HyNIC: hybrid in-network inference for line-rate anomaly detection on smartNICs

Conference item

SmartNICs have emerged as a promising platform for in-network machine learning inference, yet existing approaches largely rely on stateless packet-level inference, off-path stateful inference or offloading flow-level analysis to the host, limiting performance. This creates a performance gap between line-rate inference capabilities in the data plane and the need for flow-aware context in security and monitoring applications. In this paper, we bridge this gap by exploiting the coexistence of programmable data planes and on-NIC processing cores on SmartNICs. We propose HyNIC, a hybrid in-network inference system that performs line-rate packet classification for intrusion and anomaly detection in the data plane while subsequently enriching inference with stateful flow-level context computed on SmartNIC cores and integrated back at runtime. HyNIC enables a seamless transition from stateless to flow-aware inference without diverting packets from the fast path. We implement HyNIC in P4 on an industry-grade SmartNIC and evaluate it on realistic IoT intrusion detection datasets, demonstrating significant accuracy improvements of up to 22% over a stateless-only baseline while preserving line-rate performance.

Authors: Akem, AT-J; Zilberman, N

• Publication status: Accepted
• Peer review status: Peer reviewed
• Publisher: IEEE
• Acceptance date: 2026-03-23
• Event title: 12th IEEE International Conference on Network Softwarization (NetSoft 2026)
• Event location: Berlin, Germany
• Event website: https://netsoft2026.ieee-netsoft.org/
• Event start date: 2026-06-29
• Event end date: 2026-07-03
• Language: English