Deployment of Real-Time Network Traffic Analysis using GraphBLAS Hypersparse Matrices and D4M Associative Arrays
arXiv:2309.02464 · doi:10.1109/HPEC58863.2023.10363581
Abstract
Matrix/array analysis of networks can provide significant insight into their behavior and aid in their operation and protection. Prior work has demonstrated the analytic, performance, and compression capabilities of GraphBLAS (graphblas.org) hypersparse matrices and D4M (d4m.mit.edu) associative arrays (a mathematical superset of matrices). Obtaining the benefits of these capabilities requires integrating them into operational systems, which comes with its own unique challenges. This paper describes two examples of real-time operational implementations. First, is an operational GraphBLAS implementation that constructs anonymized hypersparse matrices on a high-bandwidth network tap. Second, is an operational D4M implementation that analyzes daily cloud gateway logs. The architectures of these implementations are presented. Detailed measurements of the resources and the performance are collected and analyzed. The implementations are capable of meeting their operational requirements using modest computational resources (a couple of processing cores). GraphBLAS is well-suited for low-level analysis of high-bandwidth connections with relatively structured network data. D4M is well-suited for higher-level analysis of more unstructured data. This work demonstrates that these technologies can be implemented in operational settings.
arXiv commentAccepted to IEEE HPEC, 8 pages, 8 figures, 1 table, 69 references. arXiv admin note: text overlap with arXiv:2203.13934. text overlap with arXiv:2309.01806
References in corpus (13)
- Community Structure in Time-Dependent, Multiscale, and Multiplex Networks
- Hypersparse Neural Network Analysis of Large-Scale Internet Traffic
- Spatial Temporal Analysis of 40,000,000,000,000 Internet Darkspace Packets
- Julia Implementation of the Dynamic Distributed Dimensional Data Model
- Multi-Temporal Analysis and Scaling Relations of 100,000,000,000 Network Packets
- GraphBLAS on the Edge: Anonymized High Performance Streaming of Network Traffic
- Zero Botnets: An Observe-Pursue-Counter Approach
- Essentials of Parallel Graph Analytics
- Large Scale Enrichment and Statistical Cyber Characterization of Network Traffic (Enriquecimiento a gran escala y caracterización cibernética estadística del tráfico de red)
- Vertical, Temporal, and Horizontal Scaling of Hierarchical Hypersparse GraphBLAS Matrices
- Effective implementation of the High Performance Conjugate Gradient benchmark on GraphBLAS
- Database Operations in D4M.jl
- Python Implementation of the Dynamic Distributed Dimensional Data Model