Real-Time Packet-Based Intrusion Detection on Edge Devices

The complexity of modern software systems, the integration of several software components, and the increasing exposure to public networks make systems more susceptible to cyber-attacks, especially those targeting memory. Memory error exploitation received worldwide attention thanks to the Morris worm in 1988 and has been around for over 30 years. As a matter of fact, attacks that involve memory safety, such as buffer overflows, are still a plague in modern software. The research in countering those kinds of attacks has gone in several directions. This work surveys memory integrity techniques developed during the last quarter century for embedded or general-purpose open-source operating systems, ranging from older mechanisms to state-of-the-art solutions. A comparison of various memory integrity techniques is presented to examine their effectiveness and technical significance. Insights into ongoing trends and developments are also provided to assess their potential impact in the foreseeable future.

show abstract

Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale

Seufert,

Dietz,

Wehner

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in largescale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.

show abstract

Real-Time Packet-Based Intrusion Detection on Edge Devices

Cited by 3 publications

References 10 publications

An IDS-Based DNN Model Deployed on the Edge Network to Detect Industrial IoT Attacks

An IDS-Based DNN Model Deployed on the Edge Network to Detect Industrial IoT Attacks

Memory Integrity Techniques for Memory-Unsafe Languages: A Survey

Marina: Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale

Contact Info

Product

Resources

About