SketchFeature In-Network Flow Feature Extraction
SketchFeature: High-Quality Per-Flow Feature Extractor Towards Security-Aware Data Plane
topic/papercomputer science/securitycomputer science/networking
Paper Summary | NDSS 2025 | Generated by Hermes Agent
Executive Summary: SketchFeature enables in-network ML-based attack detection on programmable data planes. It addresses the critical bottleneck of per-flow feature extraction — extracting high-quality features from network flows at line rate without overwhelming switch resources. Using sketch data structures on P4-programmable switches, SketchFeature computes 1st-order and 2nd-order per-flow features for downstream ML-based security classification.
1. High-Level Overview
Intelligent Network Data Planes (INDPs) promise in-network security — detecting DDoS, port scans, and anomalies at the switch before traffic reaches the server. But the bottleneck is feature extraction: computing per-flow statistics (packet counts, size distributions, inter-arrival times) at line rate is computationally expensive.
2. Core Innovation
- Sketch-based feature extraction — uses probabilistic sketch data structures (Count-Min, etc.) that fit in switch TCAM/SRAM
- 2nd-order features — goes beyond simple packet counts to compute burst density, variance, and other ML-useful features
- P4-programmable — runs on commodity programmable switches (Tofino, etc.)
- Security-aware — features optimized for security classification, not just traffic engineering
3. Key Contributions
- Demonstrates that prior approaches using only 1st-order per-packet features are insufficient for accurate security classification
- Novel sketch design capturing both statistical moments and temporal patterns
- Evaluation showing improved detection accuracy vs. baseline in-network approaches
- Maintains line-rate performance (no throughput degradation)
4. TL;DR
SketchFeature puts ML-quality per-flow feature extraction directly onto programmable switch data planes, enabling real-time in-network attack detection without server-side overhead.
Sources
- Authors: Sian Kim (Ewha), Seyed Mirnajafizadeh (Wayne State), Bara Kim (Korea Univ), Rhongho Jang (Wayne State), DaeHun Nyang (Ewha)