Flow Size Prediction with Short Time Gaps

Having a priori knowledge about network flow sizes is invaluable in network traffic control. Previous efforts on estimating flow sizes have focused on long flows, where each flow is identified by a large time gap in the sequence of packets. In this work, using extensive measurements, we investigate the feasibility of predicting the size of short flows, where the flow duration can be in the order of microseconds. Specifically, we deploy several popular workloads in a public cloud testbed, and collect both network and host traces for each workload. The network trace contains standard packet metadata, while the host trace contains high-level host statistics (e.g., memory usage and disk I/O) and low-level function call traces (e.g., malloc(), send()) that are captured during the execution of each workload via host instrumentation using eBPF. These traces are then used to train machine learning models for flow size prediction with varying time gaps ranging from microseconds to milliseconds. Our results indicate that: (1) It is feasible to predict short flow sizes with high accuracy, i.e., percentage error in 0-12% range, (2) the low-level traces lead to 10-20% improvement in prediction accuracy compared to using the network and high-level traces.