eprintid: 10139890 rev_number: 12 eprint_status: archive userid: 608 dir: disk0/10/13/98/90 datestamp: 2021-12-08 10:32:50 lastmod: 2021-12-08 10:32:50 status_changed: 2021-12-08 10:32:50 type: proceedings_section metadata_visibility: show creators_name: Gao, S creators_name: Handley, M creators_name: Vissicchio, S title: Stats 101 in P4: Towards In-Switch Anomaly Detection ispublished: pub divisions: UCL divisions: B04 divisions: C05 divisions: F48 note: This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions. https://doi.org/ abstract: Data plane programmability is greatly improving network monitoring. Most new proposals rely on controllers pulling information (e.g., sketches or packets) from the data plane. This architecture is not a good fit for tasks requiring high reactivity, such as failure recovery, attack mitigation, and so on. Focusing on these tasks, we argue for a different architecture, where the data plane autonomously detects anomalies and pushes alerts to the controller. As a first step, we demonstrate that statistical checks can be implemented in P4 by revisiting definition and online computation of statistical measures. We collect our techniques in a P4 library, and showcase how they enable in-switch anomaly detection. date: 2021-11-10 date_type: published publisher: ACM official_url: https://doi.org/10.1145/3484266.3487370 oa_status: green full_text_type: other language: eng primo: open primo_central: open_green verified: verified_manual elements_id: 1908095 doi: 10.1145/3484266.3487370 isbn_13: 9781450390873 lyricists_name: Handley, Mark lyricists_name: Vissicchio, Stefano lyricists_id: MJHAN69 lyricists_id: SVISS67 actors_name: Vissicchio, Stefano actors_id: SVISS67 actors_role: owner full_text_status: public publication: HotNets 2021 - Proceedings of the 20th ACM Workshop on Hot Topics in Networks place_of_pub: Virtual Event, United Kingdom pagerange: 84-90 event_title: 20th ACM Workshop on Hot Topics in Networks book_title: HotNets '21: Proceedings of the Twentieth ACM Workshop on Hot Topics in Networks citation: Gao, S; Handley, M; Vissicchio, S; (2021) Stats 101 in P4: Towards In-Switch Anomaly Detection. In: HotNets '21: Proceedings of the Twentieth ACM Workshop on Hot Topics in Networks. (pp. pp. 84-90). ACM: Virtual Event, United Kingdom. Green open access document_url: https://discovery.ucl.ac.uk/id/eprint/10139890/1/Stat4_hotnets21.pdf