Sergio Elizalde, a Ph.D. student and member of the Cyberinfrastructure Laboratory, received the Best Paper Award at the 2026 IEEE International Black Sea Conference on Communications and Networking (IEEE BlackSeaCom), held June 8–11 in Bucharest, Romania.
|
|---|
The award recognized the paper “Real-Time Detection of Encrypted DGA and DNS Tunneling Using DPDK on SmartNICs,” (PDF, PPT) co-authored with Ali AlSabeh, Samia Choueiri, Jaime Galán-Jiménez, Elie F. Kfoury, and Jorge Crichigno.
IEEE BlackSeaCom is an annual conference of the IEEE Communications Society that brings together researchers, practitioners, and industry professionals working in communications and networking. Its technical program covers areas such as mobile networks, artificial intelligence and machine learning for communications, software-defined networking, network virtualization, cloud and edge computing, cybersecurity, and the Internet of Things. The 2026 event marked the conference’s 14th edition.
|
|---|
The award-winning work addresses the challenge of detecting cyber threats hidden within encrypted DNS traffic. Although protocols such as DNS over HTTPS improve privacy by encrypting DNS queries, attackers can exploit them to conceal malicious activity within traffic that resembles ordinary secure web browsing. The paper focuses on two threats: Domain Generation Algorithms, which malware uses to generate domain names for communicating with attacker-controlled servers, and DNS tunneling, which can hide command-and-control messages or stolen data inside DNS traffic.
Rather than decrypting the traffic, the proposed framework analyzes statistical characteristics such as packet sizes, timing information, and flow behavior. The system runs directly on an NVIDIA BlueField-3 SmartNIC and uses a compact machine-learning model to distinguish among benign DNS-over-HTTPS traffic, DGA-based malicious traffic, tunneling-based malicious traffic, and non-DNS-over-HTTPS traffic.
To support real-time processing, the framework combines the Data Plane Development Kit (DPDK) with ARM NEON vector instructions. The evaluation reported more than 98% classification accuracy, approximately one microsecond of inference latency, and throughput of up to 16 million packets per second. The NEON optimization delivered up to a 3.6× speedup, and the system was evaluated on the FABRIC national research infrastructure.
|
|---|
By moving detection onto the SmartNIC, the approach keeps traffic analysis close to the network and reduces reliance on the host system for security monitoring. This work reflects the CI Lab’s ongoing research in SmartNICs, high-speed network monitoring, machine learning, and cybersecurity.