Low-power deep packet inspection: A programmable logic approach

Network intrusion detection systems are a core component of cybersecurity toolkits and may rely upon machine learning inference as part of deep packet inspection to improve the detection capability. But the hardware to run these algorithms can have large power requirements that make it difficult for deployment in low-power situations such as internet-of-things (IoT) environments. This work explores a machine learning approach for deep packet inspection that is semi-supervised and deployed in a low-power programmable logic device that infers at sub-millisecond latencies while using a fraction of the power of what a graphics processing unit (GPU) would use. While programmable logic implementations generally show a considerable loss in accuracy when deploying a machine learning model compared to a GPU solution, the semi-supervised model detailed here suffers a negligible loss in accuracy. Accuracy, latency, and power comparisons between a GPU and field programmable gate array (FPGA) implementation are presented using open-source attack datasets and thousands of strikes from Keysight's BreakingPoint.