REVIEW 5 cited by
pForest: In-Network Inference with Random Forests
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
When classifying network traffic, a key challenge is deciding when to perform the classification, i.e., after how many packets. Too early, and the decision basis is too thin to classify a flow confidently; too late, and the tardy labeling delays crucial actions (e.g., shutting down an attack) and invests computational resources for too long (e.g., tracking and storing features). Moreover, the optimal decision timing varies across flows. We present pForest, a system for "As Soon As Possible" (ASAP) in-network classification according to supervised machine learning models on top of programmable data planes. pForest automatically classifies each flow as soon as its label is sufficiently established, not sooner, not later. A key challenge behind pForest is finding a strategy for dynamically adapting the features and the classification logic during the lifetime of a flow. pForest solves this problem by: (i) training random forest models tailored to different phases of a flow; and (ii) dynamically switching between these models in real time, on a per-packet basis. pForest models are tuned to fit the constraints of programmable switches (e.g., no floating points, no loops, and limited memory) while providing a high accuracy. We implemented a prototype of pForest in Python (training) and P4 (inference). Our evaluation shows that pForest can classify traffic ASAP for hundreds of thousands of flows, with a classification score that is on-par with software-based solutions.
Forward citations
Cited by 5 Pith papers
-
SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate
SpliDT partitions decision trees into subtrees, processes flows in windows, and reuses switch registers via recirculation, supporting up to 5x more stateful features than NetBeacon and Leo with higher F1 at similar fl...
-
RIGEL: Real-time Optical Anomaly Diagnosis with Stateful In-Network Inference based on Distributed On-switch GNNs
A fully in-network AE-GraphSAGE pipeline on Tofino switches detects and locates optical soft failures with F1 above 98% while cutting control-plane bandwidth by two to three orders of magnitude.
-
Cruise Control: Dynamic Model Selection for ML-Based Network Traffic Analysis
A DPDK-based system dynamically swaps ML models and feature sets for network traffic analysis, using NIC packet-loss counters as a lightweight overload signal, and reports lower loss and comparable or higher median ac...
-
Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection
BGAN-augmented TabTransformer improves Macro-F1 on CICIDS2017 from 82.96% to 86.50%, but the reported adversarial robustness gains are self-referential because the test uses the same BGAN samples used for training.
-
Programmable Data Planes for Network Security
Programmable P4 switches can support a broad range of line-rate security functions, from DDoS defense and firewalls to limited cryptography and machine-learning inference, via techniques such as recirculate-and-trunca...
Discussion (0). Continue with ORCID to comment.