Distributed Traffic Replay System for Network Emulation

doi:10.3778/j.issn.1002-8331.2302-0025

Abstract

Abstract: Traffic replay can effectively improve the fidelity of network emulation and support emerging network verification and network security evaluation. A distributed traffic replay system based on cloud platform is designed for large-scale, high-speed and highly concurrent network traffic emulation, named DTRS. Aiming at the diverse network traffic, a scalable multi-stream replay method is proposed to realize the flexible reproduction of multiple protocol traffic. A traffic replay strategy based on DPDK is proposed to achieve accurate control of the replay process and improve the timing fidelity of replay. To solve the problem of insufficient traffic replay speed, a vector packet processing strategy based on VPP is proposed to improve the throughput. The experimental results show that DTRS can realize the scalable loading of diverse network traffic, and support the flexible, realistic and controllable reproduction of massive heterogeneous network scenarios. In high-speed traffic emulation, DTRS can ensure the timing fidelity of replay. Compared with traditional methods, the traffic replay throughput of DTRS has increased by 3.71 times.

Key words: traffic replay, network emulation, fidelity, high-speed

摘要： 流量回放可有效提升网络仿真的逼真度并支持新兴网络与安全技术的评测。面向大规模、高并发、高速率网络流量仿真的需求，设计并实现了一种基于云平台的分布式流量回放系统DTRS（distributed traffic replay system based on cloud platform）。基于该系统，针对网络流量多样化的特点，提出了可扩展的多流回放方法，以实现多种协议流量按需组合、灵活复现；针对数据包流转的高开销问题，提出了基于DPDK（data plane development kit）的流量回放策略，以实现流量回放过程的精确控制，提升回放的时序逼真性；针对流量回放速率不足的问题，提出了基于VPP（vector packet processing）的矢量包处理策略，提升了回放的吞吐量。实验结果表明，DTRS能实现互联网流量的多样化、可扩展加载，支持灵活、逼真、可控地复现海量异构网络场景；在高速率的流量仿真中，DTRS能保证时序逼真性；相较于传统方法，DTRS的流量回放吞吐量提升了3.71倍。

关键词: 流量回放, 网络仿真, 逼真性, 高速率

YE Haibo, LI Zhigang, HUANG Xiao, WANG Xiaofeng, LIU Yuan. Distributed Traffic Replay System for Network Emulation[J]. Computer Engineering and Applications, 2024, 60(12): 261-269.

叶海波, 李志刚, 黄骁, 王晓锋, 刘渊. 面向网络仿真的分布式流量回放系统[J]. 计算机工程与应用, 2024, 60(12): 261-269.

References

[1] 方滨兴, 贾焰, 李爱平, 等. 网络空间靶场技术研究[J]. 信息安全学报, 2016, 1(3): 1-9.
FANG B X, JIA Y, LI A P, et al. Cyber ranges: state-of-the-art and research challenges[J]. Journal of Cyber Security, 2016, 1(3): 1-9.
[2] 李馥娟, 王群. 网络靶场及其关键技术研究[J]. 计算机工程与应用, 2022, 58(5): 12-22.
LI F J, WANG Q. Research on cyber ranges and its key technologies[J]. Computer Engineering and Applications, 2022, 58(5): 12-22.
[3] 符永铨, 赵辉, 王晓锋, 等. 网络行为仿真综述[J]. 软件学报, 2022, 33(1): 274-296.
FU Y Q, ZHAO H, WANG X F, et al. State-of-the-art survey on network behavior emulation[J]. Journal of Software, 2022, 33(1): 274-296.
[4] ERAZO M A, LIU J. Leveraging symbiotic relationship between simulation and emulation for scalable network experimentation[C]//Proceedings of the 1st ACM SIGSIM Conference on Principles of Advanced Discrete Simulation, 2013: 79-90.
[5] 茹新宇, 刘渊. 网络仿真器NS3的剖析与探究[J]. 计算机技术与发展, 2018, 28(3): 72-77.
RU X Y, LIU Y. Analysis and research on network simulator 3[J]. Computer Technology and Development, 2018, 28(3): 72-77.
[6] 张磊. 基于OPNET的智慧家庭异构网络的仿真研究[D]. 北京: 北京邮电大学, 2019.
ZHANG L. Opnet based simulation research on heterogeneous network for smart-home[D]. Beijing: Beijing University of Posts and Telecommunications, 2019.
[7] FELTER W, FERREIRA A, RAJAMONY R, et al. An updated performance comparison of virtual machines and linux containers[C]//2015 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS), 2015: 171-172.
[8] 李春艳, 张学杰. 基于高性能计算的开源云平台性能评估[J]. 计算机应用, 2013, 33(12): 3580-3585.
LI C Y, ZHANG X J. Performance evaluation on open source cloud platform for high performance computing[J]. Journal of Computer Applications, 2013, 33(12): 3580-3585.
[9] ADELEKE O A, BASTIN N, GURKAN D. Network traffic generation: a survey and methodology[J]. ACM Computing Surveys (CSUR), 2022, 55(2): 1-23.
[10] 温晗, 刘渊, 王晓锋, 等. 面向天地一体化信息网络的恶意用户行为仿真技术[J]. 小型微型计算机系统, 2019, 40(8): 1658-1665.
WEN H, LIU Y, WANG X F, et al. Malicious user behavior emulation technology for space-ground integrated network[J]. Journal of Chinese Computer Systems, 2019, 40(8): 1658-1665.
[11] 杨天泽. Http流量回放系统的设计与实现[D]. 杭州: 浙江大学, 2021.
YANG T Z. Design and implementation of Http traffic replay system[D]. Hangzhou: Zhejiang University, 2021.
[12] LI L, HAO Z. Traffic replay in virtual network based on IP-mapping[C]//15th International Conference on Algorithms and Architectures for Parallel Processing (ICA3PP 2015). [S.l.]: Springer International Publishing, 2015: 697-713.
[13] LIU H, AN L, REN J, et al. An interactive traffic replay method in a scaled-down environment[J]. IEEE Access, 2019, 7: 149373-149386.
[14] 黄宁, 刘渊, 王晓锋. 基于交互式流量回放的用户行为仿真技术[J]. 计算机工程, 2021, 47(10): 103-110.
HUANG N, LIU Y, WANG X F. User behavior emulation technology based on interactive traffic replay[J]. Computer Engineering, 2021, 47(10): 103-110.
[15] PFAFF B, PETTIT J, KOPONEN T, et al. The design and implementation of open {vSwitch}[C]//12th USENIX Symposium on Networked Systems Design and Implementation (NSDI 15), 2015: 117-130.
[16] DERI L, FUSCO F. Using deep packet inspection in cyber traffic analysis[C]//2021 IEEE International Conference on Cyber Security and Resilience (CSR), 2021: 89-94.
[17] YANG Z, HARRIS J R, WALKER B, et al. SPDK: a development kit to build high performance storage applications[C]//2017 IEEE International Conference on Cloud Computing Technology and Science (CloudCom), 2017: 154-161.
[18] MASUMI K, HAN C, BAN T, et al. Towards efficient labeling if network incident datasets using tcpreplay and snort[C]//Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, 2021: 329-331.
[19] ZHANG J, FENG D, GAO J, et al. Application-aware and software-defined SSD scheme for Tencent large-scale storage system[C]//2016 22nd International Conference on Parallel and Distributed Systems, 2016: 482-490.
[20] CERRATO I, ANNARUMMA M. Supporting fine-grained network functions through Intel DPDK[C]//2014 Third European Workshop on Software Defined Networks, 2014: 1-6.
[21] SHI J, PESACENTO D. NDN-DPDK: NDN forwarding at 100 Gbps on commodity hardware[C]//7th ACM Conference on Information-Centric Networking, 2020: 30-40.
[22] 潘恬, 林兴晨, 张娇, 等. 基于高性能包处理架构VPP的带内网络遥测系统[J]. 通信学报, 2021, 42(3): 75-90.
PAN T, LIN X C, ZHANG J, et al. In-band network telemetry system based on high-performance packet processing architecture VPP[J]. Journal on Communications, 2021, 42(3): 75-90.
[23] OKELMANN P, LINGUAGLOSSA L, GEYER F, et al. Adaptive batching for fast packet processing in software routers using machine learning[C]//7th International Conference on Network Softwarization, 2021: 206-210.
[24] LASHKARI A, KADIR A. Toward developing a systematic approach to generate benchmark android malware datasets and classification[C]//2018 International Carnahan Conference on Security Technology (ICCST), 2018: 1-7.