A Multilayer Neural Network for IP Lookup Packet Classification

A Multilayer Neural Network for IP Lookup Packet Classification and * + 8 * Mehran Mahramian Moallem, Nasser Yazdani, Karim Faez, Hassan Taheri * + Amir Kabir University of Technology, Tehran University {htaheri, kfaez) @aku.ac.ir, yazdani@ut.ac.ir, m-mahramian@isc.iranet.net Abstract--1P routers use lookup tables to forward packets. They also classify packets to determine which flow they belong to in order to decide the type of quality of service they should receive. Increasing rate of communication links and expansion of the global network is in contrast with the practical processing power of the switching devices. We propose a neural network scheme for the IP lookup problem. Our algorithm -a 12 layers neural network- represents acceptable results on the error rate and training time. Fortunately, parallel processing of neural networks provides a huge processing power to process packets. Our algorithm can be implemented in hardware on a single chip and can perform an IP lookup in only 4.5 nanoseconds implying it can support 60 Gbps link rate. Pipelining and parallel processing can be used to increase the link rate up to 400 Gbps and decrease the learning time. Keywords: IP lookup, Packet classification, Neural network, Back propagation. I I. INTRODUCTION Communication link rates have been increased up to terra bit per second, however; processing power in the switching elements has not been improved at the same pace. Fiber links are potentially able to transfer billions of packets in one second, but switching devices can not process them in the line speed. On the other hand, expansion the size of the global network increases the size of lookup tables. However, increasing communication line speeds reduces the process and search times since the packets must be switched at the wire speed. All these imply forwarding engines need a more efficient IP lookup scheme [29]. Routers forward an incoming packet to the next hop based on the packet s destination address. This is accomplished by finding the longest prefix matching the packet s destination address in the forwarding lookup table and, then, forwarding it to the corresponding next hop. Unfortunately, this process is very time consuming and costly. Hence, regarding facts such as increase in the packet arrival rates, complexity of the lookup and size of the lookup tables, it sounds IP lookup is a bottleneck in high speed networks [IO]. Packet classification is an essential feature in supporting QoS, Quality of Service, and security in data networks. This is usually accomplished through some rules stored in a table. Each rule is identified by few fields of the TCPIIP header and the action must be applied to the packets whose header fields match the rule. Since different rules may match a specific packet, then, the main objective is to identify the highest priority rule that applies to an incoming packet. Two of the special interest header fields are the packet s source and destination. These fields are usually specified as prefixes. Then, we encounter the same prefix matching problem in packet classification. Two different approaches may be used to apply the proposed algorithm to the packet classification problem. In the first approach, one of the previous algorithms that map packet classification to IP lookup is used and, then, our proposed neural network algorithm for IP lookup can be used at the second step. For example, the algorithm proposed by Srinivasan et. al. [26], translates the packet classification problem to IP lookup. This needs a preprocessing, which can be implemented in hardware or software. The second approach can be used in cases where there are fvied rules or the classification rules are rarely modified. For example, for a two fields based rules consisting of the source and destination 1P addresses, our proposed architecture for 1P lookup can be used directly, i.e. the first and the second neural networks (i.e. the first 6 layers) are disabled sticking their inputs to zero and the third neural network (i.e. the layers 7, 8 and 9) is used for source IP address and the last neural network (i.e. the last three layers) is used for destination IP address. Therefore, in this paper, only concentrate on the IP lookup problem and its implementation and skip the details of mapping to classification. Most of the proposed solutions transform the packet classification problem into IP lookup [2-4, 8, 9, 12, 13, 16, 24, 25, 261. Indeed, the IP lookup problem is a special case of the packet classification problem when matching is only performed on one dimension or simply destination address. Thus, a scalable and fast solution for IP lookup can also be used to solve the packet classification problem. This is the direction we pursue in this proposal. Any lookup or classification algorithm must satisfy some requirements [lo]. First, it must be fast enough to work on the wire speed. Implementation comes next implying that it must be easy and feasible. It also should have low update and initialization time even though this condition is not as critical as the search and matching time. 0-7803-81 14-9/03/$17.00 02003 IEEE. 924

~ I Output port with longest prefix match t I Wt? 0000000000000000 IP ADDRESS Figure I. Block diagram of a neural network IP lookup System. Neural network has been rarely applied to the packet classification and IP lookup problems. K. M. C. Tan tries to detect the presence of unauthorized and anomalous network services [27]. He proposes developing a neural network system for a network connection signature for common network services. This allows any connection to be recognized and serviced independently of the connecting port. Neural network algorithms are generally flexible and fast. They can be implemented using parallel processors. They require distributed memory architectures, which results in reduced access time to the memory since they can be accessed simultaneously. By increasing the number of hidden layer neurons, neural networks can learn large routing tables [ls]. Training time is the main issue in neural networks. Usually, it takes a long time for a neural network to leam all input patterns. Updating rate of neural networks is another problem [7]. Our third algorithm proposed in this paper fairly solves these problems. We propose a new multi layer algorithm based on back propagation. Our method uses a supervised algorithm i.e. each new IP address IS trained to the neural network as well as its next hop [ 11. We tune the algorithm to make it suitable for IP lookup. Links running at 60 Gbps rates need the router to process 200 million packets per second (assuming minimum-sized 40 bytes TCPIIP packets) [ 101. Our algorithm can accept a new packet every 4.5ns. Therefore, it can forward 200 million packets in a second. The proposed network can be implemented in a single chip. We investigated a fast multiplier for the links and our calculations show that it can be implemented in an IC (ASIC or FPGA). The rest of the paper is organized as follows. Section 2 describes IP lookup problem. Back propagation neural networks are described in section 3. Our new algorithm is presented in Section 4. Implementation issues including architecture of the VLSI circuit and neurons are investigated in section 5. Section 6 concludes the paper and contains the future work. 11.,BACKGROUND AND RELATED WORK The proposed approaches for the IP lookup problem are usually classified in four categories [28]. First category includes methods which usually modify exact matching schemes and apply them to prefix matching. We include the trie-based schemes in this category. The methods are many including M-Way prefix tree and binary prefix tree [29], Ranged search tree, Patricia Trie, Dynamic Prefix Trie [6], Level Compression Trie [20], Multiway and Multicolumn Search [ 171, DIR-24-8-BASIC scheme [ 111, Multilevel prefix tree [5] and some others. Second category contains hardware based solutions. They usually use CAM (Content Addressable Memory). In CAM, the content of each memory location is compared in parallel to the input key and data in the matching location is put on the output. This is relatively fast, but an expensive solution [19,21]. Third category contains protocol-based solutions like MPLS, Multiprotocol Label Switching, and TAG switching. These methods try to avoid prefix matching by translate it into exact matching. These methods require modifying packet headers. Unfortunately, not 'all of the existing networks support these protocols. Furthermore, still, we need IP lookup at the ingress or edges of networks. Finally, the last category of solutions is caching. This solution is also expensive like CAM and cannot be used for large IP lookup tables. In the neural network algorithm, we train the neural network and apply all of the prefixes to the network. After the learning phase, each IP address enters the network and the next hop address appears at the output of the network. Figure 1 shows the block diagram of the system. This is a simplified view. IF' packets enter from input ports of the switch and the corresponding destination address, which specifies the output port the packet to be forwarded to, appears at the output of the neural network. There is a module for training and a memory for managing updates. 111. IP LOOKUP AND BACK PROPAGATION Back propagation (BP) is simply a gradient descent method to minimize the total squared error of the output computed by the net. Although a single-layer net is severely limited in the mapping it can learn, a multi layer net can leam any continuous mapping to an arbitrary accuracy. The BP neural networks used in this study are three layered feed forward. The length of the IP address, 32 bits, dictates the 925

& :* -~ -& ~- hl*- &--:>ga - %.-.-.A * * a r m Figure 1. A 12 layers neural network based on four back propagation networks. Each network gets 8 bits of IP prefix. Training is done in parallel. size of the input layer. The number of available next hops represented in the IP switch, each output unit representing one output port, determines the output layer size. The hidden unit size, in the first step is ten. We use the Hecht-Nielsen theorem [7] for an optimized and reliable number of hidden neurons. The theorem says that any continuous function f : I" -+ R", where I is the closed unit interval [0, 11, can be represented exactly by a feed forward neural network having N input units, 2N + 1 hidden units and M output units. Thus, we chose 2 * 32 + 1 = 65 for the number of hidden neurons. Bipolar input and output and bipolar sigmoid activation function are used. If input IP address is C4(H), the input of BP network will be +1+1-1-1-1+1-1-1 which is applied directly to X layer of the BP network. Nguyen-Widrow initialization [7] is used for initialization of the first and second layer weights. Biases in both layers are assumed. Operations of the neural IP lookup system consist of two stages: the leaming stage and the retrieving stage. At the learning stage, IP prefixes are presented to the input channels of the system. For example, let the IP prefix length to be 2 (n = 2) bits, the number of units in the hidden layer to be 2 (p = 2) and the number of output units to be 2 (m = 2). Weight matrices are V and W. V is a (n+l)*p matrix. It connects input layer to the hidden layer. W is a (p+l)*m matrix which connects each unit of hidden layer to the output layer. If IP address = [+1-13 appears at the input of the [ 1-1.85] Figure 3. Number of routing Errors during training phase versus number of iterations. -.'I neural network and V and W have the following initial values: [1.2 V = 1.9.6,W= -1.5 -.9.03-1.7-1.4 the input of the hidden layer will be a Z matrix calculated by: z, = [l IP] * v. (Eq. 1) Outputs of the hidden units are determined by a built-in activation function f(.) like a bipolar sigmoid function: (ZO = f(z1)). (Eq. 2) 0, vector represents inputs of output layer (01 = Z,I* W) 0%. 3) Another activation function brings the output vector 0. If the input packet should be forwarded to the first output, then, we will expect a [+1-11 for the output vector. During learning phase, weights in V and W are changed, so we can have the desired output vector for each input IP address. In retrieving phase, the incoming packets' IP addresses are applied to the neural network and the network decides the next hop using the multiplication, summation and activation functions (Equations 1 to 3). w. A MULTI LAYER NEURAL NETWORK The most serious problem of a back propagation network is the training time. To solve the problem, a new algorithm, which uses four back propagation networks, is proposed. Each network is trained separately; therefore, the size of training for an IP prefix is limited to 256. Figure 2 shows the architecture of the network. The network consists of the 4 cascaded back propagation networks. Each network is trained separately in parallel. Using a simple back Neuron Input Figure 4: Detail parts of a neuron for implementation. 926

TABLE 1: SIMULATION RESULTS FOR THE THIRD ALGORITHM. 15 IP PREFIXES WERE IN THE ROUTING TABLE. propagation algorithm, the network should learn 2(32-k) IP addresses for each k bits IP prefix. For instance, the system must learn 65536 IP addresses for a 16 bits long IP prefix. In the new multilayer network, at most 3 * 256 + 128 = 896 IP addresses will be trained to the network for a 1 bit IP prefix. E.g. the IP prefm 101.229.5*(H).* is divided into 4 eight bits parts: 101, 129, 80:95, 0:255, and each of them is applied to one of back propagation networks. Thus, the first and the second networks learn one input, but the third and the fourth networks learn 15 and 256 inputs respectively. In the lookup phase, the destination address of an input packet is applied to the four back propagation networks. Next, Output of the first network is given as an input to the second network. The same is done for the third and the fourth networks. The output of the fourth network determines the output port or next hop. One question remains to answer. What will happen when some prefixes have some equal parts or one is prefix of another like 101.129.*.* and 101.129.15.*? To solve the problem, a preprocessing phase is added to the system such that each IP address to go to the output port with the longest match. In other words, the third network learns that 15 corresponds to the output port of 10 1.129.15.* and all other 255 numbers (0:14, 16:255) with the output port of 101.129.*.*. In the same way, the fourth network learns all 256 numbers, one time with output port of the first IP prefix and one time with the output port of the second one. To achieve a uniform training time in 4 back propagation networks, the total number of inputs multiplied by the number of iterations is considered as a constant Thus, the number of iterations for 4 networks is chosen in a decreasing order, e.g. 2000,50,25,6. Tables 1 and 2 show the results of simulation. The simulation was performed 24 times with different parameters; 12 times of them were repeated simulations to evaluate the repeatability of the results (Table 1). It can be seen that there is no critical error in these tests. If a packet is forwarded to an output port corresponding to a matching prefm, but not necessarily the longest one, there will be an error, but the error is not so critical. A critical error means forwarding a packet to a wrong direction. In Table 2, some other configurations are shown. The second column, simulation configuration, indicates the number of input ports, the number of neurons in hidden layer (p) and the number of output ports. sortall, simulation #2, means that prefixes are sorted before training. Unfortunately, sorting does not improve simulation results. Sorting inputs of the first layer, simulation number 6, gives similar results. Simulations 8 to 12 use a simpler algorithm. In this configuration, outputs of four back propagation networks are rounded to a one bit number where we have only 1 or -1 at the outputs of the networks. This simplifies the implementation while sensibly affecting the number of errors. v. IMPLEMENTATION ISSUES Figure 4 illustrates a neuron that should be implemented in hardware [15]. The most important part of this block diagram is the multiplier since the time needed for a multiplication is the bottleneck. The transfer kction can be implemented with a small lookup table or another neural network. We use the bipolar sigmoid function. A simple 5- steps lookup table can perform the task of transfer function. Using a multiplier in a pipelined architecture, a multiplication of two numbers can be performed in only one clock cycle. Therefore, our neural network can forward each IP packet in one clock cycle. With a 200 Mega Hertz clock, the circuit can forward 200 million packets in each second. Assuming an average of 256 bytes for the IP packet length, our algorithm can support 400 Gbps link rate. Using a higher technology, we can increase the clock rate so advancing the rate of forwarded packets in one second. For example, assuming a one Giga Hertz clock, the architecture can support 2000 Gbps link rate. The logic for each multiplier requires n * (n-bit AND) + (n-1) * (2n-bit ADD). Nine NAND gates are considered for each full adder, 13n gates are needed for each n bit adder. Thus the area of the silicon chip will be: n2 + (n-1) * (2n * 13) = 27 * n2-26 * n. Assuming n to be 16, 6500 NAND gates is needed for each neuron. In the proposed neural network, the number of inputs is 32 and the number of outputs is 8. Choosing 5 as the number of hidden neurons, we will need 40 multipliers for the second layer, which adds up to 4 * 40 multipliers totally. For the first layer, 1 * 16 bit multipliers are needed because inputs are 1 or -1. These multipliers can be ignored comparing with the second layer multipliers. Therefore we need 160 * 6500 = 1,040,000 NAND gates for implementation of the neural network. Assuming 3 transistors for each NAND gate, the network will contain 3 million-transistor, which can be implemented on a single VI. CONCLUSION AND FUTURE WORK We propose a new neural network algorithm for the IP lookup problem, which gives promising results. Our results show an IP packet can be forwarded in only one clock cycle. We also propose an architecture for the on chip implementation of our algorithm. According to our primary calculation, the method can be implemented in a chip with roughly 3 million-transistors. Regarding the average packet size of 256 bytes, our method can easily handle a 400 Gbps link rate. 927

~~ TABLE 2: SIMULATION RESULTS FOR DIFFERENT NUMBER OF IP PREFlXES AND CONFIGURATIONS. We are investigating the existing methods for optimizing the number of hidden units and generalization of BP networks. We believe one of the most important problems in neural network algorithms is convergence in the training phase. Unfortunately, this badly affects the scalability of the algorithm to the larger set of IP prefix. Improving the scalability of the algorithm constitutes the next step in this direction. REFERENCES Baraldi, A.; Panniggiani, F., neural network for unsupervised categorization of multivalued input pattems: an application to satellite image clustering, IEEE Transactions on Geoscience and Remote Sensing, pp. 305-316, Vol. 33, March 1995. Borg, N.; Svanberg, E.; Schelen, O., Efficient multi-field packet classification for QoS purposes., Seventh Intemational Workshop on Quality of Service, pp. 109-118, May 1999. Chaskar, H.M.; Dimitriou, E.; Ravikanth, R., Service guarantees in the Intemet: differentiated services approach., Eighth Intemational Workshop on Quality of Service, pp. 176-178, June 2000. Decasper, D.; Dittia, 2.; Parulkar, G.; Plattner, B., Router plugins: a software architecture for next-generation routers,, IEEEIACM Transactions on Networking, pp. 2-15, Feb. 2000. Degermark. M.; Brodlink. A.; Carlsson. S.; Pink. S., Small Forwarding Tables for Fast Routing Lookups., Proceedings of SIGCOMM, pp. 3-14, 1997. Doeringer. W.; Karjoth. G.; Nassehi. M., Routing on longest- Matching Prefixes., IEEE/ACM Trans. Networking, vol. 4, no. 1, pp. 86-97, Feb. 1996. Fausett, L. Fundamentals of neural networks. Architectures, Algorithms and Applications., Prentice Hall Intemational, Inc., 1994. Fulu Li; Seddigh, N.; Nandy, B.; Matute, D., An empirical study of today s lntemet traffic for differentiated services IP QoS, Proceedings of Fifth IEEE Symposium on Computers and Communications, pp. 207-213, July 2000. Feldman, A.; Muthukrishnan, S., Tradeoffs for packet classification., Proceedings of Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies, pp. 1193-1202, Vol. 3, March 2000. [IO] [Pankaj Gupta, Algorithms for Routing lookups and Packet Classification., Degree of Doctor of Philosophy Thesis Submitted to the Department of Computer Science of Stanford University, 2001. [I 13 Gupta. P.; Lin. S.; McKeown. N., Routing Lookups in Hardware at memory access speeds., Proceedings of Seventeenth Annual Joint Conference of the IEEE Computer and Communications Societies, vo1.3, pp. 1240-1247, 1998. [I21 Pankaj Gupta and Nick McKcown, Packet Classification on Multiple Fields., Proceedings of SIGCOMM, pp. 147-160, 1999. [I31 Hari, A.; Suri, S.; Parulkar, G., Detecting and resolving packet filter conflicts., Proceedings of Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies, pp. 1203-,1212, Vol. 3, March 2000. Hill. F. J.; Peterson. J. R., Introduction to switching theory and logical design., John Wiley & Sons, New York, Third edition, 1981. Jabri, M. A.; Coggins, R. J.; Flower. B. G., Adaptive Analog VLSI Neural Systems., Chapman & Hall, 1996. Jun Xu; Singhal, M.; Degroat, J., A novel cache architecture to support layer-four packet classification at memory access speeds., Proceedings of Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies, pp. 1445-1454, Vol. 3, March 2000 Lampson. B.; Srinivasan. V.; Varghese. G., IP Lookup using Multi way and Multicolumn Search., IEEEIACM Transactions on Networking, Vol. 7, pp. 324-334, June 1999. Lawrence. S., C. Lee Giles, Ah Chung Tsoi, What Size Neural Network Gives Optimal Generalization? Convergence Properties of Back propagation., Technical Report, Institute for Advanced Computer Studies University of Maryland, June 1996. McAuley. A. J.; Francis. P., Fast Routing Table Using CAMS., Proceedings of Twelfth Annual Joint Conference of the IEEE Computer and Communications Societies. Networking: Foundation for the Future, vo1.3, pp. 1382-1391, 1993. Nilsson, S., IP-Address Lookup Using LC-Tries., IEEE Journal on Selected Areas in Communications, Vol. 17, pp. 1083-1092, June 1999. Pi-Chung Wang; Chia-Tai Chan; Yaw-Chung Chen, A fast IP routing lookup scheme., IEEE International Conference on Communications, pp, 1140-1144, Vol. 2, June 2000. Rao, A.; Walker, M.R.; Clark, L.T.; Akers, L.A., ART1 network implementation issues., Fourth IEEE Region International Conference, pp. 462-466, Nov. 1989. Rao, A.; Walker, M.R.; Clark, L.T.; Akers, L.A., Integrated circuit emulation of ART1 networks., First IEE International Conference on Artificial Neural Networks, pp. 37-41, 1989. Singh, K., A configurable 5-D packet classification engine with 4Mpackeds throughput for high-speed data networking., IEEE International solid-state Circuits Conference, pp. 82-83, Feb 2000. Shiomoto, K.; Uga, M.; Omotani, M.; Shimizu, S.; Chimaru, T. Scalable multi-qos IP+ATM switch router Architecture IEEE Communications Magazine, pp. 86-92,.Vol. 38, 2000. V. Srinivasan, G. Varghese, S. Suri and M. Waldvogel, Fast and Scalable Layer Four Switching., Proceedings of SIGCOMM, pp. 191-202, 1998. Tan, K.M.C.; Collie, B.S., Detection and classification of TCP/IP network services., Proceedings of 13th Annual of Computer Security Applications Conference, pp. 99-107, Dec. 1997. Waldvogel. M.; Varghese. G.; Turner. J.; Plattner. B., Scalable High Speed IP Routing Lookups., In Computer Communication Review, Vol. 27, #4, October 1997. Yazdani, N.; Min, P.S., Fast and scalable schemes for the IP address lookup problem., Proceedings of the IEEE Conference on High Performance Switching and routing, pp. 83-92, June 2000. 928