@inproceedings{discovery10139890, month = {November}, journal = {HotNets 2021 - Proceedings of the 20th ACM Workshop on Hot Topics in Networks}, publisher = {ACM}, year = {2021}, title = {Stats 101 in P4: Towards In-Switch Anomaly Detection}, address = {Virtual Event, United Kingdom}, note = {This version is the author accepted manuscript. For information on re-use, please refer to the publisher's terms and conditions. https://doi.org/}, pages = {84--90}, booktitle = {HotNets '21: Proceedings of the Twentieth ACM Workshop on Hot Topics in Networks}, abstract = {Data plane programmability is greatly improving network monitoring. Most new proposals rely on controllers pulling information (e.g., sketches or packets) from the data plane. This architecture is not a good fit for tasks requiring high reactivity, such as failure recovery, attack mitigation, and so on. Focusing on these tasks, we argue for a different architecture, where the data plane autonomously detects anomalies and pushes alerts to the controller. As a first step, we demonstrate that statistical checks can be implemented in P4 by revisiting definition and online computation of statistical measures. We collect our techniques in a P4 library, and showcase how they enable in-switch anomaly detection.}, author = {Gao, S and Handley, M and Vissicchio, S}, url = {https://doi.org/10.1145/3484266.3487370} }