arXiv subjects

Roman Beltiukov

Publications and source records attributed to Roman Beltiukov.

3 recordsLinked to original sources

arXiv2025

SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate

Machine learning (ML) is increasingly being deployed in programmable data planes (switches and SmartNICs) to enable real-time traffic analysis, security monitoring, and in-network decision-making. Decision trees (DTs) are particularly well-suited for these tasks due to their interpretability and compatibility with data-plane architectures, i.e., match-action tables (MATs). However, existing in-network DT implementations are constrained by the need to compute all input features upfront, forcing models to rely on a small, fixed set of features per flow. This significantly limits model accuracy and scalability under stringent hardware resource constraints. We present SPLIDT, a system that rethinks DT deployment in the data plane by enabling partitioned inference over sliding windows of packets. SPLIDT introduces two key innovations: (1) it assigns distinct, variable feature sets to individual sub-trees of a DT, grouped into partitions, and (2) it leverages an in-band control channel (via recirculation) to reuse data-plane resources (both stateful registers and match keys) across partitions at line rate. These insights allow SPLIDT to scale the number of stateful features a model can use without exceeding hardware limits. To support this architecture, SPLIDT incorporates a custom training and design-space exploration (DSE) framework that jointly optimizes feature allocation, tree partitioning, and DT model depth. Evaluation across multiple real-world datasets shows that SPLIDT achieves higher accuracy while supporting up to 5x more stateful features than prior approaches (e.g., NetBeacon and Leo). It maintains the same low time-to-detection (TTD) as these systems, while scaling to millions of flows with minimal recirculation overhead (<0.05%).

cs.NI↗

arXiv2025

Leveraging Large Language Models to Contextualize Network Measurements

With the worldwide growth of remote communication and telepresence, network measurements form a cornerstone of effective performance assessment and diagnostics for Internet users. Most often, users seek for overall connection performance measurement using publicly available tools (also known as `speed tests') that provide an overview of their connection's throughput and latency. However, extracting meaningful insights from these measurements remains a challenging task for a non-technical audience. Interpreting network measurement data often requires considerable domain expertise to account not only for subtle variations of the connection stability and metrics, but even for simpler concepts such as latency under load or packet loss influence towards connection performance. In the absence of proper expertise, common misconceptions can easily arise. To address these issues, researchers should recognize the importance of making network measurements not only more comprehensive but also more accessible for wider audience without deep technical knowledge. A promising direction to achieve this goal involves leveraging recent advancements in large language models (LLMs), which have demonstrated capabilities in conducting an analysis of complex data in other fields, such as laboratory test results interpretation, news summarization, and personal assistance. In this paper, we describe an ongoing effort to apply large language models and historical data to enhance the interpretation of network measurements in real-world environments. We aim to automate the translation of low-level metric data into accessible explanations, allowing non-experts to make more informed decisions regarding network performance and reliability.

cs.NI↗

arXiv2023

In Search of netUnicorn: A Data-Collection Platform to Develop Generalizable ML Models for Network Security Problems

The remarkable success of the use of machine learning-based solutions for network security problems has been impeded by the developed ML models' inability to maintain efficacy when used in different network environments exhibiting different network behaviors. This issue is commonly referred to as the generalizability problem of ML models. The community has recognized the critical role that training datasets play in this context and has developed various techniques to improve dataset curation to overcome this problem. Unfortunately, these methods are generally ill-suited or even counterproductive in the network security domain, where they often result in unrealistic or poor-quality datasets. To address this issue, we propose an augmented ML pipeline that leverages explainable ML tools to guide the network data collection in an iterative fashion. To ensure the data's realism and quality, we require that the new datasets should be endogenously collected in this iterative process, thus advocating for a gradual removal of data-related problems to improve model generalizability. To realize this capability, we develop a data-collection platform, netUnicorn, that takes inspiration from the classic "hourglass" model and is implemented as its "thin waist" to simplify data collection for different learning problems from diverse network environments. The proposed system decouples data-collection intents from the deployment mechanisms and disaggregates these high-level intents into smaller reusable, self-contained tasks. We demonstrate how netUnicorn simplifies collecting data for different learning problems from multiple network environments and how the proposed iterative data collection improves a model's generalizability.

cs.NI↗