Skip to content

Achieving High-Speed and Robust Encrypted Traffic Anomaly Detection with Programmable Switches (Mazu)#

SIGCOMM 2025 digest Program Core pick Coimbra · 8–11 September 2025

Abstract Paper Recording

Han Zhang et al. (Tsinghua, Peking U., Sangfor, China Telecom)

Play the recording: Achieving High-Speed and Robust Encrypted Traffic Anomaly Detection with Programmable Switches (Mazu)

Why: Inline line-rate NIDS for encrypted traffic is a core network-security capability, and this one is production-proven across two ISPs over two years.

What: An inline switch-based IDS detecting malicious traffic at ~90% accuracy within minutes, having caught 10+ critical attack events protecting 10M+ servers.

How: A dual-plane feature-extraction model at near line speed plus a one-class classifier trained only on benign traffic, with an online update mechanism for drift.

Where applicable: ISP/data-center-edge deployment on programmable switches; benign-only training is a sensible general answer to label scarcity.