A method and device for designing intelligent data plane scheme based on neural network

Abstract

The present invention proposes a neural network-based intelligent data plane solution design and device, which deploys a recurrent neural network on a P4 programmable switch to perform line-speed analysis on traffic to obtain switch classification results; based on the switch classification results, the first part of traffic whose classification confidence is lower than the set classification confidence threshold is screened; by deploying a Transformer-based model on a server, the first part of traffic is upgraded and analyzed, thereby improving the classification accuracy. Compared with the analysis method outside the switch, the present invention has the advantage of high throughput, and compared with the previous analysis method based on the tree structure model on the switch, the present invention has the advantage of accuracy; by deploying a Transformer-based model on the server for upgraded analysis, a high-throughput online traffic analysis method based on the Transformer model can be provided, and the analysis accuracy of the entire system can be further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a neural network-based intelligent data plane solution design and device. Background Art

[0002] The development of network programmable devices has led to research on deploying intelligent models for traffic analysis on the network data plane. Traditional traffic analysis is either to directly deploy models on the end to analyze traffic, or to collect information from the data plane and perform calculations with the help of an auxiliary control plane. In contrast, direct traffic analysis on the network data plane can achieve line-speed traffic analysis due to the characteristics of the data plane itself in processing and forwarding data packets.

[0003] The exploration of deploying intelligent models on the data plane mainly focuses on tree-structured intelligent models, namely decision trees and random forest models, because the decision-making process of tree structures is closer to the match-action mechanism of programmable data planes. However, tree-structured decision models need to calculate a large number of statistical features, consume a lot of storage resources, and have lower accuracy than neural networks for more complex tasks. Previously, there was a method to deploy binary multi-layer perceptrons on smart network cards, but the throughput of smart network cards is several orders of magnitude lower than that of programmable switches, and this method cannot be applied to programmable switches because it consumes too many hardware resources.

[0004] In previous explorations, some methods have proposed the concept of hybrid analysis, that is, part of the traffic is analyzed on the programmable data plane, and part of the traffic is sent to the large tree structure model on the server for analysis. However, these explorations lack design and do not precisely control the traffic that should be sent to the server for analysis. Summary of the invention

[0005] The present invention provides a neural network-based intelligent data plane solution design and device, aiming to upgrade the network traffic analysis mechanism and improve the accuracy of network traffic analysis.

[0006] To this end, the first object of the present invention is to propose a neural network-based intelligent data plane solution design, including:

[0007] Deploy a recurrent neural network on a P4 programmable switch to perform line-speed analysis of traffic and obtain switch classification results;

[0008] According to the switch classification result, filtering the first part of traffic whose classification confidence is lower than a set classification confidence threshold;

[0009] By deploying a Transformer-based model on the server, the first part of the traffic is upgraded and analyzed to improve the classification accuracy.

[0010] Among them, a recurrent neural network is deployed on the P4 programmable switch to perform line-speed analysis on the traffic and obtain the switch classification results, including:

[0011] Assign the array index of traffic storage according to the hash value, and update and maintain the traffic;

[0012] Embed the sequence information of traffic into a low-dimensional vector;

[0013] According to the low-dimensional vector sequence obtained by embedding, the intermediate reasoning result is obtained through recurrent neural network reasoning;

[0014] Aggregate the intermediate reasoning results;

[0015] Determine whether to upgrade the analysis based on the aggregation results.

[0016] Among them, the array index of the traffic storage is allocated according to the hash value, and the traffic is updated and maintained, including:

[0017] Calculate the hash value based on the traffic [source IP address - destination IP address - source port - destination port - protocol type] quintuple information as the array index for storing traffic information;

[0018] Stores traffic identity information and the timestamp of the last packet;

[0019] The storage traffic is updated and maintained based on whether the identity information conflicts and whether the timestamp has timed out.

[0020] The sequence information is a packet length sequence or a packet time interval sequence of the traffic; embedding the sequence information of the traffic into the low-dimensional vector is to embed the packet length sequence and / or the packet time interval sequence into the low-dimensional vector sequence by table lookup.

[0021] Among them, according to the low-dimensional vector sequence obtained by embedding, the intermediate reasoning results are obtained through recurrent neural network reasoning, including:

[0022] Preset the number of time steps based on hardware resource constraints and the sliding window length accordingly;

[0023] Storing the low-dimensional vector and updating the low-dimensional vector sequence in the sliding window;

[0024] The calculation of the recurrent neural network is continuously performed on the low-dimensional vector sequence for a number of times equal to the time step by table lookup to obtain an intermediate inference result.

[0025] The intermediate reasoning results are aggregated, and whether to upgrade the analysis is determined based on the aggregated results, including:

[0026] Aggregate the sequence formed by the intermediate inference results as the window slides, and select the cumulative maximum value as the analysis result and its confidence;

[0027] Use an optimized ternary encoding algorithm to compress the number of steps required to select the maximum value;

[0028] The analysis results and their confidence are compared with the preset confidence threshold. If they are lower than the preset confidence threshold, the analysis results are considered ambiguous. If the cumulative number of result ambiguities exceeds the preset threshold, this part of the traffic is taken as the first part of the traffic described in the present invention, and is forwarded to the server, and an upgraded analysis is performed using a Transformer-based model.

[0029] The first part of the traffic is upgraded and analyzed by deploying a Transformer-based model on the server to improve the classification accuracy, including:

[0030] Use DPDK to accelerate packet processing and create multiple analysis engines based on RSS multiple receive queues:

[0031] A packet parsing engine, used to obtain original data packets and packet parsing data; wherein the packet parsing engine calls the DPDK interface to obtain the original data packets from the network card, and then parses and extracts the information required for reasoning analysis;

[0032] A flow information organization engine, used to organize the data obtained from packet parsing according to flows; wherein the flow information organization engine obtains information extracted from the packet parsing data from the packet parsing engine, and organizes the information of each flow according to the flow determined by the five-tuple [source IP address-destination IP address-source port-destination port-protocol type], and transmits the information required for reasoning in batches in units of flows;

[0033] An inference analysis engine, used to perform inference analysis based on the data of each flow; wherein the inference analysis engine obtains the batch input required for the inference analysis from the flow information organization engine, and obtains the batch inference analysis results after Transformer-based model inference;

[0034] A packet cache engine is used to cache packets and send out packets after obtaining inference results; wherein the packet cache engine obtains and caches batch inference analysis results from the inference analysis engine, obtains original data packets from the packet parsing engine, caches data packets that need to wait for inference analysis results, and sends data packets for which inference analysis results can be found in the cache.

[0035] The second object of the present invention is to provide an intelligent data plane device based on a neural network, comprising:

[0036] The preliminary analysis module is used to deploy a recurrent neural network on the P4 programmable switch to perform line-speed analysis of traffic and obtain switch classification results;

[0037] A screening module, configured to screen a first portion of traffic whose classification confidence is lower than a set classification confidence threshold according to the classification result of the switch;

[0038] The upgraded analysis module is used to perform upgraded analysis on the first part of traffic by deploying a Transformer-based model on the server, thereby improving the classification accuracy.

[0039] The third object of the present invention is to provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute each step in the method of the aforementioned technical solution.

[0040] A fourth object of the present invention is to provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute each step in the method according to the aforementioned technical solution.

[0041] Different from the prior art, the neural network-based intelligent data plane solution design provided by the present invention deploys a recurrent neural network on a P4 programmable switch to perform line-speed analysis on the traffic to obtain the switch classification result; based on the switch classification result, the first part of the traffic whose classification confidence is lower than the set classification confidence threshold is screened; by deploying a Transformer-based model on the server, the first part of the traffic is upgraded and analyzed, thereby improving the classification accuracy. Compared with the analysis method outside the switch, the present invention has the advantage of high throughput, and compared with the previous analysis method based on the tree structure model on the switch, the present invention has the advantage of accuracy; by deploying a Transformer-based model on the server for upgraded analysis, it is possible to provide a high-throughput online traffic analysis method based on the Transformer model, and further improve the analysis accuracy of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention and / or additional aspects and advantages will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0043] Figure 1 It is a logical schematic diagram of a neural network-based intelligent data plane solution design provided by the present invention.

[0044] Figure 2It is a schematic diagram of a recurrent neural network architecture implemented on a switch in a neural network-based intelligent data plane solution design provided by the present invention.

[0045] Figure 3 It is a schematic diagram of parameters and resource consumption of a recurrent neural network model on a switch in a neural network-based intelligent data plane solution design provided by the present invention.

[0046] Figure 4 It is a schematic diagram of the architecture of an integrated reasoning system in the design of a neural network-based intelligent data plane solution provided by the present invention.

[0047] Figure 5 It is a schematic diagram of the expansion of a recurrent neural network according to time steps in a neural network-based intelligent data plane solution design provided by the present invention.

[0048] Figure 6 It is a schematic diagram of accessing low-dimensional embedding vectors of a recurrent neural network module in a neural network-based intelligent data plane solution design provided by the present invention.

[0049] Figure 7 The invention provides a maximum value selection ternary matching algorithm which is optional for an intermediate result aggregation module in a neural network-based intelligent data plane solution design.

[0050] Figure 8 It is a schematic diagram of reverse coding for the case of only one bit in the optional maximum value selection ternary matching algorithm of the intermediate result aggregation module in the neural network-based intelligent data plane solution design provided by the present invention. DETAILED DESCRIPTION

[0051] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0052] The embodiment of the present invention provides a neural network-based intelligent data plane solution design, including:

[0053] S110: deploy a recurrent neural network on the P4 programmable switch, perform line-speed analysis on the traffic, and obtain switch classification results.

[0054] Figure 1It is the overall logic diagram of the present invention. The meanings of the English expressions appearing in the figure are as follows, and the English expressions that appear repeatedly will not be explained again: STE is an activation function described later; FC is a fully-connected layer; GRU is a type of the recurrent computing unit; ev is an embedded vector, that is, a low-dimensional embedding vector, referred to as an embedding vector; the subscript S is the sliding window size; T_conf and T_esc are T conf and T esc two thresholds; DPDK is the data plane development kit; GPU is a graphics processing unit; Transformer is a machine learning model architecture; TS is timestamp; H and H' are hash functions; idx is the flow subscript, which is used to mark the location where traffic information is stored; ID is the flow identifier, which marks the traffic identity, such as a quintuple; CPR is cumulative probability; the subscript N is the number of categories. Figure 2 The upper part is the overall logic of traffic analysis, showing the overall analysis logic of the recurrent neural network and the integrated reasoning system on the switch. The left and middle are the logic of the recurrent neural network on the switch, and the rightmost end is a thumbnail of the integrated reasoning system. The sequence information of the data packets of the flow, in this embodiment, is the packet time interval, referred to as the packet interval, and the packet length, after passing through the embedding layer and the fully connected layer, a low-dimensional embedding vector is obtained. The sliding window maintains the low-dimensional embedding vector sequence in the window, and performs continuous calculations on the sequence by the cyclic calculation unit, in this embodiment, GRU, and finally passes through the output layer to obtain the intermediate analysis result. The intermediate analysis results are aggregated to obtain the final analysis results and analysis confidence, and the upgrade analysis mechanism is used to determine whether a flow needs to be upgraded for analysis. If a flow needs to be upgraded for analysis, this part of the traffic will be sent to the integrated reasoning system for reasoning. The details of the integrated reasoning system are described later. Figure 2 The lower part is a schematic diagram of the specific implementation of the recurrent neural network on the switch on the data plane, and the details are described later.

[0055] like Figure 1 As shown, the recurrent neural network on the switch in the embodiment of the present invention includes the following modules:

[0056] The traffic management module M1 allocates the array index for traffic storage according to the hash value, and updates and maintains the traffic; the traffic management module M1 calculates the hash value as the array index for traffic information storage according to the five-tuple information of the traffic [source IP address-destination IP address-source port-destination port-protocol type], stores the traffic identity information and the timestamp of the last packet, and updates and maintains the stored traffic according to conditions such as whether the identity information conflicts and whether the timestamp has timed out.

[0057] The information embedding module M2 is responsible for embedding the sequence information of the flow into the low-dimensional vector; the information embedding module M2 embeds the sequence characteristics of the traffic, such as the packet length sequence, the packet time interval sequence and other feature sequences into the low-dimensional vector sequence through table lookup.

[0058] The recurrent neural network module M3 is responsible for obtaining the intermediate reasoning result through recurrent neural network reasoning based on the low-dimensional vector sequence obtained by embedding; the recurrent neural network module M3 obtains the intermediate reasoning result based on the low-dimensional vector sequence. During implementation, the number of time steps is preset according to the hardware resource limit, and the sliding window length is preset accordingly. For the low-dimensional vector obtained by the information embedding module M2, the recurrent neural network module M3 stores and updates the low-dimensional vector sequence in the sliding window, and continuously performs recurrent neural network calculations on the sequence equal to the number of time steps through table lookup, and finally obtains the intermediate reasoning result.

[0059] The intermediate result aggregation module M4 is responsible for aggregating the intermediate reasoning results; the intermediate reasoning results calculated by the recurrent neural network module M3 are aggregated in a sequence formed by sliding the window to obtain the final analysis result and its confidence. The intermediate result aggregation module M4 can select the cumulative maximum value as the final analysis result and its confidence, and use the optimized ternary encoding algorithm to compress the number of steps required to select the maximum value.

[0060] The upgrade analysis module M5 determines whether to upgrade the analysis based on the aggregation results.

[0061] S120: According to the switch classification result, filter the first portion of traffic whose classification confidence is lower than a set classification confidence threshold.

[0062] Based on the final analysis result and confidence obtained by the upgrade analysis module M5 according to the intermediate result aggregation module M4, it is compared with the preset confidence threshold. If it is lower than the confidence threshold, the analysis result is considered to be ambiguous. If the cumulative number of result ambiguity exceeds the preset threshold, the subsequent traffic is forwarded to the server, and the Transformer-based model is used for upgrade analysis.

[0063] S130: By deploying a Transformer-based model on the server, the first part of the traffic is upgraded and analyzed to improve the classification accuracy.

[0064] The traffic analysis method of the present invention deploys a Transformer-based model on the server to perform an upgrade analysis on the first part of the traffic whose classification confidence is lower than the set classification confidence threshold, uses DPDK to accelerate the packet processing process, and creates multiple analysis engines based on RSS multi-receive queues:

[0065] Packet parsing engine E1 is responsible for taking the original data packet from the network card and obtaining the packet parsing data;

[0066] The flow information organization engine E2 is responsible for organizing the data obtained from packet parsing according to flows;

[0067] The reasoning analysis engine E3 is responsible for performing reasoning analysis based on the data of each flow;

[0068] The packet cache engine E4 is responsible for caching the packet and sending the packet after obtaining the inference result.

[0069] The above engines form a non-blocking packet processing pipeline.

[0070] Furthermore, the packet parsing engine E1 calls the DPDK interface to get the data packet from the network card, parses and extracts the information required for reasoning analysis, passes the extracted information to the flow information organization engine E2, and passes the original data packet and packet parsing data to the packet cache engine E4.

[0071] The flow information organization engine E2 obtains the information extracted from the packet parsing data from the packet parsing engine E1, and organizes the information of each flow into units of flows determined by the five-tuple [source IP address-destination IP address-source port-destination port-protocol type]. When the reasoning analysis engine E3 needs input, the information required for reasoning is delivered in batches in units of flows.

[0072] The reasoning analysis engine,E3,obtains the batch input required for reasoning analysis from the,stream information organization engine E2, obtains the batch reasoning analysis output after,transformer-based model reasoning, and passes the batch output to the,packet cache engine E4.

[0073] The packet cache engine E4 obtains and caches batch reasoning analysis results from the reasoning analysis engine E3, obtains original data packets from the packet parsing engine E1, caches data packets that need to wait for reasoning analysis results, and sends data packets whose reasoning analysis results can be found in the cache.

[0074] Figure 2The recurrent neural network reasoning architecture implemented on the P4 programmable switch of the present invention is demonstrated. The recurrent neural network can directly receive the original traffic sequence information as input. In this embodiment, the input sequence is a packet length sequence and a packet time interval sequence. When the information is input, the packet length sequence and the packet time interval sequence will pass through the embedding layer and then the fully connected layer, and be embedded into a low-dimensional vector; then they will cyclically pass through the recurrent calculation unit. In the embodiment, GRU is used, a recurrent calculation unit commonly used in recurrent neural networks; finally, in the traffic classification task, the output layer is composed of a fully connected layer plus a softmax function. In this embodiment, the recurrent neural network is a binary recurrent neural network, and the activation function is set to the STE (Straight-through Estimator) function. The effect is that during forward propagation, the input is mapped to 1 or -1 based on whether it is greater than zero, and during reverse propagation, the gradient in the interval of -1 and 1 remains unchanged, the gradient less than -1 becomes -1, and the gradient greater than 1 becomes 1. During reasoning on the data plane, the inputs of the embedding layer, fully connected layer, and neural network layers such as GRU, as well as the outputs after activation functions, are all considered as bit strings. The mapping relationship from the input bit string to the output bit string is obtained based on the pre-trained model. The mapping relationship is stored as a table of size 2 to the power of the length of the input bit string in the P4 language, and the output is obtained by looking up the input table to complete the forward propagation. For the case where the recurrent neural network is not binary, such as four values, eight values, or more, its essence is the mapping of the input bit string to the output bit string, and there is no difference in the specific implementation of the P4 programmable switch.

[0075] The cyclic execution of the cyclic calculation unit of the recurrent neural network requires the storage, reading and updating of the memory value, but due to the limitation of the architecture of the P4 programmable switch, it is impossible to use registers to directly implement this function. Therefore, the present invention designs the expansion of the calculation time step of the cyclic calculation unit, and performs a series of time step calculations in a series of processing stages, also called stages, of the switch packet processing pipeline. Since the number of stages of the P4 programmable switch is limited and the number of time steps that can be expanded is limited, the present invention is designed to utilize a sliding window mechanism to maintain a sliding window of size S on the input sequence, maintain the low-dimensional embedding vector of the sequence in the sliding window, and continuously calculate S time steps for the low-dimensional embedding vector in the window each time, and finally obtain the intermediate analysis result through the output layer, and then aggregate the intermediate analysis results of all times to obtain the final analysis result.

[0076] For traffic classification tasks, the intermediate result aggregation algorithm can adopt the classification with the largest cumulative probability, but there may be a situation where the cumulative probability of no classification is significantly ahead, which is also called the situation where the classification result is ambiguous. At this time, adopting the classification with the largest cumulative probability may reduce the confidence in classification. For this purpose, the present invention designs a Transformer-based model deployed on the server to upgrade and analyze a small number of traffics whose classification results are difficult to determine on the switch. However, there are two major challenges: First, the aggregation algorithm must be carefully designed to capture the traffic with ambiguous classification results as accurately as possible, and only upgrade and analyze a small amount of traffic to the server, while ensuring that the vast majority of traffic is analyzed at line speed on the switch. Second, the upgraded analysis model uses a Transformer-based model to improve the accuracy, but due to the complex calculations required for model reasoning, it is not easy to improve the throughput of reasoning analysis and maintain high-speed network forwarding.

[0077] To address the first challenge, the present invention measures classification confidence in the aggregation algorithm. For each classification, the present invention accumulates the probability of the classification in all previous intermediate analysis results, and selects the classification with the largest cumulative probability as the final classification. The present invention defines classification confidence as the cumulative probability of the final classification divided by the number of accumulated intermediate analysis results, and sets a threshold T conf , if the classification confidence is less than T conf , it is considered as a fuzzy classification result. When the number of fuzzy classification results of a flow is greater than another preset threshold T esc , this traffic will be forwarded to the Transformer-based model for upgrade analysis.

[0078] T conf and T esc The two thresholds are obtained from the classification confidence distribution of the training samples, T conf The setting should classify misclassified samples as low confidence as much as possible, and classify correctly classified samples as high confidence as much as possible. During training, assuming that p i is the probability of class i predicted by the recurrent neural network, and y is the true classification. The classic cross loss function CE is defined as CE = -log(p y ), this loss function only considers improving the model's ability to predict the correct classification. In the present invention, the loss function during training is defined as Strengthens the confidence gap between correct classification and misclassification, where (1-p y ) γ and The two weights, proposed by Focal Loss, can focus attention on samples that are difficult to classify correctly. Since the aggregation algorithm in this embodiment only selects the classification with the largest cumulative probability, the loss function can be simplified as where p false is the largest p among incorrect classifications i . According to the classification confidence distribution on the training set, T conf After that, by setting T esc To ensure that no more than a certain percentage, such as 5%, of the traffic is upgraded for analysis.

[0079] For the second challenge, the present invention designs an integrated reasoning system, deploys a Transformer-based model on the server for fast online traffic analysis, and implements a non-blocking packet analysis pipeline by four types of single-threaded tasks, also known as engines. The details will be introduced later.

[0080] The following is a detailed explanation of the implementation details of the recurrent neural network on the P4 programmable switch in conjunction with the figure. First is the M1 traffic management module. Since traffic analysis needs to maintain the status information of each flow, it is necessary to assign a storage location subscript to the flow, referred to as the flow subscript. The previous method uses the control plane to assign flow subscripts. In order to achieve line-speed traffic analysis, the present invention adopts an allocation method based on a hash function. Specifically, the subscript of a flow f is the result of the output modulo the maximum number of supported flows obtained by the hash function H using the quintuple of f as input, that is, H(f(quintuple)%maximum number of supported flows). Hash functions and modulo may introduce collisions, that is, two flows with different quintuples are assigned the same flow subscript by the hash function. To avoid confusion, this embodiment records the [traffic identifier, timestamp] tuple corresponding to the subscript position in the traffic management table. Among them, because the quintuple is too long and difficult to store directly on the switch, this embodiment uses another hash function H' to calculate the value obtained by H'(f(quintuple)) as the traffic identifier. The timestamp is the time when the most recent packet of this flow arrives at the switch. When a flow index conflict occurs, the present invention allows a new flow to replace and occupy the position if and only if the old flow has timed out, that is, the time interval between the most recent packet and the current packet exceeds a preset threshold. Otherwise, if the new flow fails to occupy the position, it will fall back to the model trained with only the features of a single packet, or perform an upgrade analysis when the integrated reasoning system has sufficient computing power. In an embodiment, the model trained based on the features of a single packet can adopt a decision tree model or a random forest model used in previous explorations.

[0081] The main parts of the information embedding module M2 and the recurrent neural network module M3 have been introduced in the previous article when introducing the recurrent neural network reasoning architecture. Here, we will provide a supplementary introduction to the implementation of the sliding window on the programmable switch, that is, the maintenance and access of the low-dimensional embedding vector in the sliding window. Figure 5 As shown, the sliding window length is S, and the embedding vectors in the window are recorded as ev1 to ev SAfter expanding by time step, the computational units are also expanded into S units, which are recorded as GRU1 to GRU from front to back. S , the implicit state changes from the initial Calculate h S Consider a window starting from the kth packet and ending at the k+S-1th packet. When the k+S-1th packet arrives, the window is filled, and the calculation of S consecutive time steps will be performed on the window. Therefore, before a window is filled, the embedding vectors of the previous S-1 packets need to be temporarily saved. The present invention uses a ring buffer of size S-1 to save these embedding vectors, and the storage location is recorded as bin1 to bin S-1 Specifically, the embedding vector of the kth packet will be stored in the k%(S-1)+1th bin, so the embedding vector of the k+S-1th packet will occupy the storage position of the original embedding vector of the kth packet, because the embedding vector of the kth packet is no longer useful when the k+Sth packet arrives. The advantage of this design is that each bin is independent of each other and can be accessed in parallel. This storage scheme will bring challenges to reading the embedded vector, because the first embedded vector ev1 in the window may not be stored in the first bin, so the bin cannot be statically stored. k The embedding vector read in is passed to GRU k Specifically, the i-th GRU inputs the required embedding vector (i∈[1, S-1]), which is stored in the (k-S+1)%(S-1)+1th bin. When declaring the table corresponding to GRU in the P4 programmable switch, the storage location of the keyword must be statically specified, so Figure 6 As shown in the figure, the embedding vector needs to be read from the bin into an intermediate variable called metadata, and then the metadata is distributed to the correct GRU table.

[0082] Intermediate result aggregation module M4, this embodiment shows a multi-classification task, and selects the classification with the largest cumulative probability as the final classification result, and the corresponding classification cumulative probability divided by the number of accumulated windows is used as confidence. In order to avoid cumulative overflow, the accumulated number and probability of sliding windows are periodically cleared in this embodiment. The remaining main problem is how to find the classification with the largest cumulative probability and its cumulative probability among multiple classification cumulative probabilities, which is similar to the argmax operation. The argmax operation refers to finding the subscript of the largest element in an array. However, argmax is not supported on the switch. If compared two by two, the required pipeline processing stage, that is, the number of stages, is large. Among the matching methods based on table lookup, the method based on exact matching requires too many table entries, and the number of simple ternary matching algorithm table entries is also large, which is difficult to expand. To this end, the present invention proposes a new argmax algorithm based on ternary matching. Ternary matching, that is, each bit in the table entry has three types: 0, 1, and *, where * is a wildcard, which can match both 0 and 1. In the ternary matching table, since there may be multiple entries that can match the keyword, the priority of the entries is specified. If the entries are written in the order in which they are generated, the earlier the entries are generated, the higher the priority. The ternary matching table designed by the present invention, in which the keyword is the cumulative probability of each category to be compared, and the value of the entry is the category with the largest cumulative probability under the corresponding situation. To simplify the description, the category with the smaller number is taken when the cumulative probability is the largest. Assuming that n numbers are to be compared, and each number has m binary bits, then the keyword has n segments, each segment corresponds to a number, and has m ternary bits, that is, it can be one of 0, 1, and *. Starting from the highest bit of each segment to the lowest bit, that is, the mth bit, the possibilities of each bit are recursively enumerated in sequence. At the lth bit, there are 2 n There are two possibilities. Consider the first k segments where this bit is 1 and the last nk segments where this bit is 0, denoted as C. (l，k) , then it is obvious that the last nk numbers cannot be the maximum value, and there is no need to enumerate the situations from the l+1th to the mth digits after this nk segment. (l，k) of 2 (m-1)n Seed situation, enumerated 2 (m-1)k No further enumeration is required after the case, reducing the enumeration space by 2 (m-l)(n-k) Based on this idea, a recursive program can be written to generate table entries, but there are still many table entries. The present invention further optimizes the algorithm by two steps. The first optimization is to observe that C (l，0) and C (l，n) The two extreme cases, that is, the first bit is enumerated as all 0 or all 1, their further enumeration can be combined. (l，0) In each case of C, if the first bit is changed from 0 to 1, the largest number subscript remains unchanged. (l，n)In each sub-case of , if the lth position is changed from all 1 to 0, the subscript of the largest number will not change. Therefore, the lth position can be filled with wildcards * to merge these two cases. In order to avoid the wildcard from mistakenly matching other cases that are not all 0 and not all 1, this algorithm will enumerate the remaining 2 positions of the lth position. n -2 possibilities and generate corresponding table entries, finally enumerate C (l，0) and C (l，n) The second optimization is that for the case of m=1, this algorithm designs a reverse encoding method so that only n entries are needed to complete the match, see Figure 8 , where x is the common prefix of the segments. Figure 7 This is the pseudo code of the algorithm as a whole. It can be proved by mathematical induction that the number of entries generated by the algorithm is nm. n-1 , significantly better than the exact match algorithm and the unoptimized version.

[0083] Upgrade analysis module M5, the main body of which has been introduced in the previous article when introducing the recurrent neural network inference architecture. Because it is not convenient to do division on the switch, when comparing the confidence and threshold T conf When converted to cumulative probability, cumulative window number and threshold T conf When a flow is confirmed to be upgraded for analysis, that is, the number of fuzzy results exceeds the threshold T esc In order to enable the flow to be subsequently forwarded to the integrated reasoning system for upgrade analysis, it is necessary to maintain the upgrade analysis flag, which is also implemented by a register on the switch.

[0084] In this embodiment, the maintenance of the embedded vector in the sliding window requires knowing the packet number of the flow to which the data packet belongs, that is, the sequence number of the packet. During reasoning, it is also necessary to determine whether it is the first S-1 packets. The first S-1 packets are not reasoned, or reasoning is performed using a model trained based on the features of a single packet, which requires a packet counter. However, using a counter may overflow. Therefore, in this embodiment, the packet counter is split into two counters. The first counter is responsible for calculating the result of the packet sequence number modulo S-1 for the access of the embedded vector described above. The second counter is responsible for adding from 0 to S and stopping at S to determine whether S packets are full for query by the reasoning-related modules.

[0085] In this embodiment, the P4 programmable switch is exemplified by the Tofino1 switch. Figure 3 is the dependency of the components of the recurrent neural network on the switch in this embodiment, the hyperparameters and the pipeline processing stage, that is, the use of the stage. In this embodiment, the tables corresponding to the first two GRU calculation units are merged, that is, h = GRU2 (GRU1 (0, ev1), ev2) is merged into Similarly, the output layer is merged with GRU8, that is, h = Output(GRU8(h, ev8)) is merged into Since Tofino1 has a small number of stages, only 12, it is necessary to use the pipelines of both the ingress and egress parts. In this embodiment, traffic management is performed only in the ingress stage. In order to avoid traffic without flow subscript conflicts in multiple ingress stages entering the same egress pipeline to cause flow subscript conflicts, the egress and ingress pipelines are bound one by one. At the same time, because the forwarding destination of the Tofino1 programmable switch packet needs to be determined in the ingress stage, and in this embodiment, whether the upgrade analysis flag is updated is determined in the egress stage, the update of the upgrade analysis flag adopts a mirror + recirculate mechanism, and the upgrade analysis flag is maintained in the ingress stage.

[0086] The integrated reasoning system in the embodiment is introduced below with reference to the figure. The purpose of the integrated reasoning system is to enable the Transformer-based model to perform online reasoning with higher reasoning analysis throughput and forwarding capabilities. In this embodiment, the model uses the Transformer-based model that uses the recently proposed YaTC, a Transformer model for network traffic based on MAE and masked autoencoder. The input for reasoning and analysis of this model is the first 5 packets of a stream, the first 80 header bytes and the first 240 payload bytes of each packet, and the insufficient bits are padded with zeros. Figure 4 The schematic diagram of the architecture of the integrated reasoning system is shown. The new English explanations in the figure are as follows: NIC, the full name of Network Interface Card, that is, network card; RX, refers to the reception of the network card; TX, refers to the transmission of the network card; RSS, the full name of receive-side scaling, is a technology that effectively distributes the traffic received by the network card to multiple receiving queues. The present invention uses Intel's data plane development kit, namely DPDK, to create multiple receiving and sending queues for the network card, each group of receiving and sending queues is bound to an analysis module, and uses RSS technology to effectively distribute the upgraded analysis traffic received by the network card to the analysis modules corresponding to each receiving queue. Each analysis module is composed of four single-threaded tasks called engines, which are respectively called packet parsing engine E1, flow information organization engine E2, reasoning analysis engine E3, and packet cache engine E4. The above engines form a non-blocking packet processing pipeline. The following embodiments introduce the relationship between each engine and the relationship between them.

[0087] The packet parsing engine E1 uses the interface provided by DPDK to parse the flow identifier of the data packet, such as the five-tuple, and the original byte sequence required for reasoning analysis. The packet parsing engine E1 stores the parsed content in a lock-free circular buffer, from which the flow information organization engine E2 obtains the parsing results and organizes them according to the flow. After the packet parsing engine E1 parses the content required for reasoning of the data packet, the data packet is placed in another lock-free circular buffer, which is obtained by the packet cache engine E4 and sent according to the reasoning analysis results. Since in this embodiment, the Transformer-based model only uses the original byte sequence of the first 5 packets of a flow, the subsequent packets of a flow directly enter the lock-free circular buffer and go to the packet cache engine E4 without parsing the original byte sequence from the data packet.

[0088] The flow information organization engine E2 converts the pipeline parsing results passed in by the packet parsing engine E1 into batch model inputs so that the model can perform reasoning. Specifically, the flow information organization engine E2 continuously organizes the pipeline parsing results passed in by the packet parsing engine E1 through the lock-free ring buffer into information for each flow according to the flow identifier. When receiving a call from the reasoning analysis engine E3, the flow information organization engine E2 selects the flow according to the timestamp of the flow, forms a batch of data, and sends the batch data to the reasoning analysis engine E3 for reasoning. In this embodiment, if a selected flow has less than 5 packets, the flow information organization engine E2 will add zeros at the end, and the reasoning result of this time will be identified as an intermediate result. This flow may be selected again at the next selection.

[0089] In order to accelerate reasoning, the reasoning analysis engine E3 uses the CUDA architecture proposed by NVIDIA to interact with the GPU that assists in reasoning. The reasoning analysis engine E3 continuously calls the stream information organization engine E2 to request batch data. Once the batch data is obtained, the reasoning analysis engine E3 performs the reasoning of the model on the GPU and sends the reasoning results to a lock-free ring buffer received by the packet cache engine E4.

[0090] The packet cache engine E4 continuously obtains the latest inference results from the inference analysis engine E3 through a lock-free ring buffer, and releases according to the inference results, that is, sends the cached data packets. When receiving a data packet from the packet parsing engine E1, it first checks whether there is an inference result. If so, the data packet is released immediately. Otherwise, the packet enters the waiting queue of the flow to which it belongs and waits for the inference result. Once the E4 packet cache engine receives the inference result for a certain flow from the inference analysis engine E3, it will directly release all data packets in the waiting queue of this flow.

[0091] In addition, the present invention provides an intelligent data plane device based on a neural network, comprising:

[0092] The preliminary analysis module is used to deploy a recurrent neural network on the P4 programmable switch to perform line-speed analysis of traffic and obtain switch classification results;

[0093] A screening module, configured to screen a first portion of traffic whose classification confidence is lower than a set classification confidence threshold according to the classification result of the switch;

[0094] The upgrade analysis module is used to perform upgrade analysis on the first part of traffic by deploying a Transformer-based model on the server, thereby improving the classification accuracy.

[0095] In order to implement an embodiment, the present invention also proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps described in the aforementioned technical solution.

[0096] In order to implement the embodiments, the present invention further proposes a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method steps of the embodiments of the present invention are implemented.

[0097] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0098] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0099] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0100] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0101] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the described embodiment, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0102] A person skilled in the art may understand that all or part of the steps of implementing the method of the embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0103] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0104] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the embodiments are exemplary and cannot be construed as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the embodiments within the scope of the present invention.

Claims

1. A method for designing an intelligent data plane solution based on a neural network, characterized in that: include: Deploy a recurrent neural network on a P4 programmable switch to perform line-speed analysis of traffic and obtain switch classification results; According to the switch classification result, filtering the first part of traffic whose classification confidence is lower than a set classification confidence threshold; By deploying a Transformer-based model on the server, the first part of the traffic is upgraded and analyzed to improve the classification accuracy.

2. The method for designing an intelligent data plane solution based on a neural network according to claim 1, characterized in that: Deploy recurrent neural networks on P4 programmable switches to perform line-speed analysis of traffic, including: Assign the array index of traffic storage according to the hash value, and update and maintain the traffic; Embed the sequence information of traffic into a low-dimensional vector; According to the low-dimensional vector sequence obtained by embedding, the intermediate reasoning result is obtained through recurrent neural network reasoning; Aggregate the intermediate reasoning results; Determine whether to upgrade the analysis based on the aggregation results.

3. The method for designing an intelligent data plane solution based on a neural network according to claim 2, characterized in that: Assign the array index of the traffic storage according to the hash value, and update and maintain the traffic, including: Calculate the hash value based on the five-tuple information of traffic source IP address-destination IP address-source port-destination port-protocol type as the array index for storing traffic information; Stores traffic identity information and the timestamp of the last packet; The storage traffic is updated and maintained based on whether the identity information conflicts and whether the timestamp has timed out.

4. The method for designing an intelligent data plane solution based on a neural network according to claim 2, characterized in that: The sequence information is a packet length sequence or a packet time interval sequence of the traffic; embedding the sequence information of the traffic into the low-dimensional vector is to embed the packet length sequence and / or the packet time interval sequence into the low-dimensional vector sequence by table lookup.

5. The method for designing an intelligent data plane solution based on a neural network according to claim 2, characterized in that: According to the low-dimensional vector sequence obtained by embedding, the intermediate reasoning results are obtained through recurrent neural network reasoning, including: Preset the number of time steps based on hardware resource constraints and the sliding window length accordingly; Storing the low-dimensional vector and updating the low-dimensional vector sequence in the sliding window; The calculation of the recurrent neural network is continuously performed on the low-dimensional vector sequence for a number of times equal to the time step by table lookup to obtain an intermediate inference result.

6. The method for designing an intelligent data plane solution based on a neural network according to claim 2, characterized in that: Aggregate the intermediate inference results and determine whether to upgrade the analysis based on the aggregation results, including: Aggregate the sequence formed by the intermediate inference results as the window slides, and select the cumulative maximum value as the analysis result and its confidence; Use an optimized ternary encoding algorithm to compress the number of steps required to select the maximum value; The analysis result and its confidence are compared with the preset confidence threshold. If it is lower than the preset confidence threshold, the analysis result is considered ambiguous. If the cumulative number of result ambiguities exceeds the preset threshold, the subsequent traffic is forwarded to the server and an upgraded analysis is performed using a Transformer-based model.

7. The method for designing an intelligent data plane solution based on a neural network according to claim 1, characterized in that: By deploying a Transformer-based model on the server, the first part of the traffic is upgraded and analyzed to improve the classification accuracy, including: Use DPDK to accelerate packet processing and create multiple analysis engines based on RSS multiple receive queues: A packet parsing engine, used to obtain original data packets and packet parsing data; wherein the packet parsing engine calls the DPDK interface to obtain the original data packets from the network card, and then parses and extracts the information required for reasoning analysis; A flow information organization engine, used to organize the data obtained from packet parsing according to flows; wherein the flow information organization engine obtains information extracted from the packet parsing data from the packet parsing engine, and organizes the information of each flow according to the flow determined by the five-tuple of source IP address-destination IP address-source port-destination port-protocol type, and transmits the information required for reasoning in batches in units of flows; An inference analysis engine, used to perform inference analysis based on the data of each flow; wherein the inference analysis engine obtains the batch input required for the inference analysis from the flow information organization engine, and obtains the batch inference analysis results after Transformer-based model inference; A packet cache engine is used to cache packets and send out packets after obtaining inference results; wherein the packet cache engine obtains and caches batch inference analysis results from the inference analysis engine, obtains original data packets from the packet parsing engine, caches data packets that need to wait for inference analysis results, and sends data packets for which inference analysis results can be found in the cache.

8. An intelligent data plane device based on a neural network, characterized in that: include: The preliminary analysis module is used to deploy a recurrent neural network on the P4 programmable switch to perform line-speed analysis of traffic and obtain switch classification results; A screening module, configured to screen a first portion of traffic whose classification confidence is lower than a set classification confidence threshold according to the classification result of the switch; The upgraded analysis module is used to perform upgraded analysis on the first part of traffic by deploying a Transformer-based model on the server, thereby improving the classification accuracy.

9. An electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform each step in the method described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute each step of the method according to any one of claims 1 to 7.

Images