Modern AI data centers face a critical paradox: while machine learning workloads dominate infrastructure demands, actual GPU utilization remains consistently low. Existing schedulers fail to coordinate heterogeneous resources effectively, lack predictive capabilities for dynamic workloads, and cannot balance isolation requirements with sharing optimization in multi-tenant clusters. This paper presents Wind, a novel resource scheduler that bridges the GPU utilization gap through predictive scheduling and geometric resource coordination. Wind introduces three key innovations: (1) a resource prediction framework that leverages historical execution patterns to forecast task requirements and completion times with high accuracy;(2) a unified scheduling architecture supporting isolation, sharing, preemption, and prioritization policies that eliminate resource fragmentation while maintaining performance guarantees; and (3) a Hilbert curve-based multi-dimensional scheduling algorithm that maps CPU-memory-GPU resource space to preserve spatial locality while achieving linear computational complexity.

Data streaming operations consume a significant portion of CPU resources in data centers. The Data Streaming Accelerator (DSA), integrated into modern Intel CPUs in datacenter, offers promising acceleration for these operations with user-friendly features. However, previous studies have overlooked DSA's internal mechanisms and the performance implications of these features, leaving key performance issues unresolved in real-world usage.

In order to provide security connections to the enterprise campus sites, internet service providers are offering comprehensive intrusion detection services at the network layer. However, existing network intrusion detection systems (NIDS) are either ineffective or inefficient for high-speed network protection, especially for encrypted traffic analysis. In this paper, we design and implement SiteGuard, an inline network intrusion detection system with programmable switches specifically developed to protect enterprise campus sites connecting to ISP. SiteGuard proposes a dual-plane feature extraction model to extract extensive traffic features at near line-speed. SiteGuard also proposes a lightweight one-class classification model that trains the best parameters exclusively on benign traffic to identify malicious traffic. In addition, SiteGuard introduces an online update mechanism that aims to dynamically adjust the detection model in response to environmental changes. SiteGuard has been in production for more than three years. Our production and testbed evaluations demonstrate SiteGuard can detect malicious traffic with approximately 90% accuracy in minutes.

Remote Direct Memory Access (RDMA) offers high performance through OS kernel bypass and has become a key technology in modern data centers. By exploiting memorysemantic operations, RDMA-based data structures can achieve high scalability and significantly reduce CPU utilization compared with traditional Ethernet-based systems. However, classic sorted indexes such asSkiplistsuffer from low throughput under RDMA memory semantics due to frequent and costly remote accesses. To achieve both scalability and high throughput for a lock-based concurrent Skiplist, this paper introduces a hybrid paradigm that combines one-sided and two-sided RDMA operations. This proposal is built upon a re-evaluation of core design choices in RDMA, including transport modes, caching strategies, and memory management. Building on this paradigm, we designHybridSkipList+, a distributed Skiplist system that integrates a client-side coherent cache with pull-based synchronization to reduce expensive network round trips, and a semi-continuous memory allocator to enhance RDMA access locality. We implementHybridSkipList+ on an eight-machine RDMA cluster and conduct extensive evaluations. Results show that HybridSkipList+ outperforms two baseline systems by up to 4.41× and 3.45× under typical workload conditions.

The provision of performance-aware video conferencing services today relies on approaches that focus on data compression and client-side bitrate adaptation techniques to optimize transmission. However, these methods fail to quickly respond to fluctuations in network conditions, thereby compromising the quality of service for transmissions. For this reason, this article aims to propose a novel traffic scheduling-based video transmission optimization solution from the perspective of the network service provider. We first investigate the resource requirements of video conferences and present the experiential performance of video conferences under different network conditions and network competition. Based on these results, we design a service-customized routing mechanism called VCApather that minimizes network contention. We then provide implementation solutions for the control plane and the data plane of VCApather . We evaluate VCApather using a fully meshed topology with five nodes and real-world video conference traffic. The results show that VCApather is capable of achieving high link utilization and balance, while also meeting predefined user metrics. Compared to other schemes, VCApather could satisfy 69.8% more QoE requirements and yielded an average bitrate improvement of 1.74 \(\times\) .

Real-time conferencing applications (RCA) are crucial for online learning and e-commerce. However, they can be affected by network fluctuations because they are heavily dependent on cloud network connections. However, there is a dearth of systematic studies that aim to pinpoint the specific network links where these fluctuations occur. We introduce a contrastive learning approach for locating anomalies, based on actual traffic from real-time conferencing applications. This method is trained on unlabeled data, which means that it does not require the creation of a large-scale training dataset. The results illustrate the robust localization ability, achieving an accuracy rate of more than 95%, demonstrating its adaptability to commonly used real-time conferencing applications.

Test-Time Adaptation (TTA) addresses domain shifts between training and testing. However, existing methods assume a homogeneous target domain (e.g., single domain) at any given time. They fail to handle the dynamic nature of real-world data, where single-domain and multiple-domain distributions change over time. We identify that performance drops in multiple-domain scenarios are caused by batch normalization errors and gradient conflicts, which hinder adaptation. To solve these challenges, we propose Domain Diversity Adaptive Test-Time Adaptation (DATTA), the first approach to handle TTA under dynamic domain shift data streams. It is guided by a novel domain-diversity score. DATTA has three key components: a domain-diversity discriminator to recognize single- and multiple-domain patterns, domain-diversity adaptive batch normalization to combine source and test-time statistics, and domain-diversity adaptive fine-tuning to resolve gradient conflicts. Extensive experiments show that DATTA significantly outperforms state-of-the-art methods by up to 13%. Code is available at https://github.com/DYW77/DATTA.

Real-time communication (RTC) applications rely on accurate bandwidth estimation to ensure high-quality communication and user experience. Traditional heuristic and reinforcement learning (RL)-based methods often face challenges with the dynamic nature of real-time networks, leading to issues with generalization. Inspired by the success of Large Language Models (LLMs)---which, with billions of parameters pre-trained on massive datasets, have demonstrated exceptional capabilities in semantic representation, adaptability, and transfer learning---we propose LLM4Band, a novel framework that integrates LLMs with offline reinforcement learning to tackle bandwidth estimation in RTC scenarios. By leveraging the powerful feature extraction capabilities of LLMs and combining them with an offline RL algorithm, LLM4Band incorporates a Balanced Replay Buffer and an LLM-based policy network to significantly enhance robustness and adaptability. Extensive experiments demonstrate that LLM4Band surpasses state-of-the-art methods, achieving a 12.35% improvement in estimation accuracy and a 21% enhancement in communication quality.

Attacks against data centers are becoming more common as a result of the fast expansion of applications. In order to keep pace with the growing amount of data centers connected to their networks, internet service providers must offer comprehensive security services. However, existing network intrusion detection systems (NIDS) are either ineffective or inefficient for the high-speed encrypted network traffic. In this paper, we design and implement Mazu, an inline network intrusion detection system with programmable switches specifically developed to protect data centers connecting to the internet service provider. Mazu proposes a dual-plane feature extraction model to extract extensive traffic features at near line-speed. Mazu also proposes a lightweight one-class classification model that trains the best parameters exclusively on benign traffic to identify the malicious traffic. In addition, Mazu introduces an online update mechanism aimed at dynamically adjusting the detection model in response to environmental changes. Mazu has been in production for two years, during which time it has identified over 10 critical attack events and protect more than 10 million servers for two ISPs. Our production and testbed evaluations demonstrate that Mazu can detect malicious traffic entering the data center sites with approximately 90% accuracy within minutes.

The growing complexity of modern Internet applications and the widespread use of microservice architectures have amplified the need for efficient trace anomaly detection to maintain system stability. Despite the fact that many trace anomaly detection algorithms have been proposed to identify abnormal behaviors, a comprehensive evaluation of these methods is lacking, which makes it difficult for developers to choose the most suitable algorithm for real-world applications. To address this gap, we presentTADBench, a comprehensive and extensible benchmark for trace anomaly detection.TADBenchconsolidates diverse publicly available trace datasets and algorithms into a unified repository, standardizes data formats, and incorporates manual anomaly labels. To ensure reproducibility and fair comparisons, we propose a modular evaluation framework supporting end-to-end model assessment. Additionally, we provide practical guidance for algorithm selection based on specific data attributes by evaluating their performance across datasets with different characteristics, thereby effectively bridging the gap between academic research and industrial deployment. To the best of our knowledge, this is the first comprehensive empirical study of trace anomaly detection algorithms. Our findings aim to facilitate the adoption of these methods in production environments, offering actionable insights for developers and researchers.

Through providing cheap rack and network hosting services, third-party internet data centers (IDCs) have gained significant popularity among cloud service providers. Real-time monitoring of the quality of the IDC network and proactively alarming is crucial to guaranteeing the reliability of cloud services. The prevailing approach to addressing this problem involves utilizing active probes and making evaluations based on the results of single-link or multi-link probing. However, the existing efforts still tend to generate a significant number of unnecessary alerts, resulting in enormous operational costs. For this reason, we first build a large-scale distributed ping-based dial test system that enables monitoring the quality of the IDC network in a many-to-one probe mode. We develop an efficient exporter tool based on the standard Prometheus' data interface to ensure real-time and precise measurement data collection. To quickly and accurately detect potential network issues, we also design a multi-step heuristic-based fault detection and alarm method. Furthermore, we propose a comprehensive alarm life-cycle model based on the results of multi-link probing to guide alarm management in production practice. This system has been successfully deployed in the production environment of Sangfor company's managed cloud for over a year, enabling proactive diagnosis of hundreds of IDC gateway IP addresses. The actual statistical results indicate a significant improvement in the mean time to repair (MTTR) for IDC network failures, reducing it from a few hours to just a few minutes. The average daily number of alarms generated by this system is less than 15, decreasing approximately 85 % compared to before. The alarm accuracy exceeds 95 % and the false negative rate is less than 2 % ■

Efficient and accurate parsing of unstructured logs is crucial for anomaly detection, root cause localization, and log compression. Although many existing works have made good progress relying on Large Language Models (LLMs) and prompt engineering techniques, most of them require a certain degree of labeling or few-shot prompts, which limits their applicability in large-scale real-time heterogeneous log environments. To tackle this issue, we develop LogGenius, a novel unsupervised log parsing framework. It initially enriches the diversity of the parsed logs by leveraging generative LLMs with zero-shot prompts. It then employs an unsupervised parsing model on the augmented log data to accomplish log parsing. In order to alleviate the impact of potential hallucination issues caused by generative LLMs, we conduct a meticulous analysis and summarize the biases inherent in LLMs when directly applying them to generate diversified logs. Building upon these insights, we propose an effective log diversity augmentation algorithm to mitigate the aforementioned concerns.We thoroughly evaluate LogGenius based on various open-source system runtime log datasets and a new alarm log dataset from a commercial cloud production environment. The experimental results demonstrate that LogGenius can improve the parsing accuracy by up to about 30%, and the parsing accuracy in unseen logs by up to about 100%, compared to the state-of-the-art unsupervised-based methods.

The rapid advancement of generative artificial intelligence (GAI) has led to the creation of transformative applications such as ChatGPT, which significantly boosts text processing efficiency and diversifies audio, image, and video content. Beyond digital content creation, GAI’s capability to analyze complex data distributions holds immense potential for next-generation networks and communications, especially given the swift rise of video conferencing applications (VCAs). This paper presents a dynamic, real-time method for detecting anomalous network links in video conferencing applications. The proposed tool, MonkeyGPT, generates tracing representations of network activity and trains a large language model from scratch to serve as a detection system based on network traffic data. Unlike traditional methods, MonkeyGPT provides an unrestricted search space and does not rely on predefined rules or patterns, enabling it to detect a wider range of anomalies. We demonstrate the effectiveness of MonkeyGPT as an anomaly detection tool in real-world VCAs. The results indicate that the model possesses strong detection capabilities, achieving an accuracy rate of over 97%. It is applicable to various platforms, including Zoom, Microsoft Teams, Tencent Meeting, and Feishu, showcasing its robust adaptability.

We propose a network service as a solution for video conference applications by constructing network layer routing strategies. Our approach takes into account the characteristics of conferencing flows, addresses various self-customized metrics, and proactively ensures a positive user experience by preventing contention. The performance of VCApather is evaluated using a fully-meshed topology with five nodes and real-world video conference traffic. The results show that VCApather is capable of achieving high link utilization and balance, while also meeting predefined user metrics. Compared to other schemes, VCApather was found to satisfy 69.8% more QoE requirement and to yield an average bitrate improvement of 1.74×.

With the development of cross-datacenter services, accurate and low-cost network performance measurement enables better traffic scheduling. However, the existing network measurement suffers from a lack of telemetry granularities and excessive costs. Besides, the implementation of INT in the WAN remains undefined. In this work, We propose WAN-INT, a two-phase path orchestration algorithm designed to address the challenges posed by limited communication resources and varying link states in WAN scenarios. By generating a telemetry policy based on this algorithm, it can effectively adapt to the requirements of various applications and network states, achieving a balance between telemetry quality and cost limitations. We conduct experiments in a commercial WAN environment. Results show that WAN-INT outperforms existing schemes and reaches a good compromise between the telemetry quality and cost constraints. Compared with the state-of-the-art telemetry system, WAN-INT effectively reduces by at least 43% of telemetry cost while ensuring telemetry quality.

Numerous distributed applications are deployed in the cross-datacenter networks (Cross-DC) where geographically distributed data centers (DC) are connected by wide area network (WAN). These online applications will generate both intra-datacenter and inter-datacenter traffic, each with distinct requirements and characteristics. We find that existing combined congestion control schemes ignore the interaction of the two types of traffic and the hybrid congestion control schemes fail to accurately estimate cross data center network congestion extent. In this paper, we propose IDCC a delay based congestion control scheme that uses delay to handle congestion inside the DC and in the WAN, respectively. We respectively utilize In-band network telemetry (INT) and round trip time (RTT) to measure the queuing delay inside DC and in the WAN and guarantee the stability of the algorithm by Proportional Integral Derivative (PID). Simultaneously, we demonstrate the empirical results of optimizing flow completion time (FCT) of intra-DC short flow by weight function in cross-DC. We implemented IDCC in simulation platform ns-3 and have performed extensive large scale simulation evaluations. Results show that IDCC decreases the FCT of intra-DC traffic by 3.6× to 12× and improves the throughput of inter-DC traffic by 9% to 16% compared to Gemini, Annulus.

RDMA (Remote Direct Memory Access) delivers both high performance and OS kernel bypass thus triggers the revolutions of the modern data center. Especially, compared with traditional Ethernet, by exploiting memory semantics operations, RDMA-based data structure has shown great potential for high scalability and CPU utilization reduction. SkipList is an elegant sorted index data structure, and yet presents low throughput upon memory semantics RDMA due to the heavy remote access.By using SkipList as a case study, we revisit the current design paradigm of RDMA such as operation type, transport type, and caching. Accordingly, we propose a one-sided/two-sided hybrid paradigm to gain high scalability and at the same time achieve high throughput based on lock-based concurrent SkipList. To reduce the number of expensive network round trips, a client-sided cache is presented. With an in-depth analysis of the design choices, we implement HybridSkipList and deploy at an eight-machine RDMA cluster. The evaluations show it can outperform two baselines by 4.41× and 3.45× respectively.

Qualitative Communication has been proposed to increase the responsiveness of a network due to packet loss. The basic idea is to allow the network to drop part of the payload to preserve the integrity of the session (as opposed to dropping whole packets as in TCP). We consider this idea in the context of AR/VR and see how selectively dropping payload naturally fits with such an application where the data can be easily split within some critical and non-critical data. We present basic mechanism to leverage qualitative communications in 360 degree video streaming, as well as a pre-fetching scheme. We evaluate this proposal on actual 360 video traces and show the significant improvement of our proposal versus a vanilla transmission mechanism.

360-degree video streaming, which is becoming more and more popular as the fast development of VR/AR applications nowadays due to the immersive viewing experience it can offer, poses enormous challenges to the current network infrastructure in terms of high bandwidth and low latency requirements. To address this problem and to ensure the QoE (quality of experience) of end-users, this paper presents CUBIST, a method and system for high-quality 360-degree video streaming in networks with cache nodes at the edge. To the best of our knowledge, it is the first tile-based edge caching solution that incorporates proactive tile prefetching and hierarchical cache organization into reactive caching to maximize the caching benefit while reducing the cost of 360-degree video streaming. Experimental results show that CUBIST can achieve a cache hit ratio of 87 % and improve the effective video bitrate by 12.9 % with most rate transitions being small when compared with the latest FoV-aware edge caching scheme.

Caching contents in a small cell base station (SBS) is getting supported more and more widely today due to the Internet traffic growth and the requirement of low access latency. A primary concern and challenging issue with cache-enabled SBSs is how to better utilize network resources to achieve high overall performance. Though existing caching strategies can solve the problem to some extent, they are far from perfect --- pure popularity-based ones usually lead to sub-optimal caching performance whereas global coordination ones suffer from extra cost of many control messages. To deal with the issue, we present an adaptive caching scheme based on Bayesian inference, which 1) identifies the traffic features over time for each SBS; 2) synthesizes various features to rank the contents via a Bayesian ranking model; and 3) does cache placement online according to the ranking results. Unlike existing approaches that only highlight some specific factor, our scheme, due to the adoption of a Bayesian approach, can easily support additional features of high impact on caching performance and measure them in a decentralized way within a single SBS. We evaluate our scheme under various circumstances in terms of SBSs density, cache size, content popularity and skewness. The results show that our solution using multiple features exhibits improved performance --- it can reduce more than 30% the overall network latency in some cases when compared with solutions that only use a single feature.

There has been increasing attention to virtual reality applications in recent years, especially to immersive or 360-degree videos that typically consume much more bandwidth than traditional ones. Though all produced data is transferred, only a small part (denoted as Field of View or viewport) is watched by users due to the nature of immersive videos. Obviously, this causes a large waste of network resources. Hence, it is important to define a viewport-dependent streaming transmission strategy by detecting where the user is gazing and the movement of the user's head. Unfortunately, there are few datasets providing this information. In this paper, we propose a tile-based simulation approach to generate the distribution of the user's behavior and to provide information that can be used to optimize future view-dependent streaming protocols. We first characterize the users' viewport pattern from datasets gathered from real users by decomposing the 360-degree stream into tiles and analyzing the frequency and time-interval distribution for each tile. Then, we devise a hierarchical Markov model that incorporates the beta distribution of each tile time interval to predict tile transition. The results show that the simulation tool characterizes the tile sequences of users accurately, performing close to the empirical results.

In-network caching is considered to be an important solution to efficiently using network resources to achieve a high overall content delivery performance in both information-centric networks (ICNs) and 5G wireless networks. Content placement plays a key role in achieving this goal. Unfortunately, most content placement strategies today rely on opportunistic caching due to the problem complexity. We analyze the content placement problem in detail and present MCPC, a new content placement strategy for architectures that support in-network caching. Unlike existing content placement approaches that try to increase cache hit ratio, MCPC leverages the information recorded in each network node to reduce content access latency. MCPC proposes two new mechanisms: 1) a content load allocation estimation method based on local requests aggregation information; and 2) a content placement algorithm that avoids long-distance signaling messages by partitioning the network into smaller domains. We evaluate MCPC on a variety of network topologies, cache sizes and content popularity distributions. The experimental results show that MPCP can reduce by up to 56% the content access latency while providing comparable cache hit ratios as traditional benchmarks.

The exponential growth of data traffic raises a great challenge to content delivery in current TCP/IP networks. To answer this challenge, Information-Centric Networking (ICN) has been proposed with the purpose of bringing content caching and name-based content access to the network layer. Though great progress has been made, most existing ICN proposals lack support for parallel data transfer over multiple paths with low data redundancy. To deal with the issue, we present CODA, a fully distributed cooperative multipath data transmission solution that enhances content delivery further. Taking Named Data Networking (NDN) as a basis, CODA works in a distributed manner with the following contributions: 1) it extends the standard Interest model in NDN to support transmission of data over multiple paths so as to reduce the flow completion time; 2) it devises a traffic scheduling model to form parallel paths for transmitting data in a cooperative way; and 3) it proposes a transmission control scheme to select paths in an efficient and reliable manner. Extensive simulation comparisons with existing data transmission methods show that: 1) CODA speeds up the data rate twice as high as that of the best-route method; and 2) the amount of Interests required by CODA to build multiple data transmission paths in the network accounts for only 66% of that by MSRT, another multipath transmission proposal.