Learning precise distributions of traffic features (e.g., burst sizes, packet inter-arrival time) is still a largely unsolved problem despite being critical for management tasks such as capacity planning or anomaly detection. A key limitation nowadays is the lack of feedback between the control plane and the data plane. Programmable data planes offer the opportunity to create systems that let data- and control plane to work together, compensating their respective shortcomings. We present FitNets, an adaptive network monitoring system leveraging feedback between the data- and the control plane to learn accurate traffic distributions. In the control plane, FitNets relies on Kernel Density Estimators which allow to provably learn distributions of any shape. In the data plane, FitNets tests the accuracy of the learned distributions while dynamically adapting data collection to the observed distribution fitness, prioritizing under-fitted features. We have implemented FitNets in Python and P4 (including on commercially available programmable switches) and tested it on real and synthetic traffic traces. FitNets is practical: it is able to estimate hundreds of distributions from up to 60 millions samples per second, while providing accurate error estimates and adapting to complex traffic patterns.

翻译：学习流量特征（如突发大小、报文到达间隔时间）的精确分布，对于容量规划或异常检测等管理任务至关重要，但至今仍是一个尚未完全解决的问题。当前的关键瓶颈在于控制平面与数据平面之间缺乏反馈机制。可编程数据平面为构建数据平面与控制平面协同工作、弥补各自缺陷的系统提供了机会。我们提出了FitNets——一种利用数据平面与控制平面间反馈来自适应学习精确流量分布的网络监控系统。在控制平面中，FitNets采用核密度估计器，可证明能够学习任意形状的分布；在数据平面中，FitNets在动态调整数据收集策略以适应观测到的分布拟合优度的同时，优先处理欠拟合特征，从而检验已学习分布的准确性。我们基于Python和P4（包括商用可编程交换机）实现了FitNets，并在真实流量和合成流量轨迹上进行了测试。实验表明，FitNets具有实用性：在提供精确误差估计并适应复杂流量模式的前提下，每秒可处理多达6000万个样本并估计数百个分布。