In-Network ML Feature Computation for Malicious Traffic Detection

We present Peregrine, a malicious traffic detector that offloads part of its computation to a programmable switch. The idea is to partition detection, by moving the ML feature computation module from a middlebox server to a switch data plane. The key innovation unlocked-computing the ML input features over all traffic-results in a significant improvement in detection performance: in our evaluation, up to 5.7x over the state of the art.