FSNIC: A Low-Latency Flow-Based Intrusion Detection Architecture for FPGA SmartNICs

2026-09-14

AI Summary

本文提出了一种基于FPGA智能网卡的低延迟流式入侵检测架构FSNIC，通过结合P4解析和RTL实现的LogicNets模型，提高了检测精度并降低了延迟。

Abstract

Modern data centres require high-performance networking alongside effective real-time security. Traditional Intrusion Detection Systems (IDS) commonly rely on general-purpose processors and often struggle to inspect high-speed traffic at line rate without introducing latency or performance bottlenecks. Smart Network Interface Cards (NICs) provide an alternative by enabling computation directly within the network data plane. This work presents a machine learning-based IDS implemented within an FPGA-based SmartNIC pipeline. The system integrates P4-based packet parsing with a LogicNets IDS model implemented in RTL, enabling deterministic, low-latency inference. Compared with traditional stateless packet-level classifiers, the proposed stateful flow-based IDS introduces minimal state by aggregating features across packets, capturing behavioural patterns not observable at the packet level. Experimental results on the UNSW-NB15 dataset show that the flow-based IDS improves detection accuracy from 86.92\% to 97.68\% compared with stateless packet-level classification. We also evaluate the proposed IDS on CICIDS2017 and compare its real-time hardware performance with prior FPGA-based IDS designs. Through hardware-software co-design, the proposed IDS achieves 6~ns inference latency using only 846 LUTs, with no BRAM or DSP usage, demonstrating a low latency and resource efficient implementation.

Problem

• Intrusion Detection System
• FPGA SmartNICs
• low-latency
• flow-based
• high-speed traffic

Innovation

• FPGA SmartNIC
• flow-based IDS
• P4 packet parsing
• low-latency inference
• hardware-software co-design