LLM-Sketch: Enhancing Network Sketches with LLM

TL;DR

LLM-Sketch introduces a novel network sketching method that combines a two-tier data structure with fine-tuned large language models to improve accuracy and efficiency in network stream mining tasks.

Contribution

It presents a new approach that leverages additional packet header fields and LLMs to enhance sketch accuracy and adaptivity in dynamic network environments.

Findings

Achieves 7.5x accuracy improvement over state-of-the-art methods.

Effectively distinguishes large and small flows with minimal memory.

Demonstrates robustness across three network stream mining tasks.

Abstract

Network stream mining is fundamental to many network operations. Sketches, as compact data structures that offer low memory overhead with bounded accuracy, have emerged as a promising solution for network stream mining. Recent studies attempt to optimize sketches using machine learning; however, these approaches face the challenges of lacking adaptivity to dynamic networks and incurring high training costs. In this paper, we propose LLM-Sketch, based on the insight that fields beyond the flow IDs in packet headers can also help infer flow sizes. By using a two-tier data structure and separately recording large and small flows, LLM-Sketch improves accuracy while minimizing memory usage. Furthermore, it leverages fine-tuned large language models (LLMs) to reliably estimate flow sizes. We evaluate LLM-Sketch on three representative tasks, and the results demonstrate that LLM-Sketch outperforms state-of-the-art methods by achieving a $7.5\times$ accuracy improvement.