Traffic Analytics Development Kits (TADK): Enable Real-Time AI Inference in Networking Apps

TL;DR

This paper introduces TADK, a high-performance, industry-standard framework enabling real-time AI inference for network traffic analysis on commodity hardware, improving detection speed and accuracy.

Contribution

The paper presents TADK, a novel framework tailored for AI-based networking workloads that operates efficiently on standard hardware without specialized accelerators.

Findings

Achieves up to 35.3Gbps throughput per core for feature extraction

Reaches 6.5Gbps per core for traffic classification

Reduces SQLi/XSS detection latency to 4.5 microseconds per request

Abstract

Sophisticated traffic analytics, such as the encrypted traffic analytics and unknown malware detection, emphasizes the need for advanced methods to analyze the network traffic. Traditional methods of using fixed patterns, signature matching, and rules to detect known patterns in network traffic are being replaced with AI (Artificial Intelligence) driven algorithms. However, the absence of a high-performance AI networking-specific framework makes deploying real-time AI-based processing within networking workloads impossible. In this paper, we describe the design of Traffic Analytics Development Kits (TADK), an industry-standard framework specific for AI-based networking workloads processing. TADK can provide real-time AI-based networking workload processing in networking equipment from the data center out to the edge without the need for specialized hardware (e.g., GPUs, Neural Processing Unit, and so on). We have deployed TADK in commodity WAF and 5G UPF, and the evaluation result shows that TADK can achieve a throughput up to 35.3Gbps per core on traffic feature extraction, 6.5Gbps per core on traffic classification, and can decrease SQLi/XSS detection down to 4.5us per request with higher accuracy than fixed pattern solution.