Traffic Refinery: Cost-Aware Data Representation for Machine Learning on Network Traffic

TL;DR

This paper introduces Traffic Refinery, a framework for evaluating network traffic representations that balances model accuracy with operational system costs, aiding practical deployment of network management ML models.

Contribution

It presents a new system and framework for joint evaluation of ML performance and system costs for network traffic representations, with a real-time traffic transformation tool.

Findings

Exploring different traffic representations improves model deployment feasibility.

Traffic Refinery enables real-time traffic monitoring and feature transformation at 10 Gbps.

Balancing system costs and accuracy enhances practical network management solutions.

Abstract

Network management often relies on machine learning to make predictions about performance and security from network traffic. Often, the representation of the traffic is as important as the choice of the model. The features that the model relies on, and the representation of those features, ultimately determine model accuracy, as well as where and whether the model can be deployed in practice. Thus, the design and evaluation of these models ultimately requires understanding not only model accuracy but also the systems costs associated with deploying the model in an operational network. Towards this goal, this paper develops a new framework and system that enables a joint evaluation of both the conventional notions of machine learning performance (e.g., model accuracy) and the systems-level costs of different representations of network traffic. We highlight these two dimensions for two practical network management tasks, video streaming quality inference and malware detection, to demonstrate the importance of exploring different representations to find the appropriate operating point. We demonstrate the benefit of exploring a range of representations of network traffic and present Traffic Refinery, a proof-of-concept implementation that both monitors network traffic at 10 Gbps and transforms traffic in real time to produce a variety of feature representations for machine learning. Traffic Refinery both highlights this design space and makes it possible to explore different representations for learning, balancing systems costs related to feature extraction and model training against model accuracy.