Data-Plane Deep Learning for Low-Latency Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep learning inference models for advanced threat detection are computationally expensive and limited by network capacity and latency when deployed in cloud-based solutions, making them inadequate for high-throughput, low-latency environments like enterprise networks.
Innovation Solution
Deploying deep learning inference models locally on security platforms, such as firewalls, for inline traffic analysis, using techniques like tokenization and model optimization to reduce compute time and memory footprint, enabling efficient detection of unknown threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep learning inference models are deployed cloud-based for advanced threat detection, then detection capability is improved, but network latency and throughput are worsened
Solution Approach 1:
The patent introduces a hybrid architecture where a cloud-based deep learning model serves as an intermediary for training and generating detection patterns, while a lightweight local model acts as the operational intermediary at the data plane. This mediation allows complex cloud processing to be translated into efficient local execution, resolving the latency issue while maintaining detection capability.
Solution Approach 2:
The detection system is segmented into two parts: a cloud-based component for model training and pattern generation, and a local data plane component for real-time inference. This segmentation allows the computationally intensive tasks to occur in the cloud while the time-sensitive detection occurs locally, eliminating the latency bottleneck.
2Measurement precision
If deep learning inference models are deployed cloud-based, then detection accuracy is improved, but processing throughput is worsened
Solution Approach 1:
The cloud-based system performs preliminary actions by training deep learning models and generating detection patterns in advance. These pre-processed knowledge structures are then deployed to the local data plane, enabling high-throughput real-time detection without the need for cloud-based processing during actual traffic analysis.
Solution Approach 2:
The patent creates a simplified copy of the cloud-based detection model that resides locally at the data plane. This local copy contains the essential detection logic and patterns learned from cloud training, enabling it to replicate the cloud model's accuracy while operating at line-speed throughput.
3Speed
If deep learning models are executed locally on security platforms, then processing speed is improved, but device complexity is worsened
Solution Approach 1:
The patent transforms the deep learning model into a different parameter representation suitable for local execution. By converting the model into a lightweight format with optimized parameters that can run on resource-constrained security platforms, it achieves high processing speed while keeping device complexity manageable.
4Loss of time
If deep learning models are executed locally, then latency is reduced, but memory footprint is worsened
Solution Approach 1:
The patent employs a lightweight local model that uses minimal memory resources compared to the full cloud-based model. This simplified model is designed to be disposable in terms of computational resources, using enough memory to achieve low-latency detection but significantly less than a full deep learning model would require.
Data Source
AI summary
Various techniques for deep learning in a data plane are disclosed. In some embodiments, a system/process/computer program product for deep learning in a data plane includes monitoring a session at a security platform, wherein the session includes network traffic; executing a local deep learning model on the network traffic, wherein the local deep learning model is executed on the security platform; and performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model.