Pith. sign in

REVIEW 4 major objections 5 minor 85 references

SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SPLI DT splits decision trees into per-window subtrees and reuses switch resources, supporting up to 5x more stateful features at line rate with higher accuracy.

desk verdict Genuinely novel partitioned-DT idea, but reported gains are undermined by test-set-driven model selection and an untested window-boundary mechanism. read the letter →

arxiv 2509.00397 v1 pith:TQ2EC4RH submitted 2025-08-30 cs.NI

Murayyiam Parvez , Annus Zulfiqar , Roman Beltiukov , Shir Landau Feibish , Walter Willinger , Arpit Gupta , Muhammad Shahbaz This is my paper · ORCID
classification cs.NI
keywords in-networkmachinelearningprogrammabledataplanesdecisiontreesstatefulfeaturesslidingwindowinferencepacketrecirculationmatch-actiontablesflowscalability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SPLI DT claims that the bottleneck for in-network decision trees is not switch hardware alone but the one-shot way trees are executed: every selected feature is computed up front and kept for the whole flow. By partitioning a tree into subtrees, giving each subtree its own feature set, and processing each flow in windows that trigger subtree transitions through packet recirculation, the same registers and match keys can be reused across the tree. On seven real-world traffic datasets, this yields up to 5x more unique stateful features than fixed top-k systems such as NetBeacon and Leo, with higher F1 scores at the same flow counts and support for millions of concurrent flows at line rate. The paper also contributes a Bayesian-optimization search that jointly picks tree depth, partition sizes, and per-subtree feature count to reach a chosen accuracy-versus-flows trade-off. If correct, it would remove the assumed conflict between feature richness and flow scalability in programmable data planes.

What carries the argument

The partition: a group of consecutive decision-tree layers containing one or more subtrees, each with its own feature set of size k. Flows are processed one window per partition; a window boundary triggers a single recirculated control packet that updates the subtree ID, clears the dependency chain and the k feature registers, and starts the next partition. The Range Marking Algorithm maps each subtree's thresholds to compact ternary range marks so each leaf becomes one TCAM rule, and a Bayesian-optimization design search selects tree depth, partition sizes, and k to maximize F1 and supported flows under target hardware constraints.

What would settle it

Run SpliDT on traffic where the flow-size header field is removed or randomized (for example, standard TCP without Homa or NDP) and compare F1 and flow capacity against the reported Pareto frontier; if accuracy falls to top-k levels or subtree transitions fail, the window-boundary assumption is the cause. Also instrument the actual switch to count recirculated control packets per flow at 1M flows under the Hadoop workload and verify that bandwidth stays at or below the reported <0.05% figure.

Watch

Extended reading notes

Core claim

At the paper's center is a collect-and-predict abstraction: instead of computing a fixed global set of top-k features and traversing the whole decision tree in one pass, SpliDT splits the tree into partitions of subtrees, assigns each subtree its own subset of at most k features, and runs inference over sliding windows of packets. A flow enters at the root subtree, collects that subtree's features during the first window, predicts the next subtree ID, and recirculates one control packet to switch the active subtree and reset the feature registers. This time-sharing lets the data plane reuse the same k stateful register slots and match keys across the tree, so the total number of unique featu

Load-bearing premise

The load-bearing premise is that the switch can reliably determine where each flow's window ends from packet-header flow-size information; the paper assumes modern transports such as Homa and NDP expose this, and its own limitations section notes that if the field is absent or spoofed, window boundaries can be wrong and the partitioned inference loop can break.

Editorial extensions

If this is right

  • Data-plane decision trees can use many more stateful features than the top-k limit, because only the active subtree's k features occupy registers at any given time.
  • Accuracy and flow scalability can improve together: SpliDT reports higher F1 at 100K, 500K, and 1M flows than fixed top-k models across all seven evaluated datasets.
  • Recirculation overhead stays bounded and small (<0.05% of bandwidth in the worst case), so the partitioned loop preserves line-rate operation and matches baseline time-to-detection.
  • Each leaf maps to a single TCAM rule via range marking, keeping rule count manageable even as the number of subtrees and unique features grows.
  • The design search yields a Pareto-optimal configuration per dataset and hardware target, letting operators choose where to sit on the accuracy-versus-flows curve.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The window-boundary mechanism depends on flow-size header fields from transports such as Homa and NDP; applying SpliDT to ordinary TCP would require an external way to estimate flow progress, which the paper leaves as future work.
  • The reported 5x feature scaling relies on feature sparsity across subtrees (roughly 6-10% of features needed per subtree in the evaluated datasets); models with dense per-subtree feature usage would gain less.
  • The same partition-and-recirculate strategy could extend to random forests or other stateful models, but the paper does not evaluate that setting.
  • Adaptive window sizing, listed as future work, could change the Pareto frontier for bursty traffic since fixed windows currently constrain both accuracy and resource efficiency.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents SpliDT, a partitioned decision-tree architecture for programmable data planes. Instead of computing a fixed top-k set of stateful features for the entire flow, SpliDT splits the DT into partitions and subtrees, assigns each subtree its own feature subset, collects features over sliding windows of packets, and uses packet recirculation as an in-band control channel to reuse registers and match keys across subtrees. A Bayesian-optimization-based design-space exploration framework jointly selects tree depth, partition sizes, and per-subtree feature counts. The paper evaluates SpliDT on seven public network datasets and compares against NetBeacon and Leo, reporting higher F1 scores, up to 5x more unique features, flows up to 1M, and recirculation overhead below 0.05%.

Significance. The core idea is timely and potentially significant: if validated, it decouples the number of stateful features used by an in-network DT from the per-flow register budget, and it offers a concrete way to time-share match-action resources. Strengths of the paper include the full P4 implementation compiled with BF-SDE for Tofino, the use of a real testbed, a custom training/DSE framework, and an explicit commitment to release artifacts. The main claims, however, rest on two evaluation choices that need to be corrected or scoped before the results can be taken at face value: using the test set to drive Bayesian optimization, and relying on an unvalidated window-boundary mechanism for the evaluated TCP-like workloads.

major comments (4)
  1. [§3.2.1 (Figure 5), §5.2 (Table 3, Figure 6)] The BO loop is described as evaluating each proposed configuration 'on a test dataset' and feeding that F1 score back into the optimizer. Because the reported F1 values are the best over 500 BO iterations, they are subject to optimistic selection bias. This is load-bearing for the central 'higher accuracy than NetBeacon and Leo' claim: part or all of the gap may be an artifact of model selection on the test split. Please use a train/validation/test protocol: run BO on the validation split, then evaluate the final selected configuration once on a locked test set, and report both the validation-selected and locked-test F1 values.
  2. [§1, §3.1.3, §5.1, §6] The partitioned inference loop requires the data plane to know when a flow window ends and to trigger a recirculation with the next SID. The paper states in §1 that Homa/NDP embed flow-size information in headers, and §6 discusses only spoofing of that field. However, the evaluation is performed on offline datasets processed with CICFlowMeter, which provides ground-truth per-window statistics and thus an oracle for window boundaries. No P4-level mechanism for detecting window boundaries on ordinary TCP/IP traffic is specified, and no experiment exercises the header-parsing/triggering path. The end-to-end claims of line-rate, millions-of-flows operation are therefore not supported for the evaluated workloads. Please either scope SpliDT explicitly to transports with flow-size headers and demonstrate that path (including spoofing robustness), or implement and validate an alternative boundar
  3. [Table 5, §5.3, Abstract] The recirculation-overhead results appear to be estimates rather than on-switch measurements; no testbed measurement of recirculated packet rate or its impact on throughput is presented. Additionally, the numbers are internally inconsistent: Table 5 lists a maximum of 60.0 Mbps for D7 in the Hadoop environment at 1M flows, which is 0.06% of a 100 Gbps link, while the abstract says '≤0.05%' and the introduction says 'just 50 Mbps (0.05%) in the worst case.' Please reconcile these values and clarify whether Figure 10's time-to-detection is measured or simulated, including how recirculation latency is accounted for.
  4. [Table 3, §1, §5.3] The claim of 'up to 5× more stateful features' compares SpliDT's total unique features across all subtrees with the baselines' fixed top-k set. This is a legitimate aggregate property, but it can be misleading: SpliDT's register budget is set only by the per-subtree value k (e.g., 4 features), so the unique features are not simultaneously 'supported' in the data-plane registers. Moreover, the F1 gains may come substantially from window-based training and per-subtree specialization rather than from a larger simultaneous feature set. A controlled ablation (same k and feature budget, with and without partitioning) would substantiate the claimed mechanism and make the comparison with NetBeacon/Leo fairer.
minor comments (5)
  1. [Front matter] There is a duplicated/leftover abstract block beginning with 'FlowNetBeacon,Leo Feature Collection...' before Section 1; it should be removed or replaced with the actual paper abstract.
  2. [References] Reference [22] is listed as 'Details omitted for double-blind review.' Since the paper commits to public artifact release, the reference should be resolved or the artifact linked.
  3. [Table 3] The '#Features' column should clearly state that for SpliDT it denotes the total number of unique features across all subtrees, while for NetBeacon/Leo it denotes the fixed per-flow top-k value. Without this clarification, the reader may over-interpret the comparison.
  4. [§5.2] All datasets are multi-class, but the paper does not specify whether the reported F1 is macro-, micro-, or weighted. Please state the averaging method.
  5. [§3.2.1] The paper says the BO search runs 500 iterations, while Figure 7 shows convergence within 150 iterations. It would be helpful to state the stopping criterion or why 500 iterations were used.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SpliDT's central claims are empirical, externally benchmarked, and do not reduce to their own inputs.

full rationale

I find no circular step in the paper. The central claims—higher accuracy, up to 5x more unique stateful features, low recirculation overhead, and flow scalability—are supported by training on public datasets and comparing against external baselines (NetBeacon, Leo), not by an equation that reduces to a fitted parameter. The 5x feature-count result is a measured property of the trained partitioned trees (Table 3), not a parameter fitted to itself. Recirculation overhead is estimated from flow-size distributions and partition counts (Table 5), and the Range Marking Algorithm is cited prior work used as a building block, not presented as a predictive result. The self-citations in the paper are background/related-work references and are not load-bearing premises for the architecture's validity. The Section 6 limitations (fixed window sizes, spoofable flow-size headers) and the unvalidated assumption that Homa/NDP expose flow-size information for window-boundary detection are deployment-validity concerns, not circularity: they do not make the claimed derivation equivalent to its inputs. The Bayesian optimization loop selecting configurations on test F1 is a methodological risk if the same test set is used for final reporting, but that is an evaluation-protocol concern, not a construction-level circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central contribution rests on the domain assumption that subtrees are feature-sparse and that window boundaries can be detected in hardware. The main free parameters are the DSE choices k, depth, partition sizes, and bit precision, which are selected per dataset. No new physical entities are introduced; SIDs and partition registers are implementation state.

free parameters (4)
  • k (features per subtree) = k chosen by BO per dataset, e.g., 4 in the running example; ranges reported as 1-6
    Central to resource reuse: only k feature registers are active per flow. BO selects k to maximize F1 and flow count on the target hardware.
  • Tree depth D and partition sizes [i1,...,ip] = e.g., D=6 with partitions [2,3,1] in the example; varies by dataset
    Defines the number and size of partitions and subtrees. The DSE searches these values and the reported Pareto frontiers depend on them.
  • Window size (fraction of flow per partition) = Implicit from number of partitions and flow-size field; per-flow windows are uniform
    Each subtree observes a window of packets; window boundaries depend on flow size and chosen partitions, affecting feature computation and time-to-detection.
  • Feature bit precision = 32, 16, or 8 bits in microbenchmarks
    Varied in Figure 12 to trade accuracy versus supported flow count; the reported Pareto frontiers depend on this precision choice.
assumptions (5)
  • domain assumption Each subtree in a trained DT needs at most k features
    Required for k register reuse and for the claim that partitions avoid top-k feature loss. Supported by Table 1 for D1-D3, asserted to hold for D4-D7.
  • domain assumption Packet recirculation can serve as an in-band control channel without disturbing line-rate data traffic
    The design resubmits one control packet per flow window with the next subtree ID. This is a hardware capability of Tofino/Trident-class switches, cited in Section 2.3.
  • domain assumption Flow size information is available in packet headers to determine window boundaries
    Needed to halt feature collection and trigger partition transitions. The paper cites Homa and NDP for this and Section 6 acknowledges header spoofing as a security limitation.
  • domain assumption Leaf subsets from the previous partition retain enough samples to train the next subtree
    Algorithm 1 recursively trains only on samples reaching each leaf. At deep partitions, subset sizes can shrink and degrade model quality; the paper does not quantify this effect.
  • domain assumption The Range Marking Algorithm correctly encodes DT rules into TCAM without rule explosion
    Adopted from NetBeacon [85] and used for both feature tables and model tables; the paper assumes its correctness and efficiency.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate." pith.science (2026). https://pith.science/paper/TQ2EC4RH

@misc{pith2026250900397,
  author       = {Pith},
  title        = {Pith review of: SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TQ2EC4RH}},
  note         = {Machine review of arXiv:2509.00397}
}
read the original abstract

Machine learning (ML) is increasingly being deployed in programmable data planes (switches and SmartNICs) to enable real-time traffic analysis, security monitoring, and in-network decision-making. Decision trees (DTs) are particularly well-suited for these tasks due to their interpretability and compatibility with data-plane architectures, i.e., match-action tables (MATs). However, existing in-network DT implementations are constrained by the need to compute all input features upfront, forcing models to rely on a small, fixed set of features per flow. This significantly limits model accuracy and scalability under stringent hardware resource constraints. We present SPLIDT, a system that rethinks DT deployment in the data plane by enabling partitioned inference over sliding windows of packets. SPLIDT introduces two key innovations: (1) it assigns distinct, variable feature sets to individual sub-trees of a DT, grouped into partitions, and (2) it leverages an in-band control channel (via recirculation) to reuse data-plane resources (both stateful registers and match keys) across partitions at line rate. These insights allow SPLIDT to scale the number of stateful features a model can use without exceeding hardware limits. To support this architecture, SPLIDT incorporates a custom training and design-space exploration (DSE) framework that jointly optimizes feature allocation, tree partitioning, and DT model depth. Evaluation across multiple real-world datasets shows that SPLIDT achieves higher accuracy while supporting up to 5x more stateful features than prior approaches (e.g., NetBeacon and Leo). It maintains the same low time-to-detection (TTD) as these systems, while scaling to millions of flows with minimal recirculation overhead (<0.05%).

Figures

Figures reproduced from arXiv: 2509.00397 by the authors.

Figure 1
Figure 1. One-short versus interval-based Feature Col IttSPLIDT [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. SPLIDT and top-k ≤ 7 model versus the ideal scenario with unlimited resources. SPLIDT, with access to all features, achieves higher F1 score than top-k for the datasets, D1–3 (details in §5). The per-packet models peak at 0.41, 0.56, and 0.59, respectively (not shown). resource-constrained programmable data planes. Observation: The constraints of prior DT-based systems are often perceived as intrinsic to programmabl… view at source ↗
Figure 3
Figure 3. Domain-specific properties of DTs: Partitions [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: SPLIDT’s partitioned inference architecture, processing flow windows in two phases: (1) Feature Collection and Engineering (left) and (2) Subtree Model Prediction (right)—leveraging resource reuse (i.e., registers and match keys) via recirculation, for efficient execut…
Figure 5
Figure 5. Figure 5: Workflow of SPLIDT’s Model Design Search. 3.1.2 Subtree Model Prediction. The prediction phase ( [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Pareto frontier of SPLIDT vs. baselines, indicating the best F1 score for a given #flows in the data plane. Data #Flows F1 Score Depth / #Partitions #Features #TCAM Entries Register Size (bits) NB Leo SPLIDT NB Leo SPLIDT NB Leo SPLIDT NB Leo SPLIDT NB Leo SPLIDT D1 10…
Figure 7
Figure 7. Figure 7: Number of BO search iterations to reach peak [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Pareto frontiers for SPLIDT partitioned trees under varying constraints (top to bottom): (a) fixed tree depth, (b) fixed number of partitions, and (c) fixed number of features per subtree. ●● ● ●●●●●●● ●● ● ● ● ● ● ●●●●●●● ●●● ● ● ●● ● ●● ● ●● ● ●● ●●●● ● 0.00 0.15 0.3…
Figure 9
Figure 9. Figure 9: Comparison of #TCAM entries against F1 score for S [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Time-to-detection (TTD) of D3 for environ￾ments: WS and HD. Other datasets show a similar trend. ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● 0…
Figure 11
Figure 11. Figure 11: Register sizes (in bits) versus number of fea [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Pareto frontier of D3 versus bit precisions. pipelines to improve inference efficiency. pForest [12] gen￾eralizes DTs to random forests, enabling dynamic feature selection based on real-time traffic. Unlike these approaches, SPLIDT removes the static top-k feature con…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

85 extracted references · 78 canonical work pages

  1. [1]

    Pensando

    AMD. Pensando. https://www.amd.com/en/ accelerators/pensando, last accessed: 06/05/2025

    2025

  2. [2]

    Machine Learning for En- crypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity

    Blake Anderson and David McGrew. Machine Learning for En- crypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2017

    2017

  3. [3]

    Opentuner: An Extensible Framework for Program Autotuning

    Jason Ansel, Shoaib Kamil, Kalyan Veeramachaneni, Jonathan Ragan-Kelley, Jeffrey Bosboom, Una-May O’Reilly, and Saman Amarasinghe. Opentuner: An Extensible Framework for Program Autotuning. In Proceedings of the 23rd Interna- tional Conference on Parallel Architectures and Compilation, 2014

    2014

  4. [4]

    Practical Traffic Analysis Attacks on Secure Messaging Applications

    Alireza Bahramali, Amir Houmansadr, Ramin Soltani, Dennis Goeckel, and Don Towsley. Practical Traffic Analysis Attacks on Secure Messaging Applications. In NDSS, 2020

    2020

  5. [5]

    Diogo Barradas, Nuno Santos, Luis Rodrigues, Salvatore Sig- norello, Fernando M. V . Ramos, and André Madeira. FlowLens: Enabling Efficient Flow Classification for ML-based Network Security Applications. In NDSS, 2021

    2021

  6. [6]

    Understanding data center traffic characteristics

    Theophilus Benson, Ashok Anand, Aditya Akella, and Ming Zhang. Understanding data center traffic characteristics. ACM SIGCOMM Computer Communication Review (CCR), 2010

    work page 2010

  7. [7]

    Bergstra, D

    J. Bergstra, D. Yamins, and D. D. Cox. Making a Science of Model Search: Hyperparameter Optimization in Hundreds of Dimensions for Vision Architectures. In ICML, 2013

    work page 2013

  8. [8]

    P4: Programming Protocol-Independent Packet Processors

    Pat Bosshart, Dan Daly, Glen Gibb, Martin Izzard, Nick McK- eown, Jennifer Rexford, Cole Schlesinger, Dan Talayco, Amin Vahdat, George Varghese, and David Walker. P4: Programming Protocol-Independent Packet Processors. In ACM SIGCOMM Computer Communication Review (CCR), 2014

    work page 2014

Show all 85 references
  1. [9]

    Forwarding Metamorphosis: Fast Programmable Match-Action Processing in Hardware for SDN

    Pat Bosshart, Glen Gibb, Hun-Seok Kim, George Varghese, Nick McKeown, Martin Izzard, Fernando Mujica, and Mark Horowitz. Forwarding Metamorphosis: Fast Programmable Match-Action Processing in Hardware for SDN. In ACM SIGCOMM, 2013

    2013

  2. [10]

    Trident 5 / BCM78800 Series

    BROADCOM. Trident 5 / BCM78800 Series. https://www. broadcom.com/products/ethernet-connectivity/ switching/strataxgs/bcm78800, last accessed: 06/05/2025

    2025

  3. [11]

    Trident4/BCM56880 Series

    BROADCOM. Trident4/BCM56880 Series. https:// www.broadcom.com/products/ethernet-connectivity/ switching/strataxgs/bcm56880-series, last accessed: 06/05/2025

    2025

  4. [12]

    pForest: In- Network Inference with Random Forests

    Coralie Busse-Grawitz, Roland Meier, Alexander Dietmüller, Tobias Bühler, and Laurent Vanbever. pForest: In- Network Inference with Random Forests. arXiv preprint arXiv:1909.05680, 2022

    1909 arXiv

  5. [13]

    CIC IDS 2017 Dataset

    Canadian Institute for Cybersecurity. CIC IDS 2017 Dataset. https://www.unb.ca/cic/datasets/ids-2017. html, last accessed: 06/05/2025

    2017

  6. [14]

    CIC IDS 2018 Dataset

    Canadian Institute for Cybersecurity. CIC IDS 2018 Dataset. https://www.unb.ca/cic/datasets/ids-2018. html, last accessed: 06/05/2025

    2018

  7. [15]

    CIC IoMT 2024 Dataset

    Canadian Institute for Cybersecurity. CIC IoMT 2024 Dataset. https://www.unb.ca/cic/datasets/ iomt-dataset-2024.html, last accessed: 06/05/2025

    2024

  8. [16]

    CIC IoT 2023 Dataset

    Canadian Institute for Cybersecurity. CIC IoT 2023 Dataset. https://www.unb.ca/cic/datasets/iotdataset-2023. html, last accessed: 06/05/2025

    2023

  9. [17]

    CIC VPN Dataset

    Canadian Institute for Cybersecurity. CIC VPN Dataset. https://www.unb.ca/cic/datasets/vpn.html, last accessed: 06/05/2025

    2025

  10. [18]

    Tensor Processing Units (TPUs)

    Google Cloud. Tensor Processing Units (TPUs). https:// cloud.google.com/tpu, 2025

    2025

  11. [19]

    Intel P4 Insight

    Intel Corporation. Intel P4 Insight. https:// p4.org/onf-product/intel-p4-insight/ , last accessed: 06/05/2025

    2025

  12. [20]

    Intel ® P4 Studio

    Intel Corporation. Intel ® P4 Studio. https://www. intel.com/content/www/us/en/products/details/ network-io/intelligent-fabric-processors/ p4-studio.html, last accessed: 06/05/2025

    2025

  13. [21]

    NVIDIA T4 Tensor Core GPU

    NVIDIA Corporation. NVIDIA T4 Tensor Core GPU. https: //www.nvidia.com/en-us/data-center/tesla-t4/ , 2025

    2025

  14. [22]

    Details omitted for double-blind review

  15. [23]

    Brighten Godfrey, and Michael Schapira

    Mo Dong, Qingxi Li, Doron Zarchy, P. Brighten Godfrey, and Michael Schapira. PCC: Re-Architecting Congestion Control for Consistent High Performance. In USENIX NSDI, 2015

    2015

  16. [24]

    HorusEye: A Realtime IoT Malicious Traffic Detec- tion Framework using Programmable Switches

    Yutao Dong, Qing Li, Kaidong Wu, Ruoyu Li, Dan Zhao, Gareth Tyson, Junkun Peng, Yong Jiang, Shutao Xia, and Ming- wei Xu. HorusEye: A Realtime IoT Malicious Traffic Detec- tion Framework using Programmable Switches. In USENIX Security, 2023

    2023

  17. [25]

    Doriguzzi-Corin, S

    R. Doriguzzi-Corin, S. Millar, S. Scott-Hayward, J. Martínez- del Rincón, and D. Siracusa. Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection. IEEE Transactions on Network and Service Management, 2020

    2020

  18. [26]

    Moongen: A Scriptable High- Speed Packet Generator

    Paul Emmerich, Sebastian Gallenmüller, Daniel Raumer, Flo- rian Wohlfart, and Georg Carle. Moongen: A Scriptable High- Speed Packet Generator. In ACM IMC, 2015

    2015

  19. [27]

    BOHB: Robust and efficient hyperparameter optimization at scale

    Stefan Falkner, Aaron Klein, and Frank Hutter. BOHB: Robust and efficient hyperparameter optimization at scale. In ICML, 2018

    2018

  20. [28]

    Stratum OS

    Open Networking Foundation. Stratum OS. https://www. opennetworking.org/stratum/, last accessed: 06/05/2025

    2025

  21. [29]

    Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

    Chuanpu Fu, Qi Li 0002, and Ke Xu 0002. Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis. In NDSS, 2023

    2023

  22. [30]

    Network Pro- gramming Language (NPL) Specification

    Saikrishna Garlapati. Network Pro- gramming Language (NPL) Specification. https://www.scribd.com/document/430082948/Network- programming-Language-NPL, last accessed: 06/05/2025

    2025

  23. [31]

    Characterization of encrypted and VPN traffic using time-related features

    Gerard Drapper Gil, Arash Habibi Lashkari, Mohammad Ma- mun, and Ali A Ghorbani. Characterization of encrypted and VPN traffic using time-related features. In Proceedings of the 2nd international conference on information systems security and privacy, 2016. 13

    2016

  24. [32]

    CICFlowMeter

    Arash Habibi Lashkari (GitHub). CICFlowMeter. https: //github.com/ahlashkari/CICFlowMeter/tree/master, last accessed: 06/05/2025

    2025

  25. [33]

    PostgreSQL

    PostgreSQL Global Development Group. PostgreSQL. https: //www.postgresql.org, last accessed: 06/05/2025

    2025

  26. [34]

    Gupta, R

    A. Gupta, R. Harrison, M. Canini, N. Feamster, J. Rexford, and W. Willinger. Sonata: Query-driven network telemetry. In ACM SIGCOMM, 2018

    2018

  27. [35]

    netFound: Foundation Model for Network Security

    Satyandra Guthula, Roman Beltiukov, Navya Battula, Wenbo Guo, Arpit Gupta, and Inder Monga. netFound: Foundation Model for Network Security. arXiv preprint arXiv:2310.17025, 2025

    2025 arXiv

  28. [36]

    CUBIC: A New TCP- Friendly High-Speed TCP Variant

    Sangtae Ha, Injong Rhee, and Lisong Xu. CUBIC: A New TCP- Friendly High-Speed TCP Variant. ACM SIGOPS Operating Systems Review, 2008

    2008

  29. [37]

    Moore, Gianni Antichi, and Marcin Wój- cik

    Mark Handley, Costin Raiciu, Alexandru Agache, Andrei V oinescu, Andrew W. Moore, Gianni Antichi, and Marcin Wój- cik. Re-Architecting Datacenter Networks and Stacks for Low Latency and High Performance. In ACM SIGCOMM, 2017

    2017

  30. [38]

    Understanding the CRC32 Hash: A Comprehensive Guide

    He3 Team. Understanding the CRC32 Hash: A Comprehensive Guide. https://he3.app/blogs/understanding-the-crc32-hash-a- comprehensive-guide/, last accessed: 06/05/2025

    2025

  31. [39]

    MongoDB Inc. MongoDB. https://www.mongodb.com, last accessed: 06/05/2025

    2025

  32. [40]

    Intel Ethernet Network Adapter X710

    Intel. Intel Ethernet Network Adapter X710. https://www.intel.com/content/www/us/en/ products/details/ethernet/700-network-adapters/ x710-network-adapters/products.html, last accessed: 06/05/2025

    2025

  33. [41]

    Tofino: P4-programmable Ethernet switch ASIC that delivers better performance at lower power

    Intel. Tofino: P4-programmable Ethernet switch ASIC that delivers better performance at lower power. https://www.intel.com/content/www/us/en/products/network- io/programmable-ethernet-switch/tofino-series.html, last accessed: 06/05/2025

    2025

  34. [42]

    Tofino2: Second-generation P4-programmable Ethernet Switch ASIC that Continues to De- liver Programmability without Compromise

    Intel. Tofino2: Second-generation P4-programmable Ethernet Switch ASIC that Continues to De- liver Programmability without Compromise. https://www.intel.com/content/www/us/en/products/network- io/programmable-ethernet-switch/tofino-2-series.html, last accessed: 06/05/2025

    2025

  35. [43]

    Leo: Online ML-based Traffic Classification at Multi-Terabit Line Rate

    Syed Usman Jafri, Sanjay Rao, Vishal Shrivastav, and Mohit Tawarmalani. Leo: Online ML-based Traffic Classification at Multi-Terabit Line Rate. In USENIX NSDI, 2024

    2024

  36. [44]

    AC-DC: Adaptive Ensemble Classification for Network Traffic Identification.arXiv preprint arXiv:2302.11718, 2023

    Xi Jiang, Shinan Liu, Saloua Naama, Francesco Bronzino, Paul Schmitt, and Nick Feamster. AC-DC: Adaptive Ensemble Classification for Network Traffic Identification.arXiv preprint arXiv:2302.11718, 2023

    2023 arXiv

  37. [45]

    GPflowOpt: A Bayesian Optimization Library Using TensorFlow

    Nicolas Knudde, Joachim van der Herten, Tom Dhaene, and Ivo Couckuyt. GPflowOpt: A Bayesian Optimization Library Using TensorFlow. arXiv preprint arXiv:1711.03845, 2017

    2017 arXiv

  38. [46]

    The IPU: A New, Strate- gic Resource for Cloud Service Providers

    Patricia Kummrow. The IPU: A New, Strate- gic Resource for Cloud Service Providers. https://community.intel.com/t5/Blogs/Tech-Innovation/Data- Center/The-IPU-A-New-Strategic-Resource-for-Cloud- Service-Providers/post/1335081, last accessed: 06/05/2025

    2025

  39. [47]

    Characterization of tor traffic using time based features

    Arash Habibi Lashkari, Gerard Draper Gil, Mohammad Sai- ful Islam Mamun, and Ali A Ghorbani. Characterization of tor traffic using time based features. In International Conference on Information Systems Security and Privacy, 2017

    2017

  40. [48]

    HPCC: High Precision Congestion Control

    Yuliang Li, Rui Miao, Hongqiang Harry Liu, Yan Zhuang, Fei Feng, Lingbo Tang, Zheng Cao, Ming Zhang, Frank Kelly, Mohammad Alizadeh, and Minlan Yu. HPCC: High Precision Congestion Control. In ACM SIGCOMM, 2019

    2019

  41. [49]

    SMAC3: A versatile Bayesian optimization package for hyperparameter optimiza- tion

    Marius Lindauer, Katharina Eggensperger, Matthias Feurer, André Biedenkapp, Difan Deng, Carolin Benjamins, Tim Ruhkopf, René Sass, and Frank Hutter. SMAC3: A versatile Bayesian optimization package for hyperparameter optimiza- tion. Journal of Machine Learning Research (JMLR), 2022

    2022

  42. [50]

    ServeFlow: A Fast-Slow Model Architecture for Network Traffic Analysis

    Shinan Liu, Ted Shaowang, Gerry Wan, Jeewon Chae, Jonatas Marques, Sanjay Krishnan, and Nick Feamster. ServeFlow: A Fast-Slow Model Architecture for Network Traffic Analysis. arXiv preprint arXiv:2402.03694, 2024

    2024 arXiv

  43. [51]

    Neural Adaptive Video Streaming with Pensieve

    Hongzi Mao, Ravi Netravali, and Mohammad Alizadeh. Neural Adaptive Video Streaming with Pensieve. In ACM SIGCOMM, 2017

    2017

  44. [52]

    Homa: A Receiver-Driven Low-Latency Transport Protocol Using Network Priorities

    Behnam Montazeri, Yilong Li, Mohammad Alizadeh, and John Ousterhout. Homa: A Receiver-Driven Low-Latency Transport Protocol Using Network Priorities. In ACM SIGCOMM, 2018

    2018

  45. [53]

    Algorithmic Performance- accuracy Trade-off in 3D Vision Applications using Hyper- mapper

    Luigi Nardi, Bruno Bodin, Sajad Saeedi, Emanuele Vespa, An- drew J Davison, and Paul HJ Kelly. Algorithmic Performance- accuracy Trade-off in 3D Vision Applications using Hyper- mapper. In IEEE IPDPSW, 2017

    2017

  46. [54]

    ConnectX-6 Network Adapters

    Nvidia. ConnectX-6 Network Adapters. https://www.nvidia.com/en-us/networking/ethernet/connectx- 6-dx/, last accessed: 06/05/2025

    2025

  47. [55]

    DOCA Documentation

    Nvidia. DOCA Documentation. https://docs.nvidia. com/doca/archive/2-9-2/doca+p4+developer+tools/ index.html, last accessed: 06/05/2025

    2025

  48. [56]

    Nvidia BlueField Data Processing Units

    Nvidia. Nvidia BlueField Data Processing Units. https://www.nvidia.com/en-us/networking/ products/data-processing-unit/, last accessed: 06/05/2025

    2025

  49. [57]

    NVIDIA Spectrum-X: Ethernet Networking Platform for AI

    NVIDIA Corporation. NVIDIA Spectrum-X: Ethernet Networking Platform for AI. https://www.nvidia.com/ en-us/networking/spectrumx/, last accessed: 06/05/2025

    2025

  50. [58]

    pandas. pandas. https://pandas.pydata.org/, last ac- cessed: 06/05/2025

    2025

  51. [59]

    Scikit-learn: Machine learning in Python

    Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vin- cent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blon- del, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. Scikit-learn: Machine learning in Python. Journal of machine learning research, 2011

    2011

  52. [60]

    Proxmox. Proxmox. https://www.proxmox.com/en/, last ac- cessed: 06/05/2025

    2025

  53. [61]

    Arjun Roy, Hongyi Zeng, Jasmeet Bagga, George Porter, and Alex C. Snoeren. Inside the Social Network’s (Datacenter) Network. In ACM SIGCOMM, 2015

    2015

  54. [62]

    Elastic RSS: Co-Scheduling Packets and Cores Using Programmable NICs

    Alexander Rucker, Muhammad Shahbaz, Tushar Swamy, and Kunle Olukotun. Elastic RSS: Co-Scheduling Packets and Cores Using Programmable NICs. In APNet, 2019. 14

    2019

  55. [63]

    The case for an intermediate representation for programmable data planes

    Muhammad Shahbaz and Nick Feamster. The case for an intermediate representation for programmable data planes. In SOSR, 2015

    2015

  56. [64]

    Query planning for robust and scalable hybrid network telemetry systems

    Chaofan Shou, Rohan Bhatia, Arpit Gupta, Rob Harrison, Daniel Lokshtanov, and Walter Willinger. Query planning for robust and scalable hybrid network telemetry systems. Pro- ceedings of the ACM on Networking, 2024

    2024

  57. [65]

    Exploring Hyperparameter Usage and Tuning in Machine Learning Re- search

    Sebastian Simon, Nikolay Kolyada, Christopher Akiki, Mar- tin Potthast, Benno Stein, and Norbert Siegmund. Exploring Hyperparameter Usage and Tuning in Machine Learning Re- search. In IEEE/ACM 2nd International Conference on AI Engineering–Software Engineering for AI (CAIN), 2023

    2023

  58. [66]

    Re-architecting Traffic Analysis with Neural Network Interface Cards

    Giuseppe Siracusano, Salvator Galea, Davide Sanvito, Moham- mad Malekzadeh, Gianni Antichi, Paolo Costa, Hamed Had- dadi, and Roberto Bifulco. Re-architecting Traffic Analysis with Neural Network Interface Cards. In USENIX NSDI, 2022

    2022

  59. [67]

    Taurus: A Data Plane Architecture for Per-Packet ML

    Tushar Swamy, Alexander Rucker, Muhammad Shahbaz, Ishan Gaur, and Kunle Olukotun. Taurus: A Data Plane Architecture for Per-Packet ML. In ASPLOS, 2022

    2022

  60. [68]

    Homunculus: Auto-Generating Ef- ficient Data-Plane ML Pipelines for Datacenter Networks

    Tushar Swamy, Annus Zulfiqar, Luigi Nardi, Muhammad Shah- baz, and Kunle Olukotun. Homunculus: Auto-Generating Ef- ficient Data-Plane ML Pipelines for Datacenter Networks. In ASPLOS, 2023

    2023

  61. [69]

    Tensorflow

    Tensorflow. Tensorflow. https://www.tensorflow.org/, last accessed: 06/05/2025

    2025

  62. [70]

    Malware traffic classification using convo- lutional neural network for representation learning

    Wei Wang, Ming Zhu, Xuewen Zeng, Xiaozhou Ye, and Yiqiang Sheng. Malware traffic classification using convo- lutional neural network for representation learning. In Interna- tional Conference on Information Networking (ICOIN), 2017

    2017

  63. [71]

    xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses

    Feng Wei, Hongda Li, Ziming Zhao, and Hongxin Hu. xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses. In USENIX Security, 2023

    2023

  64. [72]

    Bayesian Optimization

    Wikipedia. Bayesian Optimization. https: //en.wikipedia.org/wiki/Bayesian_optimization, last accessed: 06/05/2025

    2025

  65. [73]

    TCP ex machina: Computer-generated Congestion Control

    Keith Winstein and Hari Balakrishnan. TCP ex machina: Computer-generated Congestion Control. In ACM SIGCOMM Computer Communication Review (CCR), 2013

    2013

  66. [74]

    A GPU-accelerated network traf- fic monitoring and analysis system

    Wenji Wu and Phil Demar. A GPU-accelerated network traf- fic monitoring and analysis system. In IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), 2013

    2013

  67. [75]

    Mousika: Enable General In-Network Intel- ligence in Programmable Switches by Knowledge Distillation

    Guorui Xie, Qing Li, Yutao Dong, Guanglin Duan, Yong Jiang, and Jingpu Duan. Mousika: Enable General In-Network Intel- ligence in Programmable Switches by Knowledge Distillation. In IEEE INFOCOM, 2022

    2022

  68. [76]

    Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Net- work Environments with TCP-Aware Traffic Augmentation

    Renjie Xie, Jiahao Cao, Enhuan Dong, Mingwei Xu, Kun Sun, Qi Li, Licheng Shen, and Menghao Zhang. Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Net- work Environments with TCP-Aware Traffic Augmentation. In USENIX Security, 2023

    2023

  69. [77]

    Alveo SN1000 SmartNICs

    Xilinx. Alveo SN1000 SmartNICs. https://www. xilinx.com/content/dam/xilinx/publications/ product-briefs/sn1000-product-brief.pdf , last accessed: 06/05/2025

    2025

  70. [78]

    Alveo U250 Data Center Accelerator Card

    AMD Xilinx. Alveo U250 Data Center Accelerator Card. https://www.xilinx.com/products/boards-and-kits/ alveo/u250.html, last accessed: 06/05/2025

    2025

  71. [79]

    Do Switches Dream of Machine Learning? Toward In-Network Classification

    Zhaoqi Xiong and Noa Zilberman. Do Switches Dream of Machine Learning? Toward In-Network Classification. InACM HotNets, 2019

    2019

  72. [80]

    X2 Programmable Ethernet Switch

    Xsight Labs. X2 Programmable Ethernet Switch. https: //xsightlabs.com/products/, last accessed: 06/05/2025

    2025

  73. [81]

    Yan, Hudson Ayers, Chenzhi Zhu, Sadjad Fouladi, James Hong, Keyi Zhang, Philip Levis, and Keith Winstein

    Francis Y . Yan, Hudson Ayers, Chenzhi Zhu, Sadjad Fouladi, James Hong, Keyi Zhang, Philip Levis, and Keith Winstein. Learning in situ: A Randomized Experiment in Video Stream- ing. In USENIX NSDI, 2020

    2020

  74. [82]

    Pantheon: The Training Ground for Internet Congestion-Control Research

    Francis Y Yan, Jestin Ma, Greg D Hill, Deepti Raghavan, Riad S Wahby, Philip Levis, and Keith Winstein. Pantheon: The Training Ground for Internet Congestion-Control Research. In USENIX ATC, 2018

    2018

  75. [83]

    Brain-on-switch: towards advanced intelligent network data plane via NN-driven traffic analysis at line-speed

    Jinzhu Yan, Haotian Xu, Zhuotao Liu, Qi Li, Ke Xu, Mingwei Xu, and Jianping Wu. Brain-on-switch: towards advanced intelligent network data plane via NN-driven traffic analysis at line-speed. In USENIX NSDI, 2024

    2024

  76. [84]

    Planter: Rapid prototyping of in-network machine learning inference

    Changgang Zheng, Mingyuan Zang, Xinpeng Hong, Liam Per- reault, Riyad Bensoussane, Shay Vargaftik, Yaniv Ben-Itzhak, and Noa Zilberman. Planter: Rapid prototyping of in-network machine learning inference. ACM SIGCOMM Computer Com- munication Review (CCR), 2024

    2024

  77. [85]

    An Efficient Design of Intelligent Network Data Plane

    Guangmeng Zhou, Zhuotao Liu, Chuanpu Fu, Qi Li, and Ke Xu. An Efficient Design of Intelligent Network Data Plane. In USENIX Security, 2023. 15

    2023

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.