GraphVeri: A NAR-based control plane verification framework for routing protocols

Abstract

The distributed control plane routing protocols of networks are inherently complex and prone to configured incorrectly, such as BGP and OSPF, necessitating rigorous verification to ensure that configurations meet requirements. The classic methods for configuration verification predominantly rely on formal verification techniques, which model the intricate relationships among network configurations, protocols and the corresponding forwarding behaviors, under some assumptions of the network environment. However, these methods are lack of scalability (the verification time increases exponentially as topology scales) and generality (requiring substantial manual effort for development and maintenance). This paper introduces a novel neural algorithmic reasoning (NAR) based verification framework called GraphVeri, aiming at distributed routing protocol configuration verification. Our approach can learn how to verify from the perfect mapping from configurations to specification satisfactions directly and continuously, thereby capturing the underlying knowledge of distributed control plane protocols and their verification processes. With such a learning-based verifier, we can achieve comprehensive end-to-end verification with perfect scalability and extendability, and without the burdensome task of formal modeling typically associated with distributed routing protocols. Furthermore, the inductive learning capability of GraphVeri enables the verifier to learn how to integrate the local node attribute information to generate embeddings for previously unseen nodes. Evaluations conducted on the Topology Zoo dataset and BGP&OSPF protocols demonstrate that our NAR-based learning verifiers attain high accuracy, efficiency and scalability. GraphVeri achieves comparable accuracy to GraphGAT, which was initially developed for network synthesis, while at $2\times$ (GPU) and $10\times$ (CPU) speed up. Compared with the classic verifiers, GraphVeri (CPU) can attain a speed up of 2.93–38.28$\times$ and 2300–12764$\times$ to Batfish and Minesweeper respectively; GraphVeri (GPU) attain a speed of 33.51–366.29$\times$ and 30434–217653$\times$ to Batfish and Minesweeper respectively. Moreover, the verification time of GraphVeri increases slower than that of the classic verifiers.