Net2Text: Query-Guided Summarization of Network Forwarding Behaviors - PowerPoint PPT Presentation

Net2Text: Query-Guided Summarization of Network Forwarding Behaviors Rüdiger Birkner , Dana Drachsler-Cohen, Martin Vechev, Laurent Vanbever net2text.ethz.ch NSDI ’18 April, 11 2018

SEAT NEWY CHIC DENV KSCY INDI SUNV PHIL LOSA ATLA HOUS 1

SEAT NEWY CHIC DENV KSCY INDI SUNV PHIL LOSA ATLA HOUS 1

Where is the traffic leaving in NEWY coming from? 1

Where is the traffic leaving NEWY coming from? Approach Look at entire forwarding state all the tra ffj c statistics to identify important destinations to reroute Challenge From a wealth of low-level data, extract the high-level insights 2

Understanding how the network behaves, can take hours Fast reaction is required Customer experience depends on it Networks get more and more complex New peerings, more routers, etc. 3

What if you could simply ask the questions… and automatically get an answer? 4

Text Net 2 Type a message… 5

Text Net 2 Where is the traffic… 5

Text Net 2 question in Where is the traffic leaving natural language in NEWY coming from? Type a message… 5

Text Net 2 Where is the traffic leaving in NEWY coming from? Type a message… 5

Text Net 2 Where is the traffic leaving question in in NEWY coming from? natural language The traffic enters mostly in PHIL summary in and goes to Youtube and Netflix. natural language Type a message… 5

Net2Text has four stages: parsing, data retrieval, summarization, translation Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… Network database 6

Net2Text has four stages: parsing, data retrieval, summarization, translation Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… Network database 7

The parser maps the operator’s query to the internal query language Input Output How is Google traffic SELECT * FROM paths 
 How is Google traffic to handled ? NEWY to NEWY handled? WHERE egress=NEWY 
 Organization Router AND dest=Google Destination Egress Query Type Traffic Identifier 8

Based on the query, Net2Text retrieves all relevant data Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… Network database SELECT * FROM paths 
 WHERE egress=NEWY 
 AND dest=Google 9

The database maintains the forwarding state and traffic statistics 10

The database maintains the forwarding state and traffic statistics prefix dest. ingress egress … avg. bw path 1 8.8.8.0/24 … 98.4 Mbps Google BOST NEWY path 2 46.14.0.0/16 Swisscom BOST NEWY … 0.4 Mbps path 3 81.63.0.0/17 Swisscom ATLA NEWY … 25.0 Mbps … … … … … … path n 8.8.178.0/24 Yahoo ATLA HOUS … 1.0 Mbps 10

All the data is summarized by identifying a few clusters Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… ingress avg. bw path 1 BOST 98.4 Mbps … path 2 BOST 0.4 Mbps … … … path n SFO 16.1 Mbps … 11

All the data is summarized by identifying a few clusters Input pertaining to Google traffic leaving in NEWY Output prefix … avg. bw ingress short. path 8.8.8.0/24 path 1 98.4 Mbps … BOST T 8.8.4.0/24 path 2 0.4 Mbps BOST T … path 3 66.102.0.0/20 25.0 Mbps BOST F … path 4 35.184.0.0/19 25.0 Mbps HOUS F … … … … … … path n 35.184.0.0/19 1.0 Mbps … BOST T 12

All the data is summarized by identifying a few clusters Input pertaining to Google traffic leaving in NEWY Output prefix … avg. bw ingress short. path {BOST i }, 8.8.8.0/24 path 1 98.4 Mbps … BOST T 8.8.4.0/24 path 2 0.4 Mbps BOST T … path 3 66.102.0.0/20 25.0 Mbps BOST F … path 4 35.184.0.0/19 25.0 Mbps HOUS F … … … … … … path n 35.184.0.0/19 1.0 Mbps … BOST T 13

Each cluster represents a path specification A summary consists of multiple path specifications Input pertaining to Google traffic leaving in NEWY Output prefix … avg. bw ingress short. path {BOST i } , 8.8.8.0/24 path 1 98.4 Mbps … BOST T 8.8.4.0/24 path 2 0.4 Mbps BOST T … path 3 66.102.0.0/20 25.0 Mbps BOST F … path 4 35.184.0.0/19 25.0 Mbps HOUS F … … … … … … path n 35.184.0.0/19 1.0 Mbps … BOST T 13

All the data is summarized by identifying a few clusters Input pertaining to Google traffic leaving in NEWY Output prefix … avg. bw ingress short. path {BOST i }, 8.8.8.0/24 path 1 98.4 Mbps … BOST T {BOST i , T sp } , 8.8.4.0/24 path 2 0.4 Mbps BOST T … {BOST i , T sp , ATL w } path 3 66.102.0.0/20 25.0 Mbps BOST F … path 4 35.184.0.0/19 25.0 Mbps HOUS F … … … … … … path n 35.184.0.0/19 1.0 Mbps … BOST T 13

Path specifications are translated back to natural language Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… Network database {BOST i }, , {BOST i , T sp } {BOST i , T sp , ATL w } 14

The translation uses templates to obtain natural language from path specifications Input Output The Google traffic to NEWY The Traffic Identifier Description {BOST i }, enters in BOST… , {BOST i , T sp } enters in BOST Google {BOST i , T sp , ATL w } to NEWY 15

Net2Text has four stages: parsing, data retrieval, summarization, translation Input Workflow Output The Google traffic to NEWY How is Google traffic NL Parser Summarization Translation to NEWY handled? enters in BOST… Network database 16

Text Net 2 1 Summarization from question to succinct answer 2 Scaling summarizing fast 3 Performance & operator interviews summaries within a few seconds

Text Net 2 1 Summarization from question to succinct answer 2 Scaling summarizing fast 3 Performance & operator interviews summaries within a few seconds

Finding a summary of the network-wide forwarding state is simple Traffic is being forwarded. 17

Finding a summary of the network-wide forwarding state is simple Traffic from LOSA to 35.184.0.0/19, which is owned by Google, is leaving the network in CHIC and takes the path SUNV, DENV, KSCY, INDI to CHIC. 18

Coverage amount of data described by the summary Explainability amount of detail provided by the summary 19

Traffic is being forwarded. Coverage Explainability 19

Coverage Traffic from LOSA to 35.184.0.0/19, which is owned by Google, … Explainability 19

Coverage better Explainability 19

Summarization is an optimization problem guided by the summary score Score Weighted sum of the amount of traffic covered by each path specification in the summary. 21

Summarization is an optimization problem guided by the summary score Coverage Score Weighted sum of the amount of traffic covered by each path specification in the summary. 21

Summarization is an optimization problem guided by the summary score Explainability weights based on level of detail of the path specification Score Weighted sum of the amount of traffic covered by each path specification in the summary. 21

Summarization is an optimization problem guided by the summary score Score Weighted sum of the amount of traffic covered by each path specification in the summary. Goal Find path specifications that maximize the score. 21

all the data Coverage in all details Explainability 22

Summarization is an optimization problem guided by the summary score and a size restriction Score Weighted sum of the amount of traffic covered by each path specification in the summary. Goal Find k path specifications each of size at most t that maximize the score. 23

k = 3, t = 3 Ø,Ø,Ø 24

Ø,Ø,Ø {SUNV e },Ø,Ø {LOSA i },Ø,Ø … 24

Ø,Ø,Ø {SUNV e },Ø,Ø {LOSA i },Ø,Ø … … {SUNV e , LOSA i },Ø,Ø {LOSA i },{NEWY e },Ø 24

Ø,Ø,Ø {SUNV e },Ø,Ø {LOSA i },Ø,Ø … … {SUNV e , LOSA i },Ø,Ø {LOSA i },{NEWY e },Ø … {LOSA i },{NEWY e },{Yahoo d } {SUNV e }, {SUNV e, LOSA i },Ø … {SUNV e , LOSA i , Google d }, 
 {SUNV e , NEWY i , Yahoo d }, 
 {HOUS e , NEWY i , Yahoo d } 24

The search space is exponential in the number of path specifications and feature values Ø,Ø,Ø {SUNV e },Ø,Ø {LOSA i },Ø,Ø … … {SUNV e , LOSA i },Ø,Ø {LOSA i },{NEWY e },Ø … {LOSA i },{NEWY e },{Yahoo d } {SUNV e }, {SUNV e, LOSA i },Ø … {SUNV e , LOSA i , Google d }, 
 {SUNV e , NEWY i , Yahoo d }, 
 {HOUS e , NEWY i , Yahoo d } 24

Due to the size of the search space, exhaustive exploration is not feasible 25

Text Net 2 1 Summarization from question to succinct answer 2 Scaling summarizing quickly 3 Performance & operator interviews summaries within a few seconds

Net2Text relies on two optimizations Optimization 1 Optimization 2 Approximation Sampling Reduce the search space Reduce the input data 26