Automating In-Network Machine Learning

Abstract

Using programmable network devices to aid in-network machine learning has been the focus of significant research. However, most of the research was of a limited scope, providing a proof of concept or describing a closed-source algorithm. To date, no general solution has been provided for mapping machine learning algorithms to programmable network devices. In this paper, we present Planter, an opensource, modular framework for mapping trained machine learning models to programmable devices. Planter supports a wide range of machine learning models, multiple targets and can be easily extended. The evaluation of Planter compares different mapping approaches, and demonstrates the feasibility, performance, and resource efficiency for applications such as anomaly detection, financial transactions, and quality of experience. The results show that Planterbased in-network machine learning algorithms can run at line rate, have a negligible effect on latency, coexist with standard switching functionality, and have no or minor accuracy trade-offs.

E-Commerce Bot Traffic: In-Network Impact, Detection, and Mitigation

“…More advanced switching solutions, such as OvS and the Data Plane Development Kit (DPDK), can potentially be leveraged too. As INCS is implemented using Planter [28], it can also be deployed on other targets such as programmable switches. However, this is not trivial, primarily due to limited processing and memory resources on switches.…”

“…Leveraging prototyping frameworks like Planter [28] and DINC [29], in-network machine learning algorithms have conducted applications across various domains, notably in tasks such as anomaly detection [28]- [30], traffic classification [31], load balancing [32], and financial market prediction [33]. Nevertheless, while some references present in-network machine learning for attack detection (especially for DDOS) [30], [34], the case of attacks on caching systems is unique, because none of the preceding works have explicitly addressed its integration within caching systems for its attacks.…”

“…INCS runs on a programmable network target, such as a DPU using Behavioral Model Version 2 (BMV2) [56] or Open vSwitch (OvS). The in-network machine learning algorithms are realized using Planter [28], observing all incoming requests before the controller. INCS provides feature extraction required for the machine learning, as well as standard switch functionality, and the two are executed in parallel.…”

Enhancing Network Security: A Machine Learning-Based Approach for Detecting and Mitigating Krack and Kr00k Attacks in IEEE 802.11

“…In [55], the authors investigated how to map machine learning algorithms to programmable network devices. Furthermore, state-of-the-art and newly proposed in-network ML algorithms are evaluated and compared in terms of functionality, resources, scalability, and throughput.…”

Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale

“…In-network ML (bottom part of Figure 1) integrates the ML model directly into the data plane, either offloading feature extraction to an external system [22], [23], or by integrating both the feature extraction process and the ML model [24], [25], [26], in which case the monitoring system might provide high capacities and real-time capabilities. However, in-network ML requires heavy tailoring and simplification of the specific ML model, given the limited operations supported by highspeed programmable hardware, losing flexibility in terms of feature and ML analytics capabilities.…”