Pith. sign in

REVIEW 2 major objections 6 minor 82 references

Programmable Data Planes for Network Security

T0 review · 2 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A systems survey argues that P4 programmable switches, despite tight memory and instruction limits, can now run DDoS mitigation, anti-spoofing, firewalls, deep packet inspection, cryptography, and ML-based security at line rate.

desk verdict A useful but uneven survey of programmable data-plane security; the taxonomy is serviceable, but the flagship DPI throughput claim is contradicted by the paper's own description of recirculate-and-truncate, and a citation attribution is wrong. read the letter →

arxiv 2507.22165 v1 pith:535EAK5B submitted 2025-07-29 cs.CR cs.NI

Gursimran Singh , H.B. Acharya , Minseok Kwon This is my paper · ORCID
classification cs.CRcs.NI
keywords P4programmabledataplanesnetworksecurityDDoSmitigationfirewallsdeeppacketinspectionin-networkmachinelearningcryptography
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey sets out to show that programmable switches built around P4 are no longer just fast forwarding devices, but viable platforms for network security. The authors systematize recent systems that detect and mitigate DDoS and spoofing, act as firewalls including application-layer deep packet inspection, implement cryptographic primitives, and run machine-learning inference directly in the data plane. They argue that two architectural workarounds, recirculate-and-truncate and lookup-table precomputation, let these functions fit within the limited memory and instruction set of commodity switches. The payoff, if the survey is right, is that defenses can respond at line rate with sub-microsecond latency instead of millisecond-scale control-plane delays, making the network fabric itself an active layer of defense. The paper also identifies a gap: pure data-plane cryptography on standard switches is still largely unsolved.

What carries the argument

The central object is the P4 programmable switch, whose protocol-independent parser, match-action pipeline, and reconfigurable tables turn packet processing into a programmable computation. Because the architecture forbids loops and complex parsing, two workarounds carry the argument: recirculate-and-truncate, which passes a packet or a clone through the pipeline multiple times, stripping one byte per pass so a deterministic finite automaton in the match-action tables can perform deep packet inspection; and lookup-table precomputation, which converts expensive operations such as AES rounds, logarithms, and ML inference into table lookups and simple bit operations. These mechanisms, plus sketch-based data structures like Count-Min Sketch and Bloom filters, are what let security functions fit on commodity hardware.

What would settle it

Implement the scrambled-lookup-table AES design from [17] on a commodity P4 switch, such as a Tofino-based switch, without FPGA externs or controller help; if the switch cannot sustain the reported 7–11 Gbps throughput or runs out of table memory, the claim that standard switches support practical cryptography fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the tight resource constraints of programmable switches, small SRAM/TCAM, no native loops, no floating-point, and no native encryption, do not preclude a broad class of security applications. The authors claim that P4 switches can already serve as line-rate platforms for spoofing protection, heavy-hitter and DDoS detection, stateful and application-layer firewalls, deep packet inspection via DFA matching over recirculated packets, AES and Diffie-Hellman via scrambled lookup tables, and ML-based traffic classification using decision trees and random forests. They further claim that tree-based models outperform neural networks on switch hardware, with F1-scores around 95–100 on intrusion datasets versus 84–91 for binarized neural networks, and that in-switch detection can reach hundreds of nanoseconds, orders of magnitude faster than control-plane approaches. The authors are explicit that cryptography is the weak spot: several cryptographic systems rely on FPGA externs, CPU offload, or controller help, and no complete secure protocol such as IPsec has been implemented purely in the data plane.

Load-bearing premise

The load-bearing premise is that the performance and accuracy numbers reported by the surveyed systems were obtained on real, commodity P4 switches under realistic traffic, and that the survey consistently distinguishes such results from systems that needed FPGA, CPU, or controller help.

Editorial extensions

If this is right

  • Network operators can deploy DDoS mitigation, anti-spoofing, and firewall policies in the data plane at line rate, removing the millisecond-scale latency of control-plane or external-appliance responses.
  • Deep packet inspection and layer-7 filtering become feasible on standard P4 switches through recirculate-and-truncate, at 10–100 Gbps with thousands of patterns.
  • Tree-based ML models, not neural networks, are the practical choice for in-switch security inference; a two-layer BNN can exhaust a Tofino ASIC while still underperforming decision trees.
  • Cryptography remains the open frontier: current data-plane crypto is either pure but slow, 7–11 Gbps AES via lookup tables, or relies on non-standard hardware, so a complete P4-native secure channel is an unsolved research gap.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the survey's picture is right, the long-term competition is over memory, not compute: techniques that give switches access to external DRAM or that compress models further will likely decide which security functions can move into the fabric.
  • The paper's own caveats suggest a testable benchmark: rerun the surveyed systems on the same commodity switch with the same traffic mixes to see whether the advertised 10–100 Gbps DPI and sub-500 ns detection survive adversarial packet patterns.
  • Because in-switch ML is dominated by decision trees, an adversary who can infer the tree thresholds from public models may craft evasive flows; adversarial robustness for P4-based security models is a natural next problem.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. This paper surveys security applications built on P4-programmable switches, organizing the literature into three areas: in-network attack mitigation (spoofing and DDoS), middlebox/firewall functions including deep packet inspection and cryptography, and machine-learning-based security. It highlights architectural workarounds, particularly recirculate-and-truncate and lookup-table precomputation, and concludes that programmable switches can now serve as a platform for a wide range of high-performance security applications. The paper is a systematization rather than a new technical result, and it includes explicit discussions of limitations in cryptography, payload inspection, and resource constraints.

Significance. If the surveyed results are accurately represented, the paper provides a useful and reasonably comprehensive systematization of an active research area, and it is honest about several hard limitations (Sections 3.2, 3.3, and 4.3). Its strengths are the breadth of coverage, the clear identification of workaround techniques, and the explicit naming of open problems. However, the central claim is quantitative: the conclusion asserts that programmable switches enable a 'wide range of high-performance security applications,' and many of the supporting numbers are secondhand, with no independent verification. The manuscript does not ship code, proofs, or new measurements, which is acceptable for a survey, but the accuracy of the quoted performance figures is therefore load-bearing. The text currently overstates the performance of recirculate-and-truncate DPI and does not consistently state whether each surveyed system ran on a commodity switch, an FPGA, or a CPU, so the generalization to 'commodity programmable switches' is only partially supported.

major comments (2)
  1. [Section 3.1 and Section 4.3] The claim that recirculate-and-truncate enables 'deep packet inspection at line rate' and that PPS 'achieves line-rate processing at 10–100 Gbps' is internally contradicted by the mechanism described in the same section and by the later admission in Section 4.3 that payload inspection 'requires complex and slow workarounds (recirculate-and-truncate).' The text says one byte is removed per pipeline pass; a 1500-byte packet therefore needs roughly 1500 passes. With fixed aggregate pipeline capacity, sustainable throughput for full-size packets is about port_speed divided by the number of passes, i.e. roughly 67 Mbps on a 100 Gbps port, not 10–100 Gbps. The survey provides no per-packet pass count, no throughput-versus-payload-length model, and no explanation of how the quoted numbers were obtained. Since DPI is a flagship application in the conclusion, this overstatement is load-bearing; please either correct the throughput figure, specify a multi-byte or k-stride mechanism with its actual pass count, or soften the 'line-rate' language.
  2. [Sections 3.2 and 3.3] The survey does not consistently distinguish 'implemented in P4 on a commodity switch' from 'implemented with FPGA, CPU, or controller help.' For instance, the AES bullet in Section 3.2 says the scheme works 'entirely in the data plane without controller interaction,' but the same paragraph says it uses packet recirculation, and Section 3.3 later states that no secure protocol has been implemented purely in the data plane. Similarly, the cryptographic-hash and FPGA-accelerated bullets explicitly use non-standard targets, while the ML systems in Section 4.1 (Planter, Soter, Mousika, etc.) are listed without stating whether their reported accuracy and latency came from real Tofino-class switches, emulators, or FPGAs. Because the conclusion generalizes to 'commodity programmable switches,' each surveyed system should state its target platform and whether the quoted performance was measured or estimated.
minor comments (6)
  1. [Section 3.1] DeeP4R is attributed in the text to 'Gupta et al.,' but reference [31] lists Gosain et al. as the authors; please correct the in-text attribution.
  2. [Section 3.2] 'Diffie-Helman' should be spelled 'Diffie-Hellman' in the bullet on key exchange.
  3. [Throughout] The paper uses 'user plane' and 'control-user plane' in Section 4.2; for consistency with the rest of the manuscript and the P4 literature, these should be 'data plane' and 'control-data plane.'
  4. [Section 1] In the contributions list, 'F or in-network attack mitigation' appears to be a formatting artifact; please fix the spacing.
  5. [Section 2.2] The claim that an industrial-scale switch costs '$5 k – $10 k' is presented without a citation or configuration details; please add a source or qualify the statement as an estimate.
  6. [Section 4.4] The statement that RF models achieved 'F1-scores typically in the 95-100 range' lacks dataset, standard-deviation, and model-size context; a survey aimed at guiding model selection should report these details or cite the comparison more precisely.

Circularity Check

0 steps flagged · score 0.0 of 10

Survey with no original derivation; reported results come from external systems, so no circularity found.

full rationale

This paper is a systematization survey, not a derivation. It introduces no equations, fits no parameters, and makes no first-principles prediction that is subsequently 'confirmed.' Each capability and performance number (e.g., PPS at 10–100 Gbps, AES at 10.92 Gbps, smart-grid detection at 356 ns) is attributed to independently published systems with external citations, so the claims are anchored outside the paper's own argument. The central tension the skeptic identifies — that recirculate-and-truncate requires one pipeline pass per payload byte, which is inconsistent with 'line-rate DPI,' and that Section 4.3 itself calls the workaround 'complex and slow' — is an internal consistency and evidence-quality objection, not a circular reduction. Similarly, Section 3.3 explicitly concedes that none of the secure protocols were implemented purely in the data plane, which undermines the breadth of the conclusion but again is not a circularity. There is no self-citation chain, no imported uniqueness theorem, and no fitted quantity renamed as a prediction. Therefore the circularity score is 0.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

This survey introduces no free parameters and no new entities. Its central claim inherits the trustworthiness of roughly 80 cited systems; the two axioms above are the background premises that would, if false, weaken the claim that programmable switches are a practical security platform.

assumptions (2)
  • domain assumption The quantitative results reported in the cited papers, including throughput, latency, and accuracy figures, are accurate and reproducible on the hardware described in those papers.
    Sections 3.1, 3.2, and 4.2 treat these numbers as evidence that in-network security is practical; the survey does not reproduce or independently validate them.
  • domain assumption Commodity P4/PISA switches have the constraints described, namely a single-pass parser, no loops or native floating point, and limited SRAM/TCAM, and results obtained with FPGAs, CPU externs, or controllers are clearly separable from standard-switch results.
    The workaround narrative in Sections 1 and 5 depends on these constraints; the paper's own Sections 3.2 and 3.3 show that some systems rely on non-standard hardware, so the separation is not always explicit.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Programmable Data Planes for Network Security." pith.science (2026). https://pith.science/paper/535EAK5B

@misc{pith2026250722165,
  author       = {Pith},
  title        = {Pith review of: Programmable Data Planes for Network Security},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/535EAK5B}},
  note         = {Machine review of arXiv:2507.22165}
}
read the original abstract

The emergence of programmable data planes, and particularly switches supporting the P4 language, has transformed network security by enabling customized, line-rate packet processing. These switches, originally intended for flexible forwarding, now play a broader role: detecting and mitigating attacks such as DDoS and spoofing, enforcing next-generation firewall policies, and even supporting in-network cryptography and machine learning. These capabilities are made possible by techniques such as recirculate-and-truncate and lookup-table precomputation, which work around architectural constraints like limited memory and restricted instruction sets. In this paper, we systematize recent advances in security applications built on programmable switches, with an emphasis on the capabilities, challenges, and architectural workarounds. We highlight the non-obvious design techniques that make complex in-network security functions feasible despite the constraints of the hardware platform, and also comment on remaining issues and emerging research directions.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 78 canonical work pages

  1. [31]

    Deep4r: Deep packet inspection using recirculation in programmable data planes

    Devashish Gosain et al. Deep4r: Deep packet inspection using recirculation in programmable data planes. In IEEE/IFIP Network Operations and Management Symposium (NOMS) , 2023

    work page 2023

  2. [1]

    Akem, Beyza B¨ ut¨ un, Michele Gucciardo, and Marco Fiore

    Aristide T.-J. Akem, Beyza B¨ ut¨ un, Michele Gucciardo, and Marco Fiore. Henna: hierarchical machine learning inference in programmable switches. In Proceedings of the 1st International Workshop on Native Network Intelligence , pages 1–7, 2022

    2022

  3. [2]

    Akem, Beyza B¨ ut¨ un, Michele Gucciardo, and Marco Fiore

    Aristide T.-J. Akem, Beyza B¨ ut¨ un, Michele Gucciardo, and Marco Fiore. Jewel: Resource-efficient joint packet and flow level inference in programmable switches. In IEEE INFOCOM 2024 - IEEE Conference on Computer Communications , 2024

    2024

  4. [3]

    Akem, Guillaume Fraysse, and Marco Fiore

    Aristide T.-J. Akem, Guillaume Fraysse, and Marco Fiore. Encrypted traffic classification at line rate in programmable switches with machine learning. In IEEE/IFIP Network Operations and Management Symposium (NOMS), pages 1–9, 2024

    work page 2024

  5. [4]

    Akem, Michele Gucciardo, and Marco Fiore

    Aristide T.-J. Akem, Michele Gucciardo, and Marco Fiore. Flowrest: Practical flow-level inference in programmable switches with random forests. InIEEE INFOCOM 2023 - IEEE Conference on Computer Communications, pages 1–10, 2023

    work page 2023

  6. [5]

    Akem, Michele Gucciardo, and Marco Fiore

    Aristide T.-J. Akem, Michele Gucciardo, and Marco Fiore. Ultra-low latency user-plane cyberattack detection in sdn-based smart grids. In Proceedings of the 15th ACM International Conference on Future and Sustainable Energy Systems , e-Energy ’24, pages 676–682, 2024

    work page 2024

  7. [6]

    Lightweight edge authentication for software defined networks

    A Almaini, A Al-Dubai, I Romdhani, M Schramm, and A Alsarhan. Lightweight edge authentication for software defined networks. Computing, 103(2):291–311, 2021

    work page 2021

  8. [7]

    Delegation of authen- tication to the data plane in software-defined networks

    Abdulsalam Almaini, Ahmed Al-Dubai, Imed Romdhani, and Martin Schramm. Delegation of authen- tication to the data plane in software-defined networks. In 2019 IEEE International Conferences on Ubiquitous Computing & Communications (IUCC) and Data Science and Computational Intelligence (DSCI) and Smart Computing, Networking and Services (SmartCNS) , pages 5...

    work page 2019

Show all 82 references
  1. [8]

    Amado, Fernando Pereira, Diogo Pissarra, Salvatore Signorello, Miguel Correia, and Fernando M

    Jo˜ ao R. Amado, Fernando Pereira, Diogo Pissarra, Salvatore Signorello, Miguel Correia, and Fernando M. V. Ramos. Peregrine: Ml-based malicious traffic detection for terabit networks. arXiv preprint arXiv:2403.18788, 2024

    2024 arXiv

  2. [9]

    Pereira, Salvatore Signorello, Miguel Correia, and Fernando Ramos

    Jo˜ ao Romeiras Amado, Fernando C. Pereira, Salvatore Signorello, Miguel Correia, and Fernando Ramos. Poster: In-network ml feature computation for malicious traffic detection. In Proceedings of the ACM SIGCOMM 2023 Conference , pages 1105–1107, 2023

    2023

  3. [10]

    Flowlens: Enabling efficient flow classification for ml-based network security applications

    Diogo Barradas, Nuno Santos, Lu ´ ıs Rodrigues, Salvatore Signorello, Fernando M Ramos, and Andr´ e Madeira. Flowlens: Enabling efficient flow classification for ml-based network security applications. In Proceedings of the 28th Network and Distributed System Security Symposium , 2021

    2021

  4. [11]

    Efficient measurement on pro- grammable switches using probabilistic recirculation

    Ran Ben-Basat, Xiaoqi Chen, Gil Einziger, and Ori Rottenstreich. Efficient measurement on pro- grammable switches using probabilistic recirculation. In 2018 IEEE 26th International Conference on Network Protocols (ICNP), pages 313–323. IEEE, 2018

    2018

  5. [12]

    A real-time attack defense framework for 5g network slicing

    Marielly Bonfim, Maicon Santos, Kelvin Dias, and Sydney Fernandes. A real-time attack defense framework for 5g network slicing. Software: Practice and Experience, 50(10):1756–1775, 2020

    2020

  6. [13]

    P4: Programming protocol-independent packet processors

    Pat Bosshart, Dan Daly, Glen Gibb, Martin Izzard, Nick McKeown, Jennifer Rexford, Cole Schlesinger, Dan Talayco, Amin Vahdat, George Varghese, et al. P4: Programming protocol-independent packet processors. ACM SIGCOMM Computer Communication Review , 44(3):87–95, 2014

    2014

  7. [14]

    Forwarding metamorphosis: Fast programmable match-action processing in hardware for sdn

    Pat Bosshart, Glen Gibb, Hun-Seok Kim, George Varghese, Nick McKeown, Martin Izzard, Fernando Mujica, and Mark Horowitz. Forwarding metamorphosis: Fast programmable match-action processing in hardware for sdn. In Proceedings of the ACM SIGCOMM 2013 conference on SIGCOMM , page...

    2013

  8. [15]

    pforest: In-network inference with random forests

    Christoph Busse-Grawitz, Roland Meier, Alexander Dietm¨ uller, Tobias B¨ uhler, and Laurent Vanbever. pforest: In-network inference with random forests. arXiv preprint arXiv:1909.05680v2 , 2019

    1909 arXiv

  9. [16]

    Cofilter: A high-performance switch-assisted stateful packet filter

    Jiasong Cao, Jun Bi, Yu Zhou, and Cheng Zhang. Cofilter: A high-performance switch-assisted stateful packet filter. In Proceedings of the ACM SIGCOMM 2018 Conference on Posters and Demos , pages 9–11, 2018

    2018

  10. [17]

    Implementing aes encryption on programmable switches via scrambled lookup tables

    Xiaoqi Chen. Implementing aes encryption on programmable switches via scrambled lookup tables. In Proceedings of the Workshop on Secure Programmable Network Infrastructure , pages 8–14, 2020

    2020

  11. [18]

    Measuring tcp round-trip time in the data plane

    Xiaoqi Chen, Hyojoon Kim, Javed M Aman, Willie Chang, Ming Lee, and Jennifer Rexford. Measuring tcp round-trip time in the data plane. In Proceedings of the Workshop on Secure Programmable Network Infrastructure, pages 35–41, 2020

    2020

  12. [19]

    Backorders: Using random forests to detect ddos attacks in programmable data planes

    Bruno Coelho and Alberto Schaeffer-Filho. Backorders: Using random forests to detect ddos attacks in programmable data planes. In EuroP4 ’22, pages 1–7. ACM, 2022

    2022

  13. [20]

    An improved data stream summary: the count-min sketch and its applications

    Graham Cormode and Sairam Muthukrishnan. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms , 55(1):58–75, 2005

    2005

  14. [21]

    Euclid: A fully in-network, p4-based approach for real-time ddos attack detection and miti- gation

    Augusto da Silveira Ilha, ˆAngelo Cardoso Lapolli, Jonatas Adilson Marques, and Luciano Paschoal Gaspary. Euclid: A fully in-network, p4-based approach for real-time ddos attack detection and miti- gation. IEEE Transactions on Network and Service Management , 2020

    2020

  15. [22]

    P4guard: Designing p4 based firewall

    Rupam Datta, Sangheon Choi, Ankur Chowdhary, and Younghee Park. P4guard: Designing p4 based firewall. In MILCOM 2018-2018 IEEE Military Communications Conference (MILCOM) , pages 1–6. IEEE, 2018

    2018

  16. [23]

    In-network volumetric ddos victim identification using programmable commodity switches

    Daniele Ding, Marco Savi, Federico Pederzolli, Mauro Campanella, and Domenico Siracusa. In-network volumetric ddos victim identification using programmable commodity switches. IEEE Transactions on Network and Service Management , 2021

    2021

  17. [24]

    Estimating logarithmic and exponential functions to track network traffic entropy in p4

    Daniele Ding, Marco Savi, and Domenico Siracusa. Estimating logarithmic and exponential functions to track network traffic entropy in p4. In NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium, pages 1–9. IEEE, 2020

    2020

  18. [25]

    Introducing packet-level analysis in programmable data planes to advance network intrusion detection

    Roberto Doriguzzi-Corin, Luis Augusto Dias Knob, Luca Mendozzi, Domenico Siracusa, and Marco Savi. Introducing packet-level analysis in programmable data planes to advance network intrusion detection. Computer Networks , 239:110162, 2024

    2024

  19. [26]

    Wedge 100bf-32x 100gbe data center switch, 2025

    Edge Networks. Wedge 100bf-32x 100gbe data center switch, 2025

    2025

  20. [27]

    Distributed sip ddos defense with p4

    Andreia Febro, Huawei Xiao, and Jonathan Spring. Distributed sip ddos defense with p4. In 2019 IEEE Wireless Communications and Networking Conference (WCNC) , pages 1–8. IEEE, 2019

    2019

  21. [28]

    A learning methodology for line-rate ransomware mitigation with p4 switches

    Karim Friday, Elias Bou-Harb, and Jorge Crichigno. A learning methodology for line-rate ransomware mitigation with p4 switches. In NSS, 2022

    2022

  22. [29]

    Inc: In-network classification of botnet propagation at line rate

    Karim Friday, Elias Kfoury, Elias Bou-Harb, and Jorge Crichigno. Inc: In-network classification of botnet propagation at line rate. In Computer Security – ESORICS , 2022

    2022

  23. [30]

    Comparative evaluation of ip address anti-spoofing mechanisms using a p4/netfpga-based switch

    Hardik Gondaliya, G Chandra Sankaran, and Krishna M Sivalingam. Comparative evaluation of ip address anti-spoofing mechanisms using a p4/netfpga-based switch. In Proceedings of the 3rd P4 Workshop in Europe , pages 1–6, 2020

    2020

  24. [32]

    Why do tree-based models still outperform deep learning on typical tabular data? In NeurIPS 2022 , 2022

    L´ eo Grinsztajn, Edouard Oyallon, and Ga¨ el Varoquaux. Why do tree-based models still outperform deep learning on typical tabular data? In NeurIPS 2022 , 2022

    2022

  25. [33]

    P4-ipsec: Implementation of ipsec gateways in p4 with sdn control for host-to-site scenarios

    Florian Hauser, Michael H¨ aberle, Marco Schmidt, and Michael Menth. P4-ipsec: Implementation of ipsec gateways in p4 with sdn control for host-to-site scenarios. arXiv preprint arXiv:1907.03593 , 2019

    1907 arXiv

  26. [34]

    P4-macsec: Dynamic topology monitoring and data layer protection with macsec in p4-based sdn

    Florian Hauser, Marco Schmidt, Michael H¨ aberle, and Michael Menth. P4-macsec: Dynamic topology monitoring and data layer protection with macsec in p4-based sdn. IEEE Access, 8:58845–58858, 2020

    2020

  27. [35]

    Measuring control plane latency in sdn-enabled switches

    Keqiang He, Junaid Khalid, Aaron Gember-Jacobson, Sourav Das, Chaithan Prakash, Aditya Akella, Li Erran Li, and Marina Thottan. Measuring control plane latency in sdn-enabled switches. In SOSR ’15. ACM, 2015

    2015

  28. [36]

    Deepmatch: practical deep packet inspection in the data plane using network processors

    Jubril Hypolite, John Sonchack, Shlomo Hershkop, Nathan Dautenhahn, Andr´ e DeHon, and Jonathan M Smith. Deepmatch: practical deep packet inspection in the data plane using network processors. In Proceedings of the 16th International Conference on emerging Networking EXperimen...

    2020

  29. [37]

    Ai/ml for network security: The emperor has no clothes

    Arthur S Jacobs, Roman Beltiukov, Walter Willinger, Ronaldo A Ferreira, Arpit Gupta, and Lisandro Z Granville. Ai/ml for network security: The emperor has no clothes. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , pages 1537–1551, 2022

    2022

  30. [38]

    Fast string searching on pisa

    Theo Jepsen, Daniel Alvarez, Nate Foster, Changhoon Kim, Jeongkeun Lee, Masoud Moshref, and Robert Soul´ e. Fast string searching on pisa. In Proceedings of the 2019 ACM Symposium on SDN Research, pages 21–28, 2019

    2019

  31. [39]

    Programmable in-network security for context-aware byod policies

    Qiao Kang, Liang Xue, Adam Morrison, Yuxin Tang, Ang Chen, and Xiapu Luo. Programmable in-network security for context-aware byod policies. In 29th USENIX Security Symposium (USENIX Security 20), pages 595–612, 2020

    2020

  32. [40]

    Dida: Distributed in- network defense architecture against amplified reflection ddos attacks

    Xixi Zheng Khooi, Levente Csikor, Dinil Mon Divakaran, and Min Suk Kang. Dida: Distributed in- network defense architecture against amplified reflection ddos attacks. In 2020 6th IEEE Conference on Network Softwarization (NetSoft) , pages 277–281. IEEE, 2020

    2020

  33. [41]

    Generic external memory for switch data planes

    Daehyeok Kim, Yibo Zhu, Changhoon Kim, Jeongkeun Lee, and Srinivasan Seshan. Generic external memory for switch data planes. In Proceedings of the 17th ACM Workshop on Hot Topics in Networks , pages 1–7, 2018

    2018

  34. [42]

    P4dad: Securing duplicate address detection using p4

    Peng Kuang, Yong Liu, and Liangliang He. P4dad: Securing duplicate address detection using p4. In ICC 2020-2020 IEEE International Conference on Communications (ICC) , pages 1–7. IEEE, 2020

    2020

  35. [43]

    Seek and push: Detecting large traffic aggregates in the dataplane

    Jan Kuˇ cera, Diana Andreea Popescu, Gianni Antichi, Jan Koˇ renek, and Andrew W Moore. Seek and push: Detecting large traffic aggregates in the dataplane. arXiv preprint arXiv:1805.05993 , 2018

    2018 arXiv

  36. [44]

    Offloading real- time ddos attack detection to programmable data planes

    ˆAngelo Cardoso Lapolli, Jonatas Adilson Marques, and Luciano Paschoal Gaspary. Offloading real- time ddos attack detection to programmable data planes. In 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM) , pages 19–27. IEEE, 2019

    2019

  37. [45]

    Defeating protocol abuse with p4: Application to explicit congestion notification

    Abdelali Laraba, J´ erˆ ome Fran¸ cois, Isabelle Chrisment, Shihabur Rahman Chowdhury, and Raouf Boutaba. Defeating protocol abuse with p4: Application to explicit congestion notification. In 2020 IFIP Networking Conference (Networking) , pages 431–439. IEEE, 2020

    2020

  38. [46]

    Switchtree: in-network computing and traffic analyses with random forests

    Jonghwan Lee and Kamaldeep Parmar Singh. Switchtree: in-network computing and traffic analyses with random forests. Neural Computing and Applications , pages 1–12, 2020

    2020

  39. [47]

    Nethcf: Enabling line-rate and adaptive spoofed ip traffic filtering

    Guozhen Li, Mingwei Zhang, Chunming Liu, Xiao Kong, Ang Chen, Guofei Gu, and Haixin Duan. Nethcf: Enabling line-rate and adaptive spoofed ip traffic filtering. In 2019 IEEE 27th International Conference on Network Protocols (ICNP) , pages 1–12. IEEE, 2019

    2019

  40. [48]

    Sdn-based stateful firewall for cloud

    Jia Li, Hui Jiang, Weijia Jiang, Jason Wu, and Wenyuan Du. Sdn-based stateful firewall for cloud. In 2020 IEEE 6th International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing,(HPSC) and IEEE In...

    2020

  41. [49]

    R. Li, Q. Li, Y. Zhang, D. Zhao, X. Xiao, and Y. Jiang. Genos: General in-network unsupervised intrusion detection by rule extraction. In IEEE INFOCOM 2024 - IEEE Conference on Computer Communications, 2024

    2024

  42. [50]

    Enhancing 5g/iot transport security through content permutation

    Yi-Bing Lin, Tsung-Jui Huang, and Sheng-Chen Tsai. Enhancing 5g/iot transport security through content permutation. IEEE Access, 7:94293–94299, 2019

    2019

  43. [51]

    Softwarized iot network immunity against eavesdropping with programmable data planes

    Gang Liu, Wei Quan, Nan Cheng, Dingde Gao, Ning Lu, Hongke Zhang, and Xuemin Shen. Softwarized iot network immunity against eavesdropping with programmable data planes. IEEE Internet of Things Journal, 8(12):9847–9860, 2021

    2021

  44. [52]

    Jaqen: A high-performance switch-native approach for de- tecting and mitigating volumetric ddos attacks with programmable switches

    Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. Jaqen: A high-performance switch-native approach for de- tecting and mitigating volumetric ddos attacks with programmable switches. In 30th USEN...

    2021

  45. [53]

    The real cause of large ddos - ip spoofing, 2018

    Marek Majkowski. The real cause of large ddos - ip spoofing, 2018

    2018

  46. [54]

    Hardware- accelerated cryptography for software-defined networks with p4

    Lukas Malina, David Smekal, Sara Ricci, Jan Hajny, Peter C ´ ıbik, and Jan Hrabovsky. Hardware- accelerated cryptography for software-defined networks with p4. In International Conference on Infor- mation Technology and Communications Security , pages 271–287. Springer, 2020

    2020

  47. [55]

    Openflow: enabling innovation in campus networks

    Nick McKeown, Tom Anderson, Hari Balakrishnan, Guru Parulkar, Larry Peterson, Jennifer Rex- ford, Scott Shenker, and Jonathan Turner. Openflow: enabling innovation in campus networks. ACM SIGCOMM Computer Communication Review , 38(2):69–74, 2008

    2008

  48. [56]

    Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set)

    Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In MilCIS 2015 , 2015

    2015

  49. [57]

    The evaluation of network anomaly detection systems: Statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set.Inf

    Nour Moustafa and Jill Slay. The evaluation of network anomaly detection systems: Statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set.Inf. Sec. J.: A Global Perspective, 25(1–3), 2016

    2016

  50. [58]

    Mitigation of security attacks in the sdn data plane using p4-enabled switches

    N Narayanan, GC Sankaran, and KM Sivalingam. Mitigation of security attacks in the sdn data plane using p4-enabled switches. In 2019 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS), pages 1–6. IEEE, 2019

    2019

  51. [59]

    dh-aes-p4: On-premise encryption and in-band key-exchange in p4 fully programmable data planes

    Isaac Oliveira, Em ´ ıdio Neto, Roger Immich, Ramon Fontes, Augusto Neto, Fabr ´ ıcio Rodriguez, and Christian Esteve Rothenberg. dh-aes-p4: On-premise encryption and in-band key-exchange in p4 fully programmable data planes. In 2021 IEEE Conference on Network Function Virtual...

    2021

  52. [60]

    Line-speed and scalable intrusion detection at the network edge via federated learning

    Qun Qin, Konstantinos Poularakis, Kin K Leung, and Leandros Tassiulas. Line-speed and scalable intrusion detection at the network edge via federated learning. In 2020 IFIP Networking Conference (Networking), pages 352–360. IEEE, 2020

    2020

  53. [61]

    Hardware-accelerated firewall for 5g mobile networks

    R Ricart-Sanchez, P Malagon, JM Alcaraz-Calero, and Q Wang. Hardware-accelerated firewall for 5g mobile networks. In 2018 IEEE 26th International Conference on Network Protocols (ICNP) , pages 446–447. IEEE, 2018

    2018

  54. [62]

    Netfpga-based firewall solution for 5g multi-tenant architectures

    Roberto Ricart-Sanchez, Pedro Malagon, Jose M Alcaraz-Calero, and Qi Wang. Netfpga-based firewall solution for 5g multi-tenant architectures. In 2019 IEEE International Conference on Edge Computing (EDGE), pages 132–136. IEEE, 2019

    2019

  55. [63]

    Cryptographic hashing in p4 data planes

    Dominik Scholz, Andreas Oeldemann, Fabien Geyer, Sebastian Gallenm¨ uller, Henning Stubbe, Thomas Wild, Andreas Herkersdorf, and Georg Carle. Cryptographic hashing in p4 data planes. In 2019 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) ,...

    2019

  56. [64]

    Marina: Realizing ml-driven real-time network traffic monitoring at terabit scale

    Michael Seufert, Konstantin Dietz, Nils Wehner, Steffen Geißler, Julian Sch¨ uler, Maximilian Wolz, An- dreas Hotho, Pedro Casas, Tobias Hoßfeld, and Anja Feldmann. Marina: Realizing ml-driven real-time network traffic monitoring at terabit scale. IEEE Transactions on Network ...

    2024

  57. [65]

    Ghorbani

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In ICISSP 2018 , pages 108–116, 2018

    2018

  58. [66]

    Dropppp: A p4 approach to mitigating dos attacks in sdn

    G¨ urkan Simsek, Hasret Bostan, A Kemal Sarica, Emre Sarikaya, Avincan Keles, Pelin Angin, Hande Alemdar, and Ertan Onur. Dropppp: A p4 approach to mitigating dos attacks in sdn. In International Workshop on Information Security Applications , pages 55–66. Springer, 2019

    2019

  59. [67]

    In-network neural networks

    Giuseppe Siracusano and Roberto Bifulco. In-network neural networks. arXiv preprint arXiv:1801.05731, 2018

    2018 arXiv

  60. [68]

    Heavy-hitter detection entirely in the data plane

    Vibhaalakshmi Sivaraman, Srinivas Narayana, Ori Rottenstreich, S Muthukrishnan, and Jennifer Rex- ford. Heavy-hitter detection entirely in the data plane. In Proceedings of the Symposium on SDN Research, pages 164–176, 2017

    2017

  61. [69]

    A fast and compact invertible sketch for network-wide heavy flow detection

    Lingjun Tang, Qun Huang, and Patrick PC Lee. A fast and compact invertible sketch for network-wide heavy flow detection. IEEE/ACM Transactions on Networking , 28(5):2350–2363, 2020

    2020

  62. [70]

    Ghorbani

    Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A. Ghorbani. A detailed analysis of the kdd cup 99 data set. In 2009 IEEE CISDA , 2009

    2009

  63. [71]

    P4 16 portable switch architecture (psa), 2024

    The P4.org Architecture Working Group. P4 16 portable switch architecture (psa), 2024

    2024

  64. [72]

    G. Xie, Q. Li, Y. Dong, G. Duan, Y. Jiang, and J. Duan. Mousika: Enable general in-network intelli- gence in programmable switches by knowledge distillation. In IEEE INFOCOM 2022, pages 1938–1947, 2022

    2022

  65. [73]

    Soter: Deep learning enhanced in-network attack detection based on programmable switches

    Guang Xie, Qing Li, Chao Cui, Peng Zhu, Dehua Zhao, Wen Shi, Zuqing Qi, Yanwei Jiang, and Xiaobo Xiao. Soter: Deep learning enhanced in-network attack detection based on programmable switches. In 2022 41st International Symposium on Reliable Distributed Systems , 2022

    2022

  66. [74]

    Netwarden: Mitigating network covert channels while preserving performance

    Jiarong Xing, Qiao Kang, and Ang Chen. Netwarden: Mitigating network covert channels while preserving performance. In 29th USENIX Security Symposium (USENIX Security 20) , pages 2039– 2056, 2020

    2020

  67. [75]

    Architecting programmable data plane defenses into the network with fastflex

    Jiarong Xing, Wenqing Wu, and Ang Chen. Architecting programmable data plane defenses into the network with fastflex. In Proceedings of the 18th ACM Workshop on Hot Topics in Networks , pages 161–169, 2019

    2019

  68. [76]

    Do switches dream of machine learning? toward in-network classi- fication

    Zhaoqi Xiong and Noa Zilberman. Do switches dream of machine learning? toward in-network classi- fication. In HotNets 2019 , pages 25–33. ACM, 2019

    2019

  69. [77]

    P4knocking: Offloading host-based firewall functionalities to the network

    Elisa Ordo˜ nez Zaballa, Daniel Franco, Zhou Zhou, and Michael S Berger. P4knocking: Offloading host-based firewall functionalities to the network. In 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN) , pages 7–12. IEEE, 2020

    2020

  70. [78]

    Bolt: Bridging the gap between software and hardware for stateful and efficient network functions

    Menghao Zhang, Chen Li, Yuwei Zhang, Yang Xiang, Zhenyu Wu, and Hai Jin. Bolt: Bridging the gap between software and hardware for stateful and efficient network functions. In IEEE INFOCOM 2021 - IEEE Conference on Computer Communications , 2021

    2021

  71. [79]

    Poseidon: Mitigating volumetric ddos attacks with programmable switches

    Mingwei Zhang, Guozhen Li, Shangqing Wang, Chunming Liu, Ang Chen, Haoyu Hu, Guofei Gu, Qi Li, Minglong Xu, and Jianping Wu. Poseidon: Mitigating volumetric ddos attacks with programmable switches. In Network and Distributed System Security Symposium , 2020

    2020

  72. [80]

    pheavy: Predicting heavy flows in the pro- grammable data plane

    Xiang Zhang, Lin Cui, Fung Po Tso, and Weijia Jia. pheavy: Predicting heavy flows in the pro- grammable data plane. IEEE Trans. Netw. Serv. Manag. , 18(4):4353–4364, 2021

    2021

  73. [81]

    Planter: Seeding trees within switches

    Cheng Zheng and Noa Zilberman. Planter: Seeding trees within switches. In SIGCOMM ’21 Poster and Demo Sessions , pages 12–14. ACM, 2021

    2021

  74. [82]

    An efficient design of intelligent network data plane

    Guangmeng Zhou, Zhongxin Liu, Chengjie Fu, Qing Li, and Ke Xu. An efficient design of intelligent network data plane. In USENIX Security 23 , 2023. Author Biographies Gursimran Singh is a PhD candidate at Rochester Institute of Technology. His research focus is on network secu...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.