← 研踪 PaperTrailarXiv:2403.18788 · v2
Where to Sample: Rethinking ML-Based Malicious Traffic Detection at Terabit Scale
首次提交 2024-03-28 01:33
版本更新 2026-10-27 19:15
雷达观测 2026-10-29 00:35
摘要
Machine Learning (ML)-based malicious traffic detectors can identify unseen attacks, including in encrypted traffic, but scaling them to Terabit rates remains challenging. Packet sampling, commonly used to meet processing limits, can discard essential behavioral information and render detection ineffective. We present Peregrine, a hardware-software co-designed architecture built around a simple principle: compute features before sampling. Peregrine updates ML features over all traffic at line rate in a programmable switch, then downsamples the feature records sent to software inference. We instantiate this design with two detectors that impose distinct feature-computation requirements on the switch. Across 84 attack traces from three datasets, we show that approximate features computed over all packets can outperform exact features computed from sampled packets. In our evaluation, Peregrine preserves detection effectiveness while reducing feature-record rates by three orders of magnitude - even where pre-feature sampling causes detection to collapse.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-10-27 19:15 · 最新观测版本
Where to Sample: Rethinking ML-Based Malicious Traffic Detection at Terabit Scale
Machine Learning (ML)-based malicious traffic detectors can identify unseen attacks, including in encrypted traffic, but scaling them to Terabit rates remains challenging. Packet sampling, commonly used to meet processing limits, can discard essential behavioral information and render detection ineffective. We present Peregrine, a hardware-software co-designed architecture built around a simple principle: compute features before sampling. Peregrine updates ML features over all traffic at line rate in a programmable switch, then downsamples the feature records sent to software inference. We instantiate this design with two detectors that impose distinct feature-computation requirements on the switch. Across 84 attack traces from three datasets, we show that approximate features computed over all packets can outperform exact features computed from sampled packets. In our evaluation, Peregrine preserves detection effectiveness while reducing feature-record rates by three orders of magnitude - even where pre-feature sampling causes detection to collapse.
查看此版本解读 →查看此版本原文 ↗