Abstract:Programmable data planes offer precise control over the low-level processing steps applied to network packets, serving as a valuable tool for analysing malicious flows in the field of intrusion detection. Albeit with limitations on physical resources and capabilities, they allow for the efficient extraction of detailed traffic information, which can then be utilised by Machine Learning (ML) algorithms responsible for identifying security threats. In addressing resource constraints, existing solutions in the literature rely on compressing network data through the collection of statistical traffic features in the data plane. While this compression saves memory resources in switches and minimises the burden on the control channel between the data and the control plane, it also results in a loss of information available to the Network Intrusion Detection System (NIDS), limiting access to packet payload, categorical features, and the semantic understanding of network communications, such as the behaviour of packets within traffic flows. This paper proposes P4DDLe, a framework that exploits the flexibility of P4-based programmable data planes for packet-level feature extraction and pre-processing. P4DDLe leverages the programmable data plane to extract raw packet features from the network traffic, categorical features included, and to organise them in a way that the semantics of traffic flows are preserved. To minimise memory and control channel overheads, P4DDLe selectively processes and filters packet-level data, so that only the features required by the NIDS are collected. The experimental evaluation with recent Distributed Denial of Service (DDoS) attack data demonstrates that the proposed approach is very efficient in collecting compact and high-quality representations of network flows, ensuring precise detection of DDoS attacks.

dh-aes-p4: On-premise encryption and in-band key-exchange in P4 fully programmable data planes

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

A review on P4-Programmable data planes: Architecture, research efforts, and future directions

Architecture of SDN Applications Based on Software Defined Price

P4SC: A High Performance and Flexible Framework for Service Function Chain

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Anti-DDoS Attacks Strategy of SDN Data Plane with Data Augmentation Based on P4

A Review of P4 Programmable Data Planes for Network Security

A Survey on P4 Challenges in Software Defined Networks: P4 Programming

Advancing SDN from OpenFlow to P4: A Survey

Encryption of Sensitive Data Flow Information in Hybrid Networks with P4

Enhancing 5G SDN/NFV Edge with P4 Data Plane Programmability

A P4 Data Plane for the Quantum Internet

P4-MACsec: Dynamic Topology Monitoring and Data Layer Protection with MACsec in P4-SDN

P4-ONIDS: A P4-based NIDS optimized for constrained programmable data planes in SDN

A survey on data plane programming with P4: Fundamentals, advances, and applied research

Software-Defined Network (SDN) Data Plane Security: Issues, Solutions and Future Directions

P4BFT: Hardware-Accelerated Byzantine-Resilient Network Control Plane

SDPA: Toward a Stateful Data Plane in Software-Defined Networking

SDN Oriented Software-Defined Security Architecture

Introducing Packet-Level Analysis in Programmable Data Planes to Advance Network Intrusion Detection