Author

Marius Portmann

View on Semantic Scholar

2 papers indexed here

We haven’t gathered this author’s papers yet. Follow them and we’ll fetch their work.

Not the right person? Other researchers publish under this name.

Review Open access 2026

Programmable Data Planes for AI Infrastructure Readiness: Abstractions, Accelerators, and Systems—A Survey

Software-Defined Networking (SDN) enables data plane programmability and allows for customised, high-speed packet processing that transcends the limitations of fixed-function hardware. This flexibility is increasingly vital for modern networks tasked with supporting intensive workloads, such as distributed AI training and real-time telemetry. However, supporting these workloads in practice is far from straightforward, as each technology operates within strict physical and architectural boundaries that ultimately determine what is feasible at deployment. This survey provides a detailed examination of the practical capability boundaries of prominent programmable data plane technologies, including Protocol-Oblivious Forwarding (POF), Programming Protocol-independent Packet Processors (P4), the extended Berkeley Packet Filter (eBPF), and the Network Programming Language (NPL). It traces their evolution and functional capabilities. We further explore the prevailing system designs and hardware platforms, spanning Application-Specific Integrated Circuits (ASICs) switches, Smart Network Interface Cards (SmartNICs) or Data Processing Units (DPUs), Field-Programmable Gate Arrays (FPGAs), and kernel or eXpress Data Path (XDP)-based software targets. A central concern of this survey is bridging the gap between theoretical programmability and what these platforms can realistically deliver in production. To that end, we map each hardware profile to concrete deployment scenarios, examining how these data planes are currently used across cloud data centres, edge and telco networks (including 5G and emerging 6G), and distributed AI and High-Performance Computing (HPC) clusters. Finally, we explore emerging high-speed communication fabrics and AI compute-enabled data planes, outlining the open challenges that will shape the next generation of intelligent networked systems.

Yaying Chen, S. Layeghy, Marius Portmann · IEEE Access · 0 citations

Preprint Aug 2026

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The framework models user activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised behavioural context from each user's historical activity. Rather than performing end-to-end classification directly from raw logs, it first generates structured, interpretable sets of threat-specific risk indicators, which are then classified jointly across temporal sequences to capture attack patterns spanning multiple windows.The framework is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection, using four combinations of two open-weight LLMs under both retrieval and non-retrieval settings. All configurations outperform the previous state-of-the-art LLM-based framework (GABM), with the best configuration improving the F1-score by 11.40 percentage points on CERT r5.2 and 31.50 percentage points on PicoDomain. Results further show that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context. The most effective assignment of LLMs to the two stages depends on the dataset. These findings show that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance.

A. Al-Ghamdi, S. Layeghy, Marius Portmann · 0 citations