%0 Journal Article %1 10480735 %A Seufert, Michael %A Dietz, Katharina %A Wehner, Nikolas %A Geißler, Stefan %A Schüler, Joshua %A Wolz, Manuel %A Hotho, Andreas %A Casas, Pedro %A Hoßfeld, Tobias %A Feldmann, Anja %D 2024 %J IEEE Transactions on Network and Service Management %K %P 1-1 %R 10.1109/TNSM.2024.3382393 %T Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale %X Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in large-scale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.

@article{10480735, abstract = {Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in large-scale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.}, added-at = {2024-04-03T10:38:06.000+0200}, author = {Seufert, Michael and Dietz, Katharina and Wehner, Nikolas and Geißler, Stefan and Schüler, Joshua and Wolz, Manuel and Hotho, Andreas and Casas, Pedro and Hoßfeld, Tobias and Feldmann, Anja}, biburl = {https://www.bibsonomy.org/bibtex/25cfa72e00788897be0f2105400c035d6/hotho}, doi = {10.1109/TNSM.2024.3382393}, interhash = {96beeb7452b5e5dc0dbc16aa9b46f97e}, intrahash = {5cfa72e00788897be0f2105400c035d6}, issn = {1932-4537}, journal = {IEEE Transactions on Network and Service Management}, keywords = {}, pages = {1-1}, timestamp = {2024-04-03T10:38:06.000+0200}, title = {Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale}, year = 2024 }