Making the Self-Driving “Net” Work�Unlocking the Power of Abundant (Unlabeled) Network Telemetry Data with Network Foundation Models
Arpit Gupta
Assistant Professor, UC Santa Barbara
Faculty Scientist, Berkeley Lab (ESnet)
Progress in Last Decade---Software-Defined Networks
Monitor
Control
Programmable Dataplane
Sense
with fine-grained telemetry data
Network Automation
Infer
disruptive network events and threats
React
with precise control actions
Enables secure and performant connectivity with limited resources
Still…
Monitor
Control
Still…SDN’s Network Automation is Human-Centric
Monitor
Control
Fails to handle complex learning problems �(e.g., detect and neutralize APTs)
Pre-defined rules
…
Changing Requirements---Network Security
National Security Commission on Artificial Intelligence, 2021
What do we “Really” Need?
Monitor
Control
Pre-defined rules
…
Machine Learning
Self-Driving Networks
secure & performant connectivity with minimal human interventions
2018
2019
Key Requirement
Monitor
Control
…
Production-ready ML Model(s)
Generalizable, robust, trustworthy, ...
Production-Ready ML Model(s) for Networks
1000+ research publications, multiple products/startups, millions of dollars invested
Production-Ready ML Model(s) for Networks
1000+ research publications, multiple products/startups, billions of dollars invested
Getting even a single ML model deployed in production settings is a struggle!
Fundamental Roadblocks
Training
Evaluation
Preprocessing +
Model selection
Deployment
Data
Model
For any given learning problem and target environment �what is the “right” data
Standard ML Pipeline
Places the responsibility on users to find the right data, �i.e., data that enables developing generalizable ML model
Fundamental Roadblocks
Training
Evaluation
Preprocessing +
Model selection
Deployment
Data
Model
For any given learning problem and target environment
how to collect the “right” data
Standard ML Pipeline
Networking problems necessitate endogenous data collection
Data Collection
Fundamental Roadblocks
Training
Evaluation
Preprocessing +
Model selection
Deployment
Data
Model
How to assess if resulting models are generalizable, i.e., not underspecificied?
Standard ML Pipeline
Black-box
Outputs the most performant model, with little to no insights into model’s decision-making (black-box)
Closed-Loop ML Pipeline
Training
Evaluation
Preprocessing +
Model selection
Deployment
Explain
Analyze
Data Collection
Domain Expert
Analysis results
Data-collection intents
“Better” Data
For any given learning problem and environment,
iteratively fix underspecification issues to collect “better” data
“Some” Data
Building Blocks for Closed-loop ML Pipeline
Iteratively collect data for any problem and environment
Explain and analyze ML model’s decision making
Transform your production network for data collection
Data
Training
Evaluation
Preprocessing +
Model selection
Deployment
Trustee
netUnicorn
Domain Expert
Analysis results
Data-collection intents
PINOT
Is this Enough?
Endogenous
Labelled
Data
Training
Evaluation
Preprocessing +
Model selection
Deployment
Trustee
netUnicorn
Domain Expert
Analysis results
Data-collection intents
PINOT
Exogenous
Unlabelled
Telemetry Data
How to leverage the untapped potential of abundant, yet, unlabeled telemetry data
Network Foundation Model
Unlabeled
Telemetry Data
Pre-Training
Task Agnostic
self-supervised learning
Labelled
Network Data
Fine-Tuning
Fine-Tuning
Task Specific
supervised learning
. . .
Labelled
Network Data
Abundant!
Thanks to SDN-powered telemetry infrastructure
Can be sparse and noisy!
Almost always the case, even with closed-loop ML pipeline
Ability to leverage abundant telemetry data,
catalyze development of production-ready ML for networks
What’s Unique about Network Data (Packet Traces)?
Packet content is dictated by disparate protocols and standards
Packet sequences at any granularity is heavy tailed (multi-fractal behavior)
Packet sequences carry critical spatial, temporal, & contextual information
Packets in different spatial/temporal groups have disparate semantic meanings
Necessitates a “Domain-specific” Approach
netFound: A Domain-Specific Network Foundation Model
Protocol-aware tokenization
Metadata
Hierarchical
Architecture
One of the first attempt to develop domain-specific network foundation model from scratch!
How well does it perform?
Network
Foundation Models
Deep Learning
Models
How well does it perform?
Outperforms all existing SOTAs for different downstream learning tasks
Current State
Packet
Traces
Develop performant & generalizable solutions to well-explored learning problems
Where do we want to go?
System
Calls
MIBs
Packet
Traces
IDS
Alerts
App.
Logs
Client
Code
Server
Code
Use multi-modal heterogenous data to learn learn hidden context---solve “unexplored” learning problems
“Unexplored” Learning Problems in Networking
A natural language chatbot to summarize network state and take “low-risk” actions
Accurately predict future traffic patterns (what/when/where) for known (e.g., scientific workflow) or unknown (e.g., APT) application
Learn pkt-2-pkt, code-2-pkt, and pkt-2-code transformations
Peering into the Future
Goal
Offer trillion+ parameters network foundation model as a service
Cloud/Content Service Providers
(AWS, Google, ESnet, etc.)
Internet Service Providers
(AWS, Google, MS, etc.)
Small-medium Enterprises
(UCSB, GT, Princeton, etc.)
Local fine-tuning
Global pre-training
Peering into the Future
Fundamental Research Questions
Cloud/Content Service Providers
(AWS, Google, ESnet, etc.)
Internet Service Providers
(AWS, Google, MS, etc.)
Small-medium Enterprises
(UCSB, GT, Princeton, etc.)
Goal
Offer trillion+ parameters network foundation model as a service
Making the Self-Driving Networks “Work”!
Monitor
…
Control
Global Pre-trained
Network Foundation Model
Local Fine-tuned
Learning models (agents)
Production-ready ML Model(s)
Generalizable, robust, trustworthy, ...
Strategic investment in a publicly accessible pre-trained network foundation model is vital for realizing self-driving networks!
Summary
Urgent need to develop Self-driving Networks!
Simplifies collecting unlabeled telemetry data at scale
Enables developing generalizable and explainable ML models using supervised learning techniques
Leverage SDN-powered telemetry data and closed-loop ML pipeline to realize self-driving networks
Backup Slides
Our Approach: Traffic Decomposition
Decompose the input packet sequences into semantically meaningful hierarchical sub-groups (i.e., flows, bursts, etc.)
Our Approach: Embedding Meta Information
Concatenate the contextual multi-modal information as metadata
Our Approach: Protocol-Aware Tokenization
Preserve the semantic meanings of different packet fields during tokenization
Our Approach: Data-Driven Token selection
Our Approach: Hierarchical Transformer
Learns latent representations at different granularities & captures token dependencies across different sub-groups
netFound Overview
Training
Evaluation
Pre-trained
model
Deployment
Trustee
netUnicorn
Domain Expert
Analysis results
Data-collection intents
PINOT
netFound
Network Foundation Model
Endogenous
(labelled)
Data
Exogenous
(unlabeled)
Telemetry Data
Preprocessing +
Model selection
Task-Agnostic Pretraining
Task-Specific Fine-Tuning