Neural network deployment method in network based on SDN (Software Defined Network) mode

Abstract

The invention relates to an in-network neural network deployment method based on an SDN modal, and the method comprises the steps: mapping an input feature and an output result of a deep neural network model into a flow table item of network equipment, achieving the deep neural network reasoning through a table item matching mode, and achieving the network functions of flow classification, anomaly detection and the like. According to the method, the deep neural network model is compressed and converted into the table item matching task suitable for the programmable network equipment, so that efficient network data plane reasoning is realized. According to the method, the utilization of storage and computing resources is optimized, the computing complexity of network equipment is remarkably reduced, and the throughput and the real-time performance are improved. Through an innovative table item compression and adaptive matching mechanism, the method supports high-precision applications such as traffic classification and anomaly detection, and the network intelligent management and optimization capability is remarkably improved. According to the method, efficient deployment of the deep neural network in the in-network equipment can be realized, and an effective solution is provided for development of an intelligent network technology.

Description

Technical Field

[0001] The present invention relates to the field of network intelligence technology, and in particular to a method for deploying a neural network in a network based on an SDN mode. Background Art

[0002] With the rapid growth of network scale, the complexity and variety of network traffic are also increasing. Traditional network equipment and management methods are difficult to meet the needs of modern networks for intelligence and real-time performance. Especially in tasks such as network traffic analysis, anomaly detection, and traffic classification, traditional solutions based on static rules or simple algorithms cannot effectively cope with dynamically changing traffic and increasingly complex network attacks, which has promoted the demand for intelligent network management. In recent years, deep learning technology, especially deep neural networks (DNNs), has been widely used in fields such as network traffic analysis and anomaly detection, and has achieved certain results. However, the training and reasoning process of deep neural networks usually requires a lot of computing resources and storage space, which makes it challenging to directly deploy them on traditional network equipment (such as routers and switches).

[0003] Currently, most deep learning-based network intelligence solutions rely on high-performance servers or data centers for model reasoning. Although this can provide high processing power, it has significant limitations. First, when deep neural network models are deployed on network devices, the computing resources and storage capacity of traditional devices often cannot meet the needs of real-time reasoning. Secondly, existing solutions ignore the limitations of device resources, resulting in low computing efficiency, high latency, and inability to cope with complex network traffic patterns or high throughput requirements. Especially on edge devices and small and medium-sized network devices, how to efficiently run deep neural network reasoning remains an issue that needs to be solved.

[0004] With the development of software-defined networks (SDN) and programmable network devices, the flexibility and programmability of network devices have been greatly improved. In particular, programmable switches and routers based on the P4 language provide support for deep control of the data plane and customized processing capabilities, allowing deep neural networks to be directly deployed in network devices. However, existing neural network reasoning methods are generally unable to adapt to the computing and storage constraints of these devices, resulting in the reasoning process still having problems such as high computational complexity and high latency. Therefore, there is an urgent need for a new method that can reduce computing and storage requirements while ensuring the effect of intelligent reasoning, and can be efficiently deployed in programmable network devices to promote the development of intelligent network technology.

[0005] By combining neural network model compression technology with table matching mechanism, the present invention proposes a network traffic processing solution based on equivalent deep neural network, which can efficiently deploy deep neural network reasoning in network equipment and improve the intelligent management capability and real-time processing performance of network equipment. Summary of the invention

[0006] The present invention aims to solve the problems of high computational complexity and large resource consumption in the neural network reasoning process in existing network devices, and provides an in-network neural network deployment method based on the SDN modality, which can optimize the computing and storage requirements of neural networks in the network data plane, thereby realizing efficient deployment of deep neural networks in programmable network devices.

[0007] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a method for deploying a neural network in a network based on the SDN mode, by mapping the input features and output results of a deep neural network (DNN) model into flow table items of a network device, and realizing deep neural network reasoning by table item matching, thereby realizing network functions including traffic classification and anomaly detection; comprising the following steps: (1) Train DNN and binarized neural network (BNN) models based on public network datasets to obtain corresponding weight parameters; (2) Compress the DNN model, taking the features of the data packet as input and the classification results of the model as output, converting the input-output mapping into flow table entries suitable for programmable network devices, and reducing the storage resources occupied by the table entries through a three-layer compression method; (3) Based on the computing resource limitations of network devices, use the BNN model for fast reasoning, optimizing reasoning speed and storage efficiency under resource constraints; (4) When a data packet enters the network, the extracted feature values ​​are used to match the DNN equivalent table items, obtain the inference results of the deep neural network, and perform corresponding network operations based on the inference results.

[0008] Furthermore, the DNN model is optimized through a table item compression method to reduce the resources occupied by table item storage and improve the inference speed.

[0009] Furthermore, in step (1), when training the DNN and BNN models, a variety of network traffic datasets are used to ensure that the models have good generalization capabilities and can adapt to traffic characteristics in different network environments.

[0010] Furthermore, in step (4), when a data packet matches a flow table entry, the inference result is returned, and traffic classification, anomaly detection or other network functions are performed through the corresponding network policy.

[0011] Furthermore, whenever the number of data packets in the data packet counting register reaches a preset threshold, flow table entries with low hit rates are cleared, the use efficiency of the flow table is optimized, and the computing and storage resource utilization of the network device is improved.

[0012] Furthermore, the deep neural network reasoning is performed within the data plane, and by executing reasoning directly on network devices, network latency is reduced and real-time network traffic analysis and decision-making are optimized.

[0013] Compared with the prior art, the present invention has the following beneficial effects: The present invention optimizes computing resources and storage utilization efficiency by closely integrating the deep neural network reasoning process with the data plane of programmable network devices. Compared with the traditional deep learning deployment method that relies on high-performance servers, the present invention significantly reduces the computing complexity and storage consumption of network devices through compression and binarization of neural network technology, while improving the reasoning speed and real-time performance. In addition, the deep neural network model is converted into an executable task for network devices using a table matching mechanism, so that intelligent functions such as traffic classification and anomaly detection can be efficiently executed directly on edge devices such as switches, reducing network latency and improving the intelligent processing capabilities of the network. The present invention has wide applicability and can effectively improve traffic management and security protection capabilities in large-scale network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is an overall architecture diagram of the method of an embodiment of the present invention; Figure 2 This is a diagram of an implementation architecture of an equivalent neural network in a network according to an embodiment of the present invention; Figure 3 It is the equivalent neural network running code framework in the network embodiment of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0016] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0017] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0018] This embodiment provides a method for deploying a neural network in a network based on an SDN mode. The method maps the input features and output results of a deep neural network (DNN) model into flow table items of a network device, and implements deep neural network reasoning by matching table items, thereby realizing network functions such as traffic classification and anomaly detection. In this process, the DNN and binarized neural network (BNN) models are first trained based on a public network data set, and the models are compressed, and a three-layer compression method is used to reduce the storage occupancy of table items. The compressed table items are sent to the target programmable switch through the P4Runtime interface to realize real-time traffic reasoning. In the case where the computing resources of the network device are limited, the BNN model is used for reasoning to further optimize storage and computing efficiency. When a data packet enters the network, the device extracts its features and matches them with the flow table items. After obtaining the reasoning results, the corresponding network operations, such as traffic classification or anomaly detection, are performed. The present invention also ensures that the network device can efficiently handle large-scale traffic, reduce network delays, and improve the management and decision-making capabilities of the intelligent network by optimizing the table item storage and reasoning process. The method specifically includes the following steps: (1) Train DNN and binarized neural network (BNN) models based on public network datasets to obtain corresponding weight parameters. When training DNN and BNN models, use a variety of network traffic datasets to ensure that the models have good generalization capabilities and adapt to traffic characteristics in different network environments.

[0019] (2) Compress the DNN model, take the characteristics of the data packet (such as quintuple) as input, and the classification result of the model as output, convert the input-output mapping into flow table entries suitable for programmable network devices, and reduce the storage resources occupied by the table entries through a three-layer compression method.

[0020] (3) Based on the computing resource limitations of network devices, the BNN model is used for fast reasoning to optimize reasoning speed and storage efficiency under resource-constrained conditions.

[0021] (4) When a data packet enters the network, the extracted feature values ​​are used to perform DNN equivalent table matching to obtain the inference results of the deep neural network, and corresponding network operations are performed based on the inference results, such as traffic classification or abnormal traffic detection.

[0022] When a data packet matches a flow table entry, the inference result is returned and traffic classification, anomaly detection or other network functions are performed through the corresponding network policy.

[0023] Whenever the number of packets in the packet counting register reaches a preset threshold, the flow table entries with low hit rates are cleared to optimize the use efficiency of the flow table and improve the computing and storage resource utilization of network devices.

[0024] The deep neural network reasoning is performed within the data plane. By executing reasoning directly on network devices, network latency is reduced and real-time network traffic analysis and decision-making are optimized.

[0025] like Figure 1 As shown, the present invention realizes an efficient network traffic processing solution by combining a deep neural network with a table matching mechanism of a programmable network device. By compressing the neural network model and adopting binarization neural network technology, not only the storage and computational complexity are reduced, but also the real-time performance and throughput of the network device are significantly improved. This solution can effectively support intelligent tasks such as network traffic classification and anomaly detection, promote the development of intelligent network technology, and has broad application prospects, as follows: 1. Network architecture and data plane deployment: Figure 1 As shown, the overall architecture of the present invention includes multiple programmable network devices, a network data plane, and an intelligent reasoning module. Each network device can process network traffic in real time through a locally deployed compressed neural network model. The network data plane can perform intelligent processing tasks such as classification and anomaly detection based on traffic characteristics by docking with a deep neural network (DNN) model. In the network device, the original traffic data is inferred in real time through an adaptive model, and the inference result is used as a network control instruction to execute traffic control or issue an alarm.

[0026] 2. Neural network model training and compression: In this embodiment, the DNN and binarized neural network (BNN) models are first trained using a public network dataset to obtain the weight parameters of the model. Through the training of the deep neural network, the recognition ability and accuracy of the model in different network traffic scenarios are optimized. During the training process, a variety of network traffic data sets are used to ensure that the model has strong generalization capabilities and adapts to the traffic characteristics in different network environments. After the DNN model training is completed, the model is further compressed. Through a three-layer compression method, the five-tuple features of the data packet are used as input, and the classification results of the model are used as output, and then the input-output mapping is converted into a flow table item suitable for the network device, and storage resources are optimized.

[0027] 3. Equivalent neural network implementation architecture within the network: Figure 2 As shown in the figure, the implementation architecture of the equivalent neural network in the network converts the calculation process of the deep neural network model into a table matching task to reduce the consumption of storage and computing resources. In this architecture, network devices use flow table items for matching and reasoning. When a data packet enters the network, the data packet features are extracted and matched with the compressed flow table items. Through the matching results, the reasoning results of the deep neural network can be obtained, thereby realizing network intelligent functions such as traffic classification or anomaly detection.

[0028] 4. Neural network reasoning and decision execution framework: Figure 3The running code framework of the equivalent neural network in the network is shown, which includes modules such as data acquisition, model loading, reasoning calculation, and decision execution. The data acquisition module is responsible for capturing and processing network traffic in real time, preprocessing data and sending it to the neural network model for reasoning. The model loading and reasoning module loads the compressed neural network model from the storage, performs reasoning calculation, and generates results. The decision module makes decisions such as traffic classification and anomaly detection based on the reasoning results, and performs traffic control or alarm operations through the response module.

[0029] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0030] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0031] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0032] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0033] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A method for deploying a neural network in a network based on SDN mode, characterized in that: By mapping the input features and output results of the deep neural network (DNN) model into flow table items of network devices and implementing deep neural network reasoning through table item matching, network functions including traffic classification and anomaly detection are realized; the following steps are included: (1) Train DNN and binarized neural network (BNN) models based on public network datasets to obtain corresponding weight parameters; (2) Compress the DNN model, taking the features of the data packet as input and the classification results of the model as output, converting the input-output mapping into flow table entries suitable for programmable network devices, and reducing the storage resources occupied by the table entries through a three-layer compression method; (3) Based on the computing resource limitations of network devices, use the BNN model for fast reasoning, optimizing reasoning speed and storage efficiency under resource constraints; (4) When a data packet enters the network, the extracted feature values ​​are used to match the DNN equivalent table items, obtain the inference results of the deep neural network, and perform corresponding network operations based on the inference results.

2. According to the SDN mode-based in-network neural network deployment method of claim 1, it is characterized in that: The DNN model is optimized through a table item compression method to reduce the resources occupied by table item storage and improve the reasoning speed.

3. According to the SDN mode-based in-network neural network deployment method of claim 1, it is characterized in that: In step (1), when training DNN and BNN models, a variety of network traffic datasets are used to ensure that the model has good generalization ability and can adapt to the traffic characteristics in different network environments.

4. The method for deploying an intra-network neural network based on SDN mode according to claim 1, characterized in that: In step (4), when a data packet matches a flow table entry, the inference result is returned and traffic classification, anomaly detection or other network functions are performed through the corresponding network policy.

5. The method for deploying an intra-network neural network based on SDN mode according to claim 1, characterized in that: Whenever the number of packets in the packet counting register reaches a preset threshold, the flow table entries with low hit rates are cleared to optimize the use efficiency of the flow table and improve the computing and storage resource utilization of network devices.

6. The method for deploying an in-network neural network based on SDN mode according to claim 1, characterized in that: The deep neural network reasoning is performed within the data plane. By executing reasoning directly on network devices, network latency is reduced and real-time network traffic analysis and decision-making are optimized.

Images