Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC

TL;DR

Nepco is a novel system that offloads network foundation models to SmartNICs, enabling versatile and efficient traffic analysis by focusing on localized byte sequences and employing a pattern-aware convolutional architecture.

Contribution

The paper introduces Nepco, a hardware-friendly, localized byte-sequence modeling approach that maintains versatility and significantly reduces latency in network traffic analysis.

Findings

Nepco achieves macro F1 scores comparable to 8 state-of-the-art models.

Nepco reduces end-to-end latency by 328 times, reaching millisecond scale.

Nepco demonstrates effective analysis on Nvidia BlueField-3 SmartNIC.

Abstract

Pervasive encryption makes large-scale labeling infeasible for traffic analysis, while security operations demand edge analysis to avert service degradation and further vulnerabilities. These pressures have produced two disjoint research lines: 1) versatile analysis, via network foundation models for low label dependency, and 2) efficient analysis, via hardware offloading for low analysis latency. However, versatility and efficiency have appeared fundamentally incompatible to co-achieve, with prior work consistently sacrificing one for the other, yet we show that this incompatibility is a consequence of polarized design choices across the three components of traffic analysis systems, i.e., traffic processing, model architecture, and analysis execution. In response, we present Nepco, a versatile yet efficient network traffic analysis system that offloads network foundation models to SmartNIC. Our key observation is that discriminative traffic information is concentrated in localized byte regions, motivating versatile yet efficient localized byte-sequence modeling rather than inefficient global modeling. To exploit this without incurring the latency bottlenecks of complex encoding steps, we employ a hardware-friendly processing pipeline that directly embeds raw byte sequences. Crucially, to maintain versatility across diverse tasks, we propose a pattern-aware convolutional architecture equipped with dedicated scoring and gating mechanisms. By exploiting translation invariance, this design dynamically locates and extracts salient semantic signatures. We prototype Nepco on the Nvidia BlueField-3 SmartNIC with multiengine collaborative analysis execution. The experimental results demonstrate that Nepco achieves macro F1 competitive with the best performances achieved by 8 state-of-the-art network foundation models, while reducing end-to-end latency by 328x to the millisecond scale.