Crossing domains for accuracy: in-network stacking of machine learning classifiers

• Autor(a) principal: Xavier, Bruno Missi
• Data de Publicação: 2024
• Tipo de documento: Tese
• Idioma: por
• Título da fonte: Repositório Institucional da Universidade Federal do Espírito Santo (riUfes)
• Texto Completo: http://repositorio.ufes.br/handle/10/18092
• topic: Network softwarization; Machine learning; Traffic classification; Ciência da Computação

Traffic management plays a crucial role for this expansive global connectivity. In this context, traffic classification strategically differentiates a range of applications and its requirements. This transformation enhances network agility and facilitates the direct integration of Machine Learning (ML) into the network infrastructure, fundamentally changing traffic management by promoting proactive data processing and analysis within the network. The synergy of Network Softwarization (NS) with ML not only leads to reduced latency and improved load management, but also increases the capacity to effectively handle larger volumes of data. Consequently, networks are better equipped to meet the complex demands of modern digital ecosystems, ensuring robust and efficient connectivity. This thesis delved into the domain of programmable networks, with a specific focus on implementing ML for traffic classification within the network architecture components, including the Radio Access Network (RAN) and programmable data planes. This approach represents a significant departure from the traditional traffic classification techniques, which are typically deployed on end-hosts. It also paves the way for integrating Cross Domain Artificial Intelligence (AI) capabilities within the network, facilitated by multi-view learning. More specifically, we advanced the state-of-the-art with four main contributions: (i) We design a framework named Early Attack Guarding and Learning Engine (EAGLE) as the first defense line against a set of cyber threats. Our framework explores Open Radio Access Network (O-RAN) to collect measurements from the air interface (that is, Physical and Medium Access Control) to identify and early mitigate malicious flows; (ii) We introduce MAP4 that demonstrates the feasibility of deploying ML models (that is, decision trees and Random Forest) in the data plane. To achieve this, we rely on the P4 language to deploy a pre-trained model to accurately classify flows at line rate; (iii) We proposed an In-Network Concept Drift to deal with the dynamic nature of the network traffic. This approach detects changes in traffic distribution by implementing Exponentially Weighted Moving Average (EWMA) overcoming the P4 limitations; (iv) Our Cross-Domain AI integrates multiple layers (RAN and programmable data planes) to form an in-network stacking of ML classifiers under the multi-view learning perspective. This innovative approach overcomes the challenges of a single layer in order to improve the overall accuracy of the classification system.