Hardware-Accelerated Flow Interaction Graph Compression for High-Speed Anomaly Detection

The proliferation of encrypted Internet traffic fosters new anomaly detection techniques relying on flow interactions, which are resilient and effective in detecting encrypted malicious traffic and zero-day attacks. However, existing software-based solutions fail to achieve high-speed anomaly detection for up to 100Gbps or higher throughput traffic fed by the current NICs. To solve this problem, we propose ICAD to enable hardware-accelerated flow interaction graph compression and high-speed anomaly detection. ICAD integrates the up-to-date high-speed measurement technology and uses the hardware Bloom filter and CM -Sketches for line-speed data processing and flow interaction graph compression, greatly reducing the host processor's computational load. High throughput and accuracy on data analysis are achieved by using a decision tree model. We implement a prototype on a server with an FPGA-based Smart-NIC and show that with the line-speed hardware acceleration, ICAD improves the software throughput of graph construction and anomaly detection by 2x and 134x over the state-of-the-art solution, and achieves higher than 99 % detection accuracy and 99% F1-score. Using 15 processor cores, ICAD can sustain the worst-case 100GE traffic. The FPGA resource and ASIC chip area evaluations prove the ICAD hardware cost is low.