Learning precise distributions of traffic features (e.g., burst sizes, packet inter-arrival time) is still a largely unsolved problem despite being critical for management tasks such as capacity planning or anomaly detection. A key limitation nowadays is the lack of feedback between the control plane and the data plane. Programmable data planes offer the opportunity to create systems that let data- and control plane to work together, compensating their respective shortcomings. We present FitNets, an adaptive network monitoring system leveraging feedback between the data- and the control plane to learn accurate traffic distributions. In the control plane, FitNets relies on Kernel Density Estimators which allow to provably learn distributions of any shape. In the data plane, FitNets tests the accuracy of the learned distributions while dynamically adapting data collection to the observed distribution fitness, prioritizing under-fitted features. We have implemented FitNets in Python and P4 (including on commercially available programmable switches) and tested it on real and synthetic traffic traces. FitNets is practical: it is able to estimate hundreds of distributions from up to 60 millions samples per second, while providing accurate error estimates and adapting to complex traffic patterns.

翻译：学习流量特征（如突发大小、数据包到达间隔时间）的精确分布，对于容量规划或异常检测等管理任务至关重要，但这在很大程度上仍是一个未解决的问题。当前的一个关键限制在于控制平面与数据平面之间缺乏反馈。可编程数据平面为创建让数据平面与控制平面协同工作的系统提供了机会，从而弥补了各自的不足。我们提出了FitNets，这是一种利用数据平面与控制平面之间的反馈来学习精确流量分布的自适应网络监控系统。在控制平面，FitNets依赖于核密度估计器，它能够可证明地学习任意形状的分布。在数据平面，FitNets测试已学习分布的准确性，同时根据观测到的分布拟合度动态调整数据收集，优先处理拟合不足的特征。我们已在Python和P4（包括在商用可编程交换机上）实现了FitNets，并在真实和合成的流量轨迹上进行了测试。FitNets具有实用性：它能够从每秒高达6000万个样本中估计数百个分布，同时提供准确的误差估计并适应复杂的流量模式。