In high-speed data center networks, persistent flows are repeatedly observed over extended periods, potentially signaling threats such as stealthy DDoS or botnet attacks. Monitoring every flow in production-grade hardware switches that feature limited memory, however, is challenging under typical high flow rates and data volumes. To tackle this, approximate data structures, like sketches, are often employed. Yet many existing methods rely on per-time-window flag resets, which require frequent control-plane interventions that make them unsuitable for high-speed traffic. This paper introduces Pallas, a fully data-plane-implementable sketch for detecting persistent flows in high-speed networks with high accuracy, obviating the need for time-window-based resets. We further propose Opt-Pallas, an enhanced variant of Pallas that improves detection accuracy by incorporating flow arrival patterns. We present a rigorous error bound analysis for both Pallas and Opt-Pallas, along with extensive performance evaluations using a P4-based prototype on an Intel Tofino switch. Pallas scales persistent flow detection to line-rate capacity, while state-of-the-art solutions fail to operate beyond a few Mbps. Our results show that Pallas and Opt-Pallas can accurately detect persistent flows in traffic volumes over 60× higher than those handled by the best existing approach. Additionally, even under low-speed traffic, Pallas and Opt-Pallas achieve 4.21% and 7.85% higher lookup accuracy while consuming only 8.5% and 9.7% of switch resources, respectively. Extensive trace-driven results on a CPU platform further validate the high detection accuracy of Opt-Pallas compared to existing methods.

In today's web-scale, data-driven environments, real-time detection of persistent items that consistently recur over time is essential for maintaining system integrity, reliability, and security. Persistent items often signal critical anomalies, such as stealthy DDoS and botnet attacks in web infrastructures. Although various methods exist for identifying such items as well as for determining their frequency, they require recording every item for processing, which is impractical at very high data rates achieved by modern data streams. In this paper, we introduce Pontus, a novel approach that uses an approximate data structure (sketch) specifically designed for the efficient and accurate detection of persistent items. Our method not only achieves fast and precise lookup but is also flexible, allowing for minor modifications to accommodate other types of persistence-based item detection tasks, such as detecting persistent items with low frequency. We rigorously validate our approach through formal methods, offering detailed proofs of time/space complexity and error bounds to demonstrate its theoretical soundness. Our extensive trace-driven evaluations across various persistence-based tasks further demonstrate Pontus's effectiveness in significantly improving detection accuracy and enhancing processing speed compared to existing approaches. We implement Pontus in an experimental platform with industry-grade Intel Tofino switches and demonstrate the practical feasibility of our approach in a real-world memory-constrained environment.

Integrating machine learning (ML) models directly in the network user plane enables inference on data traffic at line rate, and can dramatically reduce the latency and improve the scalability of key functionalities like traffic classification or intrusion detection. Yet, the hardware that can be used for this purpose, in particular programmable switches, present stringent constraints in terms of limited memory and little support for mathematical operations or data types that render ML model deployment a substantial technical challenge. In this paper, we make a step forward in user-plane ML by introducingFlowrest, a solution that redefines the state of the art in flow-level inference for programmable switches.Flowrestallows implementing general-purpose Random Forest (RF) models in industry-grade switches by ($\boldsymbol {i}$) suitably handling stateful flow-level (FL) features in the switch ASIC, ($\boldsymbol {ii}$) achieving low-collision flow management, and ($\boldsymbol {iii}$) customizing RF models right from the design phase for in-switch operation. We developFlowrestas an open-source software using the P4 language and evaluate its performance in an experimental testbed with Intel Tofino switches. Experiments with inference tasks of varying complexity prove that our solution improves accuracy by over 10 percent points on average with respect to the second-best competitor out of five recent approaches for RF-based in-switch inference, while maintaining sub-microsecond latency.

Embedding machine learning (ML) models in programmable switches realizes the vision of high-throughput and low-latency inference at line rate. Recent works have made breakthroughs in embedding Random Forest (RF) models in switches for either packet-level inference or flow-level inference. The former relies on simple features from packet headers that are simple to implement but limit accuracy in challenging use cases; the latter exploits richer flow features to improve accuracy, but leaves early packets in each flow unclassified. We propose Jewel, an in-switch ML model based on a fully joint packet-and flow-level design, which takes the best of both worlds by classifying early flow packets individually and shifting to flow-level inference when possible. Our proposal involves (i) a single RF model trained to classify both packets and flows, and (ii) hardware-aware model selection and training techniques for resource footprint minimization. We implement Jewel in P4 and deploy it in a testbed with Intel Tofino switches, where we run extensive experiments with a variety of real-world use cases. Results reveal how our solution outperforms four state-of-the-art benchmarks, with accuracy gains in the 2.0%–5.3% range.

Recent endeavours have enabled the integration of trained machine learning models like Random Forests in resource-constrained programmable switches for line rate inference. In this work, we first show how packet-level information can be used to classify individual packets in production-level hardware with very low latency. We then demonstrate how the newly proposed Flowrest framework improves classification performance relative to the packet-level approach by exploiting flow-level statistics to instead classify traffic flows entirely within the switch without considerably increasing latency. We conduct experiments using measurement data in a real-world testbed with an Intel Tofino switch and shed light on how Flowrest achieves an F1-score of 99% in a service classification use case, outperforming its packet-level counterpart by 8%.