AI 中文总结
XNET是基于Linux XDP技术的智能动态采样系统，可在商用硬件上实现100Gbps线速安全监控，能缩减84%流量且无丢包，将低价值流量可见性提5倍，IDS检测率达99.6%。
AI 中文摘要
现代企业网络中100GbE线速已很普及，不断提升的网络速率给运维人员和安全应用带来挑战，它们需在不依赖昂贵硬件、过度采样或复杂分布式部署的前提下，相应提升运行效率。随机数据包采样导致的无意丢包常产生低质量流量，进一步增加了漏检关键安全事件的风险，尤其是那些隐藏在低速率流量中的事件，如高级持续威胁（APT）或恶意软件的命令与控制通信。本文提出XNET系统，该系统使用商用硬件以线速监控流量，并通过动态采样放大高安全价值流量的可见性。XNET利用Linux的XDP技术高效处理数据包，依据安全价值对其分类，并按配置的策略进行采样，最终得到一个缩减后的数据包流，其中与安全相关的流量部分被放大，而低关注度的流量片段则被缩减。XNET是一个高度灵活、可扩展且动态的系统，可根据网络需求进行调整。我们仅使用商用硬件在一个大型实际网络中部署了XNET，结果显示XNET可实现高达84%的流量缩减且无数据包丢失，同时将原本可忽略的流量的可见性提高了五倍。通过受控压力测试，我们进一步证明XNET的可扩展性可达100Gbps。此外，我们还表明，在入侵检测系统（IDS）应用中，XNET采样带来了99.6%的检测率。
英文摘要
Growing network speeds, with 100GbE line rates becoming common in modern enterprise networks, pose challenges to operators and security applications, as they struggle to scale their operational efficiency accordingly, without relying on costly hardware, excessive sampling, or complex distributed deployments. Unintentional loss due to stochastic packet sampling often produces low-quality traffic, further risking missed detection of critical security incidents, particularly those hidden in typically low-rate traffic, such as APT/malware command-and-control communications. In this paper, we introduce XNET, a system that monitors traffic at line rate using commodity hardware and applies dynamic sampling to amplify the visibility of high security value traffic. XNET leverages Linux's XDP technology to process packets efficiently, classify them based on their security value, and sample them as per configured policies. The outcome is a reduced packet stream in which the security-relevant portion of the traffic is amplified at the expense of less interesting traffic segments. XNET is a highly flexible, scalable and dynamic system that can be adapted based on a network's needs. We deployed XNET in a large real-world network using only commodity hardware, where our results show that XNET can achieve up to 84% traffic reduction with no packet loss while increasing the visibility of otherwise negligible traffic fivefold. With controlled stress tests, we further demonstrate XNET's scalability up to 100Gbps. Additionally, we show that XNET sampling led to a detection rate of 99.6% in an IDS application.
Comments18 pages, 10 figures and 4 tables
