SmartNICs have emerged as a promising platform for in-network machine learning inference, yet existing approaches largely rely on stateless packet-level inference, off-path stateful inference or offloading flow-level analysis to the host, limiting performance. This creates a performance gap between line-rate inference capabilities in the data plane and the need for flow-aware context in security and monitoring applications. In this paper, we bridge this gap by exploiting the coexistence of programmable data planes and on-NIC processing cores on SmartNICs. We propose HyNIC, a hybrid in-network inference system that performs line-rate packet classification for intrusion and anomaly detection in the data plane while subsequently enriching inference with stateful flow-level context computed on SmartNIC cores and integrated back at runtime. HyNIC enables a seamless transition from stateless to flow-aware inference without diverting packets from the fast path. We implement HyNIC in P4 on an industry-grade SmartNIC and evaluate it on realistic IoT intrusion detection datasets, demonstrating significant accuracy improvements of up to 22% over a stateless-only baseline while preserving line-rate performance.

Internet of Medical Things (IoMT) systems constitute safety-critical networking environments that remain vulnerable to cyber threats. Existing intrusion detection systems typically rely on off-path processing at the edge, fog, or cloud, resulting in increased detection latency and delayed response, which can adversely impact timely intervention in patient-critical scenarios. P4-programmable SmartNICs enable placing machine learning inference directly in the network data path for low-latency, on-path inference without reliance on external processing. In this paper, we present a SmartNIC-based intrusion detection system based on machine learning inference, running entirely on the NIC data plane. Our design builds on a stateless binary decision tree mapped onto the SmartNIC match-action pipeline, enabling per-packet classification entirely in the fast path. We implement our solution in P4 on an Intel IPU and evaluate it using two IoMT datasets. Results show that our approach reduces latency by 10× compared to a host-based system, providing end-to-end latency similar to L2 forwarding, while achieving up to 99% detection accuracy and enabling timely in-network intrusion detection.

The Internet of Medical Things is transforming healthcare from reactive, hospital-based care to preventive and continuous remote monitoring. However, current solutions often depend on cloud or mobile platforms for data aggregation and analysis, introducing latency, privacy risks, and financial burden. In-network machine learning offers an opportunity to address these challenges by enabling real-time analytics directly within the network infrastructure. In this work, we present VISTA, an in-network computing framework for health analytics that enables real-time patient monitoring through in-network machine learning within edge gateways. VISTA integrates P4-based data plane modules that asynchronously aggregate heterogeneous sensor data and execute machine learning inference locally within the gateway, eliminating the reliance on cloud offloading. Implemented on a Dell Edge Gateway and evaluated on a 2000-patient dataset for early detection of sepsis and heart failure, VISTA achieves up to 95% detection accuracy, 2 milliseconds average latency, and 90% reduction in communication overhead, compared with cloud-based baselines. These results demonstrate the potential of in-network machine learning for scalable, low-latency, and privacy-preserving remote patient monitoring.

The increasing demand for real-time inference on high-volume network traffic has led to the rise of in-network machine learning, where programmable switches execute various models directly in the data-plane at line rate. Effective network management often involves multiple prediction tasks, such as predicting bit rate, flow size, or traffic class; however, existing solutions deploy separate models for each task, placing a significant burden on the data-plane and leading to substantial resource consumption when deploying multiple tasks. To address this limitation, we introduce MUTA, a novel in-network multi-task learning framework that enables concurrent inference of multiple tasks in the data-plane, without exhausting available resources. MUTA builds a multi-task neural network to share feature representations across tasks and introduces a data-plane mapping methodology to fit it within network switches. Additionally, MUTA enhances scalability by supporting distributed deployment, where different layers of a multi-task model can be offloaded across multiple switches. An orchestrator employs multi-objective optimization to determine optimal model placement in multi-path networks. MUTA is deployed on P4 hardware switches, and is shown to reduce memory requirements by ×10.5, while at the same time improving accuracy by up to 9.14% using limited training data, compared with state-of-the-art single-task learning solutions.

The rise of generative AI has transformed many fields, including networking. While generative AI is already used for network management and operation, little was done to fundamentally change the way we use the web. In this paper, we make the case for reimagining the web in the age of AI. With just minor changes to HTTP, we demonstrate that web content can be distributed as prompts turned into content on end user devices. This new small world web (SWW) of AI reduces storage demands and network load, and has the potential to improve Internet sustainability over time.

The need for real-time inference of large volumes of data led to the development of in-network machine learning. Programmable network switches can now execute various machine learning models in the data-plane at line rate. While a stream of data may require several prediction tasks, such as predicting bit rate, flow size, or traffic class, current solutions only support separate models for each task. This places a significant burden on the data-plane and leads to substantial resource consumption when deploying multiple tasks. To solve this problem, we introduce MUTA; a novel in-network multi-task learning solution. MUTA enables executing multiple inference tasks concurrently in the data-plane, without exhausting available resources. It introduces a data-plane mapping methodology to fit non-binarized multi-task neural networks within network switches. MUTA is deployed on P4-based hardware switches, and is shown to reduce memory requirements by × 10.5 and improve accuracy by up to 9.14% using limited training data, compared with state-of-the-art single-task learning solutions.

Machine learning (ML) has become a mainstream approach in the fight against transaction fraud for its intelligence. For financial institutions and businesses, low-latency detection of fraudulent transactions in real-time is highly important as it enables rapid identification and prevention. Concurrently mitigating fraudulent transactions by using ML while also reducing latency remains a challenging endeavor, for which performing inference within programmable network devices offers a potential solution. In this paper, we introduce MIND, conducting ML-based fraud detection within programmable devices. MIND is prototyped on both software and hardware network devices, including BMv2, Intel Tofino, and NVIDIA BlueField-2 DPU, and is evaluated with three publicly available transaction datasets. Experimental results demonstrate that MIND detects transaction fraud in real-time, with a throughput of 6.4 terabits per second and microsecond-scale latency. Compared with server-based solutions, MIND can process over ×800 more transactions per second, along with a latency reduction of over ×1300 per transaction. At the same time, MIND attains 99.94% of server-based benchmarks’ accuracy and 93.66% of their F1-score, exhibiting only marginal degradation in classification performance. Therefore, MIND offers substantial savings in the number of servers, leading to reduced costs and energy consumption, while providing a better customer experience.

High-frequency trading (HFT) employs cutting-edge hardware for rapid decision-making and order execution but often relies on simpler algorithms that may miss deeper market trends. Conversely, lower-frequency algorithmic trading uses machine learning (ML) for better market predictions but higher latency can negate its strategic benefits. To achieve the best of both worlds, we present an in-network ML solution that embeds ML processes into programmable network devices, accelerating feature engineering and extraction as well as ML inference. In this paper, we design and develop a solution that supports both stock mid-price and volatility movement forecasting using commodity switches. Our approach achieves microsecond-scale, ultra-low latency, significantly lowering it by 64% to 97% compared to previous works, while upholding the same level of ML performance as server models. Additionally, by combining network hardware and servers, a hybrid deployment strategy can keep the misclassification rate change below 0.8% relative to the server baseline while processing 49% of the traffic directly on the switch and achieving a 45% average reduction in end-to-end latency.

Volumetric distributed Denial-of-Service (DDoS) attack is a key issue in modern telecommunication networks since it can exhaust the resources of legitimate users and cripple network services. Recently, with the emergence of high-throughput and low-latency programmable switches, DDoS detection mechanisms have been designed and implemented in an in-network manner, that is, DDoS detection executed directly within programmable switches. State-of-the-art works use advanced data structures to monitor the number of connections targeting destination hosts: if there is sudden increase of connections and the number exceeds a given threshold, the destination host is most likely under DDoS attack. However, while this approach is efficient in DDoS victims identification, it has inherent vulnerabilities in the detection mechanism that may lead to security issues. In this paper, we study two possible vulnerabilities in DDoS detection data structures, showing the possibilities to break DDoS detection mechanisms in programmable switches. To mitigate the constructed attacks, we propose a solution called INDDoS+. The results show that INDDoS+ is robust to attacks and can accurately detect DDoS attempts when limited hardware resources are assigned.

The widespread use of IoT devices has unveiled overlooked security risks. With the advent of ultrareliable low-latency communications (URLLCs) in 5G, fast threat defense is critical to minimize damage from attacks. IoT gateways, equipped with wireless/wired interfaces, serve as vital frontline defense against emerging threats on IoT edge. However, current gateways struggle with dynamic IoT traffic and have limited defense capabilities against attacks with changing patterns. In-network computing offers fast machine learning (ML)-based attack detection and mitigation within network devices, but leveraging its capability in IoT gateways requires new continuous learning capability and runtime model updates. In this work, we present P4Pir, a novel in-network traffic analysis framework for IoT gateways. P4Pir incorporates programmable data plane into IoT gateway, pioneering the utilization of in-network ML inference for fast mitigation. It facilitates continuous and seamless updates of in-network inference models within gateways. P4Pir is prototyped in P4 language on raspberry pi and Dell Edge Gateway. With ML inference offloaded to gateway’s data plane, P4Pir’s in-network approach achieves swift attack mitigation and lightweight deployment compared to prior ML-based solutions. Evaluation results using three public data sets show that P4Pir accurately detects and fastly mitigates emerging attacks (>30% accuracy improvement and submillisecond mitigation time). The proposed model updates method allows seamless runtime updates without disrupting network traffic.

The expanding use of Internet-of-Things (IoT) has driven machine learning (ML)-based traffic analysis. 5G networks’ standards, requiring low-latency communications for time-critical services, pose new challenges to traffic analysis. They necessitate fast analysis and response, preventing service disruption or security impact on network infrastructure. Distributed intelligence on IoT edge has been studied to analyze traffic, but introduces delays and raises privacy concerns. Federated learning can address privacy concerns, but does not meet latency requirements. In this article, we propose FLIP4: an efficient federated learning-based framework for in-network traffic analysis. Our solution introduces a lightweight federated tree-based model, offloaded and running within network devices. FLIP4 consumes less resources than previous solutions and reduces communication overheads, making it well-suited for IoT edge traffic analysis. It ensures prompt mitigation and minimal impact on services in the presence of false alerts using two approaches (metering and dropping), thereby balancing learning accuracy and privacy requirements.

The soaring use of machine learning leads to increasing processing demands. As data volume keeps growing, providing classification services with good machine learning performance, high throughput, low latency, and minimal equipment overheads becomes a challenge. Offloading machine learning tasks to network switches can be a scalable solution to this problem, providing high throughput and low latency. However, network devices are resource constrained, and lack support for machine learning functionality. In this paper, we introduce IIsy -a novel mapping tool of machine learning classification models to off-the-shelf switches. Using an efficient encoding algorithm, enables fitting a range of classification models on switches, co-existing with standard switch functionality. To overcome resource constraints, adopts a hybrid approach for ensemble models, running a small model on a switch and a large model on the backend. The evaluation shows that achieves near-optimal classification results, within minimum resource overheads, and while reducing the load on the backend by 70% for data-intensive use cases.

Machine learning is driving the evolution of algorithmic trading, but the demands for fast execution speed remain. Although both aim to increase profitability, embedding more powerful machine learning approaches and lowering trading latencies are hard to achieve simultaneously. Offloading machine learning inference to programmable network devices, also referred to as in-network machine learning, provides a delicate balance between the two ends of this trade-off. In this paper, we present LOBIN, providing machine learning based market prediction using high-frequency market data feeds. LOBIN builds limit order books and conducts inference within programmable switches. Compared with server-based solutions, LOBIN predicts future stock price movements with lower latency, higher throughput, and a minor impact on machine learning performance.

Bugs in network hardware can cause tremendous problems. However, programmable network devices have the potential to provide greater visibility into the internal behavior of devices, allowing us to more quickly find and identify problems. In this paper, we provide a taxonomy of data plane bugs, and use the taxonomy to derive a Portable Test Architecture (PTA) which offers essential abstractions for testing on a variety of network hardware devices. PTA is implemented with a novel data plane design that (i) separates target-specific from target-independent components, allowing for portability, and (ii) allows users to write a test program once at compile time, but dynamically alter the behavior via runtime configuration. We report 12 diverse bugs on different hardware targets, and their associated software, exposed using PTA.

No abstract available.

Building an Internet Router is a popular, hands-on project used to teach computer networks. However, there is currently no hardware target that allows students to develop the project in P4 without incurring significant cost or encountering FPGA knowledge barriers. This paper presents P4Pi as a target for the Building an Internet Router project. P4Pi is a platform for developing, testing, and evaluating P4 programs on a Raspberry Pi device. We describe the architecture of the router project on P4Pi, and discuss the practical aspects of running it as a class project. The P4Pi-based router project is low-cost and easy to adopt, enabling students to focus on their P4 programming skills and to evaluate their designs on a physical target through interoperability tests with their colleagues.

Bugs in network hardware can cause tremendous problems. However, programmable network devices have the potential to provide greater visibility into the internal behavior of devices, allowing us to more quickly find and identify problems. In this paper, we provide a taxonomy of data plane bugs, and use the taxonomy to derive a Portable Test Architecture (PTA) which offers essential abstractions for testing on a variety of network hardware devices. PTA is implemented with a novel data plane design that (i) separates target-specific from target-independent components, allowing for portability, and (ii) allows users to write a test program once at compile time, but dynamically alter the behavior via runtime configuration. We report 12 diverse bugs on different hardware targets, and their associated software, exposed using PTA.

In this paper, we explore how a programmable forwarding plane offered by a new breed of network switches might naturally accelerate consensus protocols, specifically focusing on Paxos. The performance of consensus protocols has long been a concern. By implementing Paxos in the forwarding plane, we are able to significantly increase throughput and reduce latency. Our P4-based implementation running on an ASIC in isolation can process over 2.5 billion consensus messages per second, a four orders of magnitude improvement in throughput over a widely-used software implementation. This effectively removes consensus as a bottleneck for distributed applications in data centers. Beyond sheer performance, our approach offers several other important benefits: it readily lends itself to formal verification; it does not rely on any additional network hardware; and as a full Paxos implementation, it makes only very weak assumptions about the network.

In-network computing offers an appealing scalability trajectory for network services, as application performance scales with network devices. Despite its potential, in-network computing may not be suitable for all applications, due to paradigm assumptions and network-device limitations. As users' Internet demands keep growing, any limitations on the scalability of network services such as DNS limits the scalability of end-to-end experience. In this paper we present P4DNS, an in-network DNS solution, exploring the span and limitations of implementing a realistic network service within a network device using P4. P4DNS is a high performance DNS server, implemented in P4 over NetFPGA and providing ×52 performance improvement compared with software-based solutions. P4DNS provides insight into the limitations of implementing in-network services using today's paradigms, and the trade-offs between data and control planes.

Programmable network hardware can run services traditionally deployed on servers, resulting in orders-of-magnitude improvements in performance. Yet, despite these performance improvements, network operators remain skeptical of in-network computing. The conventional wisdom is that the operational costs from increased power consumption outweigh any performance benefits. Unless in-network computing can justify its costs, it will be disregarded as yet another academic exercise.

P4 has emerged as the de facto standard language for describing how network packets should be processed, and is becoming widely used by network owners, systems developers, researchers and in the classroom. The goal of the work presented here is to make it easier for engineers, researchers and students to learn how to program using P4, and to build prototypes running on real hardware. Our target is the NetFPGA SUME platform, a 4x10 Gb/s PCIe card designed for use in universities for teaching and research. Until now, NetFPGA users have needed to learn an HDL such as Verilog or VHDL, making it off limits to many software developers and students. Therefore, we developed the P4->NetFPGA workflow, allowing developers to describe how packets are to be processed in the high-level P4 language, then compile their P4 programs to run at line rate on the NetFPGA SUME board. The P4->NetFPGA workflow is built upon the Xilinx P4-SDNet compiler and the NetFPGA SUME open source code base. In this paper, we provide an overview of the P4 programming language and describe the P4->NetFPGA workflow. We also describe how the workflow is being used by the P4 community to build research prototypes, and to teach how network systems are built by providing students with hands-on experience working with real hardware.

Machine learning is currently driving a technological and societal revolution. While programmable switches have been proven to be useful for in-network computing, machine learning within programmable switches had little success so far. Not using network devices for machine learning has a high toll, given the known power efficiency and performance benefits of processing within the network. In this paper, we explore the potential use of commodity programmable switches for in-network classification, by mapping trained machine learning models to match-action pipelines. We introduce IIsy, a software and hardware based prototype of our approach, and discuss the suitability of mapping to different targets. Our solution can be generalized to additional machine learning algorithms, using the methods presented in this work.

High end networked-systems have quickly climbed from a throughput of gigabits/sec to terabits/sec, and are approaching petabits/sec. Alas, network testing equipment has not scaled: it remained either low throughput or extremely expensive. With suitable network testing equipment either not at scale or too expensive even for commercial vendors, systems may be released without proper testing and validation. We propose a methodology for large scale testing of networked systems, based on using a low-cost, open source network tester and a commodity switch. Our approach is scalable, open source, and accurate, and can be adapted to a variety of networking equipment, widely available to users.

The demand-led growth of datacenter networks has meant that many constituent technologies are beyond the budget of the wider community. In order to make and validate timely and relevant new contributions, the wider community requires accessible evaluation, experimentation and demonstration environments with specification comparable to the subsystems of the most massive datacenter networks. We demonstrate NetFPGA SUME, an open-source FPGA-based PCIe board for rapid prototyping of high bandwidth devices. NetFPGA SUME has I/O capabilities for 100Gbps operation as a networking device, computing unit, or for test and measurement.

Network softwarization drives innovation both in software and hardware. This demo introduces a highly integrated environment that enables open source solutions for software defined network (SDN) in both hardware and software. This environment is built upon the NetFPGA platform for rapid prototyping of networking devices. It showcases tools (OSNT and OFLOPS) for evaluating the performance of networking devices, and demonstrates them using a pipelined multi-table OpenFlow enabled switch application. An open-source environment integrating both software and hardware that fully inter-operate, as demonstrated here, is essential for high-quality software defined networking solutions.

Designing scalable and cost-effective data center interconnect architectures based on electrical packet switches is challenging. To overcome this challenge, researchers have tried to harness the advantages of optics in data center environment. This has resulted in exploration of hybrid switching architectures that contains an optical circuit switch to serve long bursts of traffic along with an electrical packet switch serving short bursts of traffic. The performance of such hybrid switching architectures in data center is dependent on the schedulers. Building hybrid schedulers is challenging because of varying properties of data center traffic, increasing network demands, requirements imposed by hybrid network architecture etc. Slow schedulers can negatively impact the performance of the data center network because of poor resource utilization. With future demands, this problem is going to escalate motivating the need for faster schedulers. One approach to do this would be to use a hardware based scheduler. In this paper we propose a framework that can be used to explore and evaluate hardware based hybrid schedulers.

The demand-led growth of datacenter networks has meant that many constituent technologies are beyond the budget of the wider community. In order to make and validate timely and relevant new contributions, the wider community requires accessible evaluation, experimentation and demonstration environments with specification comparable to the subsystems of the most massive datacenter networks. We demonstrate NetFPGA, an open-source platform for rapid prototyping of networking devices with I/O capabilities up to 100Gbps. NetFPGA offers an integrated environment that enables networking research by users from a wide range of disciplines: from hardware-centric research to formal methods.

Modern high-speed networks have evolved from relatively static networks to highly adaptive networks facilitating dynamic reconfiguration. This evolution has influenced all levels of network design and management, introducing increased programmability and configuration flexibility. This influence has extended from the lowest level of physical hardware interfaces to the highest level of network management by software. A key representative of this evolution is the emergence of software-defined networking (SDN). In this paper, we review the current state of the art in reconfigurable network systems, covering hardware reconfiguration, SDN, and the interplay between them. We take a top-down approach, starting with a tutorial on software-defined networks. We then continue to discuss programming languages as the linking element between different levels of software and hardware in the network. We review electronic switching systems, highlighting programmability and reconfiguration aspects, and describe the trends in reconfigurable network elements. Finally, we describe the state of the art in the integration of photonic transceiver and switching elements with electronic technologies, and consider the implications for SDN and reconfigurable network systems.

To make networks more reliable, enormous resources are poured into all phases of the network-equipment lifecycle. The process starts early in the design phase when simulation is used to verify the correctness of a design, and continues through manufacturing and perhaps months of rigorously trials. With over 7,000 Internet RFCs and hundreds of IEEE standards, a typical piece of networking equipment undergoes hundreds of conformance tests before being deployed. Finally, when deployed in a production network, the equipment is tested regularly. Throughout the process, a relentless battery of tests and measurement help ensure the correct operation of the equipment.

The Internet is a complex network, comprised of thousands of interconnected Autonomous Systems. Considerable research is done in order to infer the undisclosed commercial relationships between ASes. These relationships, which have been commonly classified to four distinct Type of Relationships (ToRs), dictate the routing policies between ASes. These policies are a crucial part in understanding the Internet's traffic and behavior patterns. This work leverages Internet Point of Presence (PoP) level maps to improve AS ToR inference. We propose a method which uses PoP level maps to find complex AS relationships and detect anomalies on the AS relationship level. We present experimental results of using the method on ToR reported by CAIDA and report several types of anomalies and errors. The results demonstrate the benefits of using PoP level maps for ToR inference, requiring considerable less resources than other methods theoretically capable of detecting similar phenomena.

The geographical location of Internet IP addresses is important for academic research, commercial and homeland security applications. Thus, both commercial and academic databases and tools are available for mapping IP addresses to geographic locations. Evaluating the accuracy of these mapping services is complex since obtaining diverse large scale ground truth is very hard. In this work we evaluate mapping services using an algorithm that groups IP addresses to PoPs, based on structure and delay. This way we are able to group close to 100,000 IP addresses world wide into groups that are known to share a geo-location with high confidence. We provide insight into the strength and weaknesses of IP geolocation databases, and discuss their accuracy and encountered anomalies.

Peer to Peer networks are the leading cause for music piracy but also used for music sampling prior to purchase. In this paper we investigate the relations between music file sharing and sales (both physical and digital) using large Peer-to-Peer query database information. We compare file sharing information on songs to their popularity on the Billboard Hot 100 and the Billboard Digital Songs charts, and show that popularity trends of songs on the Billboard have very strong correlation (0.88-0.89) to their popularity on a Peer-to-Peer network. We then show how this correlation can be utilized by common data mining algorithms to predict a song's success in the Billboard in advance, using Peer-to-Peer information.

Geographic ad hoc networks use position information for routing. They often utilize stateless greedy forwarding and require the use of recovery algorithms when the greedy approach fails. We propose a novel idea based on virtual repositioning of nodes that allows to increase the efficiency of greedy routing and significantly increase the success of the recovery algorithm based on local information alone. We explain the problem of predicting dead ends which the greedy algorithm may reach and bypassing voids in the network, and introduce NEAR, node elevation ad-hoc routing, a solution that incorporates both virtual positioning and routing algorithms that improve performance in ad-hoc networks containing voids. We demonstrate by simulations the advantages of our algorithm over other geographic ad-hoc routing solutions.

Geographic ad hoc networks use position information for routing. They often utilize stateless greedy forwarding and require the use of recovery algorithms when the greedy approach fails. We propose a novel idea based on virtual repositioning of nodes that allows to increase the efficiency of greedy routing and significantly increase the success of the recovery algorithm based on local information alone.We explain he problem of predicting dead ends which the greedy algorithm may reach and bypassing voids in the network, and introduce NEAR, Node Elevation Ad-hoc Routing, a solution that incorporates both virtual positioning and routing algorithms that improve performance in ad-hoc networks containing voids. We demonstrate by simulations the advantages of our algorithm over other geographic ad-hoc routing solutions.