Towards detecting DoS attacks in the server's NIC#

Adrián Lara (Universidad de Costa Rica), Juan Felipe Botero (Universidad de Antioquia)

• Why: Sits at the intersection of two of the PM's core interests — network security and datapath internals — by moving DoS detection off CPUs and IDS appliances into the server's NIC dataplane, with an eBPF/XDP variant that is broadly deployable.
• What: Research on embedding ML-based DoS detection in SmartNICs to eliminate the two classic IDS deployment problems: traffic duplication (mirroring) and bottlenecks. Measured results on a Netronome SmartNIC show the ML model adds only a slight shift to the detection-delay distribution with low dispersion — inference at line rate with near-negligible overhead. A companion case applies the same idea with XDP + eBPF and model quantization (16/8/4/2-bit): all quantized models show median inference latency around 0.2 μs.
• How: Strict role split — the CPU/control plane manages global policy, model updates and exceptions; the SmartNIC dataplane does per-packet feature extraction, filtering and inference. Simple models (decision trees) are compiled into P4 match-action tables (each branch becomes a table entry over feature ranges); quantization fits models into NIC memory; the NIC exports features so the CPU can (re)train. Malicious traffic is dropped before it reaches the OS.
• Where applicable: Host-granularity DoS defense and edge microsegmentation. The P4 path requires programmable SmartNICs (demonstrated on Netronome); the eBPF/XDP variant runs on ordinary Linux hosts. Research-stage, but the architecture and quantization findings transfer directly.