Traffic Refinery: Cost-Aware Data Representation for Machine Learning on
  Network Traffic
  Network management often relies on machine learning to make predictions about
performance and security from network traffic. Often, the representation of the
traffic is as important as the choice of the model. The features that the model
relies on, and the representation of those features, ultimately determine model
accuracy, as well as where and whether the model can be deployed in practice.
Thus, the design and evaluation of these models ultimately requires
understanding not only model accuracy but also the systems costs associated
with deploying the model in an operational network. Towards this goal, this
paper develops a new framework and system that enables a joint evaluation of
both the conventional notions of machine learning performance (e.g., model
accuracy) and the systems-level costs of different representations of network
traffic. We highlight these two dimensions for two practical network management
tasks, video streaming quality inference and malware detection, to demonstrate
the importance of exploring different representations to find the appropriate
operating point. We demonstrate the benefit of exploring a range of
representations of network traffic and present Traffic Refinery, a
proof-of-concept implementation that both monitors network traffic at 10 Gbps
and transforms traffic in real time to produce a variety of feature
representations for machine learning. Traffic Refinery both highlights this
design space and makes it possible to explore different representations for
learning, balancing systems costs related to feature extraction and model
training against model accuracy.
