Leveraging Hierarchical Inference and Knowledge Distillation in Programmable Switches for Time-Varying Traffic Classification
摘要
Programmable switches, with their attractive packet processing capability and data plane programmability, are increasingly adopted for traffic classification tasks. To fit the resource-constrained hardware environment, traditional classification methods usually employ simple inference models such as Decision Tree. However, when faced with the complex time-varying network traffic with periodicity and bursts, simple models often struggle to meet the demands for both classification accuracy and real-time performance. Therefore, this paper proposes a two-stage in-network classification system based on hierarchical Inference and knowledge distillation to handle time-varying network traffic. The system deploys a lightweight Decision Tree at the ingress switch pipeline to sort out periodic flows swiftly and a high-precision Random Forest at the egress pipeline to deeply analyze bursty traffic. To further improve the model performance, we also introduce a Feature Space Balancing Multi-Layer Perceptron (FSB-MLP) based knowledge distillation method. It mitigates representation gaps between models by reconstructing feature representations from soft labels. Additionally, we combine a binning strategy with a ternary matching mechanism to optimize switch model table and feature table. Our experiments using the CICIDS2017 and UNSW-NB15 datasets show that the proposed system achieves a high F1 score of up to 99.96% while significantly reducing the number of model rules, demonstrating excellent classification performance and compact model size suitable for programmable switches.