[Paper Review] Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed

Jinzhu Yan, Haotian Xu+5 more|arXiv (Cornell University)|Mar 17, 2024

EEG and Brain-Computer Interfaces6 citations

TL;DR

BoS enables neural-network driven traffic analysis at line-speed on programmable switches by a data-plane friendly RNN and an off-switch transformer module, outperforming tree-based INDP methods in accuracy and scalability.

ABSTRACT

The emerging programmable networks sparked significant research on Intelligent Network Data Plane (INDP), which achieves learning-based traffic analysis at line-speed. Prior art in INDP focus on deploying tree/forest models on the data plane. We observe a fundamental limitation in tree-based INDP approaches: although it is possible to represent even larger tree/forest tables on the data plane, the flow features that are computable on the data plane are fundamentally limited by hardware constraints. In this paper, we present BoS to push the boundaries of INDP by enabling Neural Network (NN) driven traffic analysis at line-speed. Many types of NNs (such as Recurrent Neural Network (RNN), and transformers) that are designed to work with sequential data have advantages over tree-based models, because they can take raw network data as input without complex feature computations on the fly. However, the challenge is significant: the recurrent computation scheme used in RNN inference is fundamentally different from the match-action paradigm used on the network data plane. BoS addresses this challenge by (i) designing a novel data plane friendly RNN architecture that can execute unlimited RNN time steps with limited data plane stages, effectively achieving line-speed RNN inference; and (ii) complementing the on-switch RNN model with an off-switch transformer-based traffic analysis module to further boost the overall performance. We implement a prototype of BoS using a P4 programmable switch as our data plane, and extensively evaluate it over multiple traffic analysis tasks. The results show that BoS outperforms state-of-the-art in both analysis accuracy and scalability.

Motivation & Objective

• Push the boundaries of Intelligent Network Data Plane by enabling neural network driven traffic analysis on the data plane at line-speed.
• Overcome hardware constraints that limit feature computation on the switch by introducing a data-plane friendly NN architecture.
• Provide an escalation mechanism to leverage full-precision transformer models off-switch for improved accuracy without sacrificing line-speed performance.

Proposed method

• Propose a data-plane friendly binary RNN that preserves full-precision weights by binarizing only activations and implementing layer forward propagation as match-action table lookups.
• Introduce a sliding-window computation scheme to enable unlimited RNN time steps within a limited number of switch stages.
• Employ a ring-buffer based embedding storage and a ternary-matching design to realize argmax-like aggregation on the data plane.
• Co-design an Integrated Model Inference System (IMIS) to enable fast off-switch transformer-based analysis for escalated flows with controlled throughput.
• Define an analysis-escalation mechanism that uses confidence-based aggregation to decide which flows are escalated to the off-switch transformer module.
• Train the binary RNN with a specialized loss function that emphasizes confident predictions and discriminative non-ground-truth class probabilities.

Experimental results

Research questions

• RQ1 Can NN-based models like RNNs and transformers be deployed for traffic analysis directly on the network data plane at line-speed?
• RQ2 What architectural and algorithmic changes are needed to adapt RNNs to the constraints of programmable switches?
• RQ3 How can we selectively escalate ambiguous or edge-case flows to off-switch transformer models without compromising line-speed performance?

Key findings

• BoS achieves line-speed NN-driven traffic analysis on a P4 programmable switch using a data-plane friendly binary RNN.
• The binary RNN preserves full-precision weights while binarizing activations, enabling efficient match-action table lookup for forward propagation.
• A sliding-window mechanism allows unlimited RNN time steps despite a fixed switch pipeline, by processing fixed-length segments and aggregating intermediate results.
• An off-switch IMIS enables fast transformer-based analysis for escalated flows with a throughput target of ten million packets per second while maintaining low latency.
• BoS attains up to ~19% higher F1-scores than tree-based NetBeacon and up to ~40% higher than binary MLP-based N3IC in evaluations.
• Experiments demonstrate scalability to high flow concurrency and acceptable hardware resource utilization due to the co-design of on-switch binary RNN and off-switch IMIS.