Source-linked AI summary
FSNIC: A Low-Latency Flow-Based Intrusion Detection Architecture for FPGA SmartNICs
Nise O'Cuill, Changhong Li, Georgios Floros, Shreejith Shanker
TL;DR
SmartNIC IDS can reduce reliance on host processing, but existing approaches struggle to combine temporal behavior with deterministic, hardware-efficient execution. This paper adds lightweight flow aggregation to a P4-based SmartNIC pipeline with LogicNets inference. The flow-based approach improves detection performance on UNSW-NB15 and maintains strong classification across both evaluated datasets, with deterministic low-latency execution and low FPGA resource use.
Problem
Existing IDS approaches struggle to combine temporal traffic context for detecting behavior across packets with deterministic, hardware-efficient SmartNIC execution.
Source: §I · p. 1Method
The paper combines P4-based parsing and lightweight temporal flow aggregation with LogicNets inference in a programmable SmartNIC data path.
Source: §I · p. 1Results
Temporal aggregation improves detection performance on UNSW-NB15 while classification remains strong across UNSW-NB15 and CICIDS2017, with deterministic low-latency execution and low FPGA resource use.
Source: §I · pp. 1–2Takeaways & Limitations
The authors describe the flow-based architecture as suitable for resource-constrained SmartNIC deployment and cross-dataset evaluation.
Source: §IV · p. 4
Abstract
from arXiv · showhide
Modern data centres require high-performance networking alongside effective real-time security. Traditional Intrusion Detection Systems (IDS) commonly rely on general-purpose processors and often struggle to inspect high-speed traffic at line rate without introducing latency or performance bottlenecks. Smart Network Interface Cards (NICs) provide an alternative by enabling computation directly within the network data plane. This work presents a machine learning-based IDS implemented within an FPGA-based SmartNIC pipeline. The system integrates P4-based packet parsing with a LogicNets IDS model implemented in RTL, enabling deterministic, low-latency inference. Compared with traditional stateless packet-level classifiers, the proposed stateful flow-based IDS introduces minimal state by aggregating features across packets, capturing behavioural patterns not observable at the packet level. Experimental results on the UNSW-NB15 dataset show that the flow-based IDS improves detection accuracy from 86.92\% to 97.68\% compared with stateless packet-level classification. We also evaluate the proposed IDS on CICIDS2017 and compare its real-time hardware performance with prior FPGA-based IDS designs. Through hardware-software co-design, the proposed IDS achieves 6~ns inference latency using only 846 LUTs, with no BRAM or DSP usage, demonstrating a low latency and resource efficient implementation.
I. INTRODUCTION
The introduction frames SmartNIC IDS as a way to process traffic with lower host overhead, but argues that existing approaches struggle to combine behavioral context with deterministic, hardware-efficient execution. The paper proposes lightweight flow aggregation with LogicNets inference and evaluates it across UNSW-NB15 and CICIDS2017.
I. INTRODUCTION
- Existing software IDS can capture temporal traffic behavior with LSTMs, but their sequential dependencies and variable latency are difficult to accommodate on FPGA SmartNICs.Source: §I · p. 1
- Stateless data-plane IDS can meet latency requirements but lack flow context, while many attacks emerge across packet sequences.The introduction describes this as a trade-off between detection capability and deterministic, hardware-efficient deployment.Source: §I · p. 1
- The proposed architecture combines lightweight temporal aggregation in the data plane with LogicNets inference for programmable SmartNIC deployment.Source: §I · p. 1
- A packet reconstruction pipeline derives temporally ordered flow-window representations from UNSW-NB15 and CICIDS2017 PCAP traces for programmable data-plane evaluation.Source: §I · p. 1
- Evaluation on UNSW-NB15 and CICIDS2017 shows lightweight temporal feature aggregation improves detection performance on UNSW-NB15 and maintains strong classification performance across both datasets, with deterministic low latency execution and low FPGA resource utilisation.Source: §I · pp. 1–2
A. Overall SmartNIC IDS Framework
The framework contrasts host-based software IDS and packet-level SmartNIC classification with a flow-based path that adds short-term temporal context. The proposed path aggregates eight packets and reuses each flow's cached verdict.
A. Overall SmartNIC IDS Framework
- The conventional software workflow sends packets from the NIC to the CPU across PCIe for feature extraction and classification, requiring host intervention and data movement.The passage notes that this can become a bottleneck for line-rate detection.Source: A. Overall SmartNIC IDS Framework · p. 2
- The SmartNIC pipeline moves parsing, feature extraction, classification, and flow-control updates into the data path, avoiding host intervention and PCIe data movement.P4 parsing feeds decision logic that can forward, drop, mark, or pass traffic to the host.Source: A. Overall SmartNIC IDS Framework · p. 2
- The packet-level path classifies each packet independently from a 76-bit feature vector, so it cannot directly capture behavior across packets in a flow.Source: A. Overall SmartNIC IDS Framework · p. 2
- The flow-based path groups eight consecutive packets, forms a 77-bit feature vector from packet counts, length statistics, direction, and TCP flags, then caches the verdict for later packets.Eight packets are a proof-of-concept choice; the architecture can be extended to larger windows.Source: A. Overall SmartNIC IDS Framework · p. 2
B. P4-Compatible Stateful Flow Feature Construction
The P4 parser extracts deterministic header fields and associates packets with flow state, enabling a compact temporal representation without payload inspection. The classifier receives accumulated flow statistics rather than an isolated packet vector.
B. P4-Compatible Stateful Flow Feature Construction
- The P4 parser extracts Ethernet, IPv4, and TCP/UDP headers while ignoring payload to preserve line-rate processing.The extracted fields are deterministic header fields, without payload inspection or software-side flow reconstruction.Source: B. P4-Compatible Stateful Flow Feature… · p. 2
- The packet-level baseline independently represents each packet with a 76-bit vector of header features, so it cannot observe how a flow evolves across packets.Source: B. P4-Compatible Stateful Flow Feature… · p. 2
- Packets are associated with flows using a five-tuple key, then compressed into 34-bit metadata for flow-state indexing and accumulator updates.The metadata contains flow ID, packet length, protocol, direction, and TCP flags.Source: B. P4-Compatible Stateful Flow Feature… · p. 2
- For each flow, the RTL accumulator updates packet count, total, minimum, maximum, and mean length, forward and reverse packet counts, and TCP flag counters across eight packets.Source: B. P4-Compatible Stateful Flow Feature… · p. 2
- The proposed classifier receives a 77-bit accumulated flow vector representing short-term behavior across an eight-packet window, unlike the 76-bit single-packet baseline.The accumulated features include packet and length statistics, direction counts, and SYN, ACK, RST, and FIN counters.Source: B. P4-Compatible Stateful Flow Feature… · p. 2
C. SmartNIC Coupled Flow-Level IDS Architecture
The SmartNIC architecture keeps per-flow state alongside the packet path and feeds aggregated vectors to a LogicNets inference engine. The verdict is returned to the pipeline and cached for subsequent packets of the same flow.
C. SmartNIC Coupled Flow-Level IDS Architecture
- Packets from the same flow are accumulated in FIFO-based shift-register logic parallel to the data path, and the verdict is cached for subsequent packets.The latest eight-packet aggregate is forwarded to the IDS engine.Source: C. SmartNIC Coupled Flow-Level IDS… · p. 2
- Temporal aggregation captures directional traffic patterns, packet-size variation, and TCP flag distributions without significant hardware overhead.Source: C. SmartNIC Coupled Flow-Level IDS… · p. 3
- The LogicNets classifier uses quantised activations and sparse connectivity, then maps to layer-wise RTL blocks with pipeline registers between layers.The model uses 1-bit inputs, 2-bit hidden and output activations, and fixed input degree γ = 7; the register-based pipeline avoids FIFO inter-layer buffering and reduces inference latency.Source: C. SmartNIC Coupled Flow-Level IDS… · p. 3
- The IDS result returns through AXI4 for downstream packet processing, and the cached verdict overlaps inference with packet reception.The passage describes drop/tag processing and compilation with AMD Vitis/Vivado tools.Source: C. SmartNIC Coupled Flow-Level IDS… · p. 3
A. Experimental Setup
The evaluation uses an Alveo U280 FPGA target and reconstructed UNSW-NB15 and CICIDS2017 traces with RTL simulation, rather than live traffic on a deployed SmartNIC.
A. Experimental Setup
- The IDS engine’s reported 500 MHz frequency is from out-of-context implementation; a complete SmartNIC’s operating frequency depends on its platform and data-path infrastructure.The implementation targets an Alveo U280 FPGA.Source: A. Experimental Setup · p. 3
- The reported evaluation materials include an UNSW-NB15 architecture comparison, cross-dataset flow-based IDS evaluation, and hierarchical resource-utilisation reporting.These scopes are identified by Fig. 3 and Tables I–II.Source: Figure 3 · p. 3, Table I · p. 3, Table II · p. 3
- Evaluation uses reconstructed packet traces from UNSW-NB15 and CICIDS2017 with RTL simulation, not live traffic on a deployed SmartNIC.Full board-level validation under live traffic is proposed for future work.Source: A. Experimental Setup · p. 3
B. Flow-based IDS Performance
On UNSW-NB15, the flow-based IDS outperforms stateless and hybrid architectures in accuracy and F1 score; evaluations also cover CICIDS2017, where false negatives remain a concern.
B. Flow-based IDS Performance
- The flow-based architecture’s accuracy and F1 score significantly outperform stateless packet-level and hybrid approaches on UNSW-NB15.It aggregates temporal features across eight sequential packets; the packet-level architecture has slightly lower false-positive rates.Source: B. Flow-based IDS Performance · p. 3
- The P4 flow-feature pipeline shows strong flow-window classification performance on both UNSW-NB15 and CICIDS2017, with higher precision and TNR on CICIDS2017.The evaluation supports applicability beyond a single benchmark.Source: B. Flow-based IDS Performance · p. 3
- The paper’s comparison with prior FPGA-based IDS designs is benchmarked on UNSW-NB15 and CICIDS2017.Table III is identified as a comparison of FPGA-based IDS implementations.Source: Table III · p. 4
- The IDS produces 38 false negatives on UNSW-NB15 and 223 on CICIDS2017, corresponding to false-negative rates of 1.49% and 7.14%, respectively.The authors identify attack recall as a target for further optimisation because selected flow statistics capture some attack behaviours less consistently on CICIDS2017.Source: B. Flow-based IDS Performance · p. 4
C. Comparison with Prior Work
The proposed LogicNets-based design is reported to use less hardware and achieve lower inference latency than FINN-based configurations, though implementation differences qualify direct comparisons.
C. Comparison with Prior Work
- The proposed model has a substantially smaller hardware footprint and lower inference latency than FINN-based configurations,, while direct comparison is affected by implementation differences.The authors cite differences in model architecture, operating frequency, feature extraction, and implementation methodology.Source: C. Comparison with Prior Work · p. 4
- Earlier BNN accelerators [8],, achieved low resource use and nanosecond-level latency, but aggressive binarisation can limit model capacity on complex traffic datasets.Their UNSW-NB15 validation usually uses pre-binarised datasets, and most use offline feature extraction and evaluation.Source: C. Comparison with Prior Work · p. 4
- FINN-based work progressed from on-chip flow-bucket feature extraction to raw-packet feature extraction and multiple feature-dimensionality configurations.The paper states that higher precision and raw-packet flow analysis in these designs increase latency and resource use.Source: C. Comparison with Prior Work · p. 4
IV. CONCLUSION
The conclusion presents a SmartNIC-coupled flow-based IDS that uses lightweight temporal aggregation to retain behavioural context with deterministic low-latency inference and low FPGA resource use.
IV. CONCLUSION
- The proposed flow-based IDS is tightly coupled with the SmartNIC data path and uses lightweight temporal aggregation.The aggregation supports behavioural intrusion detection while maintaining deterministic low-latency inference and very low FPGA resource utilisation.Source: §IV · p. 4
- The authors describe the architecture as suitable for resource-constrained SmartNIC deployment and cross-dataset evaluation.The conclusion refers to detection using raw packets.Source: §IV · p. 4
- Future work includes board-level evaluation under live traffic and high flow-churn conditions, and extending the framework toward a SmartNIC-coupled Intrusion Prevention System.Source: §IV · p. 4