NeTS: Small: ML-Driven Online Traffic Analysis at Multi-Terabit Line Rates

互联网网络运营，无论是由人工还是通过自动化系统运行，都需要实时的运营数据和数据分析，以便及时做出决策，从而支持更安全可靠的互联网。 该项目支持大幅减少检测和响应网络流量异常的响应时间，并有助于性能诊断和修复。实现网络能力通常需要机器学习（ML）推理算法（例如，以检测异常业务）。不幸的是，随着网络带宽增长到每秒数百千兆比特甚至太比特，今天在线速率下分析网络流量具有挑战性。因此，网络运营商求助于带外业务分析，导致缓慢的反应时间（例如，检测网络入侵）。该项目旨在通过推进和利用可编程交换机技术，使互联网能够以数百Gbps甚至Tbps的线路速率运行ML驱动的推理算法，用于网络安全等应用。这样做是具有挑战性的，因为可编程交换机在其计算和存储器能力方面受到约束，具有有限的表现力，并且对运行时可编程性的支持有限（即，无需重新启动交换机即可进行更改的能力）。该项目正在开发（i）新的方法，可以有效地将整个流行的ML模型（如决策树和神经网络）映射到可编程开关管道，其方式是有效地使用有限的开关计算和内存资源，同时允许该类中的任何模型在运行时得到支持;（ii）用于计算有序统计的新开关原语（例如，流特征的中位数、中位数）;以及（iii）以运行时可编程的方式将大型ML模型分布在跨多个管道的可编程交换机上以及多个交换机上的技术，同时处理交换机故障，通过新的交换机原语和新的网络范围优化模型的组合实现资源效率。项目团队正在与校园网络运营商合作进行更大规模的验证。该项目将培养博士、硕士和本科生，并在网络课程中提供可编程交换机方面的材料。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Internet network operations, whether run by humans or via automated systems, need real-time operational data and data analysis for timely decision making in support of a more secure and reliable Internet. This project supports drastically reducing response times in detecting and responding to network traffic anomalies, and aid with performance diagnosis and repair. Realizing network capabilities often requires machine learning (ML) inferencing algorithms (e.g., to detect anomalous traffic). Unfortunately, as network bandwidth grows to hundreds of gigabits to even terabits per second, it is challenging to analyze network traffic at line rates today. Consequently, network operators resort to out-of-band traffic analysis resulting in slow reaction times (e.g., to detect network intrusions). This project seeks to enable an Internet that can run ML-driven inference algorithms for applications such as network security at line rate of hundreds of Gbps or even Tbps by advancing and leveraging programmable switch technology. Doing so is challenging since programmable switches are constrained in their compute and memory capabilities, have limited expressivity, and limited support for runtime programmability (i.e., ability to make changes without a switch reboot). The project is developing (i) novel methods that can efficiently map an entire class of popular ML models such as decision trees and neural networks to a programmable switch pipeline in a manner that efficiently uses limited switch computation and memory resources, while allowing any model in the class to be supported at runtime; (ii) new switch primitives for computing ordered statistics (e.g., medians, percentiles) of flow features; and (iii) techniques to distribute large ML models on programmable switches across multiple pipelines, and multiple switches in a runtime programmable fashion while handling switch failures achieving resource efficiencies through a combination of new switch primitives, and new network-wide optimization models. The project team is collaborating with campus network operators for larger scale validations. The project will train Ph.D, Masters and undergraduate students, and lead to material on programmable switches in the networking curriculum.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.