D-STREAMON - a NFV-capable distributed framework for network monitoring

TL;DR

This paper introduces D-StreaMon, an NFV-capable distributed framework for network monitoring designed to handle complex, large-scale traffic and strict latency requirements, leveraging virtualization for improved flexibility and efficiency.

Contribution

It presents the design, implementation, and performance evaluation of D-StreaMon, migrating the StreaMon platform to NFV environments for enhanced network monitoring capabilities.

Findings

D-StreaMon effectively monitors large-scale network traffic.

NFV migration improves flexibility and deployment speed.

Performance evaluation shows promising results for NFV-based monitoring.

Abstract

Many reasons make NFV an attractive paradigm for IT security: lowers costs, agile operations and better isolation as well as fast security updates, improved incident responses and better level of automation. At the same time, the network threats tend to be increasingly complex and distributed, implying huge traffic scale to be monitored and increasingly strict mitigation delay requirements. Considering the current trend of the networking and the requirements to counteract to the evolution of cyber-threats, it is expected that also network monitoring will move towards NFV based solutions. In this paper, we present Distributed StreaMon (D-StreaMon) an NFV-capable distributed framework for network monitoring. D-StreaMon has been designed to face the above described challenges. It relies on the StreaMon platform, a solution for network monitoring originally designed for traditional middleboxes. An evolution path which migrates StreaMon from middleboxes to Virtual Network Functions (VNFs) is described. The paper reports a performance evaluation of the realized NFV based solution and discusses potential benefits in monitoring tenants' VMs for Service Providers.