An LSTM Framework for Software-Defined Measurement
IEEE Transactions on Network and Service Management (TNSM), Special Issue on Data Analytics and Machine Learning for Network and Service Management, Vol. 18, No. 1, pp. 855-869, 2021
Overview
DeepFlow makes fine-grained traffic measurement scale on real SDN hardware: it spends scarce switch TCAM on the most active prefixes and uses LSTM forecasts to fill in the flows it cannot measure directly.
Key contributions
- Adaptive active-flow detection that zooms into the busiest source/destination IP prefixes and places measurement rules where they cover the most flows.
- LSTM flow-size prediction from past measurements (around 16% MAPE on real traces), with feature-based clustering so one model serves many similar flows.
- Up to 2x more flows observed for the same switch memory, reaching about 90% coverage of total traffic volume.
Abstract
Providing fine-grained traffic measurement is crucial for many network management and optimization tasks such as traffic engineering, anomaly detection, load balancing, power management, and traffic matrix estimation. Software-defined networks can potentially enable fine-grained measurement by providing statistics for each forwarding rule. However, the TCAMs that are used for rule matching and statistics generation have limited size due to their high cost and power consumption. This allows only a fraction of the flows to be monitored. In this paper, we present DeepFlow, a framework for scalable software-defined measurement that relies on an efficient mechanism that a) adaptively detects the most active source and destination IP prefixes, b) collects fine-grained measurements for the most active prefixes and coarse grained for the less active ones, and c) uses historical measurements in order to train a Long Short-Term Memory (LSTM) model that can be used to provide short-term predictions whenever exact flow counters cannot be placed at a switch due to its limited resources. Thus the number of fine-grained flows measured can increase significantly without the need to use other flow sampling solutions that suffer from low accuracy. An extensive experimental evaluation study using real network traces shows that DeepFlow outperforms the baselines in terms of the total number of flows measured.
Cite this paper
@ARTICLE{9269010,
author={A. {Lazaris} and V. K. {Prasanna}},
journal={IEEE Transactions on Network and Service Management},
title={An LSTM Framework for Software-Defined Measurement},
year={2021},
volume={18},
number={1},
pages={855-869},
doi={10.1109/TNSM.2020.3040157}}