Synecdoche: Efficient and Accurate In-Network Traffic Classification via Direct Packet Sequential Pattern Matching

TL;DR

Synecdoche is a novel traffic classification framework that leverages packet sequential pattern matching on programmable data planes, achieving high accuracy and efficiency by focusing on short discriminative Key Segments discovered offline.

Contribution

It introduces the first method to deploy packet sequential features directly on data planes using pattern matching, combining deep learning discovery with optimized table-based online classification.

Findings

Achieves up to 26.4% higher F1-score than statistical methods.

Reduces latency by 13.0% and SRAM usage by 79.2%.

Demonstrates superior accuracy and efficiency in traffic classification.

Abstract

Traffic classification on programmable data plane holds great promise for line-rate processing, with methods evolving from per-packet to flow-level analysis for higher accuracy. However, a trade-off between accuracy and efficiency persists. Statistical feature-based methods align with hardware constraints but often exhibit limited accuracy, while online deep learning methods using packet sequential features achieve superior accuracy but require substantial computational resources. This paper presents Synecdoche, the first traffic classification framework that successfully deploys packet sequential features on a programmable data plane via pattern matching, achieving both high accuracy and efficiency. Our key insight is that discriminative information concentrates in short sub-sequences--termed Key Segments--that serve as compact traffic features for efficient data plane matching. Synecdoche employs an "offline discovery, online matching" paradigm: deep learning models automatically discover Key Segment patterns offline, which are then compiled into optimized table entries for direct data plane matching. Extensive experiments demonstrate Synecdoche's superior accuracy, improving F1-scores by up to 26.4% against statistical methods and 18.3% against online deep learning methods, while reducing latency by 13.0% and achieving 79.2% reduction in SRAM usage. The source code of Synecdoche is publicly available to facilitate reproducibility and further research.