Samia Choueiri, a Ph.D. student and member of the Cyberinfrastructure Laboratory, received the Best Poster Award at the FABRIC KNIT12 Demo Night for the poster “Accelerating Attack and Fault Detection in Cyber-Physical Systems Using SmartNICs and DPDK.” (PDF) The poster was co-authored by Sergio Elizalde, Ali Mazloum, Jose Gomez, Elie Kfoury, and Jorge Crichigno.
|
|---|
FABRIC KNIT12, held in Honolulu, Hawaii, in April 2026, brought together members of the FABRIC community to share research results, exchange technical knowledge, and demonstrate experiments conducted using the FABRIC infrastructure. The Demo Night provided participants with an opportunity to present their projects and discuss their work with researchers working in advanced networking, distributed systems, cybersecurity, and programmable infrastructure.
|
|---|
The award-winning work proposes a SmartNIC-accelerated anomaly-detection framework for cyber-physical systems, where delayed identification of attacks or equipment failures can affect system stability and reliability. The framework supports both fault detection, including sensor and system failures, and attack detection for network-based anomalies. It processes flow-level features from industrial Modbus traffic and uses a Random Forest model to distinguish normal from anomalous behavior.
The system separates model training from real-time inference. During the offline phase, network traces are processed on the host to extract features and train the machine-learning model. The trained model is then deployed on an NVIDIA BlueField-3 SmartNIC, where DPDK enables the decision trees to evaluate incoming flows directly in the network data plane. This approach keeps detection close to the monitored traffic while reducing dependence on host-based processing.
Experimental results showed approximately 98% detection accuracy and inference latency below one microsecond. The evaluation also examined the trade-offs among model depth, number of trees, memory use, and inference time, showing that lightweight models can support efficient real-time attack detection, while fault detection requires more complex models to capture less separable behavior.
This recognition highlights the CI Lab’s ongoing research in SmartNICs, in-network machine learning, cyber-physical systems, and real-time network security.