immUNITY: 利用可编程交换机和智能网络接口卡检测和缓解低流量及缓慢攻击
immUNITY: Detecting and Mitigating Low Volume & Slow Attacks with Programmable Switches and SmartNICs
AI总结：
本文提出一种利用可编程交换机和智能网络接口卡检测低流量及缓慢攻击的方法，通过高效过滤结构快速路由良性流量，并结合机器学习和入侵检测规则识别恶意源IP，最终实现高精度的攻击缓解。
摘要：
我们的分析表明，最近的互联网追踪显示，多达71%的流量包含可疑行为，这些行为可能指示低流量网络攻击，如端口扫描。然而，实时区分异常流量具有挑战性，因为每个攻击流可能只包含几个数据包。我们扩展了先前工作，通过结合交换机和SmartNIC的能力来检测低流量和缓慢攻击。我们翻转了通常的设计方法，提出了一种高效的过滤数据结构，用于快速将标记为良性流量路由到目标终端系统。我们精心利用有限的可编程交换机内存和流水线阶段，并补充SmartNIC资源来分析可能异常的剩余流量。使用部署在SmartNIC上的机器学习分类器和入侵检测规则，我们识别出恶意源IP，然后进行更深入的取证分析以实现攻击缓解。最后，我们开发了一种数据平面协议，以快速协调这些设备之间的数据结构更新。我们在一个包含Tofino v1交换机和Bluefield 3 SmartNIC的测试床中实现了immUNITY，展示了其高精度，同时最小化了在交换机外分析的流量。
英文摘要：
Our analysis of recent Internet traces shows that up to 71% of flows contain suspicious behaviors indicative of low-volume network attacks such as port scans. However, distinguishing anomalous traffic in real time is challenging as each attack flow may comprise only a few packets. We extend prior work that tracks heavy hitter flows to also detect low-volume and slow attacks by combining the capabilities of both switches and SmartNICs. We flip the usual design approach by proposing an efficient filter data structure used to quickly route traffic marked as benign towards destination end-systems. We make careful use of limited programmable switch memory and pipeline stages, and complement them with SmartNIC resources to analyze the remaining traffic that may be anomalous. Using machine learning classifiers and intrusion detection rules deployed on the SmartNIC, we identify malicious source IPs, which then undergo more detailed forensics for attack mitigation. Finally, we develop a dataplane based protocol to rapidly coordinate data structure updates between these devices. We implement immUNITY in a testbed with Tofino v1 switch and Bluefield 3 SmartNIC, demonstrating its high accuracy, while minimizing traffic that's analyzed outside the switch.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
