The Nuts and Bolts of Building FlowLens

Abstract

The recent adoption of programmable switching devices has enabled the deployment of efficient packet processing primitives in large-scale, high-speed networks. These capabilities have sparked a consistent effort from the research community to perform network security tasks in such switches with the goal of decreasing reaction times to threats and reducing costs associated with equivalent centralized server-based infrastructures. Unfortunately, existing solutions [20, 23, 41] target specific security-driven tasks and cannot accommodate ML tasks that perform targeted flow classification based on packet size or inter-packet frequency distributions.