Methods and systems for classifying traffic flows based on packet processing metadata
AssigneePensando Systems Inc.
InventorsLakshmi Narasimhan Seshan, Bharat Kumar Bandaru
Life of this patent
Estimating the term…
Abstract
Methods and system for directing traffic flows to a fast data path or a slow data path are disclosed. Parsers can produce packet header vectors (PHVs) for use in match-action units. The PHVs are also used to generate feature vectors for the traffic flows. A flow training engine produces a classification model. Feature vectors input to the classification model result in output predictions predicting if a traffic flow will be long lived or short lived. The classification models are used by network appliances to install traffic flows into fast data paths or the slow data paths based on the predictions.
Claims18
A method comprising:
- receiving, by a network appliance, a plurality of packets of a plurality of traffic flows;
- parsing, by a parser in a data path implemented by a special purpose packet processing circuitry in the network appliance, a plurality of packet headers of the packets to produce a plurality of packet header vectors (PHVs);
- using the PHVs to process the packets in the data path before transmitting the packets to a plurality of destination IP addresses that are in the PHVs;
- storing, in a flow table of the network appliance, a flow creation time of the traffic flows or a packet count of the traffic flows;
- using the PHVs, by the network appliance, to produce a plurality of feature vectors for the traffic flows;
- associating a plurality of labels with the feature vectors, each of the plurality of feature vectors labeled with one of the labels;
- producing a training data that includes the feature vectors stored in association with the labels;
- and
- producing a classification model using the training data, wherein the classification model is configured to produce a prediction based on an input feature vector, the prediction indicating one of the labels,
- wherein
- the labels are associated with the feature vectors based on the flow creation time, a duration determined using the flow creation time, or the packet count of the traffic flows.
A network appliance comprising:
- an ingress unit that receives a plurality of packets of a plurality of traffic flows;
- special purpose packet processing circuitry that implements a parser that parses the packets to produce a plurality of PHVs;
- a plurality of match action units that are implemented by the special purpose packet processing circuitry that use the PHVs to process the packets;
- a flow table that stores a flow creation time of the traffic flows or a packet count of the traffic flows;
- and
- an egress unit that transmits the packets to a plurality of destination IP addresses that are in the PHVs after the packets are processed by the match action units,
- wherein
- the network appliance produces a plurality of feature vectors for the traffic flows from the PHVs,
- the network appliance associates a plurality of labels with the feature vectors,
- the labels are associated with the feature vectors based on the flow creation time, a duration determined using the flow creation time, or the packet count,
- the network appliance produces a training data that includes the feature vectors stored in association with the labels, and
- the network appliance submits the training data to a flow training engine configured to produce a classification model using the training data, wherein the classification model is configured to produce a prediction based on an input feature vector, the prediction indicating one of the plurality of labels.
Dependencies are inferred from the claim text.