Why Actors Rock: Designing a Distributed Database with libcppa - PowerPoint PPT Presentation

Why Actors Rock: Designing a Distributed Database with libcppa Matthias Vallentin matthias@bro.org University of California, Berkeley C ++ Now May 15, 2014

Outline 1. System Overview: VAST 2. Architecture: Ingestion, Indexing, and Query Ingestion Indexing Query 3. Experience 4. Demo 1 / 13

VAST: Visibility Across Space and Time Ingestor Ingestor Ingestor VAST Distributed database built with libcppa Receiver Goals Archive Index ◮ Scalability ◮ Sustain high & continuous input rates ◮ Linear scaling with number of nodes ◮ Interactivity Search ◮ Sub-second response times ◮ Iterative query refinement ◮ Strong and rich typing ◮ High-level types and operations ◮ Type safety in query language Client Client Client 2 / 13

Example Use Case: Network Security Analysis Network Forensics & Incident Response ◮ Scenario: security breach discovered ◮ Analysts tasked with determining scope and impact Analyst questions ◮ How did the attacker(s) get in? ◮ How long did the they stay under the radar? ◮ What is the damage ($$$, reputation, data loss, etc.)? ◮ How to detect similar attacks in the future? 3 / 13

Outline 1. System Overview: VAST 2. Architecture: Ingestion, Indexing, and Query Ingestion Indexing Query 3. Experience 4. Demo 3 / 13

Outline 1. System Overview: VAST 2. Architecture: Ingestion, Indexing, and Query Ingestion Indexing Query 3. Experience 4. Demo 3 / 13

Ingestion Ingestor Ingestor Ingestor Core Client Client Client 4 / 13

Ingestion Ingestor 4 / 13

Ingestion Source Ingestor Segmentizer 4 / 13

Ingestion Source 10.0.0.1 10.0.0.254 53/udp 10.0.0.2. 10.0.0.254 80/tcp ingestor 1. Parse input into events Ingestor Segmentizer 4 / 13

Ingestion Source ingestor 1. Parse input into events 10.0.0.1 10.0.0.254 53/udp 2013-08-12 12:08:32 type info Ingestor Segmentizer 4 / 13

Ingestion Source ingestor 1. Parse input into events 2. Compress & chunk into Ingestor segments Segmentizer 4 / 13

Ingestion Source ingestor 1. Parse input into events chunk meta data 2. Compress & chunk into Ingestor segments Segmentizer segment 4 / 13

Ingestion Source ingestor 1. Parse input into events 2. Compress & chunk into Ingestor segments Segmentizer 4 / 13

Ingestion Source ingestor 1. Parse input into events 2. Compress & chunk into Ingestor segments 3. Send segments to receiver Segmentizer Core Receiver Archive Index 4 / 13

Ingestion Source ingestor 1. Parse input into events 2. Compress & chunk into Ingestor segments 3. Send segments to receiver Segmentizer Core Receiver Archive Index 4 / 13

Ingestion Receiver ingestor Archive Index 1. Parse input into events 2. Compress & chunk into segments 3. Send segments to receiver 4 / 13

Ingestion Receiver ingestor Archive Index 1. Parse input into events 2. Compress & chunk into segments 3. Send segments to receiver Tracker receiver 1. Accept and ACK segment 2. Assign segment an ID range from space 2 64 4 / 13

Ingestion Receiver ingestor Archive Index 1. Parse input into events 2. Compress & chunk into segments 3. Send segments to receiver Tracker Search receiver 1. Accept and ACK segment 2. Assign segment an ID range from space 2 64 3. Record segment schema 4 / 13

Ingestion Receiver ingestor Archive Index 1. Parse input into events 2. Compress & chunk into segments ... 3. Send segments to receiver Partitions Tracker Search receiver 1. Accept and ACK segment 2. Assign segment an ID range from space 2 64 3. Record segment schema 4 / 13

Ingestion Receiver ingestor Archive Index 1. Parse input into events 2. Compress & chunk into segments ... 3. Send segments to receiver Partitions Tracker Search receiver 1. Accept and ACK segment 2. Assign segment an ID range from space 2 64 3. Record segment schema 4. Forward segment to archive and index 4 / 13

Outline 1. System Overview: VAST 2. Architecture: Ingestion, Indexing, and Query Ingestion Indexing Query 3. Experience 4. Demo 4 / 13

Indexing Index ... ... Partitions 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... Partitions 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values ... Bitmap Indexers 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values Unpacker ... Bitmap Indexers 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values 3. Unpack segment back into events Unpacker ... Bitmap Indexers 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values 3. Unpack segment back into events Unpacker indexer ... 1. Receive event Bitmap Indexers 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values 3. Unpack segment back into events Unpacker indexer ... 1. Receive event Bitmap Indexers 2. Select value to index 5 / 13

Indexing Index index 1. Forward segment to relevant partition ... ... 2. Spawn indexer for Partitions event values 3. Unpack segment back into events Unpacker indexer ... 1. Receive event Bitmap Indexers 2. Select value to index 3. Report statistics back to partition 5 / 13

Outline 1. System Overview: VAST 2. Architecture: Ingestion, Indexing, and Query Ingestion Indexing Query 3. Experience 4. Demo 5 / 13

Query Ingestor Ingestor Ingestor Core Client Client Client 6 / 13

Query 6 / 13 Client

Query client 1. Send query string to search Search 6 / 13 Client

Query client Index 1. Send query string to search search Partitions 1. Parse and validate query string Indexers Search src == 10.0.0.1 && port == 53/udp 6 / 13 Client

Query client Index 1. Send query string to search search Partitions 1. Parse and validate query string 2. Spawn dedicated query Indexers Search Query src == 10.0.0.1 && port == 53/udp 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query Indexers Search Query src == 10.0.0.1 && port == 53/udp 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor src == 10.0.0.1 && port == 53/udp search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string src == 10.0.0.1 port == 53/udp 2. Spawn dedicated query 3. Forward query to index Indexers Search Query 6 / 13 Client

Query client Index 1. Send query string to search 10100010011100 2. Receive query actor 1 = “mass” 0 = empty search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 6 / 13 Client

Query client Index 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 1. Receive hits from index 6 / 13 Client

Query client Index Archive 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 1. Receive hits from index 6 / 13 Client

Query client Index Archive 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 1. Receive hits from index 2. Ask archive for segments 6 / 13 Client

Query client Index Archive 1. Send query string to search 2. Receive query actor search Partitions 1. Parse and validate query string 2. Spawn dedicated query 3. Forward query to index Indexers Search Query query 1. Receive hits from index 2. Ask archive for segments 3. Extract events, check candidates 6 / 13 Client