Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Synecdoche: Efficient and Accurate In-Network Traffic Classification via Direct Packet Sequential Pattern Matching

Minyuan Xiao, Yunchun Li, Yuchen Zhao, Tong Guan, Mingyuan Xia, Wei Li

TL;DR

Synecdoche addresses the accuracy-efficiency gap in in-network traffic classification on programmable data planes by discovering discriminative Key Segments offline with a 1D-CNN and Grad-CAM, and then deploying them as range-based patterns for fast online matching. The approach combines a two-phase offline discovery and online matching paradigm with a backup decision-tree classifier for flows that miss Key Segments, enabling accurate, low-latency classification at line rate. Empirical results on IoT attack and encrypted application datasets show substantial $F1$ improvements over statistical and online DL baselines, along with major SRAM reductions and latency improvements on real hardware. This work demonstrates the viability of packet sequential pattern matching on PDPs and provides a reproducible framework with publicly available code. The method promises practical impact for secure and high-performance networking in 5G, IoT, and edge contexts.

Abstract

Traffic classification on programmable data plane holds great promise for line-rate processing, with methods evolving from per-packet to flow-level analysis for higher accuracy. However, a trade-off between accuracy and efficiency persists. Statistical feature-based methods align with hardware constraints but often exhibit limited accuracy, while online deep learning methods using packet sequential features achieve superior accuracy but require substantial computational resources. This paper presents Synecdoche, the first traffic classification framework that successfully deploys packet sequential features on a programmable data plane via pattern matching, achieving both high accuracy and efficiency. Our key insight is that discriminative information concentrates in short sub-sequences--termed Key Segments--that serve as compact traffic features for efficient data plane matching. Synecdoche employs an "offline discovery, online matching" paradigm: deep learning models automatically discover Key Segment patterns offline, which are then compiled into optimized table entries for direct data plane matching. Extensive experiments demonstrate Synecdoche's superior accuracy, improving F1-scores by up to 26.4% against statistical methods and 18.3% against online deep learning methods, while reducing latency by 13.0% and achieving 79.2% reduction in SRAM usage. The source code of Synecdoche is publicly available to facilitate reproducibility and further research.

Synecdoche: Efficient and Accurate In-Network Traffic Classification via Direct Packet Sequential Pattern Matching

TL;DR

Synecdoche addresses the accuracy-efficiency gap in in-network traffic classification on programmable data planes by discovering discriminative Key Segments offline with a 1D-CNN and Grad-CAM, and then deploying them as range-based patterns for fast online matching. The approach combines a two-phase offline discovery and online matching paradigm with a backup decision-tree classifier for flows that miss Key Segments, enabling accurate, low-latency classification at line rate. Empirical results on IoT attack and encrypted application datasets show substantial improvements over statistical and online DL baselines, along with major SRAM reductions and latency improvements on real hardware. This work demonstrates the viability of packet sequential pattern matching on PDPs and provides a reproducible framework with publicly available code. The method promises practical impact for secure and high-performance networking in 5G, IoT, and edge contexts.

Abstract

Traffic classification on programmable data plane holds great promise for line-rate processing, with methods evolving from per-packet to flow-level analysis for higher accuracy. However, a trade-off between accuracy and efficiency persists. Statistical feature-based methods align with hardware constraints but often exhibit limited accuracy, while online deep learning methods using packet sequential features achieve superior accuracy but require substantial computational resources. This paper presents Synecdoche, the first traffic classification framework that successfully deploys packet sequential features on a programmable data plane via pattern matching, achieving both high accuracy and efficiency. Our key insight is that discriminative information concentrates in short sub-sequences--termed Key Segments--that serve as compact traffic features for efficient data plane matching. Synecdoche employs an "offline discovery, online matching" paradigm: deep learning models automatically discover Key Segment patterns offline, which are then compiled into optimized table entries for direct data plane matching. Extensive experiments demonstrate Synecdoche's superior accuracy, improving F1-scores by up to 26.4% against statistical methods and 18.3% against online deep learning methods, while reducing latency by 13.0% and achieving 79.2% reduction in SRAM usage. The source code of Synecdoche is publicly available to facilitate reproducibility and further research.
Paper Structure (23 sections, 5 equations, 7 figures, 4 tables)

This paper contains 23 sections, 5 equations, 7 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background And Related Works
  3. Programmable Data Plane
  4. Related Work
  5. Discussion
  6. Key Segments: Definition, Properties, and Framework Overview
  7. Key Segments: Definition and Core Properties
  8. Framework Overview
  9. The Discovery of Key Segments
  10. Traffic Preprocessing
  11. 1D-CNN Model Training
  12. Segment Extraction via Grad-CAM
  13. Key Segment Generation via Clustering and Filtering
  14. Matching with Key Segments
  15. Key Segment Table Generation
  16. ...and 8 more sections

Figures (7)

  • Figure 1: Examples of Key Segments
  • Figure 2: The high-level architecture of our Synecdoche framework, illustrating the two-phase pipeline from offline discovery to online matching on the programmable data plane.
  • Figure 3: An example of segment Extraction via Grad-CAM
  • Figure 4: An example of register update and Key Segment table matching
  • Figure 5: Score threshold selection across datasets.
  • ...and 2 more figures