TECHNICAL FIELD

The embodiments relate to computer networks, network appliances, network switches, network routers, machine learning, artificial intelligence, using machine learning to classify traffic flows, and to using machine learning to improve hardware resource utilization by network appliances.

BACKGROUND

In data networks, network appliances such as switches, routers, and network interface cards receive packets at input interfaces, process the received packets, and then forward the packets to one or more output interfaces. It is important that such network appliances operate as quickly as possible in order to keep pace with a high rate of incoming packets. One challenge associated with network appliances relates to providing the flexibility to adapt to changes in desired feature sets, networking protocols, operating systems, applications, and hardware configurations.

BRIEF SUMMARY OF SOME EXAMPLES

The following presents a summary of one or more aspects of the present disclosure, in order to provide a basic understanding of such aspects. This summary is not an extensive overview of all contemplated features of the disclosure and is intended neither to identify key or critical elements of all aspects of the disclosure nor to delineate the scope of any or all aspects of the disclosure. Its sole purpose is to present some concepts of one or more aspects of the disclosure in a form as a prelude to the more detailed description that is presented later.

One aspect of the subject matter described in this disclosure can be implemented in a method implemented by a network appliance including a fast data path and a slow data path. The method includes installing a classification model in a flow predictor, the flow predictor configured to receive a feature vector and to produce a prediction based on the classification model, the prediction indicating one of a plurality of classes including long lived flow and short lived flow. The method can also include receiving a plurality of traffic flows, generating a plurality of feature vectors from the plurality of traffic flows, submitting the plurality of feature vectors to the flow predictor to obtain a plurality of predictions associated with the plurality of traffic flows, and directing the plurality of traffic flows along the fast data path or the slow data path based on the plurality of predictions.

Another aspect of the subject matter described in this disclosure can be implemented in a network appliance. The network appliance includes a fast data path, a slow data path, an ingress unit, and a flow predictor. The network appliance can be configured to install a classification model in the flow predictor, the flow predictor configured to receive a feature vector and to produce a prediction based on the classification model, the prediction indicating one of a plurality of classes including long lived flow and short lived flow. The network appliance can also be configured to receive a plurality of traffic flows, generate a plurality of feature vectors from the plurality of traffic flows, submit the plurality of feature vectors to the flow predictor to obtain a plurality of predictions associated with the plurality of traffic flows, and direct the plurality of traffic flows along the fast data path or the slow data path based on the plurality of predictions.

Another aspect of the subject matter described in this disclosure can be implemented in non-transitory computer-readable medium storing computer-executable code, comprising code for causing a network appliance to install a classification model in a flow predictor, the flow predictor configured to receive a feature vector and to produce a prediction based on the classification model, the prediction indicating one of a plurality of classes including long lived flow and short lived flow. The code can also cause the network appliance to generate a plurality of feature vectors from a plurality of traffic flows received by the network appliance, submit the plurality of feature vectors to the flow predictor to obtain a plurality of predictions associated with the plurality of traffic flows, and direct the plurality of traffic flows along a fast data path or a slow data path based on the plurality of predictions.

In some implementations of the methods and devices, the method can also include generating a plurality of training feature vectors from the plurality of traffic flows, and associating a plurality of labels with the plurality of training feature vectors, each of the plurality of training feature vectors labeled with one of the plurality of labels, each of the plurality of labels indicating one of the plurality of classes. The method can also include producing a training data that includes the plurality of training feature vectors and the plurality of labels, producing a new classification model using the training data; and installing the new classification model in the flow predictor.

In some implementations of the methods and devices, the method can also include receiving the classification model from a flow training engine configured to produce the classification model using a training data.

In some implementations of the methods and devices, the fast data path includes a parser, a match action pipeline, and a deparser, the match action pipeline including a plurality of match action units. In some implementations of the methods and devices, a special purpose packet processing circuitry is configured to implement the match action pipeline. In some implementations of the methods and devices, a network interface card includes the special purpose packet processing circuitry and the slow data path.

In some implementations of the methods and devices, a plurality of additional network appliances that include a plurality of additional flow predictors are configured to install the classification model in the plurality of additional flow predictors, receive a plurality of additional traffic flows, generate a plurality of additional feature vectors from the plurality of additional traffic flows, and direct the plurality of additional traffic flows along a plurality of additional fast data paths or a plurality of additional slow data paths based on a plurality of additional predictions produced by the plurality of additional flow predictors based on the plurality of additional feature vectors.

In some implementations of the methods and devices, the classification model is a neural network, and the flow predictor is configured to implement the neural network. In some implementations of the methods and devices, the network appliance is configured to receive a new classification model and to replace the classification model by installing the new classification model in the flow predictor.

In some implementations of the methods and devices, the network appliance is further configured to receive the classification model from a flow training engine configured to produce the classification model using a training data. In some implementations of the methods and devices, the fast data path includes a parser, a match action pipeline, and a deparser, the match action pipeline including a plurality of match action units. In some implementations of the methods and devices, a special purpose packet processing circuitry is configured to implement the fast data path.

In some implementations of the methods and devices, the network appliance includes the fast data path and the slow data path, the fast data path including a parser, a match action pipeline, and a deparser, the match action pipeline including a plurality of match action units. In some implementations of the methods and devices, a network interface card includes the fast data path, the slow data path, and a special purpose packet processing circuitry, the special purpose packet processing circuitry configured to implement the match action pipeline.

In some implementations of the methods and devices, the classification model is a neural network, and the flow predictor is configured to implement the neural network. In some implementations of the methods and devices, the network appliance is configured to receive a new classification model and to replace the classification model by installing the new classification model in the flow predictor.

These and other aspects will become more fully understood upon a review of the detailed description, which follows. Other aspects, features, and embodiments will become apparent to those of ordinary skill in the art, upon reviewing the following description of specific, exemplary embodiments of in conjunction with the accompanying figures. While features may be discussed relative to certain embodiments and figures below, all embodiments can include one or more of the advantageous features discussed herein. In other words, while one or more embodiments may be discussed as having certain advantageous features, one or more of such features may also be used in accordance with the various embodiments discussed herein. In similar fashion, while exemplary embodiments may be discussed below as device, system, or method embodiments such exemplary embodiments can be implemented in various devices, systems, and methods.

