Survey on network traffic monitoring in programmable data planes

Monitoring is a key activity that consists in measuring network traffic, observing the network state while enabling the triggering of management procedures in the event of an anomaly or attack. This survey presents a state-of-the-art on traffic monitoring with an overview of recent work enabling instrumentalized monitoring using software probes. The survey focuses primarily on programmed and customized monitoring using Software Defined Network (SDN) and Portable Switch Architecture (PSA). In particular, the survey explores techniques that monitor encrypted traffic based on artificial intelligence technologies, with the aim of identifying the causes of degradation and anomalies. Particular attention is to be paid to passive traffic monitoring, including the works proposing a classification adapted to the analysis of encrypted traffic and the evaluation of the related performance.