Evaluating Accumulo Performance for a Scalable Cyber Data Processing Pipeline

TL;DR

This paper evaluates the scalability and performance of Apache Accumulo in a cyber data processing pipeline, focusing on data ingestion, query responsiveness, and system scalability with real cyber data.

Contribution

It provides an empirical assessment of Accumulo's ingestion and query performance in a scalable cyber data warehousing context, with techniques for effective query planning.

Findings

Accumulo scales well with increased client processes and servers.

Query latency remains responsive with up to 8 nodes using real cyber data.

Effective data modeling and batching improve query response times.

Abstract

Streaming, big data applications face challenges in creating scalable data flow pipelines, in which multiple data streams must be collected, stored, queried, and analyzed. These data sources are characterized by their volume (in terms of dataset size), velocity (in terms of data rates), and variety (in terms of fields and types). For many applications, distributed NoSQL databases are effective alternatives to traditional relational database management systems. This paper considers a cyber situational awareness system that uses the Apache Accumulo database to provide scalable data warehousing, real-time data ingest, and responsive querying for human users and analytic algorithms. We evaluate Accumulo's ingestion scalability as a function of number of client processes and servers. We also describe a flexible data model with effective techniques for query planning and query batching to deliver responsive results. Query performance is evaluated in terms of latency of the client receiving initial result sets. Accumulo performance is measured on a database of up to 8 nodes using real cyber data.