Wide Area Network (WAN) management faces significant complexity in characterizing heterogeneous traffic from diverse services, which complicates unified feature extraction for operational tasks like anomaly detection. Key challenges persist in difficulty of creating generic feature sets across diverse traffic patterns and insufficient historical data for machine learning (ML) generalization. Meta-learning algorithms can be applied to learn dynamic feature sets to improve model generalizability on a limited number of data records. However, prior research focuses on algorithm design, with a lack of study on its application to in-band network monitoring. This work proposes a workflow to adaptively collect new feature sets and promptly learn from them. An adaptive in-band feature selection and extraction method is proposed for programmable switch. Meta learning algorithm is introduced for prompt decision in controller based on few-shot records. Evaluation results have shown that it outperforms prior methods in accuracy and inference time on public datasets.

Network softwarization has significantly evolved since programmable data planes became topical in academia and industry. Programming Protocol-Independent Packet Processors (P4) is a language to define packet forwarding behavior. Forwarding devices that are programmed with the P4 language support a flexible way to define headers, parse graphs, and data plane logic. However, extending the data plane with additional functionalities has an impact on packet data plane latency. For this reason, this paper analyzes the key factors that affect data pane latency to packets processed by the Tofino-based target (Tofino Native Architecture (TNA)), which can be considered the de facto production-ready and P4-programmable Application-Specific Integrated Circuit (ASIC). Our work first provides an extensive set of latency measurements and, afterwards, it includes a set of data plane latency predictions using the model derived from the latency results and machine learning (ML) algorithms. We demonstrate that the PCA-lasso polynomial (PLP) obtains the best results among the algorithms tested. The best-case results show that PLP obtained an accuracy of 98.22% prediction accuracy when considering the parser, deparser, and the control block for traffic running at 10G/s (SFP+) and 100G/s (QSFP28). To the best of our knowledge, this is the first work that provides such a comprehensive profiling, including a method to predict data plane latency in production-grade Tofino ASIC-based switching hardware, which could be leveraged to yield accurate latency values prior to investment and deployment.

The widespread use of IoT devices has unveiled overlooked security risks. With the advent of ultrareliable low-latency communications (URLLCs) in 5G, fast threat defense is critical to minimize damage from attacks. IoT gateways, equipped with wireless/wired interfaces, serve as vital frontline defense against emerging threats on IoT edge. However, current gateways struggle with dynamic IoT traffic and have limited defense capabilities against attacks with changing patterns. In-network computing offers fast machine learning (ML)-based attack detection and mitigation within network devices, but leveraging its capability in IoT gateways requires new continuous learning capability and runtime model updates. In this work, we present P4Pir, a novel in-network traffic analysis framework for IoT gateways. P4Pir incorporates programmable data plane into IoT gateway, pioneering the utilization of in-network ML inference for fast mitigation. It facilitates continuous and seamless updates of in-network inference models within gateways. P4Pir is prototyped in P4 language on raspberry pi and Dell Edge Gateway. With ML inference offloaded to gateway’s data plane, P4Pir’s in-network approach achieves swift attack mitigation and lightweight deployment compared to prior ML-based solutions. Evaluation results using three public data sets show that P4Pir accurately detects and fastly mitigates emerging attacks (>30% accuracy improvement and submillisecond mitigation time). The proposed model updates method allows seamless runtime updates without disrupting network traffic.

The expanding use of Internet-of-Things (IoT) has driven machine learning (ML)-based traffic analysis. 5G networks’ standards, requiring low-latency communications for time-critical services, pose new challenges to traffic analysis. They necessitate fast analysis and response, preventing service disruption or security impact on network infrastructure. Distributed intelligence on IoT edge has been studied to analyze traffic, but introduces delays and raises privacy concerns. Federated learning can address privacy concerns, but does not meet latency requirements. In this article, we propose FLIP4: an efficient federated learning-based framework for in-network traffic analysis. Our solution introduces a lightweight federated tree-based model, offloaded and running within network devices. FLIP4 consumes less resources than previous solutions and reduces communication overheads, making it well-suited for IoT edge traffic analysis. It ensures prompt mitigation and minimal impact on services in the presence of false alerts using two approaches (metering and dropping), thereby balancing learning accuracy and privacy requirements.

Attacks as Distributed Denial of Service (DDoS) are ones of the most frequent vehicle cybersecurity threats. In this paper, we propose a Machine Learning-based Intrusion Detection System (IDS) for monitoring network traffic and detecting abnormal activities. This IDS framework integrates streaming engines for big data analytics, management and visualization. A Vehicular ad-hoc network (VANET) topology of multiple connected nodes with mobility capability is simulated in the Mininet-Wifi environment. Real-time data is collected using the sFlow technology and transmitted from the simulator to our proposed IDS framework. We have achieved high detection accuracy results by training the Random Forest as the classifier to label out the anomalous flows. Additionally, the network throughput has been evaluated and compared with and without deploying the proposed IDS. The results verify the system is a lightweight solution by bringing little burden to the network.