An LSTM Framework for Software-Defined Measurement

Providing fine-grained traffic measurement is crucial for many network management and optimization tasks such as traffic engineering, anomaly detection, load balancing, power management, and traffic matrix estimation. Software-defined networks can potentially enable fine-grained measurement by providing statistics for each forwarding rule. However, the TCAMs that are used for rule matching and statistics generation have limited size due to their high cost and power consumption. This allows only a fraction of the flows to be monitored. In this article, we present DeepFlow, a framework for scalable software-defined measurement that relies on an efficient mechanism that a) adaptively detects the most active source and destination IP prefixes, b) collects fine-grained measurements for the most active prefixes and coarse grained for the less active ones, and c) uses historical measurements in order to train a Long Short-Term Memory (LSTM) model that can be used to provide short-term predictions whenever exact flow counters cannot be placed at a switch due to its limited resources. Thus the number of fine-grained flows measured can increase significantly without the need to use other flow sampling solutions that suffer from low accuracy. An extensive experimental evaluation study using real network traces shows that DeepFlow outperforms the baselines in terms of the total number of flows measured.