IIsy: Practical In-Network Classification

Zheng, Changgang; Xiong, Zhaoqi; Bui, Thanh T; Kaupmees, Siim; Bensoussane, Riyad; Bernabeu, Antoine; Vargaftik, Shay; Ben-Itzhak, Yaniv; Zilberman, Noa

doi:10.48550/arxiv.2205.08243

Cited by 4 publications

(2 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This approach offers advantages in traffic feature analysis and enables quick decision-making. In-network ML has been applied in traffic classification [24], attack detection [6,25], elephant flow prediction [26,27], and time-series financial data prediction [28,29]. In terms of IoT gateways, however, it remains unclear how these benefits can be effectively leveraged.…”

Section: B Programmable Data Planesmentioning

confidence: 99%

Toward Continuous Threat Defense: in-Network Traffic Analysis for IoT Gateways

Zang,

Zheng,

Dittmann

et al. 2024

IEEE Internet Things J.

View full text Add to dashboard Cite

The widespread use of IoT devices has unveiled overlooked security risks. With the advent of ultra-reliable lowlatency communications (URLLC) in 5G, fast threat defense is critical to minimize damage from attacks. IoT gateways, equipped with wireless/wired interfaces, serve as vital frontline defense against emerging threats on IoT edge. However, current gateways struggle with dynamic IoT traffic and have limited defense capabilities against attacks with changing patterns. In-network computing offers fast machine learning-based attack detection and mitigation within network devices, but leveraging its capability in IoT gateways requires new continuous learning capability and runtime model updates. In this work, we present P4Pir, a novel in-network traffic analysis framework for IoT gateways. P4Pir incorporates programmable data plane into IoT gateway, pioneering the utilization of in-network machine learning (ML) inference for fast mitigation. It facilitates continuous and seamless updates of in-network inference models within gateways. P4Pir is prototyped in P4 language on Raspberry Pi and Dell Edge Gateway. With ML inference offloaded to gateway's data plane, P4Pir's in-network approach achieves swift attack mitigation and lightweight deployment compared to prior ML-based solutions. Evaluation results using three public datasets show that P4Pir accurately detects and fastly mitigates emerging attacks (>30% accuracy improvement and sub-millisecond mitigation time). The proposed model updates method allows seamless runtime updates without disrupting network traffic.

show abstract

Section: B Programmable Data Planesmentioning

confidence: 99%

Toward Continuous Threat Defense: in-Network Traffic Analysis for IoT Gateways

Zang,

Zheng,

Dittmann

et al. 2024

IEEE Internet Things J.

View full text Add to dashboard Cite

show abstract

“…In-network ML (bottom part of Figure 1) integrates the ML model directly into the data plane, either offloading feature extraction to an external system [22], [23], or by integrating both the feature extraction process and the ML model [24], [25], [26], in which case the monitoring system might provide high capacities and real-time capabilities. However, in-network ML requires heavy tailoring and simplification of the specific ML model, given the limited operations supported by highspeed programmable hardware, losing flexibility in terms of feature and ML analytics capabilities.…”

Section: Introductionmentioning

confidence: 99%

Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale

Seufert,

Dietz,

Wehner

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in largescale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.

show abstract