Traffic Load Predictions Using Machine Learning : Scale your Appliances a priori

Abstract: Layer 4-7 network functions (NF), such as Firewall or NAPT, have traditionally been implemented in specialized hardware with little to no programmability and extensibility. The scientific community has focused on realizing this functionality in software running on commodity servers instead. Despite the many advancements over the years (e.g., network I/O accelerations), software-based NFs are still unable to guarantee some key service-level objectives (e.g., bounded latency) for the customer due to their reactive approach to workload changes. This thesis argues that Machine Learning techniques can be utilized to forecast how traffic patterns change over time. A network orchestrator can then use this information to allocate resources (network, compute, memory) in a timely fashion and more precisely. To this end, we have developed Mantis, a control plane network application which (i) monitors all forwarding devices (e.g., Firewalls) to generate performance-related metrics and (ii) applies predictors (moving average, autoregression, wavelets, etc.) to predict future values for these metrics. Choosing the appropriate forecasting technique for each traffic workload is a challenging task. This is why we developed several different predictors. Moreover, each predictor has several configuration parameters which can all be set by the administrator during runtime. In order to evaluate the predictive capabilities of Mantis, we set up a test-bed, consisting of the state-of-the-art network controller Metron [16], a NAPT NF realized in FastClick [6] and two hosts. While the source host was replaying real-world internet traces (provided by CAIDA [33]), our Mantis application was performing predictions in real time, using a rolling window for training. Visual inspection of the results indicates that all our predictors have good accuracy, excluding (i) the beginning of the trace where models are still being initialized and (ii) instances of abrupt change. Moreover, applying the discrete wavelet transform before we perform predictions can improve the accuracy further.