SAND: A fault-tolerant streaming architecture for network traffic analytics

Many long-running network analytics applications (e.g., flow size estimation and heavy traffic detection) impose a high-throughput and high reliability requirements on stream processing systems. However, previous stream processing systems which are designed for higher layer applications cannot sustain high-speed traffic at the core router level. Furthermore, due to the nondeterministic nature of message passing among workers, the fault-tolerant schemes of previous streaming architectures based on the continuous operator model cannot provide strong consistency which is essential for network analytics. In this paper, we present the design and implementation of SAND, a fault-tolerant distributed stream processing system for network analytics. SAND is designed to operate under high-speed network traffic, and it uses a novel checkpointing protocol which can perform failure recovery based on upstream backup and checkpointing. We prove our fault-tolerant scheme provides strong consistency even under multiple node failure. We implement several real-world network analytics applications on SAND, including heavy traffic hitter detection as well as policy and charging control for cellular networks, and we evaluate their performance using network traffic captured from commercial cellular core networks. We demonstrate that SAND can sustain high-speed network traffic and that our fault-tolerant scheme is efficient.