🤖 AI Summary
This paper introduces NetNomos, an unsupervised framework for learning propositional logic constraints directly from raw network measurement data—a task hindered by human error in manual rule extraction and poor reliability/incompleteness of purely data-driven approaches. NetNomos pioneers a lattice-based constraint search paradigm, reducing rule discovery complexity from superquadratic to logarithmic. It jointly optimizes constraint specificity and parsimony to enable guided learning—without labeled data or domain-specific priors. Evaluated across diverse network datasets, NetNomos discovers all benchmark rules—including those covering as few as 0.01% of data points—within three hours, achieving significantly higher accuracy than state-of-the-art baselines. The framework has been successfully deployed in synthetic traffic evaluation, anomaly detection, and telemetry inference, demonstrably improving data quality, model robustness, and depth of network semantic understanding.
📝 Abstract
Network data conforms to a wide range of rules that arise from protocols, design principles, and deployment decisions (e.g., a packet's queuing delay must be less than its end-to-end delay). Formalizing such rules as logic constraints can (i) improve the quality of synthetic data, (ii) reduce the brittleness of machine learning (ML) models, and (iii) improve semantic understanding of network measurements. However, these benefits remain out of reach if rule extraction is manual or solely reliant on ML, as both approaches yield incomplete, unreliable, and/or inaccurate rules.
This paper formulates rule extraction as a constraint modeling problem and introduces NetNomos that learns propositional logic constraints directly from raw network measurements. Constraint modeling in this domain is uniquely challenging due to the scale of the data, the inherent learning complexity and passive environment, and the lack of ground truth supervision. NetNomos addresses these challenges via a lattice-based search structured by constraint specificity and succinctness. Our approach reduces learning complexity from superquadratic to logarithmic and enables efficient traversal in combinatorial search space.
Our evaluations on diverse network datasets show that NetNomos learns all benchmark rules, including those associated with as little as 0.01% of data points, in under three hours. In contrast, baseline methods discover less than 25% of the rules and require several days to run. Through three case studies, we show that: NetNomos (i) finds rule violations in the outputs of all seven synthetic traffic generators, hence can be used to assess and guide their generation process; (ii) detects semantic differences in traffic, hence can be used for anomaly detection; and (iii) automatically finds rules used for telemetry imputation, hence can support monitoring through inference.