将网络基础模型部署到SmartNIC,实现高效低延迟的流量分析。
Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC

- 通过局部字节序列建模,避免全局处理的冗余开销。
- 在8个主流模型中达到相近的宏平均F1,端到端延迟降低328倍至毫秒级。
- 适合需要实时安全分析的边缘场景,如数据中心网络监控。
普遍加密使大规模标注在流量分析中不可行,而安全运维又要求边缘分析以避免服务降级和额外漏洞。这催生了两个分离的研究方向:一是依赖少标注的通用分析(通过网络基础模型),二是通过硬件卸载实现高效分析(低延迟)。然而,以往工作始终在两者间权衡,我们认为这种不兼容性源于流量分析系统三个组件——流量处理、模型架构、分析执行——上的极端设计选择。为此,我们提出Nepco,一个将网络基础模型卸载至SmartNIC的通用且高效的流量分析系统。关键观察是:判别性流量信息集中于局部字节区域,因此应采用高效局部字节序列建模而非低效全局建模。为避免复杂编码步骤带来的延迟瓶颈,我们设计了直接嵌入原始字节序列的硬件友好流水线。更重要的是,为保持跨任务泛化能力,我们提出一种带专用评分与门控机制的模式感知卷积架构,利用平移不变性动态定位并提取关键语义特征。我们在Nvidia BlueField-3 SmartNIC上实现了Nepco,采用多引擎协同分析执行。实验表明,Nepco在宏平均F1上媲美8个顶尖网络基础模型的最佳表现,同时将端到端延迟降低328倍,达到毫秒级。
原文摘要 · Abstract (English)
Pervasive encryption makes large-scale labeling infeasible for traffic analysis, while security operations demand edge analysis to avert service degradation and further vulnerabilities. These pressures have produced two disjoint research lines: 1) versatile analysis, via network foundation models for low label dependency, and 2) efficient analysis, via hardware offloading for low analysis latency. However, versatility and efficiency have appeared fundamentally incompatible to co-achieve, with prior work consistently sacrificing one for the other, yet we show that this incompatibility is a consequence of polarized design choices across the three components of traffic analysis systems, i.e., traffic processing, model architecture, and analysis execution. In response, we present Nepco, a versatile yet efficient network traffic analysis system that offloads network foundation models to SmartNIC. Our key observation is that discriminative traffic information is concentrated in localized byte regions, motivating versatile yet efficient localized byte-sequence modeling rather than inefficient global modeling. To exploit this without incurring the latency bottlenecks of complex encoding steps, we employ a hardware-friendly processing pipeline that directly embeds raw byte sequences. Crucially, to maintain versatility across diverse tasks, we propose a pattern-aware convolutional architecture equipped with dedicated scoring and gating mechanisms. By exploiting translation invariance, this design dynamically locates and extracts salient semantic signatures. We prototype Nepco on the Nvidia BlueField-3 SmartNIC with multiengine collaborative analysis execution. The experimental results demonstrate that Nepco achieves macro F1 competitive with the best performances achieved by 8 state-of-the-art network foundation models, while reducing end-to-end latency by 328x to the millisecond scale.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。