sh) and cache. 3) Finally, each path is filled into the stateful match action table as a row, conditional statements about packets/states are put into flow/state fields of match column, and intersection of an execution path with packet/state slice is put into flow/state fields of action column. This approach gives an accurate model but is constrained by the prerequisites that source code is known. Figure 3.8(d) shows the modeling results of running NFactor on a load balancer HAProxy [71] and a cache server WWWOFFLE [72]. The logic in the match action table is described in SNAP language for abbreviation. HAProxy is a load balancer and configured in hash mode, and it randomly chooses one of its backend servers to forward the incoming requests. WWWOFFLE is a cache. When it observes a request for the first time, it forwards the request to the server; when a response is back, it records the content of the response and forwards it to its client side; and when the cache observes a request whose response appears before, it immediately replies the client with the response without forwarding the request to the server. 3 Network Function Virtualization 3.5.2 Black Box Modeling The abovementioned method may not be always applicable as NF vendors may not be willing to share source code. We explore the approach of automatically synthesizing NF models from black box observations. Black box synthesis of NF models, if viable, can faith- fully match the observed input/output behavior without needing access to the source code. It has several natural advantages: (1) the approach is faithful to input/output behavior (e.g., states need to be manifested in handling traffic) and (2) additionally, does not rely on having the source code of NFs, and thus operators can extract models without vendor support. Such black box inference can further be complementary to approaches that rely on code analysis. We formulate black box NF model synthesis as an "active learning" problem of inferring the FSM model that represents the NF behav- ior. Havi