Gregorio Procissi

Applications in virtual machines (VMs) rely on the guest Operating System (OS), which views only virtualized hardware, creating a semantic gap between this abstraction and the real execution managed by the hypervisor and host OS. Existing paravirtualization techniques bridge this gap through service-specific solutions, but implementing and extending these solutions can require changes to guest kernel components and host-side support, such as adding new hypercalls. We present a generic framework combining one-time paravirtualization during deployment with host-injected extended Berkeley Packet Filter (eBPF) programs, allowing different services to reuse the same guest infrastructure. After this initial setup, new services can be introduced by supplying additional eBPF programs, without modifying the shared guest infrastructure. Our prototype demonstrates how the same framework supports CPU pinning, dynamic memory expansion, and firewall offloading. In the evaluated benchmarks, these services achieve approximately 3.4-fold throughput with hyperthread-aware CPU pinning compared with execution without this mechanism and approximately 2.7-fold speedup with dynamic memory expansion compared with a fixed-memory configuration that resorts to swapping. Firewall offloading preserves legitimate traffic under a denial-of-service attack that prevents communication with guest-side filtering. These results demonstrate the framework’s applicability across different services; the contribution lies in their implementation through a common, extensible infrastructure.

Atmospheric compensation (AC) allows the retrieval of the reflectance from the measured at-sensor radiance and is a fundamental and critical task for the quantitative exploitation of hyperspectral data. Recently, a learning-based (LB) approach, named LBAC, has been proposed for the AC of airborne hyperspectral data in the visible and near-infrared (VNIR) spectral range. LBAC makes use of a parametric regression function whose parameters are learned by a strategy based on synthetic data that accounts for (1) a physics-based model for the radiative transfer, (2) the variability of the surface reflectance spectra, and (3) the effects of random noise and spectral miscalibration errors. In this work we extend LBAC with respect to two different aspects: (1) the platform for data acquisition and (2) the spectral range covered by the sensor. Particularly, we propose the extension of LBAC to spaceborne hyperspectral sensors operating in the VNIR and short-wave infrared (SWIR) portion of the electromagnetic spectrum. We specifically refer to the sensor of the PRISMA (PRecursore IperSpettrale della Missione Applicativa) mission, and the recent Earth Observation mission of the Italian Space Agency that offers a great opportunity to improve the knowledge on the scientific and commercial applications of spaceborne hyperspectral data. In addition, we introduce a curve fitting-based procedure for the estimation of column water vapor content of the atmosphere that directly exploits the reflectance data provided by LBAC. Results obtained on four different PRISMA hyperspectral images are presented and discussed.

One of the most challenging tasks for network operators is implementing accurate per-packet monitoring, looking for signs of performance degradation, security threats, and so on. Upon critical event detection, corrective actions must be taken to keep the network running smoothly. Implementing this mechanism requires the analysis of packet streams in a real-time (or close to) fashion. In a softwarized network context, Stream Processing Systems (SPSs) can be adopted for this purpose. Recent solutions based on traditional SPSs, such as Storm and Flink, can support the definition of general complex queries, but they show poor performance at scale. To handle input data rates in the order of gigabits per seconds, programmable switch platforms are typically used, although they offer limited expressiveness. With the proposed approach, we intend to offer high performance and expressive power in a unified framework by solely relying on SPSs for multicores. Captured packets are translated into a proper tuple format, and network monitoring queries are applied to tuple streams. Packet analysis tasks are expressed as streaming pipelines, running on general-purpose programmable network devices, and a second stage of elaboration can process aggregated statistics from different devices. Experiments carried out with an example monitoring application show that the system is able to handle realistic traffic at a 10 Gb/s speed. The same application scales almost up to 20 Gb/s speed thanks to the simple optimizations of the underlying framework. Hence, the approach proves to be viable and calls for the investigation of more extensive optimizations to support more complex elaborations and higher data rates.

The current trend characterizing new generation networks is to accommodate a variety of services on the same shared infrastructure. In this context, two main aspects are vital for network operators. On one hand, there is the need for proper mechanisms to rapidly and easily (re-)configure the network, to adapt to its changing conditions over time. On the other hand, applications for continuous network monitoring become essential to detect security problems or performance degradation. This is fundamental to guarantee the Quality of Service (QoS) requirements for every running service. This paper aims at proposing a new framework for the implementation of fast and scalable applications for real-time continuous network monitoring and data analysis. High-level abstractions will be provided to the network programmer, and the Data Stream Processing computational model will be exploited to improve performance. The framework architecture is described, along with the implementation design for this kind of applications. The main challenges are presented, with proposed solutions to tackle them. Finally, the current status of the work is discussed, along with its future developments.

The maturity level reached by today’s commodity platforms makes even low-cost PCs viable alternatives to dedicated hardware to implement real network functions without sacrificing performance. Indeed, the availability of multi-core processing packages and multi-queue network interfaces that can be managed by accelerated I/O frameworks, provides off-the-shelf servers with the necessary power capability for running a broad variety of network applications with near hardware-class performance. At the same time, the introduction of the Software Defined Networks (SDN) and the Network Functions Virtualization (NFV) paradigms call for new programming abstractions and tools to allow this new class of network devices to be flexibly configured and functionally repurposed from the network control plane. The paper presents the ongoing work towards Enif-Lang (Enhanced Network processIng Functional Language), a functional language for programming network functions over generic middleboxes running the Linux operating system. The language addresses concurrent programming by design and is targeted at developing simple stand-alone applications as well as pre-processing stages of packet elaborations. Enif-Lang is implemented as a Domain Specific Language embedded in the Haskell language and inherits the main principles of its ancestor, including the strong typedness and the concept of function compositions. Complex network functions are implemented by composing a set of elementary operations (primitives) by means of a compact yet expressive language grammar. Throughout the paper, the description of the design principles and features of Enif-Lang are accompanied by examples and use cases. In addition, a preliminary performance assessment is carried out to prove the effectiveness of the language for developing practical applications with the performance level required by 5G systems and the Tactile Internet.

The large availability of multi–gigabit network cards for commodity PCs requires network applications to potentially cope with high volumes of traffic. However, computation intensive operations may not catch up with high traffic rates and need to be run in parallel over multiple processing cores. As of today, the vast majority of network applications – e.g. monitoring and IDS systems – are still based on the pcap library interface which, unfortunately, does not provide the native multi–core support, even though the current underlying capture technologies do. This paper introduces a novel version of the pcap library for the Linux operating system that enables transparent application level parallelism. The new library supports fan–out operations for both multi–threaded and multi–process applications, by means of extended API as well as by a declarative grammar for configuration files, suitable for legacy applications. In addition, the library can transparently run on top of the standard Linux socket as well as on other accelerated active engines. Performance evaluation has been carried out on a multi–core architecture in pure capture tests and in more realistic use cases involving monitoring applications such as Tstat and Bro, with standard Linux socket as well as PF_RING and PFQ accelerated engines.

The fifth generation (5G) of cellular networks promises to be a major step in the evolution of wireless technology. 5G is planned to be used in a very broad set of application scenarios. These scenarios have strict heterogeneous requirements that will be accomplished by enhancements on the radio access network and a collection of innovative wireless technologies. Softwarization technologies, such as Software‐Defined Networking (SDN) and Network Function Virtualization (NFV), will play a key role in integrating these different technologies. Network slicing emerges as a cost‐efficient solution for the implementation of the diverse 5G requirements and verticals. The 5G radio access and core networks will be based on a SDN/NFV infrastructure, which will be able to orchestrate the resources and control the network in order to efficiently and flexibly and with scalability provide network services. In this paper, we present the up‐to‐date status of the software‐defined 5G radio access and core networks and a broad range of future research challenges on the orchestration and control aspects.

This letter proposes an analytical model to evaluate the collision probability on the Random-Access CHannel (RACH) in Long-Term Evolution systems as a function of the number of user equipment, the number of available preambles, and the Inter-arrival times of the RACH Requests (IRRs) of the average user. The model for the IRR of the average user is obtained from real traffic data captured at the eNodeB of a mobile operator, and is derived by emulating the radio resource control (RRC) state machine for different RRCs Inactivity timer (RRCIT) settings. The results of this letter suggest that when RRCIT is set to a few seconds, a mixture model is more accurate than the Poisson hypothesis both in modeling the IRR and in estimating the RACH performance.

Smart grids are electricity networks that can intelligently integrate the action of all connected users - producers, consumers, and prosumers (i.e., producers and consumers at the same time) - in order to efficiently deliver sustainable, economic and secure electricity supplies. Smart grids rely on a two-way communication infrastructures in which energy measurement data taken at users located smart meters, as well as control information, must be exchanged in real-time or - at least - near real-time, while simultaneously guaranteeing a secure and privacy preserving communication. This paper addresses such a problem by presenting a distributed communication architecture that guarantees the privacy of fine-grained users data while enabling the energy supplier to access aggregate energy measurements and per-user coarse-grained data for billing purposes. The key idea underlying the proposed architecture is to adopt a secure multiparty computation method based on a verifiable secret sharing of the keys used by the smart meters to encrypt their sensitive data. This approach allows to remove the need for any intermediate aggregator element with clear benefits in terms of scalability and robustness.