Flow feature extraction system based on programmable switch and intelligent network card

Abstract

The invention relates to the technical field of Internet, in particular to a flow feature extraction system based on a programmable switch and an intelligent network card, which comprises a feature grouping and aggregation module and a feature vector calculation module, the feature grouping and aggregating module is arranged on the programmable switch, and is used for selecting and aggregating multi-granularity data packet feature metadata from network traffic for caching, and expelling the cache to the feature vector calculation module according to a preset mechanism; the feature vector calculation module is arranged on the intelligent network card and used for receiving multi-granularity data packet feature metadata expelled from the programmable switch and processing the multi-granularity data packet feature metadata into feature vectors directly used for a machine learning algorithm through mapping, reduction and synthesis operations. The method is realized through cooperation of the programmable switch and the intelligent network card, multi-granularity data packet feature extraction and efficient feature calculation can be supported, and the detection accuracy is not reduced.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and more specifically to a traffic feature extraction system based on a programmable switch and an intelligent network card. Background Art

[0002] Due to the extensive use of encryption technology and the evolution of network attack methods, the availability of traditional traffic analysis methods based on packet payload content detection has dropped dramatically. With the rapid development of machine learning, traffic analysis methods based on machine learning have gradually become mainstream. This type of method has the advantages of high reliability, wide application range, and good scalability. A traffic analysis application based on machine learning consists of the following two systems: feature extraction system and behavior detection system. The feature extraction system extracts the required features from the original network traffic, such as packet size, packet timestamp, etc. The behavior detection system uses advanced machine learning algorithms to identify network behaviors from the packet features extracted by the feature extraction system.

[0003] However, in current machine learning-based traffic analysis applications, feature extraction systems are becoming a key bottleneck. Existing mainstream feature extraction systems usually use port mirroring to replicate collected network traffic and use a large number of servers to store massive network traffic and extract the required traffic features. These software-based solutions are not only limited by CPU processing power, but also have network problems such as triangular routing, which will bring a lot of communication, computing and storage overhead, making it difficult to support large-scale traffic feature extraction tasks. Some of the latest studies have also attempted to use programmable network hardware to accelerate the feature extraction process, and even complete the entire traffic analysis task on the data plane, thereby significantly reducing the need for additional bandwidth and servers. However, due to the limited computing model and memory resources of network hardware, these methods have deficiencies in flexibility, cannot achieve multi-granularity packet feature extraction and efficient feature calculation, and lack the versatility to support various traffic analysis algorithms and applications.

[0004] Therefore, how to provide a feature extraction system that can support multi-granularity data packet feature extraction and efficient feature calculation is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of this, the present invention provides a traffic feature extraction system based on a programmable switch and an intelligent network card, which is implemented by the collaboration of a programmable switch and an intelligent network card, and can support multi-granularity data packet feature extraction and efficient feature calculation without reducing detection accuracy.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A traffic feature extraction system based on a programmable switch and an intelligent network card, comprising: a feature grouping aggregation module and a feature vector calculation module;

[0008] The feature grouping aggregation module is arranged on the programmable switch, and is used to select and aggregate multi-granularity data packet feature metadata from network traffic for caching, and to evict the cache to the feature vector calculation module according to a preset mechanism;

[0009] The feature vector calculation module is set on the smart network card, and is used to receive multi-granularity data packet feature metadata expelled from the programmable switch, and process the multi-granularity data packet feature metadata into feature vectors directly used in the machine learning algorithm through mapping, reduction and synthesis operations.

[0010] Further, the feature grouping aggregation module includes: a cache allocation unit and a cache management unit;

[0011] The cache allocation unit is used to group the data packet feature metadata according to the coarsest granularity, and record the finest granularity grouping information of each data packet, aggregate the coarsest granularity grouping result and the finest granularity grouping information into a multi-granularity grouping data packet vector MGPV, and perform hierarchical caching on the MGPV;

[0012] The cache management unit is used to evict the cached MGPV to the smart network card through an eviction and aging mechanism.

[0013] Furthermore, in each multi-granularity group data packet vector MGPV, the finest-grained group key is stored in the form of a hash table to form a finest-grained group key table, the index of the finest-grained component table is saved together with the characteristic metadata of each data packet, and the finest-grained group key table is synchronized between the programmable switch and the smart network card, and all changes to the finest-grained group key table on the programmable switch will notify the smart network card to perform synchronous updates;

[0014] When the smart network card receives a multi-granularity packet vector MGPV from a programmable switch, it accesses the finest-grained group key of each multi-granularity packet vector MGPV according to the corresponding index in the finest-grained group key table, and splits the coarsest-grained grouping result accordingly to obtain grouping results of different levels of granularity.

[0015] Furthermore, the method of hierarchically caching the multi-granularity group data packet vector MGPV includes:

[0016] For short streams, a short buffer is allocated to store feature metadata for each coarsest-grained group;

[0017] For long flows, a set of long buffers is allocated to cache more packet feature metadata;

[0018] The size of the long buffer is set larger than that of the short buffer, and the number of the long buffer is less than that of the short buffer;

[0019] When a data flow fills its short buffer for the first time, a long buffer is popped from the stack to continue caching its packet feature metadata on the programmable switch; the stack is implemented on the programmable switch by a pointer and an array, requiring the resubmit primitive on the programmable switch to implement the semantics of element allocation and release.

[0020] Furthermore, the eviction mechanism of the cache management unit includes two situations, namely:

[0021] The first case is caused by hash collision. When a packet from a group not recorded by MGPV arrives at the programmable switch, if the corresponding slot is empty, the data will be directly inserted into the cache; otherwise, the old entry will be evicted to the SmartNIC together with its short buffer and long buffer feature metadata;

[0022] The second case is when the short buffer or the long buffer is filled. When a data packet from the MGPV record group arrives at the programmable switch and fills up the corresponding short buffer, if there is a long buffer in the stack, a long buffer is allocated to the group; otherwise, the feature metadata of the group in its short buffer will be evicted to the smart network card; when the data packet fills up the corresponding long buffer, the feature metadata of the group in both the short buffer and the long buffer will be evicted to the smart network card.

[0023] Furthermore, the aging mechanism of the cache management unit is:

[0024] Maintain a timestamp for each cache entry and evict a group entry from the cache if it has not been accessed for more than time T;

[0025] Some internal data packets that are constantly recycled in the programmable switch pipeline stay in the programmable switch through the recycling port, and cache entries are checked one by one at a certain frequency to determine whether they are timed out, and expired entries are evicted together with the data packet feature metadata in their short buffer and long buffer.

[0026] Further, the feature vector calculation module includes: a feature calculation unit and a performance optimization unit;

[0027] The feature calculation unit is used to perform summation, maximum value, minimum value, average value, variance, cardinality count and distribution-related feature calculation on multi-granularity data packet feature metadata;

[0028] The performance optimization unit is used to optimize the performance of the feature calculation unit from the aspects of calculation cycle, group table structure and memory allocation.

[0029] Furthermore, in terms of the calculation cycle, the optimization measures of the performance optimization unit are:

[0030] Dozens of processing cores are set up for parallel data packet processing, and each core executes 8 hardware threads. When a thread waits for memory access, the processing core switches to another thread to process other data packets.

[0031] Furthermore, in terms of the group table structure, the optimization measures of the performance optimization unit are:

[0032] A hash table with fixed-length chains is used to organize the group state, and entries that cannot be accepted by the hash table are stored in external DRAM.

[0033] Furthermore, in terms of memory allocation, the optimization measures of the performance optimization unit are:

[0034] According to the size and access pattern of the group state, the state is allocated to different memory levels. By modeling the group table placement problem as an integer linear programming problem, the optimal group table placement strategy is calculated to maximize the bandwidth utilization of the memory level while ensuring low access latency.

[0035] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention uses the flexibility of the programming capability of the smart network card to supplement the high throughput of the programmable switch data packet processing, and can process hundreds of Gbps of traffic with low overhead, supporting general traffic analysis applications. Compared with the existing traffic feature extraction system based on programmable switches, the programmable switch and the smart network card are used to collaborate to support multi-granularity data packet feature extraction and efficient feature calculation, and almost no reduction in detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A schematic diagram of the structure of a traffic feature extraction system based on a programmable switch and a smart network card provided by the present invention;

[0039] Figure 2 A schematic diagram of the cache allocation unit provided by the present invention grouping and caching data;

[0040] Figure 3A schematic diagram of the hardware architecture of the smart network card provided by the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] like Figure 1 As shown, the embodiment of the present invention discloses a traffic feature extraction system based on a programmable switch and an intelligent network card, including: a feature grouping aggregation module and a feature vector calculation module;

[0043] The feature grouping aggregation module is set on the programmable switch, which is used to select and aggregate multi-granularity packet feature metadata from network traffic for caching, and evict the cache to the feature vector calculation module according to a preset mechanism;

[0044] The feature vector calculation module is set on the smart network card, and is used to receive the multi-granularity data packet feature metadata expelled from the programmable switch, and through mapping, reduction and synthesis operations, process the multi-granularity data packet feature metadata into feature vectors directly used in machine learning algorithms.

[0045] The feature grouping and aggregation module and the feature vector calculation module are further explained below.

[0046] The feature grouping and aggregation module includes: a cache allocation unit and a cache management unit. Through the collaborative work of these two units, the storage and processing of multi-granularity feature metadata are optimized.

[0047] The cache allocation unit is used to group the data packet feature metadata according to the coarsest granularity, and record the finest granularity grouping information of each data packet, aggregate the coarsest granularity grouping result and the finest granularity grouping information into a multi-granularity grouping data packet vector MGPV, and perform hierarchical caching on the MGPV;

[0048] The cache management unit is used to evict the cached MGPV to the smart network card through the eviction and aging mechanism.

[0049] The functions of the cache allocation unit and the cache management unit are further explained below.

[0050] 1) The cache allocation unit is a key-value vector cache engine that supports multi-granularity packet feature metadata and takes into account efficient resource utilization. Since traffic analysis applications often require the recording of multi-granularity packet feature metadata, such as Kitsune and HEALD, both need to calculate the same packet features for packets at at least three granularities, including each source address (host), each IP connection (channel) and each streaming socket (socket), and there is usually a dependency relationship (often a dependency chain) between these granularities, therefore, the present invention proposes a new concept of multi-granularity grouped packet vector (MGPV) to efficiently support the grouping and caching of multi-granularity packet feature metadata.

[0051] Considering the chain dependency between grouping granularities, such as Figure 2 As shown in the figure, the MGPV deployed on the programmable switch only needs to group the data packet feature metadata according to the coarsest granularity (the Coarsest Granularity, CG), and record the grouping information of each data packet at the finest granularity (the Finest Granularity, FG). The smart network card can use this additional information and the coarse-grained grouping results to further restore the grouping results of the intermediate level granularity, thereby reducing the large amount of repeated storage caused by recording the grouping results of each granularity separately on the switch. Taking host, channel and socket as an example, the MGPV on the switch groups the data packets according to the host (i.e. the coarsest granularity) and saves the socket information of each data packet on the switch (i.e. the finest granularity). Later, on the smart network card, the group key of the socket granularity will be used to separate the channel granularity and socket granularity groups from the host granularity groups.

[0052] Next, the chain dependency between packet granularities is further explained. In theory, the features of each granularity can be calculated independently, but in traffic analysis, the features of different granularities are often interrelated. Taking the socket granularity as an example, the analysis results of the socket granularity often depend on the results of the channel granularity. Knowing the traffic situation of a specific channel can better analyze the performance of each socket. Otherwise, the analysis of the socket granularity lacks context and cannot accurately evaluate the traffic distribution. For example, if the traffic of a socket increases sharply, it is difficult to judge whether this is normal if the overall traffic data of the channel and host granularity is not known.

[0053] Taking host, channel and socket granularity as an example, the finest-grained grouping information is the socket information, i.e. the socket five-tuple: source IP, destination IP, source port, destination port and protocol type; a coarse-grained grouping may contain multiple fine-grained groups, such as multiple socket connections under a channel. If you want to analyze traffic anomalies now, the total traffic of host 1 is 10G, and host 1 has three channels with traffic of 8G, 1G, and 1G respectively. The traffic of a socket in channel 1 is 5G, which far exceeds the traffic of the sockets in channels 2 and 3. However, this is normal in channel 1. Therefore, if there is a lack of traffic information at the host and channel granularity, and only analysis is performed at the socket granularity, it is easy to mistakenly judge socket 1 in channel 1 as traffic anomaly.

[0054] The present invention adopts a more storage-saving method to store the finest-grained grouping information of the data packet, specifically: in each multi-granularity group data packet vector MGPV, the finest-grained group key is stored in the form of a hash table to form a finest-grained group key table, the index of the finest-grained component table is saved together with the characteristic metadata of each data packet, and the finest-grained group key table is synchronized between the programmable switch and the smart network card, and all changes to the finest-grained group key table on the programmable switch will notify the smart network card to perform synchronous updates;

[0055] Since the smart network card maintains the same finest-grained group key table as the programmable switch, when the smart network card receives a multi-granularity packet vector MGPV from the programmable switch, it accesses the finest-grained group key of each multi-granularity packet vector MGPV according to the corresponding index in the finest-grained group key table, and splits the coarsest-grained grouping result accordingly to obtain grouping results of different levels of granularity.

[0056] Specifically, MGPV implements packet grouping at a finer granularity based on the coarse-grained results. When grouping packets at a coarse granularity, the fine-grained group information of each packet is stored, and the coarse-grained group is split into multiple fine-grained groups using this additional information. For example, CG grouping is based on the source IP granularity, and then FG stores the group key of the finest granularity socket: source IP, destination IP, source port, destination port, and protocol type. The corresponding fine-grained information is searched according to the FG group key in the metadata corresponding to the coarsest granularity, that is, the source IP group key. Then, the intermediate granularity grouping is obtained based on the information in the fine-grained information. For example, the intermediate granularity such as the source IP-destination IP pair granularity grouping result can be searched based on the socket's five-tuple information. In this way, the coarsest group key table can be split according to the finest granularity group key to obtain the intermediate level granularity grouping result.

[0057] The present invention takes into account the long-tail characteristics of flow length distribution and adopts a hierarchical cache to cache the multi-granularity packet vector MGPV, specifically:

[0058] Since most flows are short flows consisting of a small number of packets, for short flows, a short buffer is allocated to store the feature metadata of each coarsest granularity group; for long flows, a group of long buffers is allocated to cache more packet feature metadata; this can greatly reduce the rate of packet feature metadata sent to the smart network card.

[0059] To adapt to the flow length distribution, the size of the long buffer is set much larger than the short buffer, and the number of long buffers is much smaller than that of short buffers;

[0060] When a data flow fills its short buffer for the first time, it may be a long flow, and a long buffer is popped from the stack to continue caching its packet feature metadata on the programmable switch; the stack is implemented on the programmable switch by a pointer and an array, and the resubmit primitive on the programmable switch is required to implement the semantics of element allocation and release.

[0061] 2) The cache management module ensures the efficiency and reusability of the cache through the eviction and aging mechanisms to improve the memory utilization of the system. The eviction mechanism includes two situations:

[0062] ①The first case is caused by a hash conflict. When the feature grouping aggregation module caches data, the storage location of each data packet feature metadata is calculated by a hash function. This hash calculation will map the input data packet to a specific location in the cache. If two different data packets are mapped to the same slot after hash calculation, a hash conflict will occur.

[0063] When a data packet from a group not recorded by MGPV (referring to data that does not yet exist in the MGPV cache, such as a new IP address starts communicating and no data packet has been recorded before, then this group of data packets is not recorded) arrives at the programmable switch, if the corresponding slot (referring to the corresponding storage location in the cache obtained by calculating the hash value, i.e., the buffer) is empty, the data will be directly inserted into the cache; otherwise, the old entry will be expelled to the smart network card together with its short buffer and long buffer feature metadata;

[0064] ② The second case is when the short buffer or long buffer is filled. When the data packet from the MGPV record group arrives at the programmable switch and just fills up the corresponding short buffer, if there is a long buffer in the stack, a long buffer is allocated to the group; otherwise, the characteristic metadata of the group in its short buffer will be expelled to the smart network card; when the data packet just fills up the corresponding long buffer, the characteristic metadata of the group in both the short buffer and the long buffer will be expelled to the smart network card. Among them, the data packet from the MGPV record group refers to the data packet that has been recorded and stored in the MGPV cache. The difference between it and the data packet of the unrecorded group is whether it has been recorded and whether it is already in the cache.

[0065] ③ The present invention designs an aging mechanism to recycle expired entries in the cache, and these resources can be released and reused after the corresponding flow becomes inactive. Specifically:

[0066] A timestamp is maintained for each cache entry and a group entry is evicted from the cache when it has not been accessed for more than time T; the aging mechanism helps the switch track the real active flows and further improve memory utilization.

[0067] In particular, occupied long buffers can be released in time and reused by other long flows, which enables the present invention to process more long flows and improve its memory efficiency. However, regularly monitoring the access status of all cache entries on the control plane is CPU intensive and consumes most of the control channel resources. In order to solve this problem, the present invention utilizes certain internal data packets that are continuously recycled (Recirculate) in the programmable switch pipeline to perform such monitoring on the data plane. These internal data packets stay in the programmable switch through the recirculation port (Recirculation port), check the cache entries one by one at a certain frequency to determine whether they have timed out, and evict the expired entries together with the data packet feature metadata in their short buffers and long buffers.

[0068] Specifically, the switch maintains a timestamp for each cache entry. Internal data packets pass through the switch at a certain frequency through the recirculation port. Each time they pass through, they check the timestamp of the cache entry in turn to determine whether it has timed out since the last access. These internal data packets only flow within the switch and will not be sent to the external network.

[0069] Next, the feature vector calculation module of the smart network card is further explained.

[0070] The feature vector calculation module receives and processes the aggregated MGPVs expelled from the programmable switch on the smart NIC. First, it traverses each MGPV unit, which contains the scattered packet feature metadata. Then, through mapping, reduction and synthesis operations, the statistics of the corresponding group are updated. Finally, the calculated feature vectors are collected as required and sent to the behavior detection component for further analysis.

[0071] Specifically, the feature vector calculation module includes: a feature calculation unit and a performance optimization unit;

[0072] The feature calculation unit is used to calculate the sum, maximum value, minimum value, average value, variance, cardinality count and distribution-related features of multi-granularity data packet feature metadata;

[0073] The performance optimization unit is used to optimize the performance of the feature calculation unit in terms of calculation cycle, group table structure and memory allocation.

[0074] The functions of the feature calculation unit and the performance optimization unit are further explained below.

[0075] 1) Feature Calculation Unit In the feature calculation process, mapping, synthesis, and collection usually do not involve complex arithmetic operations, which can be implemented intuitively on the Smart NIC. However, reduction, especially the reduction function responsible for feature calculation, has high computational complexity in the Smart NIC architecture. In order to achieve efficient reduction, the Smart NIC feature vector calculation module applies a powerful streaming algorithm. The following is the implementation of the specific streaming algorithm.

[0076] ① Sum, maximum, and minimum: These three types of functions represent the simplest reduction functions involved in the feature calculation process and do not require the use of streaming algorithms. They only need to save a state for each group and perform an addition or comparison operation on each package feature metadata.

[0077] ② Mean value and variance: Using Welford’s stream algorithm, the mean value and estimated variance can be calculated in one pass through the following formula, thus reducing the large amount of storage space required for two passes.

[0078]

[0079] ③ Cardinality counting: used to count the number of unique elements in a given group, usually used to determine the number of flows or connections established by each IP. The cardinality counting reduction algorithm is implemented through the HyperLogLog algorithm, and the number of different elements is estimated by calculating the number of leading zeros in the element hash value. This method is memory-efficient but has a large variance. To reduce the variance, we divide the flow into multiple buckets, calculate the cardinality of each bucket separately and take the average. A 32-bit hash is calculated for each packet, the first k bits are used to index the bucket, and the last 32-k bits are used to calculate the leading zeros, so that only 2^k states need to be maintained, and complex exponential and division operations are simplified to fast shift operations.

[0080] ④Distribution-related features: This part is divided into three functions: ft_hist, ft_percent and f_cdf. Among them, ft_hist is used to capture the histogram of given data to approximate its distribution, and other distribution-related features can be calculated from the histogram, so ft_hist is the basic implementation of other functions. f_cdf can be implemented by accumulating all bins of the histogram and normalizing the results, while ft_percent can be calculated by accumulating bins below the data. In the implementation of ft_hist, a state array is allocated to each group to store their bins, and the width and number of bins are specified by parameters. In addition, variable bin width is also used to improve the accuracy of features calculated by histograms.

[0081] 2) Also consider the following Figure 3 The unique hardware architecture of the Smart NIC based on the SoC architecture shown in the figure introduces a variety of optimization measures in the performance optimization unit to utilize the architectural uniqueness of the Smart NIC to improve the offload performance.

[0082] ① In terms of computing cycle, the optimization measures of the performance optimization unit are:

[0083] Dozens of processing cores are set up for parallel data packet processing, and each core executes 8 hardware threads. When a thread waits for memory access, the processing core switches to another thread to process other data packets.

[0084] Specifically, the present invention can be configured with dozens of RISC cores (such as Figure 3The cores in the MCU are used for parallel packet processing, and each core can execute 8 hardware threads at a frequency of 800MHz. The number of cycles executed by the processing core for each packet directly determines the overall performance of the Smart NIC. First, by reusing the hash values ​​calculated by the programmable switch to eliminate the hash calculation overhead of the Smart NIC, the 32-bit hash index value used by the switch cache system is sent to the Smart NIC together with the evicted MGPV. Second, the thread mechanism is used to hide memory access latency. When a thread waits for memory access, the core switches to another thread to process other packets, avoiding performance degradation caused by memory access. Finally, the module conducts in-depth analysis and optimization of the streaming algorithm, reducing the reliance on division operations, thereby significantly reducing processing cycles.

[0085] ② In terms of group table structure, mapping, reduction and synthesis operations need to maintain states for each group to perform corresponding functions. The present invention designs an efficient hash table structure for state management. The data bus width between processing cores and memory subsystems is 512 bits (64 bytes), which is usually sufficient to cover the states of multiple groups for simultaneous access. Using this hardware feature, the following optimization measures are taken:

[0086] A hash table with a fixed-length chain is used to organize the group state. This method achieves fast parallel search and low conflict rate. To resolve hash conflicts, entries that cannot be accepted by the hash table are stored in external DRAM to achieve expansion; that is, when a hash conflict occurs when an entry is inserted, that is, the storage location corresponding to the hash calculation already has an entry, then this entry is an unacceptable entry, and this new entry will be stored in external DRAM. Although accessing DRAM is slow, as long as the conflict rate is low, it has little impact on the overall performance.

[0087] ③ In terms of memory allocation, the optimization measures of the performance optimization unit are:

[0088] According to the size and access pattern of group state (referring to metadata related to a specific packet processing or feature extraction task, representing the data processing state of a group, such as the feature value of the class, statistical information, etc.), the state is allocated to different memory levels (such as Figure 3 The combination table placement problem is modeled as an integer linear programming problem, and the optimal combination table placement strategy is calculated to maximize the bandwidth utilization of the memory level while ensuring low access latency.

[0089] Specifically, the combination table placement problem is formulated, S represents the set of states required for a given feature extraction strategy, and each state s∈S is analyzed to obtain its size b s and the access time t of each data packet sThe hierarchical memory architecture is denoted by M, and each memory level m∈M has an access latency l m and the maximum accessible data bus width w m The width of the combination table in memory m is n m , which can be configured by the user to balance hash collision rate and lookup performance. Define a binary variable p if and only if state s is placed in the group table of memory m s,m =1, otherwise p s,m =0.

[0090] Then, the group state table placement problem can be solved based on integer linear programming (ILP):

[0091] min∑ s∈S ∑ m∈M p s,m t s l m (1)

[0092] The constraints are:

[0093]

[0094] Equation (1) indicates that the goal is to minimize the total access latency of all states, Equation (2) specifies that each state must be placed in a memory hierarchy, and Equation (3) specifies that the data bus of each memory must be able to access the group state table, according to the output {p s,m}The optimal group state table placement strategy can be determined.

[0095] In a specific embodiment, the feature extraction system of the present invention runs on an intelligent switch and an intelligent network card. The switch is composed of a programmable switch, and the cache allocation unit and cache management unit of the switch data plane are written in P4 language. The control plane program is written in C language, which is responsible for configuring the data plane status. The data packet features after grouping aggregation are expelled and sent to the intelligent network card for further processing. The feature calculation engine on the intelligent network card is implemented using Micro-C code, which is suitable for Netronom NFP-4000. During deployment, first use the P4 tool chain of the programmable switch system to burn the P4 program to the switch data plane, and run the control program to configure the data plane status, then compile the Micro-C program of the feature calculation engine to the intelligent network card and run it, the system will enter the normal operation state, and perform feature traffic extraction.

[0096] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0097] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A traffic feature extraction system based on a programmable switch and an intelligent network card, characterized in that: include: Feature grouping aggregation module and feature vector calculation module; The feature grouping aggregation module is arranged on the programmable switch, and is used to select and aggregate multi-granularity data packet feature metadata from network traffic for caching, and to evict the cache to the feature vector calculation module according to a preset mechanism; The feature vector calculation module is set on the smart network card, and is used to receive multi-granularity data packet feature metadata expelled from the programmable switch, and process the multi-granularity data packet feature metadata into feature vectors directly used in the machine learning algorithm through mapping, reduction and synthesis operations.

2. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 1 is characterized in that: The feature grouping aggregation module includes: a cache allocation unit and a cache management unit; The cache allocation unit is used to group the data packet feature metadata according to the coarsest granularity, and record the finest granularity grouping information of each data packet, aggregate the coarsest granularity grouping result and the finest granularity grouping information into a multi-granularity grouping data packet vector MGPV, and perform hierarchical caching on the MGPV; The cache management unit is used to evict the cached MGPV to the smart network card through an eviction and aging mechanism.

3. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 2 is characterized in that: In each multi-granularity group data packet vector MGPV, the finest-grained group key is stored in the form of a hash table to form a finest-grained group key table. The index of the finest-grained component table is saved together with the characteristic metadata of each data packet, and the finest-grained group key table is synchronized between the programmable switch and the smart network card. All changes to the finest-grained group key table on the programmable switch will notify the smart network card to synchronize and update; When the smart network card receives a multi-granularity packet vector MGPV from a programmable switch, it accesses the finest-grained group key of each multi-granularity packet vector MGPV according to the corresponding index in the finest-grained group key table, and splits the coarsest-grained grouping result accordingly to obtain grouping results of different levels of granularity.

4. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 2 is characterized in that: The method of hierarchically caching the multi-granularity packet vector MGPV includes: For short streams, a short buffer is allocated to store feature metadata for each coarsest-grained group; For long flows, a set of long buffers is allocated to cache more packet feature metadata; The size of the long buffer is set larger than that of the short buffer, and the number of the long buffer is less than that of the short buffer; When a data flow fills its short buffer for the first time, a long buffer is popped from the stack to continue caching its packet feature metadata on the programmable switch; the stack is implemented on the programmable switch by a pointer and an array, requiring the resubmit primitive on the programmable switch to implement the semantics of element allocation and release.

5. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 4 is characterized in that: The eviction mechanism of the cache management unit includes two situations, namely: The first case is caused by hash collision. When a packet from a group not recorded by MGPV arrives at the programmable switch, if the corresponding slot is empty, the data will be directly inserted into the cache; otherwise, the old entry will be evicted to the SmartNIC together with its short buffer and long buffer feature metadata; The second case is when the short buffer or the long buffer is filled. When a data packet from the MGPV record group arrives at the programmable switch and fills up the corresponding short buffer, if there is a long buffer in the stack, a long buffer is allocated to the group; otherwise, the feature metadata of the group in its short buffer will be evicted to the smart network card; when the data packet fills up the corresponding long buffer, the feature metadata of the group in both the short buffer and the long buffer will be evicted to the smart network card.

6. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 4 is characterized in that: The aging mechanism of the cache management unit is: Maintain a timestamp for each cache entry and evict a group entry from the cache if it has not been accessed for more than time T; Some internal data packets that are constantly recycled in the programmable switch pipeline stay in the programmable switch through the recycling port, and cache entries are checked one by one at a certain frequency to determine whether they are timed out, and expired entries are evicted together with the data packet feature metadata in their short buffer and long buffer.

7. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 1 is characterized in that: The feature vector calculation module includes: a feature calculation unit and a performance optimization unit; The feature calculation unit is used to perform summation, maximum value, minimum value, average value, variance, cardinality count and distribution-related feature calculation on multi-granularity data packet feature metadata; The performance optimization unit is used to optimize the performance of the feature calculation unit from the aspects of calculation cycle, group table structure and memory allocation.

8. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 7 is characterized in that: In terms of computing cycle, the optimization measures of the performance optimization unit are: Dozens of processing cores are set up for parallel data packet processing, and each core executes 8 hardware threads. When a thread waits for memory access, the processing core switches to another thread to process other data packets.

9. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 7 is characterized in that: In terms of the combination table structure, the optimization measures of the performance optimization unit are: A hash table with fixed-length chains is used to organize the group state, and entries that cannot be accepted by the hash table are stored in external DRAM.

10. The traffic feature extraction system based on a programmable switch and an intelligent network card according to claim 7, characterized in that: In terms of memory allocation, the optimization measures of the performance optimization unit are: According to the size and access pattern of the group state, the state is allocated to different memory levels. By modeling the group table placement problem as an integer linear programming problem, the optimal group table placement strategy is calculated to maximize the bandwidth utilization of the memory level while ensuring low access latency.

Images