Event-driven Principles and Complex Event Processing for Self-adaptive Network Analysis and Surveillance Systems

Event-driven approaches and Complex Event Processing (CEP) have the potential to aid in tackling the complex requirements and challenges of monitoring contemporary computer networks. The applicability of such methods, however, depends on, e.g., architectural considerations, data processing performance, or usability. In this thesis, we study the applicability of event-driven principles and CEP for analyzing and surveying computer networks and present ways for improving the applicability of these paradigms. The main contributions that are presented and discussed in this thesis are: an analysis of important properties of network analysis and surveillance, the introduction of a corresponding Event-driven Architecture (EDA) for addressing these requirements, the empirical evaluation of the proposed EDA using a prototype implementation, the development of cooperative and self-adaptive methods for addressing performance and usability issues, and the development of techniques for improving the integration of components implemented in different languages in event-driven systems. Assuring and maintaining the proper operation of computer networks is as crucial as assuring the proper operation of the Information Technology (IT) systems they connect. However, collecting and analyzing information about computer networks, which is required for assuring their proper operation, is increasingly challenging because of, e.g., the growing logical and spatial extent of computer networks, accelerated changes in computer network structures and network traffic, or near real-time requirements. Furthermore, a wide variety of methods for network analysis and surveillance exists and for acquiring comprehensive information at optimal resource requirements these various methods have to be combined with a converging approach. Based on the results of an analysis of important properties and requirements for network analysis and surveillance, we propose an approach which leverages event-driven paradigms such as EDA and CEP for addressing the complex mix of requirements in this field and for enabling convergence of the various existing methods. We evaluate our proposed approach with a case study and performance benchmarks using a prototype. Our results show that our approach is a good fit for addressing the complex mix of requirements and that it is feasible from a performance perspective. In contrast to other related recent research, which is limited to specific use cases, we propose a generic and versatile event-driven approach for universal network analysis and surveillance. Moreover, we present techniques for further improving network analysis and surveillance. While our general approach already constitutes an important improvement, we also propose and investigate further innovations. Based on the evaluation of our approach, we consider distributed operation, usability, performance in distributed deployments and of sensors, integration of data sources, and the interoperation of implementations in different programming languages in event-driven systems as most important aspects for further improvement. For improving the operation, usability, and performance in distributed contexts, we develop an approach for cooperative and self-adaptive data acquisition using the example of packet capturing. In order to research ways for advancing the operation of sensors and integration of data sources, we use the example of packet capturing with the Java Virtual Machine (JVM), for which we develop and analyze various improvements at various abstraction levels such as data extraction via a Domain Specific Language (DSL) or self-adaptive adjustments based on performance constraints. Even though packet capturing with the JVM was already employed in other research, these studies only consider the overall systems such that neither the specific implications of JVM-based packet capturing nor methods for improving the performance in this scenario were discussed in detail yet. Furthermore, we analyze the impact of programming language barriers in event-driven systems and present a batch-based approach for increasing the data exchange throughput. In conclusion, we improve the state-of-the-art of network analysis and surveillance. Our work aims on taking the next step towards holistic network analysis and surveillance by addressing distribution, convergence, usability, and performance aspects. We demonstrate the benefits and evaluate the applicability of event-driven data processing paradigms and show how self-adaptivity and cooperation can further improve the capabilities

A Comprehensive Experimental Comparison of Event Driven and Multi-Threaded Sensor Node Operating Systems

The capabilities of a sensor network are strongly influenced by the operating system used on the sensor nodes. In general, two different sensor network operating system types are currently considered: event driven and multi-threaded. It is commonly assumed that event driven operating systems are more suited to sensor networks as they use less memory and processing resources. However, if factors other than resource usage are considered important, a multi-threaded system might be preferred. This paper compares the resource needs of multi-threaded and event driven sensor network operating systems. The resources considered are memory usage and power consumption. Additionally, the event handling capabilities of event driven and multi-threaded operating systems are analyzed and compared. The results presented in this paper show that for a number of application areas a thread-based sensor network operating system is feasible and preferable

Event-Driven Network Programming

Software-defined networking (SDN) programs must simultaneously describe static forwarding behavior and dynamic updates in response to events. Event-driven updates are critical to get right, but difficult to implement correctly due to the high degree of concurrency in networks. Existing SDN platforms offer weak guarantees that can break application invariants, leading to problems such as dropped packets, degraded performance, security violations, etc. This paper introduces EVENT-DRIVEN CONSISTENT UPDATES that are guaranteed to preserve well-defined behaviors when transitioning between configurations in response to events. We propose NETWORK EVENT STRUCTURES (NESs) to model constraints on updates, such as which events can be enabled simultaneously and causal dependencies between events. We define an extension of the NetKAT language with mutable state, give semantics to stateful programs using NESs, and discuss provably-correct strategies for implementing NESs in SDNs. Finally, we evaluate our approach empirically, demonstrating that it gives well-defined consistency guarantees while avoiding expensive synchronization and packet buffering

MorphIC: A 65-nm 738k-Synapse/mm2^2 Quad-Core Binary-Weight Digital Neuromorphic Processor with Stochastic Spike-Driven Online Learning

Recent trends in the field of neural network accelerators investigate weight quantization as a means to increase the resource- and power-efficiency of hardware devices. As full on-chip weight storage is necessary to avoid the high energy cost of off-chip memory accesses, memory reduction requirements for weight storage pushed toward the use of binary weights, which were demonstrated to have a limited accuracy reduction on many applications when quantization-aware training techniques are used. In parallel, spiking neural network (SNN) architectures are explored to further reduce power when processing sparse event-based data streams, while on-chip spike-based online learning appears as a key feature for applications constrained in power and resources during the training phase. However, designing power- and area-efficient spiking neural networks still requires the development of specific techniques in order to leverage on-chip online learning on binary weights without compromising the synapse density. In this work, we demonstrate MorphIC, a quad-core binary-weight digital neuromorphic processor embedding a stochastic version of the spike-driven synaptic plasticity (S-SDSP) learning rule and a hierarchical routing fabric for large-scale chip interconnection. The MorphIC SNN processor embeds a total of 2k leaky integrate-and-fire (LIF) neurons and more than two million plastic synapses for an active silicon area of 2.86mm$^2$ in 65nm CMOS, achieving a high density of 738k synapses/mm$^2$. MorphIC demonstrates an order-of-magnitude improvement in the area-accuracy tradeoff on the MNIST classification task compared to previously-proposed SNNs, while having no penalty in the energy-accuracy tradeoff.Comment: This document is the paper as accepted for publication in the IEEE Transactions on Biomedical Circuits and Systems journal (2019), the fully-edited paper is available at https://ieeexplore.ieee.org/document/876400

Real-time detection of grid bulk transfer traffic

The current practice of physical science research has yielded a continuously growing demand for interconnection network bandwidth to support the sharing of large datasets. Academic research networks and internet service providers have provisioned their networks to handle this type of load, which generates prolonged, high-volume traffic between nodes on the network. Maintenance of QoS for all network users demands that the onset of these (Grid bulk) transfers be detected to enable them to be reengineered through resources specifically provisioned to handle this type of traffic. This paper describes a real-time detector that operates at full-line-rate on Gb/s links, operates at high connection rates, and can track the use of ephemeral or non-standard ports

When Should I Use Network Emulation?

The design and development of a complex system requires an adequate methodology and efficient instrumental support in order to early detect and correct anomalies in the functional and non-functional properties of the tested protocols. Among the various tools used to provide experimental support for such developments, network emulation relies on real-time production of impairments on real traffic according to a communication model, either realistically or not. This paper aims at simply presenting to newcomers in network emulation (students, engineers, ...) basic principles and practices illustrated with a few commonly used tools. The motivation behind is to fill a gap in terms of introductory and pragmatic papers in this domain. The study particularly considers centralized approaches, allowing cheap and easy implementation in the context of research labs or industrial developments. In addition, an architectural model for emulation systems is proposed, defining three complementary levels, namely hardware, impairment and model levels. With the help of this architectural framework, various existing tools are situated and described. Various approaches for modeling the emulation actions are studied, such as impairment-based scenarios and virtual architectures, real-time discrete simulation and trace-based systems. Those modeling approaches are described and compared in terms of services and we study their ability to respond to various designer needs to assess when emulation is needed

When should I use network emulation ?

The design and development of a complex system requires an adequate methodology and efficient instrumental support in order to early detect and correct anomalies in the functional and non-functional properties of the tested protocols. Among the various tools used to provide experimental support for such developments, network emulation relies on real-time production of impairments on real traffic according to a communication model, either realistically or not. This paper aims at simply presenting to newcomers in network emulation (students, engineers, ...) basic principles and practices illustrated with a few commonly used tools. The motivation behind is to fill a gap in terms of introductory and pragmatic papers in this domain. The study particularly considers centralized approaches, allowing cheap and easy implementation in the context of research labs or industrial developments. In addition, an architectural model for emulation systems is proposed, defining three complementary levels, namely hardware, impairment and model levels. With the help of this architectural framework, various existing tools are situated and described. Various approaches for modeling the emulation actions are studied, such as impairment-based scenarios and virtual architectures, real-time discrete simulation and trace-based systems. Those modeling approaches are described and compared in terms of services and we study their ability to respond to various designer needs to assess when emulation is needed

Predictive Duty Cycle Adaptation for Wireless Camera Networks

Wireless sensor networks (WSN) typically employ dynamic duty cycle schemes to efficiently handle different patterns of communication traffic in the network. However, existing duty cycling approaches are not suitable for event-driven WSN, in particular, camera-based networks designed to track humans and objects. A characteristic feature of such networks is the spatially-correlated bursty traffic that occurs in the vicinity of potentially highly mobile objects. In this paper, we propose a concept of indirect sensing in the MAC layer of a wireless camera network and an active duty cycle adaptation scheme based on Kalman filter that continuously predicts and updates the location of the object that triggers bursty communication traffic in the network. This prediction allows the camera nodes to alter their communication protocol parameters prior to the actual increase in the communication traffic. Our simulations demonstrate that our active adaptation strategy outperforms TMAC not only in terms of energy efficiency and communication latency, but also in terms of TIBPEA, a QoS metric for event-driven WSN

P4CEP: Towards In-Network Complex Event Processing

In-network computing using programmable networking hardware is a strong trend in networking that promises to reduce latency and consumption of server resources through offloading to network elements (programmable switches and smart NICs). In particular, the data plane programming language P4 together with powerful P4 networking hardware has spawned projects offloading services into the network, e.g., consensus services or caching services. In this paper, we present a novel case for in-network computing, namely, Complex Event Processing (CEP). CEP processes streams of basic events, e.g., stemming from networked sensors, into meaningful complex events. Traditionally, CEP processing has been performed on servers or overlay networks. However, we argue in this paper that CEP is a good candidate for in-network computing along the communication path avoiding detouring streams to distant servers to minimize communication latency while also exploiting processing capabilities of novel networking hardware. We show that it is feasible to express CEP operations in P4 and also present a tool to compile CEP operations, formulated in our P4CEP rule specification language, to P4 code. Moreover, we identify challenges and problems that we have encountered to show future research directions for implementing full-fledged in-network CEP systems.Comment: 6 pages. Author's versio

Design of a WSN Platform for Long-Term Environmental Monitoring for IoT Applications

The Internet of Things (IoT) provides a virtual view, via the Internet Protocol, to a huge variety of real life objects, ranging from a car, to a teacup, to a building, to trees in a forest. Its appeal is the ubiquitous generalized access to the status and location of any "thing" we may be interested in. Wireless sensor networks (WSN) are well suited for long-term environmental data acquisition for IoT representation. This paper presents the functional design and implementation of a complete WSN platform that can be used for a range of long-term environmental monitoring IoT applications. The application requirements for low cost, high number of sensors, fast deployment, long lifetime, low maintenance, and high quality of service are considered in the specification and design of the platform and of all its components. Low-effort platform reuse is also considered starting from the specifications and at all design levels for a wide array of related monitoring application