CoDPA: Cognitive Data-Plane Architecture for Intelligent In-Network Decision-Making, Filtering, and Aggregation in SD-IoT Threat Mitigation
Rapidly growing diversity of heterogeneous Software-Defined Internet of Things (SD-IoT) devices has created an increased vulnerability to high-rate volumetric distributed attacks, application-layer probing and bandwidth exhaustion. Traditional security architectures rely on centralized cloud-based Intrusion Detection Systems (IDS) causing considerable delays in processing, control-plane congestion and core-link bandwidth constraints. In order to solve those key issues, this paper proposes CoDPA (Cognitive Data-Plane Architecture), which presents a novel network architecture to mitigate network threats with built-in intelligence, sliding-window aggregation and adaptive policy enforcement using P4-programmable switches. One of the core elements of CoDPA is a novel approach called Confidence-Aware Decision Engine that converts behavioral metrics to policy enforcement decisions at line-rate without executing computational complex loop or floating point neural inference computations in hardware ALUs. CoDPA utilizes four customized modules for processing traffic, such as: Header Parser, Atomic SRAM register-based Feature Extractor, Sliding-Window Temporal Aggregator, and Confidence-Calibrated Match Action Evaluator. Based on the results of computing confidence scores mapped against calibrated thresholds stored in fast lookup tables, CoDPA performs dynamic orchestration of fine-grained actions such as: packet dropping for high-confidence threats; bandwidth throttling using token bucket for medium confidence anomalies; inspection tagging for out-of-line controller decision making; and line-rate forwarding for legitimated packets. Empirical experiments performed in hybrid emulated Mininet-WiFi and programmable testbeds have shown that CoDPA decreases end-to-end latency up to 90% during high-traffic peaks (up to 20,000 packets/second); saves up to 85.1% of core-link bandwidth; provides True Positive Rate (TPR) of 98.4% with False Positive Rate (FPR) of 1.8%; and mitigates attacks with latency of 1.2 milliseconds. Besides, CoDPA uses a light-weight hardware design (≤14% ALU utilization and 0.92 µs per-packet processing); provides 78.2% less carbon footprint and energy consumption than traditional IDS.