AI for Network Security P4 Language Programmable Switches (Intel Tofino) Isolation Forest Anomaly Detection Knowledge Distillation Line-Speed Detection
Important
The Problem: Programmable switch data planes face severe memory constraints and minimal support for complex math. While conventional Isolation Forests (iForests) fit these constraints, they yield suboptimal detection for malicious traffic. To achieve higher accuracy, current solutions are forced to punt packets to the software control plane for deeper analysis—creating a severe bottleneck that drastically increases latency and degrades overall network throughput.
Tip
The iGuard Solution: We introduce the first iForest implementation that accurately detects malicious traffic by distilling the "knowledge" of powerful autoencoders into a minimal set of whitelist rules natively installable on data planes.
By bridging the gap between complex ML and strict hardware limits, we developed iGuard. Here are the key contributions:
+ Unsupervised Detection: Detects anomalies without needing massive, expensively labeled datasets.
+ Autoencoder-Enhanced iForest: Significantly improves separation between benign and malicious traffic compared to conventional iForests.
+ Line-Rate Processing: Evaluates packets entirely in the data plane at massive throughput levels.
+ Hardware Efficient: Maintains strict memory efficiency suitable for Intel Tofino switches.- 📚 Research Paper: ACM Digital Library: iGuard
- 💻 Official Codebase: GitHub: networked-systems-iith/iGuard
Tip
If you are using this work in your research, please consider citing our paper.
@inproceedings{10.1145/3680121.3697807,
author = {Mittal, Sankalp and V., Harikrishnan and Heetkumar, Patel and Tammana, Praveen},
title = {iGuard: Efficient Isolation Forest Design for Malicious Traffic Detection in Programmable Switches},
year = {2024},
isbn = {9798400711084},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3680121.3697807},
doi = {10.1145/3680121.3697807},
abstract = {Deploying machine learning (ML) models in programmable switch data planes facilitates low latency and high throughput traffic inference at line speed. However, data planes pose significant constraints due to the limited memory and minimal support for mathematical operations and data types. As a result, the only unsupervised ML models implemented in data planes to date are Isolation Forests (iForests). However, conventional iForest models yield suboptimal malicious traffic detection performance in various traffic use cases. To address this limitation, this paper proposes iGuard, the first iForest implementation that can accurately detect malicious traffic by incorporating the "knowledge" of more powerful autoencoders. We deploy iGuard in the form of a small set of whitelist rules that could be easily installed in the switch data planes. We implement iGuard using the P4 language, and assess its performance in an experimental platform based on Intel Tofino switches. Upon evaluating iGuard on various attack traffic use cases, our model can improve accuracy up to 48.3\% while maintaining a similar or lower switch memory footprint over previous approaches to implement iForest models in real-world equipment.},
booktitle = {Proceedings of the 20th International Conference on Emerging Networking EXperiments and Technologies},
pages = {55–64},
numpages = {10},
keywords = {intrusion/anomaly detection, machine learning, network security, programmable switches, software defined networking},
location = {Los Angeles, CA, USA},
series = {CoNEXT '24}
}
 Dr. Praveen Tammana |
 Sankalp Mittal |
 Patel Heetkumar | V. Harikrishnan |
|
networked-systems-iith @ Indian Institute of Technology Hyderabad (IITH)
Back to top ⬆️