 ICACT20260019 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Evaluating Classical Machine Learning Classifiers for Real-Time Intrusion Detection on SmartNICs
A Hardware-Aware Evaluation for Real-Time Deployment
|
| ICACT20260019 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Real-World Failure Scenario in High-Speed Networks
Modern data centers and backbone networks routinely handle traffic rates exceeding one hundred gigabits per second, where packet inspection must be performed under strict latency constraints.
When intrusion detection systems rely on host CPUs, the associated computational overhead can quickly lead to CPU overload, resulting in delayed or missed detection of malicious traffic.
In such environments, delayed intrusion detection allows attacks to complete before any effective mitigation can occur.
|
| ICACT20260019 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Traditional intrusion detection systems process packets on host CPUs, requiring traffic to traverse the full network stack before any security decision is made.
This control-plane–centric design introduces processing bottlenecks under high traffic rates and strict latency constraints.
Smart network interface cards enable programmable data-plane processing, allowing security decisions to be made directly at the network interface.
|
| ICACT20260019 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Most intrusion detection studies evaluate models primarily based on classification accuracy.
Such evaluations largely ignore whether these models can operate under the computational and resource constraints of network hardware.
Consequently, many high-accuracy IDS models remain impractical for real-time deployment on SmartNIC platforms.
|
| ICACT20260019 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We consider a binary intrusion detection problem, where each network flow is classified as either benign or malicious.
The detection pipeline must operate under strict real-time constraints, with end-to-end inference latency below 1 millisecond.
The target deployment platform provides limited compute cores and memory, requiring lightweight and hardware-feasible models.
|
| ICACT20260019 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Deep learning models often exhibit variable inference latency due to complex architectures and dynamic execution paths.
Such models typically require substantial memory and computational resources, which are constrained on SmartNIC platforms.
Moreover, deep learning inference can be non-deterministic, making it difficult to guarantee strict real-time performance.
|
| ICACT20260019 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We use the NSL-KDD dataset as a standardized and well-balanced benchmark for intrusion detection research.
To align with real-time SmartNIC constraints, the multi-class labels are simplified into a binary classification task: benign versus malicious.
This controlled setup enables a fair comparison of models while isolating the impact of hardware-aware design choices.
|
| ICACT20260019 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Figure 1 illustrates the end-to-end machine learning pipeline used in this work. While the structure follows a standard ML workflow, each stage is designed with SmartNIC deployment constraints in mind, particularly during feature selection and inference. This ensures that the pipeline remains compatible with strict latency and resource limitations.
|
| ICACT20260019 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Categorical features are transformed using one-hot encoding to enable efficient numerical processing by classical machine learning models.
Feature correlation analysis is applied to remove redundant attributes, reducing the feature space from 41 to 35 dimensions.
This reduction minimizes computational overhead and improves inference latency under SmartNIC constraints.
|
| ICACT20260019 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Decision Tree (DT) is selected for its ultra-fast and deterministic inference, making it suitable for strict latency constraints on SmartNICs.
Random Forest (RF) provides a balanced trade-off between detection accuracy and computational cost, offering robust performance under moderate resource constraints.
K-Nearest Neighbors (KNN) is included as a high-accuracy baseline, despite its higher inference cost, to highlight the trade-off between accuracy and deployability.
|
| ICACT20260019 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Training time reflects offline model development and does not impact real-time deployment.
Inference latency determines whether a model can operate under strict real-time constraints.
In high-speed networks, intrusion detection decisions must be made on a per-packet basis, making per-sample inference latency critical.
|
| ICACT20260019 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
All experiments are conducted using stratified 10-fold cross-validation to ensure class distribution consistency across training and testing splits.
Model performance is evaluated using multiple metrics, including accuracy, ROC characteristics, and confusion matrices, to avoid reliance on a single performance indicator.
Inference time is measured separately to assess real-time feasibility under SmartNIC deployment constraints.
|
| ICACT20260019 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
High classification accuracy alone does not guarantee deployability in real-time systems.
Models intended for SmartNIC deployment must satisfy strict latency and execution stability requirements in addition to predictive performance.
Therefore, this work evaluates models based on both detection effectiveness and real-time operational feasibility.
|
| ICACT20260019 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Decision Tree achieves the lowest inference latency among all evaluated models, making it suitable for strict real-time constraints.
This speed advantage comes with a modest reduction in detection accuracy compared to ensemble-based methods.
|
| ICACT20260019 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Random Forest provides a balanced trade-off between detection accuracy and inference latency.
Its ensemble structure improves robustness while maintaining feasible per-sample inference time for SmartNIC deployment.
Compared to the Decision Tree, Random Forest (RF) achieves notably higher AUC with acceptable latency overhead.
|
| ICACT20260019 Slide.16
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
K-Nearest Neighbors (KNN) achieves high classification accuracy on the benchmark dataset.
However, its distance-based inference requires comparison with multiple stored samples, resulting in high per-sample inference latency.
This computational cost makes KNN unsuitable for real-time SmartNIC deployment, despite strong accuracy performance.
|
| ICACT20260019 Slide.17
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Decision Tree (DT) delivers the lowest per-sample latency but sacrifices robustness compared to ensemble methods.
Random Forest (RF) achieves perfect detection performance while maintaining deployable latency on SmartNIC-class hardware.
K-Nearest Neighbors (KNN), despite high accuracy, exhibits prohibitively high inference latency, making it unsuitable for real-time deployment.
|
| ICACT20260019 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Random Forest (RF) is selected as the final model:
Achieves the best balance between detection performance and deployable latency.
Maintains per-sample inference latency within SmartNIC hardware constraints.
Offers higher robustness than single-tree models
Why not Decision Tree (DT)?
Although DT provides ultra-low latency.
Its lower robustness makes it less reliable under dynamic and heterogeneous traffic patterns.
Why not K-Nearest Neighbors (KNN)?
Despite high accuracy.
Per-sample inference latency is prohibitively high.
Making it unsuitable for real-time, per-packet SmartNIC deployment.
|
| ICACT20260019 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The evaluation is conducted on the NSL-KDD dataset, which, while standardized, does not fully capture modern encrypted or zero-day traffic patterns.
The study focuses on model-level feasibility and does not include deployment on physical SmartNIC hardware.
Hardware-specific optimizations are outside the scope of this work.
|
| ICACT20260019 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Key Takeaways:
High detection accuracy alone is insufficient for real-time intrusion detection.
Per-sample inference latency and hardware feasibility determine deployability on SmartNIC platforms.
Hardware-aware evaluation bridges the gap between machine learning research and real-world network security systems.
Future Direction:
This work establishes a SmartNIC-aware machine learning baseline for intrusion detection.
Future work will focus on direct deployment and validation on programmable SmartNIC hardware.
|
| ICACT20260019 Slide.21
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Thank you |
