SentinelX: A Lightweight Malicious Traffic Detection System Based on Programmable Switches

In recent years, programmable switches have emerged as robust platforms for deploying high-performance network services to detect malicious traffic. However, current researches face several challenges: firstly, the flow tables generated by model deployment are cumbersome; secondly, existing unsupervised methods have difficulty handling repetitive traffic; and thirdly, the flow-level inference is coarse-grained and susceptible to attacks. To address these challenges, we propose SentinelX, which offers several advancements. Initially, we design a space-saving multi-level flow table representation method. We then introduce TreeDivider, an innovative model-splitting algorithm that achieves significant space reductions of up to 63.88% after only two subdivisions. Next, we propose DualTree, a hardware-specific unsupervised decision tree utilizing a dual threshold mode, which enhances detection accuracy by approximately 30.24%. Finally, we design a fine-grained method for determining the inference point, boosting the detection rate of bypass attacks by 30.03%. Extensive experiments on the H3C S9830-32H-H1 switch demonstrate that SentinelX can reach 99.99% of the maximum bandwidth of switch ports with nanosecond-level latency, approximately 1.38 times the delay of L3 (network layer) base forwarding.