REX: Resilient and efficient data structure for tracking network flows

One of the important tasks for most network security solutions is to track network flows in real-time. The universe of flow identifiers being huge, hash tables with their fast operations are well suited for this task. In order to overcome the limitations of traditional hash tables, the research community have come up with different improved variants; two of the well-knowns being Cuckoo and Peacock hash tables. Yet, network flows have interesting characteristics that can be exploited for tracking flows more efficiently. Besides, the existing hash tables are vulnerable to attacks. In this context, we design, develop and evaluate REX, a resilient and efficient data structure for tracking of network flows. REX is designed to make good use of, both, the characteristics of Internet traffic, as well as the different memory technologies. REX stores most commonly updated flows in the faster and smaller SRAM, while storing the rest in DRAM. We conducted extensive experiments using real network traffic to evaluate and compare REX, Cuckoo and Peacock hash tables. The results demonstrate, under both normal and attack scenarios, that REX not only rejects the least number of packets, but also significantly reduces the total time taken for the important hash table operations.