Hierarchical Software/Hardware Co-design for Memristive-based Network Intrusion Detection
Open Access DepositedCybersecurity threats cause billions of dollars per year in damage to commercial and defense applications. To facilitate the protection of sensitive networks from malicious actors, active detection must be implemented to have a chance to catch most malicious actors. Hierarchical machine learning models such as decision trees, can act as a compact and effective way for malicious attack classification and be explainable, without relying on the black-box nature of neural networks [1]. Due to the resource intensive nature of machine learning algorithms, they require optimization methods to compress the model and efficient hardware to support network intrusion detection. Feature boundaries needed for decision tree implementation can be naturally mapped to physical values in emerging devices. Two-terminal resistive switches (memristors) are one avenue to meet this demand for novel hardware. The speed and efficiency of memristive devices, their electronic re-programmability and non-volatile state retention are ideal traits for mapping the decision tree boundaries [2]. System integration of algorithms and devices is a difficult task that requires multiple angles of circuit design to tackle. First, a CMOS digital circuit design to obtain a benchmark for existing transistor technology support. Second, analog circuit design with supporting CMOS circuitry to support the programming of a decision tree boundary to memristor states. Considerations from the hardware side must account for the yield of existing memristive devices, while the software side must consider the non-linear behavior of memristive devices when mapping boundaries in hierarchical models [3]. This work aims to provide a framework for hierarchical software/hardware co-design for memristive-based network intrusion detection. The focus of this work is an inference comparison between a digital FPGA-based implementation and an analog circuit implementation of equivalent decision trees tested on three representative datasets, UNSW-NB15, CIC-IDS 2017, and the ACI-IoT 2023 datasets [4,5,6]. Training decision trees was done on software on these datasets show a 91%, 98%, and 95% accuracy, respectively, algorithmic benchmark using decision trees, with the existing size of these trees without any modifications are 505, 1125, and 1743 nodes, respectively. Methods like quantization of boundaries, clipping and trimming of the dataset, and node reduction to modify the decision tree into a more compact model were proposed [7]. The usefulness of these algorithmic methods shows a reduction of tree sizes to the tens of nodes while the accuracy penalty was only a few percentage points based on the amount of reduction. For the FPGA-based implementation, decision tree nodes were implemented on the Basys3 board and decision tree boundaries were fixed to maximize the digital benefit for speed. For the analog circuit design one-device per decision tree node was matched to the resistance of the memristor from the value of the feature based on the maximum and minimum range the feature could be. The speed for the FPGA implementation is ~5ns ignoring clocking in of features into the tree. For the analog design the speed is around ~2µs. The power consumption for the FPGA implementation is 101mW compared to 3.4mW of the analog implementation. Overall, the analog design based on memristors offers a much lower power implementation of decision trees which are useful for active detection of network intrusion. The results show that this framework of memristor device modeling to algorithmic integration is useful in hardware machine learning in general and efficient network intrusion detection.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.