SCREAM: Sketch Resource Allocation for Software-defined Measurement

Transcription

1 SCREAM: Sketch Resource Allocation for Software-defined Measurement (CoNEXT 15) Masoud Moshref, Minlan Yu, Ramesh Govindan, Amin Vahdat

2 Measurement is Crucial for Network Management Network Management on multiple tenants: Traffic Anomaly DDoS Engineering Detection detection Accounting Anomaly Detection Need fine-grained visibility of network traffic Measurement tasks: Heavy Hitter detection Heavy hitter detection (HH) Heavy Hitter detection Hierarchical heavy hitter detection (HHH) Change detection Super source detection (SSD) 2

3 Software Defined Measurement Task 1 Task 2 DREAM [SIGCOMM 14] / SCREAM [CoNEXT 15] Controller Configure Collect Switch A Task 1 counters Task 2 counters Switch B Task 1 counters Task 2 counters 3

4 Our Focus: Sketch-based Measurement Summaries of streaming data to approximately answer specific queries E.g., Bitmap for counting unique items Memory OpenFlow Counters DREAM [SIGCOMM 14] Expensive, power-hungry TCAM Sketches SCREAM [CoNEXT 15] Cheaper SRAM Counters Volume counters Volume and Connection counters Flows Selected prefixes All traffic all-the-time Sketches use a cheaper memory and are more expressive 4

5 Sketch Example: Count-Min Sketch At packet arrival: (IP, 1 Kbytes) h1(ip) h2(ip) d h3(ip) 1+1=2 4+1=5 2+1=3 At query: What is the traffic size of IP? = row with min collision = Min(3,5,2) = 2 Resource accuracy trade-off: Provable error bound given traffic properties (e.g., skew) 5

6 Challenges: Limited Counters for Many Tasks Limited shared resources: SRAM capacity (e.g., 128 MB) Shared with other functions (e.g., routing) Too many resources to guarantee accuracy: 1 MB-32 MB per task Less than tasks in SRAM Many task instances: 3 types (Heavy hitter, Hierarchical heavy hitter, Super source) Different flow aggregates (Rack, App, Src/Dst/Port) 1000s of tenants 6

7 Goal: Many Accurate Sketch-based Measurements Users dynamically instantiate a variety of measurement tasks SCREAM supports the largest number of measurement tasks while maintaining measurement accuracy 7

8 Approach: Dynamic Resource Allocation Resource accuracy trade-off depends on traffic Count Min: Provable error bound given traffic properties Ex: Skew of traffic from each IP Required memory Worst-case uses >10x counters than average Skew Dynamic allocation for current traffic 8

9 Opportunity: Temporal Multiplexing Memory requirement varies over time Required Memory Task 1 Task 2 Time Multiplex memory among tasks over time 9

10 Opportunity: Spatial Multiplexing Memory requirement varies across switches Required Memory Task 1 Task 2 Switch A Switch B Multiplex memory among tasks across switches 10

11 Key Insight Leverage spatial and temporal multiplexing and dynamically allocate switch memory per task to achieve sufficient accuracy for many tasks DREAM has the same insight SCREAM applies it for sketches 11

12 SCREAM Contributions 2- Allocate memory among sketch-based task instances across switches while maintaining sufficient accuracy SCREAM Dynamic resource allocator Heavy hitter (HH) tasks Allocation Hierarchical heavy hitter (HHH) tasks Super Source (SSD) tasks 1- Supports 3 sketch-based task types Anomaly detection Traffic engineering DDoS detection 12

13 SCREAM Iterative Workflow Collect & report Counters from many switches Estimate accuracy Accuracy Allocate resources Memory size 13

14 SCREAM Iterative Workflow Collect & report Estimate accuracy Task1 accuracy <80% Allocate resources Give more memory to task1 Accuracy Allocated Memory (KB) Task Task 11 Task Time (s) Task Task 1 Task Task Time (s) 14

15 SCREAM Iterative Workflow Collect & report Merge counters from switches Estimate accuracy Skew of traffic for task2 changes Task2 accuracy <80% Allocate resources Give more memory to task2 Precision Accuracy Allocated Memory (KB) Task 1 Task Time (s) Task 1 Task Time (s) 15

16 SCREAM Challenges Collect & report Network-wide task implementation using sketches Estimate accuracy Accuracy estimation without the ground-truth Allocate resources Fast & Stable allocation in DREAM [SIGCOMM 14]

17 Challenge: Merge Sketches of Different Sizes Switch A Network-wide Task Heavy hitter (HH) Source IPs sending > 10Mbps Switch B d d w1 w2 17

18 SCREAM Solution to Merge Sketches for HH Detection Previous work: Min of sums Min Switch A SCREAM: Sum of mins Min + 30 Switch B Min Both over-approximate smaller is more accurate 18

19 SCREAM Solutions Collect & report Network-wide task implementation using sketches Merge sketches of different sizes for HH, HHH, SSD SSD algorithm with higher and more stable accuracy Estimate accuracy Accuracy estimation without the ground-truth Allocate resources Fast & Stable allocation in DREAM [SIGCOMM 14]

20 Precision Estimation for Heavy Hitter Detection True detected HH Precision = = Sum(P[Detected HH is true]) Detected HHs Insight: Relate probability to Error on counters of detected HHs Estimate-Threshold Threshold Error Estimate-Threshold True HH False HH Estimated Real P[Detected HH is true] = 1 - P[Error Estimate-Threshold] 20

21 Precision Estimation Step 1: Find a Bound on The Error P[Detected HH is true] = 1 - P[Error Estimate-Threshold] Insight: Relate probability to Error on counters of detected HHs Idea 1: Use average Error in Markov s inequality to bound it Idea 1 21

22 Precision Estimation Step 2: Improve The Bound Idea 2 Idea 1 A row in Count-Min: Insight: Average Error = heavy items collision + small items collision Counter indices of detected HHs show heavy collisions Idea 2: Markov s inequality only for small items 22

23 SCREAM Solutions Collect & report Network-wide task implementation using sketches Merge sketches of different sizes for HH, HHH, SSD SSD algorithm with higher and more stable accuracy Estimate accuracy Accuracy estimation without the ground-truth Precision estimators for HH, HHH and SSD tasks Allocate resources Fast & Stable allocation in DREAM [SIGCOMM 14]

24 Evaluation Metrics: Satisfaction of a task: Fraction of task s lifetime with sufficient accuracy % of rejected tasks Alternatives: OpenSketch: Allocate for bounded error for worst-case traffic at task instantiation (test with different bounds) Oracle: Knows required resource for a task in each switch in advance 24

25 Evaluation Setting Simulation for 8 switches: 256 task instances (HH, HHH, SSD, combination) Accuracy bound = 80% 5 min tasks arriving in 20 minutes 2 hours CAIDA trace 25

26 SCREAM Provides High Accuracy for More Tasks SCREAM: High satisfaction and low reject Average Satisfaction OS_10 OS_50 20 OS_90 SCREAM Switch capacity (KB) Rejected tasks (%) OS_10 OS_50 OS_90 SCREAM Switch capacity (KB) OpenSketch: Loose bound Under provision low satisfaction Tight bound Over provision high reject 26

27 SCREAM s Performance Is Close to An Oracle Average Satisfaction Oracle SCREAM Switch capacity (KB) Rejected tasks (%) Oracle SCREAM Switch capacity (KB) SCREAM performance is close to an oracle, its satisfaction is a bit lower because: Iterative allocation takes time Accuracy estimation has error 27

28 Other Evaluations Changing traffic skew SCREAM supports more accurate tasks than OpenSketch Accuracy estimation error SCREAM accuracy estimation has 5% error in average Other accuracy metrics Tasks in SCREAM have high recall (low false negative) 28

29 Conclusion Measurement is crucial for SDN management in a resource-constrained environment Practical sketch-based SDM by dynamic memory allocation Implementing network-wide tasks using sketches Estimating accuracy for 3 types of tasks SCREAM is available at github.com/usc-nsl/scream 29

30 Thanks! Questions? 30