Packet Classification Using Dynamically Generated Decision Trees 2017/4/27 Packet Classification Using Dynamically Generated Decision Trees Author: Yu-Chieh Cheng and Pi-Chung Wang Publisher: IEEE Transactions on Computers, Vol. 64, No. 2, February 2015 Presenter: Chih-Hsun Wang Date: 2014/3/18 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C. CSIE CIAL Lab 1

2017/4/27 Introduction Most decision-tree-based algorithms may suffer from a memory explosion problem. Binary Search on Levels (BSOL) is a decision-tree algorithm for packet classification with superior speed performance. Our scheme dynamically generates multiple decision trees to eliminate filter replications in BSOL. 因為 replication Based on BSOL, 提出一個replication control的方法 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels Decision tree construction All filters are listed in a root node A cut filter is generated to partition the filters into two groups. BSOL constraints the same cut rule when applying on nodes with the same tree height. Node space partitioning stops when all leaf nodes have less than or equal to bucket size. BSOL他分為兩部分: decision tree construction, hash building 一開始所有的rules會在root中，接著選一個會產生最少replication的field去對切，並且他限制同個level並需用相同的維度去切，這樣做是為了將同level的leaf node存在同個hash table，搜尋時就不用從decision tree去搜尋，直接對hash table 做binary search National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels For example National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels Hash building A set of hash tables is generated to store the leaf nodes, where each hash table corresponds to a height of the decision tree with leaf nodes. The markers are then inserted into the hash tables for enabling a binary search. 建好decision tree後，根據每個level去產生hash table，然後為了要能在hash table做binary search，還會插入marker National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels 00 F9,F10 Leaf 10 F8,F11 01 Marker 11 H1 011 F10 Leaf 111 F11 010 Marker 110 H2 H3 H4 01010 F0, F5,F10 Leaf 01011 F0, F1, F6, F10 11000 F3, F7, F11 11001 F2, F4, F7, F11 0100 F10 Leaf 1101 F7,F11 0101 Marker 1100 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels Incoming Packet: 0000, 1011, 11, 01, TCP Search: 11000 H1 H2 00 F9,F10 Leaf 10 F8,F11 01 Marker 11 011 F10 Leaf 111 F11 010 Marker 110 切割順序: f5, f2, f1, f2, f4 H3 H4 0100 F10 Leaf 1101 F7,F11 0101 Marker 1100 01010 F0, F5,F10 Leaf 01011 F0, F1, F6, F10 11000 F3, F7, F11 11001 F2, F4, F7, F11 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels Incoming Packet: 0000, 1011, 11, 01, TCP Search: 11000 H1 H2 00 F9,F10 Leaf 10 F8,F11 01 Marker 11 011 F10 Leaf 111 F11 010 Marker 110 H3 H4 0100 F10 Leaf 1101 F7,F11 0101 Marker 1100 01010 F0, F5,F10 Leaf 01011 F0, F1, F6, F10 11000 F3, F7, F11 11001 F2, F4, F7, F11 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Binary Search On Levels 2017/4/27 Binary Search On Levels Incoming Packet: 0000, 1011, 11, 01, TCP Search: 11000 H1 H2 00 F9,F10 Leaf 10 F8,F11 01 Marker 11 011 F10 Leaf 111 F11 010 Marker 110 H3 H4 0100 F10 Leaf 1101 F7,F11 0101 Marker 1100 01010 F0, F5,F10 Leaf 01011 F0, F1, F6, F10 11000 F3, F7, F11 11001 F2, F4, F7, F11 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

2017/4/27 BSOL2 A single decision tree may not be scalable for large filter sets. Dividing the filter set into two subsets. One stores the filters whose length of source IP address prefix is less than five. The remaining filters are stored in another subset. The source IP address is selected since there are usually the most wildcards or short prefixes. 為了解決BSOL replication 問題，後來又有人提出一個方法BSOL2，由於單一decision tree的方式較不適用於大的rule set，因為會有太多replication，BSOL2將rule set 切成兩棵decision tree，將src ip prefix < 5 的 建成一棵，其餘的建成另一棵，挑選src ip主要是因為他觀察真實src IP發現這部分有較多的wildcard或是prefix較小，而prefix越小越容易產生replication。但這種方法缺乏彈性，在某些情況下performance會更糟 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

2017/4/27 BSOL2 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

2017/4/27 BSOL-RC Replication control adjusts the filters stored in a decision tree by utilizing the information of filter replication during tree construction. rrthresh * n is the maximum allowable number of filters in a decision tree. i.e., the total number of filters including replicated filters after completing tree construction must be less than or equal to rrthresh * n 利用tree建立時replication的資訊來調整decision tree的rule Rrthresh*n 是他定義包含replication可以在decision tree中存在的rule數最大值 N 是原本存在decision tree 的 filters數 rrthresh是rule replication ratio threshold National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

2017/4/27 BSOL-RC Initially, we employ the BSOL procedure to construct a decision tree. If the total number of the stored filters in a decision tree is greater than the upper bound, the filters with the smallest replication level are removed from the decision tree. Filters removed from the decision tree are inserted into a new decision tree to repeat the above steps. If a constructed tree is too high to search, we need to reconstruct the decision tree to improve the storage efficiency. 首先會利用原本BSOL的方式去建decision tree, 若遇到replication則將該level記為replication level，並紀錄replication 的數量 若decision tree所存的rules數大於upper bound，就去最小的replication level remove掉replication 的 rule，將他插入下一棵新的decision tree 接著就一直repeat 直到 decision tree complete National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F0,F1,F5,F6,F9,F10 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 f2:0* f2:1* f2:0* f2:1* rrthresh=1，表示只要一有replication，就會將之remove到下一棵樹，這種動態處理replication的方式更適合處理不同及大量的set F9,F10 F0,F1,F5,F6,F10 F8,F11 F2,F3,F4,F7,F11 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F10,F11 F0,F1,F5,F6,F9,F10 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F10,F11 f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 f2:0* f2:1* f2:0* f2:1* F9 F0,F1,F5,F6 F8 F2,F3,F4,F7 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F10,F11 F0,F1,F5,F6,F9,F10 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F10,F11 f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 f2:0* f2:1* f2:0* f2:1* F9 F0,F1,F5,F6 F8 F2,F3,F4,F7 f1:0* f1:0* F0,F1,F5,F6 F2,F3,F4,F7 f2:11* f2:10* f2:11* F0,F1,F5,F6 F2,F3,F4,F7 F7 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F7,F10,F11 F0,F1,F5,F6,F9,F10 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F7,F10,F11 f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 f2:0* f2:1* f2:0* f2:1* F9 F0,F1,F5,F6 F8 F2,F3,F4,F7 f1:0* f1:0* F0,F1,F5,F6 F2,F3,F4,F7 f2:11* f2:10* F0,F1,F5,F6 F2,F3,F4 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F7,F10,F11 F0,F1,F5,F6,F9,F10 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F7,F10,F11 f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 f2:0* f2:1* f2:0* f2:1* F9 F0,F1,F5,F6 F8 F2,F3,F4,F7 f1:0* f1:0* F0,F1,F5,F6 F2,F3,F4,F7 f2:11* f2:10* F0,F1,F5,F6 F2,F3,F4 f4:0* f4:1* f4:0* f4:1* F0, F5 F0, F1, F6 F2, F4 F3 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F0,F7,F10,F11 2017/4/27 BSOL-RC rrthresh=1 Bucket size: 2 F0-F11 F0,F7,F10,F11 f5:UDP f5:TCP f5:UDP f5:TCP F0,F1,F5,F6,F9,F10 F2,F3,F4,F7,F8,F12 F0,F10 F7, F11 f2:0* f2:1* f2:0* f2:1* F9 F0,F1,F5,F6 F8 F2,F3,F4,F7 f1:0* f1:0* F0,F1,F5,F6 F2,F3,F4,F7 f2:11* f2:10* F0,F1,F5,F6 F2,F3,F4 f4:0* f4:1* f4:0* f4:1* F5 F1, F6 F2, F4 F3 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Performance Evaluation 2017/4/27 Performance Evaluation RC的架構下，大部分memory比BSOL2還要少 因為2較沒有彈性，始終都是針對IP source來做分類，如果遇到一個特殊case，將會造顯著的replication增加。 而RC是動態的調整replication的filter，有效減少replication的產生，故memory使用較少。 National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Performance Evaluation 2017/4/27 Performance Evaluation National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab

Performance Evaluation 2017/4/27 Performance Evaluation National Cheng Kung University CSIE Computer & Internet Architecture Lab CSIE CIAL Lab