Open Access

Michael Seufert, Katharina Dietz, Nikolas Wehner, Stefan Geißler, Joshua Schüler, Manuel Wolz, Andreas Hotho, Pedro Casas, Tobias Hoßfeld, Anja Feldmann

• Network operators need real-time traffic monitoring to ensure high performance and security across their infrastructure. While artificial intelligence and machine learning (ML) have proven effective in enhancing network visibility, especially for encrypted traffic, existing solutions struggle to handle the scale and speed of modern high-throughput networks. To address this, we present Marina, a system designed for ML-driven traffic monitoring at terabit scale. Marina distributes the monitoring workload between a high-performance data plane, capable of extracting traffic statistics at line rate, and a powerful ML server that performs inference using complex ML models. By applying temporal microaggregation over sub-second intervals and computing moment-based statistics, Marina enables timely and flexible monitoring decisions during the next time slot. We demonstrate the scalability of our approach through a prototype implemented on a Barefoot Wedge 100BF-65X P4 switch, capable ofNetwork operators need real-time traffic monitoring to ensure high performance and security across their infrastructure. While artificial intelligence and machine learning (ML) have proven effective in enhancing network visibility, especially for encrypted traffic, existing solutions struggle to handle the scale and speed of modern high-throughput networks. To address this, we present Marina, a system designed for ML-driven traffic monitoring at terabit scale. Marina distributes the monitoring workload between a high-performance data plane, capable of extracting traffic statistics at line rate, and a powerful ML server that performs inference using complex ML models. By applying temporal microaggregation over sub-second intervals and computing moment-based statistics, Marina enables timely and flexible monitoring decisions during the next time slot. We demonstrate the scalability of our approach through a prototype implemented on a Barefoot Wedge 100BF-65X P4 switch, capable of monitoring over 520,000 concurrent flows at full switching capacity of 6.4 Tbps. Finally, we validate Marina ’s analytics capabilities across four real-time ML-based monitoring tasks using standard ML models, achieving results that are comparable or better than state-of-the-art methods.…