Soter: Deep Learning Enhanced In-Network Attack Detection Based on Programmable Switches

Guorui Xie1; Qing Li2; Chupeng Cui3; Peican Zhu4; Dan Zhao1; Wanxin Shi1; Zhuyun Qi1; Yong Jiang1; Xi Xiao5

10.1109/SRDS55811.2022.00029

2022

41st International Symposium on Reliable Distributed Systems (SRDS)

1060-9857

2575-8462

978-1-6654-9754-1

2022 41st International Symposium on Reliable Distributed Systems (SRDS)

225-236

19-22 Sept. 2022

Vienna, Austria

345 E 47TH ST, NEW YORK, NY 10017 USA

IEEE

Though several deep learning (DL) detectors have been proposed for the network attack detection and achieved high accuracy, they are computationally expensive and struggle to satisfy the real-time detection for high-speed networks. Recently, programmable switches exhibit a remarkable throughput efficiency on production networks, indicating a possible deployment of the timely detector. Therefore, we present Soter, a DL enhanced in-network framework for the accurate real-time detection. Soter consists of two phases. One is filtering packets by a rule-based decision tree running on the Tofino ASIC. The other is executing a well-designed lightweight neural network for the thorough inspection of the suspicious packets on the CPU. Experiments on the commodity switch demonstrate that Soter behaves stably in ten network scenarios of different traffic rates and fulfills perflow detection in 0.03s. Moreover, Soter naturally adapts to the distributed deployment among multiple switches, guaranteeing a higher total throughput for large data centers and cloud networks.

In-network intelligence deep learning network security

其他

英语

CPCI-S

National Key Research and Development Project of China[2020AAA0107704] ; National Natural Science Foundation of China["61972189","62073263"] ; Shenzhen Key Lab of Software Defined Networking[ZDSYS20140509172959989]

Computer Science ; Engineering

Computer Science, Hardware & Architecture ; Computer Science, Theory & Methods ; Engineering, Electrical & Electronic

WOS:000920405900019

IEEE

1.Peng Cheng Laboratory, Shenzhen, China
2.Southern University of Science and Technology, Shenzhen, China
3.Jilin University, Changchun, China
4.Northwestern Polytechnical University, Xi'an, China
5.International Graduate School, Tsinghua University, Shenzhen, China

Guorui Xie,Qing Li,Chupeng Cui,et al. Soter: Deep Learning Enhanced In-Network Attack Detection Based on Programmable Switches[C]. 345 E 47TH ST, NEW YORK, NY 10017 USA:IEEE,2022:225-236.