Practical and General-Purpose Flow-Level Inference with Random Forests in Programmable Switches

Abstract

Integrating machine learning (ML) models directly in the network user plane enables inference on data traffic at line rate, and can dramatically reduce the latency and improve the scalability of key functionalities like traffic classification or intrusion detection. Yet, the hardware that can be used to this purpose, in particular programmable switches, present stringent constraints in terms of limited memory and little support for mathematical operations or data types that render ML model deployment a substantial technical challenge. In this paper, we make a step forward in user-plane ML by introducing Flowrest, a solution that redefines the state of the art in flow-level inference for programmable switches. Flowrest allows implementing general-purpose Random Forest (RF) models in industry-grade switches by (i) suitably handling stateful flow-level (FL) features in the switch ASIC, (ii) achieving low-collision flow management, and (iii) customizing RF models right from the design phase for in-switch operation. We develop Flowrest as an open-source software using the P4 language and evaluate its performance in an experimental testbed with Intel Tofino switches. Experiments with inference tasks of varying complexity prove that our solution improves accuracy by over 10 percent points on average with respect to the second-best competitor out to five recent approaches for RF-based in-switch inference, while maintaining sub-microsecond latency.