Machine learning (ML) algorithms have been shown to be effective in classifying a broad range of applications in the Internet traffic. In this paper, we propose algorithms and architectures to realize online traffic classification using flow level features. First, we develop a traffic classifier based on C4.5 decision tree algorithm and Entropy-MDL (Minimum Description Length) discretization algorithm. It achieves an overall accuracy of 97.92 percent for classifying eight major applications. Next we propose approaches to accelerate the classifier on FPGA (Field Programmable Gate Array) and multicore platforms. We optimize the original classifier by merging it with discretization. Our implementation of this optimized decision tree achieves 7500+ Million Classifications Per Second (MCPS) on a state-of-the-art FPGA platform and 75-150 MCPS on two state-of-the-art multicore platforms. We also propose a divide and conquer approach to handle imbalanced decision trees. Our implementation of the divide-and-conquer approach achieves 10,000+ MCPS on a state-of-the-art FPGA platform and 130-340 MCPS on two state-of-the-art multicore platforms. We conduct extensive experiments on both platforms for various application scenarios to compare the two approaches.

Accelerating Decision Tree Based Traffic Classification on FPGA and Multicore Platforms

Sketch, a highly accurate data stream summarization technique, has gained much interest in the research community in recent years. Because of its sub-linear memory complexity, Sketch-based techniques consume significantly less memory than the traditional per-item-state techniques for processing high throughput data streams. One of the major applications of Sketch is in network anomaly detection, which is critical for network management and security in both Internet and data centers. In these applications, throughput is a key performance metric. Due to the low memory complexity, Sketch-based techniques can be supported by the fast on-chip storage of the state-of-the-art computing platforms to achieve high throughput. In this work, we first propose a generic architecture on FPGA to accelerate Sketch and adopt it to 2 widely used Sketches: Count-min Sketch and K-ary Sketch. We propose online Sketch-based algorithms for 2 key network anomaly detection tasks: heavy hitter detection and heavy change detection. We adopt the proposed generic architecture for Sketch to accelerate these online algorithms. The post place-and-route results on a state-of-the-art FPGA show that our generic architecture can accelerate both Count-min Sketch and K-ary Sketch to over 150 Gbps, demonstrating significant throughput performance improvements compared with other Sketch acceleration techniques. Our architectures for online anomaly detection tasks sustain 100-150 Gbps throughput for various system configurations.

Sketch Acceleration on FPGA and its Applications in Network Anomaly Detection

Packet classification techniques are continuously challenged as network bandwidth increases and new services are deployed. Ternary Content Addressable Memories (TCAMs) have traditionally been used for scenarios requiring high-speed packet processing. However, TCAM-based classification suffers from high power consumption and clock rate limitations. Among several proposed solutions, TCAM emulation through RAM has emerged as a more flexible and energy-efficient strategy. On the other hand, Field-Programmable Gate Array (FPGA) devices have been evolving providing not only abundant logical resources but also an increasing number of integrated RAM blocks. This paper investigates performance and trade-offs related to TCAM emulation in FPGAs. In particular, we analyze the impact of encoding different key ranges on rules for different configurations in terms of the search key length and the number of rules. To validate and evaluate actual performance, we report and discuss results of real implementations on FPGA devices. Our work shows that classification rates above 300Mpps for both large keys and rule sets can be implemented with only a few megabits of RAM when considering up to medium size range matching intervals.

Performance evaluation of packet classification on FPGA-based TCAM emulation architectures

Nowadays, in a broad range of application areas, the daily data production has reached unprecedented levels. This data origins from multiple sources, such as sensors, social media posts, digital pictures and videos and so on. The technical and scientific issues related to the data booming have been designated as the "Big Data" challenges. To deal with big data analysis, innovative algorithms and data mining tools are needed in order to extract information and discover knowledge from the continuous and increasing data growing. In most of data mining methods the data volume and variety directly impact on computational load. In this paper we illustrate a hardware architecture of the decision tree predictor, a widely adopted machine learning algorithm. In particular we show how it is possible to automatically generate a hardware implementation of the predictor module that provides a better throughput that available software solutions.

Towards Automatic Generation of Hardware Classifiers

Carrying out deep packet inspection (DPI) in aggregated network connections remains a continuous requirement even though the line rate reaches and exceeds 100 Gb/s. The increasing packet-arrival rate necessitates efficient solutions for on-the-fly packet parsing, packet classification, and distribution for parallelized, software-based payload inspection. Inspection complexity and real-time processing are competing requirements. The deep analysis capabilities of software-based approaches can be enhanced by hardware-based support on time-critical packet parsing and classification. Moreover, some payload inspection tasks can be carried out in hardware as well, further reducing the resources spent on software-based solutions. This paper aims at presenting the state-of-the-art and describing a set of best practices in field programmable gate arrays (FPGA)-based packet processing, which can be applied for DPI-related tasks at 100 Gb/s and beyond. Accordingly, we provide an architectural view of the DPI systems throughout the paper. Besides summarizing the limitations of hardware- and software-based solutions for the three processing phases within a DPI system (packet parsing, packet classification, and payload inspection), this paper reveals the possible trade-offs for choosing the different technical approaches. These limitations include operating frequency, bus size, available memory, on-chip physical resources for hardware-based implementations, and CPU time for software-based solutions.

FPGA-Assisted DPI Systems: 100 Gbit/s and Beyond

Machine learning (ML) algorithms have been shown to be effective in classifying the dynamic internet traffic today. Using additional features and sophisticated ML techniques can improve accuracy and can classify a broad range of application classes. Realizing such classifiers to meet high data rates is challenging. In this paper, we propose two architectures to realize complete online traffic classifier using flow-level features. First, we develop a traffic classifier based on C4.5 decision tree algorithm and Entropy-MDL discretization algorithm. It achieves an accuracy of 97.92% when classifying a traffic trace consisting of eight application classes. Next, we accelerate our classifier using two architectures on FPGA. One architecture stores the classifier in on-chip distributed RAM. It is designed to sustain a high throughput. The other architecture stores the classifier in block RAM. It is designed to operate with small hardware footprint and thus built at low hardware cost. Experimental results show that our high throughput architecture can sustain a throughput of $550$ Gbps assuming 40 Byte packet size. Our low cost architecture demonstrates a 22% better resource efficiency than the high throughput design. It can be easily replicated to achieve $449$ Gbps while supporting 160 input traffic streams concurrently. Both architectures are parameterizable and programmable to support any binary-tree-based traffic classifier. We develop a tool which allows users to easily map a binary-tree-based classifier to hardware. The tool takes a classifier as input and automatically generates the Verilog code for the corresponding hardware architecture.

http://cial.csie.ncku.edu.tw/st2012/pdf/(FPGA%202013)%20High%20throughput%20and%20programmable%20online%20traffic%20classifier%20on%20FPGA.pdf

High throughput and programmable online trafficclassifier on FPGA

Hardware implementations of Internet Protocol (IP) classification algorithms have been proposed by the research community over the years to realize high speed routers and Internet backbone. Decomposition-based IP classification algorithms are desirable for hardware implementation due to their parallel search on multiple fields. These algorithms consist of two phases: independent searches on each packet field in the first phase followed by the second phase where the results from the first phase are combined. However, the primary challenge in implementing this high-level approach lies in the second phase, i.e. how to efficiently combine the results of the single field searches. In this paper, we propose a systolic-array-based architecture on FPGA focusing on the combining techniques in phase two. The proposed approach exploits the rich logic resources on FPGA and achieves high throughput by deeply pipelining the architecture. We show the area analysis of the design to demonstrate the efficiency in on-chip resource usage. We also experimentally evaluate the impact of the size of the input rule set and number of matching rules from first phase on the performance of our design. We compare our design against the Bit Vector algorithm, another decomposition-based classification method, and demonstrate that our design is more efficient with respect to logic resource usage and is feasible for large rule sets. Post place and route result using a state-of-the-art FPGA device shows that the design can sustain a throughput of 107 Gbps, for a rule set consisting of up to 64K rules.

https://www.computer.org/csdl/pds/api/csdl/proceedings/download-article/12OmNxwENQz/pdf

Optimizing Decomposition-Based Packet Classification Implementation on FPGAs

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Lu Sun

Author Tools

Chat about Author

Papers

High throughput and programmable online trafficclassifier on FPGA

Optimizing Decomposition-Based Packet Classification Implementation on FPGAs