Peregrine: ML-based Malicious Traffic Detection for Terabit Networks
CoRR(2024)
摘要
Malicious traffic detectors leveraging machine learning (ML), namely those
incorporating deep learning techniques, exhibit impressive detection
capabilities across multiple attacks. However, their effectiveness becomes
compromised when deployed in networks handling Terabit-speed traffic. In
practice, these systems require substantial traffic sampling to reconcile the
high data plane packet rates with the comparatively slower processing speeds of
ML detection. As sampling significantly reduces traffic observability, it
fundamentally undermines their detection capability.
We present Peregrine, an ML-based malicious traffic detector for Terabit
networks. The key idea is to run the detection process partially in the network
data plane. Specifically, we offload the detector's ML feature computation to a
commodity switch. The Peregrine switch processes a diversity of features
per-packet, at Tbps line rates - three orders of magnitude higher than the
fastest detector - to feed the ML-based component in the control plane. Our
offloading approach presents a distinct advantage. While, in practice, current
systems sample raw traffic, in Peregrine sampling occurs after feature
computation. This essential trait enables computing features over all traffic,
significantly enhancing detection performance. The Peregrine detector is not
only effective for Terabit networks, but it is also energy- and cost-efficient.
Further, by shifting a compute-heavy component to the switch, it saves precious
CPU cycles and improves detection throughput.
更多查看译文
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要