[网络领域顶会追踪系列#5][NSDI'22] 差异化网络分析

本系列为个人论文阅读笔记，大多数应该是对顶会摘要的个人菜鸟翻译，旨在让感兴趣的朋友能快速浏览、获取信息。如有错误或心得，欢迎在评论区交流指正！

Differential Network Analysis

背景

网络在持续改变。为避免严重后果，操作员需要知道网络控制面的潜在变化是否会造成端到端转发行为的不想要的变化。例如，配置变化前和变化后的哪对主机的连通性会受到影响？

挑战

控制面验证器不适合回答这样的问题，因为它们仅仅做了快照，然后检查它是否遵守显式指定的属性，而不是量化对端到端转发行为的影响。

工作

主张一个新的控制面分析流程，可以让不同成为一等公民。Different Network Analysis (DNA，差异化网络分析)获取控制平面变化，增量计算控制面和数据面的状态，然后输出相应的在端到端行为上的差异。将计算分为三个阶段：控制面仿真、数据面建模、属性检查，并且分别利用差异化数据流编编程框架、增量数据流验证、定制化图算法来让各个阶段是增量的。

实验

仿真结果表明人造和真实的控制面变化下，DNA可以在数秒内计算可达性的差异，比最先进的数据面验证器快了3个数量级以上。

原文摘要

Networks are constantly changing. To avoid outages, operators need to know whether prospective changes in a network's control plane will cause undesired changes in end-to-end forwarding behavior. For example, which pairs of end hosts are reachable before a configuration change but unreachable after the change? Control plane verifiers are ill-suited for answering such questions because they operate on a single snapshot to check its "compliance" with "explicitly specified" properties, instead of quantifying the "differences" in "affected" end-to-end forwarding behaviors. We argue for a new control plane analysis paradigm that makes differences first class citizens. Differential Network Analysis (DNA) takes control plane changes, incrementally computes control and data plane state, and outputs consequent differences in end-to-end behavior. We break the computation into three stages---control plane simulation, data plane modeling, and property checking---and leverage differential dataflow programming frameworks, incremental data plane verification, and customized graph algorithms, respectively, to make each stage incremental. Evaluations using both real and synthetic control plane changes demonstrate that DNA can compute the resulting differences in reachability in a few seconds---up to 3 orders of magnitude faster than state-of-the-art control plane verifiers.