Evolving intrusion detection and prevention with programmable data planes

Network monitoring has traditionally been constrained by the infrastructure’s inherent limitations, including diverse device capabilities, legacy systems, and the physical separation between data generation and monitoring. These constraints delay threat detection and response, providing adversaries opportunities to exploit network vulnerabilities and exhaust resources. While Software-Defined Networking (SDN) has introduced tools for enriched network visibility, its centralized nature imposes latency, limiting real-time threat mitigation. This thesis explores the potential of fully programmable P4 data planes to transform network threat detection. By enabling line-rate packet processing and custom pipelines, P4 empowers network engineers to proactively detect threats and react with unprecedented speed. Our work demonstrates the versatility of P4 through frameworks addressing diverse challenges. In Part II, we introduce P4RTHENON, which combines a simple data plane anomaly detection algorithm with control plane refinement to detect and mitigate DDoS attacks. Building on this, we propose an adaptive anomaly detection framework leveraging active learning to iteratively refine machine learning models, seamlessly integrating them into P4 pipelines. Part III investigates Distributed Ledger Technologies (DLTs) for tamper-proof alert dissemination, presenting P-IOTA, a framework linking P4-enabled switches directly to IOTA’s ledger, bypassing intermediaries and enhancing trust in alert systems. Part IV explores P4’s applications in IIoT networks, presenting use cases such as edge-assisted in-network computing with data integrity and industrial tunneling mechanisms, showcasing P4’s ability to secure legacy and resource-constrained systems. Concluding, the thesis outlines open challenges, such as balancing real-time detection with resource efficiency and extending P4’s capabilities for broader system integration, emphasizing its role as a cornerstone for future secure networks.