A network-in neural network deployment method based on an SDN mode

Abstract

The application relates to an in-network neural network deployment method based on an SDN mode, which maps input features and output results of a deep neural network model into flow table entries of network equipment, realizes deep neural network reasoning through table entry matching, and further realizes network functions such as traffic classification and anomaly detection. The application realizes efficient network data plane reasoning by compressing and converting the deep neural network model into a table entry matching task suitable for programmable network equipment. The application optimizes the utilization of storage and computing resources, significantly reduces the computing complexity of the network equipment, and improves the throughput and real-time performance. Through the innovative table entry compression and adaptive matching mechanism, the application supports high-precision applications such as traffic classification and anomaly detection, and significantly improves the intelligent management and optimization capability of the network. The application can realize efficient deployment of deep neural networks in in-network equipment, and provides an effective solution for the development of intelligent network technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network intelligence, and particularly relates to a network-in neural network deployment method based on an SDN mode. BACKGROUND

[0002] With the rapid growth of network scale, the complexity and variety of network traffic are also increasing, and traditional network devices and management methods are difficult to meet the demand of modern networks for intelligence and real-time. Especially in network traffic analysis, anomaly detection, traffic classification and other tasks, the traditional scheme based on static rules or simple algorithms cannot effectively cope with dynamically changing traffic and increasingly complex network attacks, which promotes the demand for intelligent network management. In recent years, deep learning technology, especially deep neural networks (DNN), has been widely used in network traffic analysis and anomaly detection and other fields, and has achieved certain results. However, the training and inference process of deep neural networks usually requires a large amount of computing resources and storage space, which makes it difficult to directly deploy them on traditional network devices (such as routers and switches).

[0003] At present, most deep learning-based network intelligent schemes rely on high-performance servers or data centers for model inference, although this can provide higher processing power, but there are significant limitations. First, when deploying deep neural network models on network devices, the computing resources and storage capacity of traditional devices often cannot meet the real-time inference requirements. Second, existing schemes ignore the limitations of device resources, resulting in low computing efficiency and high latency, which cannot cope with complex network traffic patterns or high throughput requirements. Especially on edge devices and small and medium-sized network devices, how to efficiently run deep neural network inference is still a problem to be solved.

[0004] With the development of software-defined networks (SDN) and programmable network devices, the flexibility and programmability of network devices have been greatly improved. In particular, programmable switches and routers based on the P4 language provide support for deep control and customized processing capabilities of the data plane, enabling deep neural networks to be deployed directly in network devices. However, existing neural network inference methods usually cannot adapt to the computing and storage constraints of these devices, resulting in high computational complexity and large latency in the inference process. Therefore, a new method is needed that can reduce computing and storage requirements while ensuring intelligent inference effectiveness and efficiently deploy to programmable network devices, promoting the development of intelligent network technology.

[0005] The application combines a neural network model compression technology and a table matching mechanism, and proposes a network traffic processing scheme based on an equivalent deep neural network, which can efficiently deploy deep neural network inference in network devices and improve intelligent management capabilities and real-time processing performance of the network devices. SUMMARY

[0006] The application aims to solve the problems of high computational complexity and large resource consumption in the neural network inference process of existing network devices, and provides an in-network neural network deployment method based on an SDN mode, which can optimize the calculation and storage requirements of neural networks in the network data plane, thereby realizing efficient deployment of deep neural networks in programmable network devices.

[0007] To achieve the above purpose, the technical solution adopted by the application is: an in-network neural network deployment method based on an SDN mode, which maps input features and output results of a deep neural network (DNN) model to flow table entries of a network device, and realizes deep neural network inference through table entry matching, thereby realizing network functions including traffic classification and anomaly detection; comprising the following steps:

[0008] (1) training DNN and binary neural network (BNN) models based on public network data sets to obtain corresponding weight parameters;

[0009] (2) compressing the DNN model, taking the features of the data packet as the input and the classification results of the model as the output, converting the input-output mapping into flow table entries suitable for programmable network devices, and reducing the storage resources occupied by the table entries through a three-layer compression method;

[0010] (3) using the BNN model for fast inference according to the calculation resource limit of the network device, optimizing the inference speed and storage efficiency under resource-limited conditions;

[0011] (4) when the data packet enters the network, performing DNN equivalent table entry matching using the extracted feature values to obtain the inference result of the deep neural network, and performing corresponding network operations according to the inference result.

[0012] Further, the DNN model is optimized by a table compression method to reduce the resources occupied by table storage and improve the inference speed.

[0013] Further, in step (1), when training the DNN and BNN models, multiple network traffic data sets are used to ensure that the models have good generalization ability and adapt to traffic features in different network environments.

[0014] Further, in step (4), when the data packet matches the flow table entry, the inference result is returned, and the network policy is executed to perform traffic classification, anomaly detection or other network functions.

[0015] Further, when the number of data packets in the data packet counting register reaches a preset threshold, the flow table entry with low hit rate is cleared, the use efficiency of the flow table is optimized, and the utilization rate of the computing and storage resources of the network device is improved.

[0016] Further, the deep neural network inference is performed in the data plane, and by directly performing inference on the network device, network delay is reduced, and real-time network traffic analysis and decision-making are optimized.

[0017] Compared with the prior art, the present application has the following beneficial effects: the present application optimizes the utilization efficiency of computing resources and storage by closely combining the deep neural network inference process with the data plane of the programmable network device. Compared with the traditional deep learning deployment method relying on high-performance servers, the present application significantly reduces the computational complexity and storage consumption of the network device by compressing and binarizing the neural network, while improving the inference speed and real-time performance. In addition, the table entry matching mechanism is used to convert the deep neural network model into a task executable by the network device, so that intelligent functions such as traffic classification and anomaly detection can be efficiently executed directly on edge devices such as switches, reducing network delay and improving the intelligent processing capability of the network. The present application has wide applicability and can effectively improve the traffic management and security protection capability in large-scale network environment. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is the overall architecture diagram of the method of the embodiment of the present application;

[0019] Figure 2 is the in-network equivalent neural network implementation architecture diagram in the embodiment of the present application;

[0020] Figure 3 is the in-network equivalent neural network running code framework in the embodiment of the present application. DETAILED DESCRIPTION

[0021] The present application will be further described below in conjunction with the drawings and embodiments.

[0022] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as generally understood by those skilled in the art to which the present application belongs.

[0023] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments in accordance with the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, steps, operations, elements, components, and / or groups thereof, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof.

[0024] The embodiment provides an in-network neural network deployment method based on an SDN mode. The method maps input features and output results of a deep neural network (DNN) model to flow table entries of a network device, and realizes deep neural network inference through flow table entry matching, thereby realizing network functions such as traffic classification and anomaly detection. In this process, first, a DNN and a binary neural network (BNN) model are trained based on a public network dataset, and the model is compressed, and a three-layer compression method is used to reduce the storage occupation of the table entries. The compressed table entries are pushed to the target programmable switch through the P4Runtime interface to realize real-time traffic inference. In the case of limited computing resources of the network device, the BNN model is used for inference to further optimize the storage and computing efficiency. When the data packet enters the network, the device extracts its features and matches them with the flow table entries, obtains the inference result, and performs the corresponding network operation, such as traffic classification or anomaly detection. The application also optimizes the table entry storage and inference process to ensure that the network device can efficiently process large-scale traffic, reduce network delay, and improve the management and decision-making ability of the intelligent network. The method specifically includes the following steps:

[0025] (1) Training a DNN and a binary neural network (BNN) model based on a public network dataset to obtain corresponding weight parameters. When training the DNN and BNN models, multiple network traffic datasets are used to ensure that the model has good generalization ability and is suitable for traffic characteristics in different network environments.

[0026] (2) Compressing the DNN model, taking the features of the data packet (such as the five-tuple) as the input and the classification result of the model as the output, mapping the input-output into flow table entries suitable for programmable network devices, and reducing the storage resources occupied by the table entries through a three-layer compression method.

[0027] (3) According to the computing resource limit of the network device, using the BNN model for fast inference to optimize the inference speed and storage efficiency in the case of limited resources.

[0028] (4) When the data packet enters the network, the extracted feature values are used for DNN equivalent table entry matching to obtain the inference result of the deep neural network, and the corresponding network operation is performed according to the inference result, such as traffic classification or anomaly traffic detection.

[0029] When the data packet matches the flow table entry, the inference result is returned, and the traffic classification, anomaly detection or other network functions are performed through the corresponding network policy.

[0030] Whenever the number of data packets in the packet count register reaches the preset threshold, the flow table entry with low hit rate is cleared, optimizing the use efficiency of the flow table and improving the utilization rate of the computing and storage resources of the network device.

[0031] The deep neural network inference is performed in the data plane, which reduces network latency by directly performing inference on the network device, optimizing real-time network traffic analysis and decision-making.

[0032] As shown in Figure 1 , the present application realizes an efficient network traffic processing scheme by combining deep neural networks with the table entry matching mechanism of programmable network devices. By compressing the neural network model and using binary neural network technology, not only the storage and computing complexity are reduced, but also the real-time performance and throughput of the network device are significantly improved. This scheme can effectively support intelligent tasks such as network traffic classification and anomaly detection, promoting the development of intelligent network technology and having wide application prospects, as follows:

[0033] 1. Network architecture and data plane deployment: as shown in Figure 1 , the overall architecture of the present application includes multiple programmable network devices, a network data plane and an intelligent inference module. Each network device can process network traffic in real time through the locally deployed compressed neural network model. The network data plane can perform intelligent processing tasks such as classification and anomaly detection based on traffic characteristics by interfacing with the deep neural network (DNN) model. In the network device, the original traffic data is processed in real time by the adaptive model, and the inference result is used as the network control instruction to execute traffic control or issue an alarm.

[0034] 2. Neural network model training and compression: in this embodiment, first, the DNN and binary neural network (BNN) models are trained using public network data sets to obtain the model's weight parameters. Through the training of the deep neural network, the recognition ability and accuracy of the model in different network traffic scenarios are optimized. During the training process, multiple network traffic data sets are used to ensure that the model has strong generalization ability and adapts to traffic characteristics in different network environments. After the DNN model is trained, the model is further compressed, the five-tuple features of the data packet are used as the input, and the classification result of the model is used as the output, and then the input-output mapping is converted into a flow table entry suitable for the network device, and the storage resources are optimized.

[0035] 3. In-network equivalent neural network implementation architecture: as shown in Figure 2As shown, the implementation architecture of the in-network equivalent neural network converts the calculation process of the deep neural network model into a table entry matching task to reduce the consumption of storage and calculation resources. In this architecture, the network device matches and infers using flow table entries. When a data packet enters the network, the data packet features are extracted and matched with the compressed flow table entries. Through the matching result, the inference result of the deep neural network can be obtained, and then the network intelligent functions such as traffic classification or anomaly detection are realized.

[0036] 4. Neural network inference and decision execution framework: Figure 3 The running code framework of the in-network equivalent neural network is shown, which includes data acquisition, model loading, inference calculation, decision execution and other modules. The data acquisition module is responsible for capturing and processing network traffic in real time. After preprocessing the data, it is sent to the neural network model for inference. The model loading and inference module loads the compressed neural network model from the storage, performs inference calculation, and generates the result. The decision module makes decisions such as traffic classification, anomaly detection, etc. according to the inference result, and executes traffic control or alarm operation through the response module.

[0037] Those skilled in the art will appreciate that embodiments of the application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer usable program code.

[0038] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0039] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocksFigure 1 the function(s) specified in the block or blocks.

[0040] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flow Figure 1 the flow or flows and / or blocks Figure 1 the function(s) specified in the block or blocks.

[0041] The above description is only the preferred embodiment of the present application, not other forms of the present application, any skilled in the art can use the above disclosed technical content to change or modify as equivalent embodiments of equivalent changes. But any simple modification, equivalent change and modification of the above embodiments without departing from the technical solution content of the present application, according to the technical essence of the present application, still belongs to the protection scope of the technical solution of the present application.

Claims

1. A method for in-network neural network deployment based on SDN modality, characterized in that, The input features and output results of a deep neural network (DNN) model are mapped to flow table entries of a network device, and deep neural network inference is realized through table entry matching, thereby realizing network functions including traffic classification and anomaly detection; the method comprises the following steps: (1) training a DNN and a binary neural network (BNN) model based on a public network dataset to obtain corresponding weight parameters; (2) compressing the DNN model, taking the features of a data packet as input and the classification results of the model as output, converting the input-output mapping into flow table entries suitable for a programmable network device, and reducing the storage resources occupied by the table entries through a three-layer compression method; First, a deep neural network and a binary neural network model are trained using a public network dataset to obtain the weight parameters of the model; during the training process, multiple network traffic datasets are used to adapt the model to the traffic characteristics in different network environments; after the deep neural network model is trained, the model is further compressed, the five-tuple features of a data packet are taken as input, the classification results of the model are taken as output, and then the input-output mapping is converted into flow table entries suitable for a network device, and the storage resources are optimized; (3) using the BNN model for fast inference according to the calculation resource limitations of the network device to optimize the inference speed and storage efficiency under resource limitations; (4) when a data packet enters the network, the extracted feature values are used for DNN equivalent table entry matching to obtain the inference results of the deep neural network, and corresponding network operations are performed according to the inference results; The implementation architecture of the in-network neural network converts the calculation process of the deep neural network model into a table entry matching task; in this architecture, the network device uses flow table entries for matching and inference, extracts the features of a data packet when the data packet enters the network, and matches the data packet with the compressed flow table entries; through the matching results, the inference results of the deep neural network are obtained, and network intelligent functions such as traffic classification or anomaly detection are realized. 2.The in-network neural network deployment method based on SDN modal according to claim 1, characterized in that, The DNN model is optimized through a table entry compression method to reduce the resources occupied by table entry storage and improve the inference speed.

3. The in-network neural network deployment method based on the SDN mode according to claim 1, characterized in that, In step (1), when training the DNN and BNN models, multiple network traffic datasets are used to ensure that the model has good generalization ability and adapts to the traffic characteristics in different network environments.

4. The in-network neural network deployment method based on the SDN mode according to claim 1, characterized in that, In step (4), when a data packet is matched with a flow table entry, the inference result is returned, and traffic classification, anomaly detection or other network functions are performed through corresponding network strategies.

5. The in-network neural network deployment method based on SDN modalities according to claim 1, characterized in that, Whenever the number of data packets in the data packet count register reaches a preset threshold, the flow table entries with low hit rates are cleared to optimize the use efficiency of the flow table and improve the utilization rate of the calculation and storage resources of the network device.

6. The in-network neural network deployment method based on the SDN mode according to claim 1, characterized in that, The deep neural network inference is performed in the data plane, and by directly performing inference on the network device, network delay is reduced, and real-time network traffic analysis and decision-making are optimized.

Images