A traffic feature extraction system based on programmable switches and smart network cards
By working together with programmable switches and smart network interface cards, the bottleneck problem of feature extraction systems in existing traffic analysis systems has been solved, enabling multi-granularity data packet feature extraction and efficient feature calculation, thereby improving the system's processing capacity and detection accuracy.
Patent Information
- Application Number
- CN202411881092.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-10-28
- Estimated Expiration
- 2044-12-19
AI Technical Summary
In existing machine learning-based traffic analysis systems, the feature extraction system has become a key bottleneck, failing to effectively support multi-granularity data packet feature extraction and efficient feature calculation, and also suffering from high computational and storage overhead and insufficient flexibility.
A collaborative system based on programmable switches and smart network interface cards (NICs) is adopted. The feature grouping and aggregation module performs caching and eviction of multi-granularity data packet feature metadata on the programmable switch, and performs mapping, reduction and synthesis operations on the smart NIC to form feature vectors that can be directly used for machine learning algorithms.
It achieves low-overhead processing of hundreds of Gbps traffic, supports multi-granularity packet feature extraction and efficient feature calculation, improves the accuracy and flexibility of detection, and is suitable for various traffic analysis algorithms and applications.
Smart Images
Figure CN119728471B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet technology, and more specifically to a traffic feature extraction system based on a programmable switch and a smart network interface card. Background Technology
[0002] Due to the widespread use of encryption technology and the evolution of network attack methods, the availability of traditional traffic analysis methods based on packet payload content inspection has drastically decreased. However, with the rapid development of machine learning, machine learning-based traffic analysis methods have gradually become mainstream. These methods offer advantages such as high reliability, wide applicability, and good scalability. A machine learning-based traffic analysis application consists of two systems: a feature extraction system and a behavior detection system. The feature extraction system extracts the necessary features from the raw network traffic, typically such as packet size and timestamps. The behavior detection system then uses advanced machine learning algorithms to identify network behavior from the packet features extracted by the feature extraction system.
[0003] However, in current machine learning-based traffic analysis applications, feature extraction systems are becoming a critical bottleneck. Existing mainstream feature extraction systems typically use port mirroring to replicate collected network traffic and utilize numerous servers to store massive amounts of network traffic and extract the required traffic features. These software-based solutions are not only limited by CPU processing power but also suffer from network problems such as triangular routing, leading to significant communication, computation, and storage overhead, making it difficult to support large-scale traffic feature extraction tasks. Some recent research has attempted to leverage programmable network hardware to accelerate the feature extraction process, even completing the entire traffic analysis task on the data plane, thereby significantly reducing the need for additional bandwidth and servers. However, due to the limited computational models and memory resources of network hardware, these methods lack flexibility, cannot achieve multi-granularity packet feature extraction and efficient feature computation, and lack versatility in supporting various traffic analysis algorithms and applications.
[0004] Therefore, how to provide a feature extraction system that supports multi-granularity data packet feature extraction and efficient feature calculation is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] In view of this, the present invention provides a traffic feature extraction system based on a programmable switch and a smart network interface card (NIC). The system is implemented by the collaboration of a programmable switch and a smart NIC, which can support multi-granularity packet feature extraction and efficient feature calculation without reducing detection accuracy.
[0006] In order to achieve the above object, the present invention adopts the following technical solutions:
[0007] A traffic feature extraction system based on a programmable switch and a smart network interface card includes: a feature grouping aggregation module and a feature vector calculation module;
[0008] The feature grouping aggregation module is installed on the programmable switch and is used to select and aggregate multi-granularity data packet feature metadata from network traffic for caching, and to evict the cache to the feature vector calculation module according to a preset mechanism.
[0009] The feature vector calculation module is installed on the smart network card and is used to receive multi-granularity data packet feature metadata ejected from the programmable switch. Through mapping, reduction and synthesis operations, the multi-granularity data packet feature metadata is processed into feature vectors that can be directly used for machine learning algorithms.
[0010] Furthermore, the feature grouping aggregation module includes: a cache allocation unit and a cache management unit;
[0011] The cache allocation unit is used to group the data packet feature metadata according to the coarsest granularity, record the finest granularity grouping information of each data packet, aggregate the coarsest granularity grouping results and the finest granularity grouping information into a multi-granularity grouped data packet vector MGPV, and perform hierarchical caching on the MGPV.
[0012] The cache management unit is used to evict cached MGPVs to the smart network card through an eviction and aging mechanism.
[0013] Furthermore, in each multi-granularity packet vector (MGPV), the finest-grained group key is stored in the form of a hash table, forming a finest-grained group key table. The index of the finest-grained group key table and the characteristic metadata of each packet are stored together. This finest-grained group key table is synchronized between the programmable switch and the smart network interface card (NIC). All changes to this finest-grained group key table on the programmable switch will notify the smart NIC to update synchronously.
[0014] When a smart network interface card (NIC) receives a multi-granularity packet data vector (MGPV) from a programmable switch, it accesses the finest-grained group key of each MGPV based on the corresponding index in the finest-grained group key table, and then splits the coarsest-grained packet result accordingly to obtain packet results at different levels of granularity.
[0015] Furthermore, hierarchical caching methods for multi-granularity packet vectors (MGPV) include:
[0016] For short streams, allocate a short buffer to store the feature metadata for each coarsest granularity group;
[0017] For long flows, allocate a set of long buffers to cache more packet feature metadata;
[0018] The size of the long buffer is set to be larger than that of the short buffer, and the number of long buffers is less than that of short buffers;
[0019] When a data stream first fills its short buffer, a long buffer is popped from the stack to continue caching its packet feature metadata on the programmable switch; the stack is implemented on the programmable switch by a pointer and an array, and the resubmit primitive on the programmable switch is required to implement the semantics of element allocation and release.
[0020] Furthermore, the eviction mechanism of the cache management unit includes two cases:
[0021] The first scenario is caused by a hash collision. When a packet from a group not recorded by MGPV arrives at the programmable switch, if the corresponding slot is empty, the data will be directly inserted into the buffer; otherwise, the old entry will be evicted from its short buffer and long buffer's characteristic metadata into the smart NIC.
[0022] The second scenario is when either the short or long buffer is full. When a packet from an MGPV record group arrives at the programmable switch and just fills the corresponding short buffer, if there is still a long buffer in the stack, a long buffer is allocated to that group; otherwise, the feature metadata of that group in its short buffer will be evicted to the smart NIC. When a packet just fills the corresponding long buffer, the feature metadata of that group in both the short and long buffers will be evicted to the smart NIC.
[0023] Furthermore, the aging mechanism of the cache management unit is as follows:
[0024] Maintain a timestamp for each cached entry, and evict a group of entries from the cache if they have not been accessed for more than time T.
[0025] Some internal data packets that are continuously recirculated within the programmable switch pipeline will remain in the programmable switch through the recirculation port. The cache entries will be checked one by one at a certain frequency to determine whether they have timed out, and the expired entries will be evicted along with the data packet characteristic metadata in their short and long buffers.
[0026] Furthermore, the feature vector calculation module includes: a feature calculation unit and a performance optimization unit;
[0027] The feature calculation unit is used to perform summation, maximum value, minimum value, average value, variance, cardinality count, and distribution-related feature calculations on the feature metadata of multi-granularity data packets;
[0028] The performance optimization unit is used to optimize the performance of the feature calculation unit in terms of calculation cycle, group table structure, and memory allocation.
[0029] Furthermore, regarding the computation cycle, the optimization measures of the performance optimization unit are as follows:
[0030] Dozens of processing cores are configured for parallel packet processing, with each core executing 8 hardware threads. When a thread is waiting for memory access, the processing core switches to another thread to process other packets.
[0031] Furthermore, regarding the group table structure, the optimization measures of the performance optimization unit are as follows:
[0032] A hash table with a fixed length chain is used to organize the group state, and entries that cannot be accepted by the hash table are stored in external DRAM.
[0033] Furthermore, regarding memory allocation, the performance optimization unit implements the following optimization measures:
[0034] Based on the size and access pattern of the group state, the state is allocated to different memory levels. By modeling the group table placement problem as an integer linear programming problem, the optimal group table placement strategy is calculated to maximize the bandwidth utilization of the memory level while ensuring low access latency.
[0035] As can be seen from the above technical solution, compared with the prior art, the present invention has the following beneficial effects:
[0036] This invention leverages the flexibility of smart network interface card (NIC) programming capabilities to complement the high throughput of programmable switch (PSB) packet processing, enabling the handling of traffic volumes in the hundreds of Gbps range with low overhead, supporting general traffic analysis applications. Compared to existing traffic feature extraction systems based on PSBs, this method, using a collaborative approach between a PSB and a smart NIC, supports multi-granularity packet feature extraction and efficient feature calculation, with virtually no reduction in detection accuracy. Attached Figure Description
[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0038] Figure 1 A schematic diagram of the traffic feature extraction system based on a programmable switch and a smart network interface card provided by the present invention;
[0039] Figure 2 This is a schematic diagram illustrating how the cache allocation unit provided by the present invention groups and caches data;
[0040] Figure 3This is a schematic diagram of the hardware architecture of the smart network card provided by the present invention. Detailed Implementation
[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0042] like Figure 1 As shown, this embodiment of the invention discloses a traffic feature extraction system based on a programmable switch and a smart network interface card, including: a feature grouping aggregation module and a feature vector calculation module;
[0043] The feature grouping aggregation module is installed on the programmable switch and is used to select and aggregate multi-granularity packet feature metadata from network traffic for caching, and evict the cached data to the feature vector calculation module according to a preset mechanism.
[0044] The feature vector calculation module is located on the smart network card and is used to receive feature metadata of multi-granular data packets evicted from the programmable switch. Through mapping, reduction and synthesis operations, the feature metadata of multi-granular data packets is processed into feature vectors that can be directly used for machine learning algorithms.
[0045] The following section provides further explanation of the feature grouping and aggregation module and the feature vector calculation module.
[0046] The feature grouping and aggregation module includes a cache allocation unit and a cache management unit. Through the collaborative work of these two units, the storage and processing of multi-granularity feature metadata are optimized.
[0047] The cache allocation unit is used to group the data packet feature metadata according to the coarsest granularity and record the finest granularity grouping information of each data packet. The coarsest granularity grouping results and the finest granularity grouping information are aggregated into a multi-granularity grouped data packet vector MGPV, and the MGPV is cached in layers.
[0048] The cache management unit is used to evict cached MGPVs to the smart network interface card through eviction and aging mechanisms.
[0049] The functions of the cache allocation unit and the cache management unit will be further explained below.
[0050] 1) The cache allocation unit is a key-value vector caching engine that simultaneously supports multi-granularity packet feature metadata and ensures efficient resource utilization. Since traffic analysis applications often require the recording of multi-granularity packet feature metadata, such as Kitsune and HEALD, which need to calculate the same packet features for packets at at least three granularities—including each source address (host), each IP connection (channel), and each streaming socket—and these granularities typically have dependencies (often a dependency chain), this invention proposes a novel concept: Multi-granularity Grouped Packet Vector (MGPV), to efficiently support the grouping and caching of multi-granularity packet feature metadata.
[0051] Considering the chain dependency between grouping granularities, such as Figure 2 As shown, the MGPV deployed on a programmable switch only needs to group packet feature metadata according to the coarsest granularity (CG), while simultaneously recording the finest granularity (FG) grouping information for each packet. The smart NIC can then use this additional information and the coarsest granularity grouping results to further reconstruct the intermediate granularity grouping results. This reduces the significant amount of redundant storage caused by separately recording the grouping results for each granularity on the switch. Taking host, channel, and socket as examples, the MGPV on the switch groups packets according to the host (i.e., the coarsest granularity) and stores the socket information for each packet on the switch (i.e., the finest granularity). Then, on the smart NIC, the socket granularity group key is used to separate the channel granularity and socket granularity groups from the host granularity groups.
[0052] Next, we will further explain the chain-like dependencies between group granularities. Theoretically, the features of each granularity can be calculated independently, but in traffic analysis, features of different granularities are often interrelated. Taking socket granularity as an example, the analysis results at the socket granularity level often depend on the results at the channel granularity level. Knowing the traffic situation of a specific channel is essential for better analysis of the performance of each socket. Otherwise, the analysis at the socket granularity level lacks context and cannot accurately assess traffic distribution. For example, if the traffic of a certain socket surges, it is difficult to determine whether this is normal without knowing the overall traffic data at the channel and host granularities.
[0053] Taking host, channel, and socket granularity as examples, the finest-grained packet information is the socket information, specifically the socket 5-tuple: source IP, destination IP, source port, destination port, and protocol type. A coarse-grained packet may contain multiple fine-grained packets, such as multiple socket connections under a single channel. If we want to analyze traffic anomalies, and host 1 has a total traffic of 10G, with three channels having traffic volumes of 8G, 1G, and 1G respectively, and a socket in channel 1 having a traffic volume of 5G, far exceeding the traffic volumes of sockets in channels 2 and 3, but this is normal within channel 1, then without host and channel-level traffic information and only analyzing at the socket level, it's easy to mistakenly classify socket 1 in channel 1 as having abnormal traffic.
[0054] This invention employs a more storage-efficient method to store the finest-grained packet information of data packets. Specifically, in each multi-granularity packet vector (MGPV), the finest-grained group key is stored in the form of a hash table, forming a finest-grained group key table. The index of the finest-grained group key table and the characteristic metadata of each data packet are stored together. Furthermore, this finest-grained group key table is synchronized between the programmable switch and the smart network interface card (NIC). All changes to this finest-grained group key table on the programmable switch will notify the smart NIC to perform synchronous updates.
[0055] Since the smart network interface card (NIC) maintains the same finest-grained group key table as the programmable switch, when the smart NIC receives a multi-granularity packet data vector (MGPV) from the programmable switch, it accesses the finest-grained group key of each MGPV according to the corresponding index in the finest-grained group key table, and splits the coarsest-grained packet result accordingly to obtain packet results of different levels of granularity.
[0056] Specifically, MGPV achieves packet grouping at a finer granular level based on coarse-grained results. When grouping packets at a coarse granular level, it stores fine-grained group information for each packet and uses this additional information to split the coarse-grained group into multiple fine-grained groups. For example, CG grouping is based on the source IP address, while FG grouping stores the finest-grained socket group key: source IP, destination IP, source port, destination port, and protocol type. The corresponding fine-grained information is retrieved from the FG group key in the metadata corresponding to this coarse-grained source IP group key. Then, intermediate-grained grouping is obtained based on the information in the fine-grained information. For example, the intermediate-grained grouping result, such as source IP-destination IP pairing, can be retrieved based on the socket's five-tuple information. Thus, the coarse-grained group key table can be split based on the finest-grained group key to obtain intermediate-level granular grouping results.
[0057] This invention takes into account the long-tail characteristic of stream length distribution and employs hierarchical caching to cache multi-granularity packet vectors (MGPV), specifically:
[0058] Since most flows are short flows consisting of a small number of packets, a short buffer is allocated to store the feature metadata of each coarsest group for short flows; for long flows, a set of long buffers is allocated to cache more packet feature metadata; this can greatly reduce the rate at which packet feature metadata is sent to the smart network interface card.
[0059] To accommodate the distribution of stream lengths, the size of long buffers is set much larger than that of short buffers, and the number of long buffers is much smaller than that of short buffers;
[0060] When a data stream first fills its short buffer, it is likely a long stream, and a long buffer is popped from the stack to continue caching its packet characteristic metadata on the programmable switch; the stack on the programmable switch is implemented with a pointer and an array, and the resubmit primitive on the programmable switch is required to implement the semantics of element allocation and release.
[0061] 2) The cache management module ensures the efficiency and reusability of the cache through eviction and aging mechanisms, thereby improving the system's memory utilization. The eviction mechanism includes two cases:
[0062] ① The first scenario is caused by hash collisions. When the feature grouping and aggregation module caches data, the storage location of the feature metadata of each data packet is calculated by a hash function. This hash calculation maps the input data packet to a specific location in the cache. If two different data packets are mapped to the same slot after hash calculation, a hash collision will occur.
[0063] When a data packet from an unrecorded group in the MGPV cache (meaning data that does not yet exist in the MGPV cache, such as when a new IP address starts communicating and no data packets have been recorded before, then this group of data packets is unrecorded) arrives at the programmable switch, if the corresponding slot (the storage location in the cache obtained by calculating the hash value, i.e., the buffer) is empty, the data will be directly inserted into the cache; otherwise, the old entry will be evicted from its short buffer and long buffer feature metadata together to the smart NIC.
[0064] ② The second scenario is when either the short or long buffer is full. When a data packet from an MGPV record group arrives at the programmable switch and just fills the corresponding short buffer, if there is still a long buffer in the stack, a long buffer is allocated to that group; otherwise, the group's feature metadata in its short buffer will be evicted to the smart NIC. When a data packet just fills the corresponding long buffer, the group's feature metadata in both the short and long buffers will be evicted to the smart NIC. Here, a data packet from an MGPV record group refers to a data packet whose feature metadata has already been recorded and stored in the MGPV cache. The difference between a data packet from an unrecorded group and a data packet from an unrecorded group is whether it has been recorded and whether it is already in the cache.
[0065] ③ This invention designs an aging mechanism to reclaim expired entries in the cache. These resources can be released and reused after the corresponding stream transitions to an inactive state. Specifically:
[0066] Each cached entry is maintained with a timestamp, and entries in a group that have not been accessed for more than time T are evicted from the cache; the aging mechanism helps the switch track the actual flow of activity and further improves memory utilization.
[0067] In particular, occupied long buffers can be released promptly and reused by other long flows, enabling this invention to handle more long flows and improve its memory efficiency. However, periodically monitoring the access status of all cache entries on the control plane is CPU-intensive and consumes most of the control channel resources. To address this issue, this invention utilizes certain internal packets that are continuously recirculated within the programmable switch pipeline to perform such monitoring on the data plane. These internal packets remain in the programmable switch through a recirculation port, checking cache entries one by one at a certain frequency to determine if they have timed out, and evicting expired entries along with the packet characteristic metadata in their short and long buffers.
[0068] Specifically, the switch maintains a timestamp for each cached entry. Internal data packets pass through the recirculation port at a certain frequency. Each time they pass through, the timestamp of the cached entry is checked to determine whether it has timed out since the last access. These internal data packets only flow within the switch and are not sent to the external network.
[0069] The following section provides further explanation of the feature vector calculation module for smart network cards.
[0070] The feature vector calculation module receives and processes aggregated MGPVs evicted from the programmable switch on the smart network interface card. First, it traverses each MGPV cell, which contains scattered packet feature metadata. Then, it updates the statistics for the corresponding group through mapping, reduction, and synthesis operations. Finally, it collects the calculated feature vectors as required and sends them to the behavior detection component for further analysis.
[0071] Specifically, the feature vector calculation module includes: a feature calculation unit and a performance optimization unit;
[0072] The feature calculation unit is used to perform summation, maximum value, minimum value, average value, variance, cardinality count, and distribution-related feature calculations on the feature metadata of multi-granularity data packets;
[0073] The performance optimization unit is used to optimize the performance of the feature computation unit in terms of computation cycle, group table structure, and memory allocation.
[0074] The functions of the feature calculation unit and the performance optimization unit will be further explained below.
[0075] 1) Feature Computation Unit: During feature computation, mapping, synthesis, and collection typically do not involve complex arithmetic operations, which can be intuitively implemented on the smart NIC. However, reduction, especially the reduction function responsible for feature computation, has high computational complexity in the smart NIC architecture. To achieve efficient reduction, the smart NIC feature vector computation module applies a powerful streaming algorithm, the implementation of which is described below.
[0076] ① Summation, maximum, and minimum values: These three types of functions represent the simplest reduction functions involved in the feature calculation process and do not require the use of streaming algorithms. They only need to maintain a state for each group and perform an addition or comparison operation once on the feature metadata of each bag.
[0077] ② Mean and variance: Using Welford's stream algorithm, the mean and variance can be calculated and estimated in one traversal using the following formula, reducing the large amount of storage space required for two traversals.
[0078]
[0079] ③ Radix Counting: Used to count the number of unique elements in a given group, typically used to determine the number of flows or connections established by each IP. A radix count reduction algorithm is implemented using the HyperLogLog algorithm, estimating the number of distinct elements by calculating the number of leading zeros in the element's hash value. This method is memory efficient but has high variance. To reduce variance, we divide the flow into multiple buckets, calculate the radix of each bucket, and take the average. A 32-bit hash is calculated for each packet; the first k bits are used to index the bucket, and the last 32-k bits are used to calculate the leading zeros. This requires maintaining only 2^k states and simplifies complex exponentiation and division operations into fast shift operations.
[0080] ④ Distribution-Related Features: This section consists of three functions: ft_hist, ft_percent, and f_cdf. ft_hist captures a histogram of the given data to approximate its distribution, and other distribution-related features can be calculated from the histogram; therefore, ft_hist is the foundation for the other functions. f_cdf is implemented by summing all bins of the histogram and normalizing the result, while ft_percent is calculated by summing bins below the given value. In the implementation of ft_hist, a state array is allocated to each group to store its bins; the width and number of bins are specified by parameters. Furthermore, variable bin widths are used to improve the accuracy of features calculated from the histogram.
[0081] 2) At the same time, considering such Figure 3 The unique hardware architecture of the SoC-based smart NIC shown incorporates various optimization measures in the performance optimization unit to leverage the unique architecture of the smart NIC and improve offloading performance.
[0082] ① Regarding the computation cycle, the optimization measures for the performance optimization unit are as follows:
[0083] Dozens of processing cores are configured for parallel packet processing, with each core executing 8 hardware threads. When a thread is waiting for memory access, the processing core switches to another thread to process other packets.
[0084] Specifically, this invention can be configured with dozens of RISC cores (such as...). Figure 3The cores in the module are used for parallel packet processing, with each core capable of executing 8 hardware threads at a frequency of 800MHz. The number of cycles per packet processed by the core directly determines the overall performance of the smart NIC. First, the hash value calculated by the programmable switch is reused to eliminate the hash calculation overhead of the smart NIC. The 32-bit hash index value used by the switch's caching system is sent to the smart NIC along with the evicted MGPV. Second, a threading mechanism is used to hide memory access latency. When a thread is waiting for memory access, the core switches to another thread to process other packets, avoiding performance degradation caused by memory access. Finally, the module has undergone in-depth analysis and optimization of the streaming algorithm, reducing the reliance on division operations and thus significantly reducing processing cycles.
[0085] ② Regarding the group table structure, mapping, reduction, and composition operations require maintaining the state of each group to perform the corresponding functions. This invention designs an efficient hash table structure for state management. The data bus width between processing cores and the memory subsystem is 512 bits (64 bytes), which is usually sufficient to cover simultaneous access to the states of multiple groups. Utilizing this hardware characteristic, the following optimization measures are taken:
[0086] A fixed-length chained hash table is used to organize group states, achieving fast parallel lookups and a low collision rate. To resolve hash collisions, entries that cannot be accepted by the hash table are stored in external DRAM, thus enabling expansion; that is, when a hash collision occurs during the insertion of an entry, meaning the storage location corresponding to the hash calculation already contains an entry, this entry is unacceptable, and the new entry is stored in external DRAM. Although accessing DRAM is slower, as long as the collision rate is low, the impact on overall performance is minimal.
[0087] ③ Regarding memory allocation, the performance optimization unit's optimization measures are as follows:
[0088] Based on the size and access pattern of the group state (referring to metadata related to a specific data packet processing or feature extraction task, representing the data processing status of a group, such as class feature values, statistics, etc.), the state is allocated to different memory levels (e.g., Figure 3 In CLS, CTM, IMEM, and EMEM, the optimal table placement strategy is optimized to improve memory access performance. By modeling the table placement problem as an integer linear programming problem, the optimal table placement strategy is calculated to maximize the bandwidth utilization of the memory hierarchy while ensuring low access latency.
[0089] Specifically, the problem of grouping tables is formalized, where S represents the set of states required for a given feature extraction strategy, and each state s∈S is analyzed to obtain its size b. s and the access time t for each data packet sA hierarchical memory architecture uses M, where each memory level m ∈ M has an access latency l. m and maximum access data bus width w m The width of the group table in memory m is n. m This can be configured by the user to balance hash collision rate and lookup performance. A binary variable p is defined if and only if the state s is placed in a group table in memory m. s,m =1, otherwise p s,m =0.
[0090] Then, the group state table placement problem can be solved based on integer linear programming (ILP):
[0091] min∑ s∈S ∑ m∈M p s,m t s l m (1)
[0092] The constraints are:
[0093]
[0094] Equation (1) states that the objective is to minimize the total access latency of all states, equation (2) specifies that each state must be placed in a memory hierarchy, and equation (3) specifies that the data bus of each memory must be able to access the group state table. Based on the output {p s,m The optimal group state table placement strategy can be determined.
[0095] In one specific embodiment, the feature extraction system of the present invention runs on a smart switch and a smart network interface card (NIC). The switch is composed of a programmable switch, with the data plane's buffer allocation and management units written in P4 language, and the control plane program written in C language to configure the data plane state. The features of the aggregated packets are evicted and sent to the smart NIC for further processing. The feature calculation engine on the smart NIC is implemented using Micro-C code, suitable for Netronom NFP-4000. During deployment, the P4 program is first burned into the switch's data plane using the programmable switch system's P4 toolchain, and the control program is run to configure the data plane state. Then, the Micro-C program of the feature calculation engine is compiled into the smart NIC and run, and the system enters normal operation to extract feature traffic.
[0096] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.
[0097] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A traffic feature extraction system based on a programmable switch and a smart network interface card, characterized in that, include: Feature grouping and aggregation module and feature vector calculation module; The feature grouping aggregation module is installed on the programmable switch and is used to select and aggregate multi-granularity data packet feature metadata from network traffic for caching, and to evict the cache to the feature vector calculation module according to a preset mechanism. The feature vector calculation module is set on the smart network card and is used to receive multi-granularity data packet feature metadata ejected from the programmable switch. Through mapping, reduction and synthesis operations, the multi-granularity data packet feature metadata is processed into feature vectors that can be directly used for machine learning algorithms. The feature grouping aggregation module includes: a cache allocation unit and a cache management unit; The cache allocation unit is used to group data packet feature metadata according to the coarsest granularity and record the finest granularity grouping information for each data packet. It then aggregates the coarsest granularity grouping results and the finest granularity grouping information into a multi-granularity grouped data packet vector (MGPV), and performs hierarchical caching on the MGPV. The hierarchical caching method for the multi-granularity grouped data packet vector (MGPV) includes: For short streams, allocate a short buffer to store the feature metadata for each coarsest granularity group; For long flows, allocate a set of long buffers to cache more packet feature metadata; The size of the long buffer is set to be larger than that of the short buffer, and the number of long buffers is less than that of short buffers; When a data stream first fills its short buffer, a long buffer is popped from the stack to continue caching its packet characteristic metadata on the programmable switch; the stack is implemented on the programmable switch by a pointer and an array, and the resubmit primitive on the programmable switch is required to implement the semantics of element allocation and deallocation; The cache management unit is used to evict cached MGPVs to the smart network interface card through an eviction and aging mechanism; The eviction mechanism of the cache management unit includes two cases: The first scenario is caused by a hash collision. When a data packet from a group not recorded by MGPV arrives at the programmable switch, if the corresponding slot is empty, the data will be directly inserted into the buffer; otherwise, the old entry will be evicted from its short and long buffers along with their characteristic metadata into the smart NIC. The slot refers to the corresponding storage location in the buffer obtained by calculating the hash value, i.e., the buffer. The second scenario is when either the short or long buffer is full. When a packet from an MGPV record group arrives at the programmable switch and just fills the corresponding short buffer, if there is still a long buffer in the stack, a long buffer is allocated to that group; otherwise, the feature metadata of that group in its short buffer will be evicted to the smart NIC. When a packet just fills the corresponding long buffer, the feature metadata of that group in both the short and long buffers will be evicted to the smart NIC.
2. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 1, characterized in that, In each multi-granularity packet vector (MGPV), the finest-grained group key is stored in the form of a hash table, forming a finest-grained group key table. The index of the finest-grained group key table and the characteristic metadata of each packet are stored together. This finest-grained group key table is synchronized between the programmable switch and the smart network interface card (NIC). All changes to this finest-grained group key table on the programmable switch will notify the smart NIC to update synchronously. When a smart network interface card (NIC) receives a multi-granularity packet data vector (MGPV) from a programmable switch, it accesses the finest-grained group key of each MGPV based on the corresponding index in the finest-grained group key table, and then splits the coarsest-grained packet result accordingly to obtain packet results at different levels of granularity.
3. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 1, characterized in that, The aging mechanism of the cache management unit is as follows: Maintain a timestamp for each cached entry, and evict a group of entries from the cache if they have not been accessed for more than time T. Some internal data packets that are continuously recirculated within the programmable switch pipeline will remain in the programmable switch through the recirculation port. The cache entries will be checked one by one at a certain frequency to determine whether they have timed out, and the expired entries will be evicted along with the data packet characteristic metadata in their short and long buffers.
4. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 1, characterized in that, The feature vector calculation module includes: a feature calculation unit and a performance optimization unit; The feature calculation unit is used to perform summation, maximum value, minimum value, average value, variance, cardinality count, and distribution-related feature calculations on the feature metadata of multi-granularity data packets; The performance optimization unit is used to optimize the performance of the feature calculation unit in terms of calculation cycle, group table structure, and memory allocation.
5. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 4, characterized in that, Regarding the computation cycle, the optimization measures of the performance optimization unit are as follows: Dozens of processing cores are configured for parallel packet processing, with each core executing 8 hardware threads. When a thread is waiting for memory access, the processing core switches to another thread to process other packets.
6. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 4, characterized in that, Regarding the group table structure, the optimization measures of the performance optimization unit are as follows: A hash table with a fixed length chain is used to organize the group state, and entries that cannot be accepted by the hash table are stored in external DRAM.
7. The traffic feature extraction system based on a programmable switch and a smart network interface card according to claim 4, characterized in that, Regarding memory allocation, the performance optimization unit employs the following optimization measures: Based on the size and access pattern of the group state, the state is allocated to different memory levels. By modeling the group table placement problem as an integer linear programming problem, the optimal group table placement strategy is calculated to maximize the bandwidth utilization of the memory level while ensuring low access latency.