A Virtualized Network Function for Advanced Network Flow Logging in Microsoft Azure Distributed System

摘要

Storing, viewing, and analyzing network flows in a Cloud environment is an important Virtualized Network Function (VNF) for Cloud tenants and users. It is used to store, track, and analyze traffic that belongs to Virtual Networks (VNETs), Virtual Machines (VMs), or Network Interfaces (NICs). It is used for logging ingress and egress IP traffic flows, number of bytes and packets transmitted and received, and network connections. Flow logging is critical for the investigation of firewall functionalities, security incidents, and threat detection. Moreover, it can be used for detecting connection and network anomalies such as connection outages, configuration changes, or malicious activities. Alerts can be fired for any suspicious network activities. Visualization of flows logs provides insights such as who is using a web-service or an application, when customers are logged in and out, and what are the geographical locations where connections are being initiated or terminated. In this paper, a novel method for VNF that details the framework for logging network flows in a Cloud environment is provided. The method aims at accommodating multiple and simulations Cloud tenants and enabling the logging of network flows while at the same time accommodates high incoming rates of flow events and data. One of the major benefits of this new method is that it supports high number of flows per second that facilitates flow logging of high traffic volumes. Not only customers can experience higher number of flows logged, but the flow logs are visualized and contain the number of packets and bytes transmitted and received for outbound and inbound flows, respectively.