IXPs) are the ideal candidates for the early adopters of our verifiable filters due to their central locations and flexible softwaredefined architecture.