1 of 35

Making the Self-Driving “Net” Work�Unlocking the Power of Abundant (Unlabeled) Network Telemetry Data with Network Foundation Models

Arpit Gupta

Assistant Professor, UC Santa Barbara

Faculty Scientist, Berkeley Lab (ESnet)

2 of 35

Progress in Last Decade---Software-Defined Networks

Monitor

Control

Programmable Dataplane

Sense

with fine-grained telemetry data

Network Automation

Infer

disruptive network events and threats

React

with precise control actions

Enables secure and performant connectivity with limited resources

3 of 35

Still…

Monitor

Control

4 of 35

Still…SDN’s Network Automation is Human-Centric

Monitor

Control

Fails to handle complex learning problems �(e.g., detect and neutralize APTs)

Pre-defined rules

5 of 35

Changing Requirements---Network Security

National Security Commission on Artificial Intelligence, 2021

  • AI is a quintessential dual-use technology
  • AI-enabled tools will be the first resort in a new era of conflict
  • Countering AI-capable adversaries with human intelligence alone invites disaster

6 of 35

What do we “Really” Need?

Monitor

Control

Pre-defined rules

Machine Learning

Self-Driving Networks

secure & performant connectivity with minimal human interventions

2018

2019

7 of 35

Key Requirement

Monitor

Control

Production-ready ML Model(s)

Generalizable, robust, trustworthy, ...

8 of 35

Production-Ready ML Model(s) for Networks

  • Efforts in Past Decades

1000+ research publications, multiple products/startups, millions of dollars invested

  • Expectations
    • Easy to develop ML models for any given problem and target environment
    • Abundance of production-ready ML models---ready for high-stake decision-making

  • Reality
    • Availability of public datasets dictates choice of learning problem and environment
    • Abundance of ML artifacts with high performance in controlled “lab” settings

9 of 35

Production-Ready ML Model(s) for Networks

  • Efforts in Past Decades

1000+ research publications, multiple products/startups, billions of dollars invested

  • Expectations
    • Easy to develop ML models for any given problem and target environment
    • Abundance of production-ready ML models---ready for high-stake decision-making

  • Reality
    • Availability of public datasets dictates choice of learning problem and environment
    • Abundance of ML artifacts with high performance in controlled “lab” settings
    • Reluctance among network operators to deploy existing ML-based solutions

Getting even a single ML model deployed in production settings is a struggle!

10 of 35

Fundamental Roadblocks

Training

Evaluation

Preprocessing +

Model selection

Deployment

Data

Model

For any given learning problem and target environment �what is the “right” data

Standard ML Pipeline

Places the responsibility on users to find the right data, �i.e., data that enables developing generalizable ML model

11 of 35

Fundamental Roadblocks

Training

Evaluation

Preprocessing +

Model selection

Deployment

Data

Model

For any given learning problem and target environment

how to collect the “right” data

Standard ML Pipeline

Networking problems necessitate endogenous data collection

Data Collection

12 of 35

Fundamental Roadblocks

Training

Evaluation

Preprocessing +

Model selection

Deployment

Data

Model

How to assess if resulting models are generalizable, i.e., not underspecificied?

Standard ML Pipeline

Black-box

Outputs the most performant model, with little to no insights into model’s decision-making (black-box)

13 of 35

Closed-Loop ML Pipeline

Training

Evaluation

Preprocessing +

Model selection

Deployment

Explain

Analyze

Data Collection

Domain Expert

Analysis results

Data-collection intents

“Better” Data

For any given learning problem and environment,

iteratively fix underspecification issues to collect “better” data

“Some” Data

14 of 35

Building Blocks for Closed-loop ML Pipeline

  • netUnicorn [CCS’23]

Iteratively collect data for any problem and environment

  • Trustee [CCS’22]

Explain and analyze ML model’s decision making

  • PINOT [HotNets’19, NSDI’22, VLDB’23, ANRW’23]

Transform your production network for data collection

Data

Training

Evaluation

Preprocessing +

Model selection

Deployment

Trustee

netUnicorn

Domain Expert

Analysis results

Data-collection intents

PINOT

15 of 35

Is this Enough?

Endogenous

Labelled

Data

Training

Evaluation

Preprocessing +

Model selection

Deployment

Trustee

netUnicorn

Domain Expert

Analysis results

Data-collection intents

PINOT

Exogenous

Unlabelled

Telemetry Data

How to leverage the untapped potential of abundant, yet, unlabeled telemetry data

16 of 35

Network Foundation Model

Unlabeled

Telemetry Data

Pre-Training

Task Agnostic

self-supervised learning

Labelled

Network Data

Fine-Tuning

Fine-Tuning

Task Specific

supervised learning

. . .

Labelled

Network Data

Abundant!

Thanks to SDN-powered telemetry infrastructure

Can be sparse and noisy!

Almost always the case, even with closed-loop ML pipeline

Ability to leverage abundant telemetry data,

catalyze development of production-ready ML for networks

17 of 35

What’s Unique about Network Data (Packet Traces)?

  • Embody different protocols (tokenization?)

Packet content is dictated by disparate protocols and standards

  • Entail variable length sequences (token selection?)

Packet sequences at any granularity is heavy tailed (multi-fractal behavior)

  • Encode multi-modal information (token embedding)

Packet sequences carry critical spatial, temporal, & contextual information

  • Intrinsically hierarchical (modelling)

Packets in different spatial/temporal groups have disparate semantic meanings

Necessitates a “Domain-specific” Approach

18 of 35

netFound: A Domain-Specific Network Foundation Model

Protocol-aware tokenization

Metadata

Hierarchical

Architecture

One of the first attempt to develop domain-specific network foundation model from scratch!

19 of 35

How well does it perform?

Network

Foundation Models

Deep Learning

Models

20 of 35

How well does it perform?

Outperforms all existing SOTAs for different downstream learning tasks

21 of 35

Current State

Packet

Traces

Develop performant & generalizable solutions to well-explored learning problems

22 of 35

Where do we want to go?

System

Calls

MIBs

Packet

Traces

IDS

Alerts

App.

Logs

Client

Code

Server

Code

Use multi-modal heterogenous data to learn learn hidden context---solve “unexplored” learning problems

23 of 35

“Unexplored” Learning Problems in Networking

  • Less Ambitious

A natural language chatbot to summarize network state and take “low-risk” actions

  • Moderately Ambitious

Accurately predict future traffic patterns (what/when/where) for known (e.g., scientific workflow) or unknown (e.g., APT) application

  • Extremely Ambitious

Learn pkt-2-pkt, code-2-pkt, and pkt-2-code transformations

24 of 35

Peering into the Future

Goal

Offer trillion+ parameters network foundation model as a service

Cloud/Content Service Providers

(AWS, Google, ESnet, etc.)

Internet Service Providers

(AWS, Google, MS, etc.)

Small-medium Enterprises

(UCSB, GT, Princeton, etc.)

Local fine-tuning

Global pre-training

25 of 35

Peering into the Future

Fundamental Research Questions

  • Embed multi-modal multi-dimensional telemetry data from hosts & network devices
  • Explain decision-making for both pre-trained and fine-tuned models
  • Determine how much and what data to use
  • How to leverage production data in a privacy-preserving manner for pre-training
  • Scale pre-training to trillions of params

Cloud/Content Service Providers

(AWS, Google, ESnet, etc.)

Internet Service Providers

(AWS, Google, MS, etc.)

Small-medium Enterprises

(UCSB, GT, Princeton, etc.)

Goal

Offer trillion+ parameters network foundation model as a service

26 of 35

Making the Self-Driving Networks “Work”!

Monitor

Control

Global Pre-trained

Network Foundation Model

Local Fine-tuned

Learning models (agents)

Production-ready ML Model(s)

Generalizable, robust, trustworthy, ...

Strategic investment in a publicly accessible pre-trained network foundation model is vital for realizing self-driving networks!

27 of 35

Summary

Urgent need to develop Self-driving Networks!

  • Past--Software-defined Networking

Simplifies collecting unlabeled telemetry data at scale

  • Present--Closed-loop ML

Enables developing generalizable and explainable ML models using supervised learning techniques

  • Future--Network Foundation Model

Leverage SDN-powered telemetry data and closed-loop ML pipeline to realize self-driving networks

28 of 35

Backup Slides

29 of 35

Our Approach: Traffic Decomposition

Decompose the input packet sequences into semantically meaningful hierarchical sub-groups (i.e., flows, bursts, etc.)

30 of 35

Our Approach: Embedding Meta Information

Concatenate the contextual multi-modal information as metadata

31 of 35

Our Approach: Protocol-Aware Tokenization

Preserve the semantic meanings of different packet fields during tokenization

32 of 35

Our Approach: Data-Driven Token selection

  • Select the median sequence lengths

  • Compose sequences from different hierarchies
    • 18 tokens per packet
    • 6 packets per burst
    • 12 bursts per flow

33 of 35

Our Approach: Hierarchical Transformer

Learns latent representations at different granularities & captures token dependencies across different sub-groups

34 of 35

netFound Overview

35 of 35

Training

Evaluation

Pre-trained

model

Deployment

Trustee

netUnicorn

Domain Expert

Analysis results

Data-collection intents

PINOT

netFound

Network Foundation Model

Endogenous

(labelled)

Data

Exogenous

(unlabeled)

Telemetry Data

Preprocessing +

Model selection

Task-Agnostic Pretraining

Task-Specific Fine-Tuning