Defeating Slow-and-Low Threats via Diffusion Model-based Generative Inference
summary
SketchVision encodes packet-level timing into compact images in an eBPF-enabled data plane, then uses a diffusion-based denoiser plus a learned forecaster and CNN classifier to predict mature flow states from partial observations. Prototype runs on an edge server with GPU, uses 12 MB sketch memory, processes ~2,000 flows/s with 140 ms total inference, and is trained on 19 slow-and-low attacks plus benign traffic. It reports average AUC 0.982, F1 0.913 and up to 29% improvement over prior methods.
AI-written summary · about
chapters (13)
- 0:00Slow-and-low threats intro
- 1:02Detecting slow-and-low attacks
- 2:52Limitations of flow monitoring
- 5:00Sketch Vision system
- 7:04Flow painting with vision
- 8:29Denoising sketches with diffusion
- 10:15Forecasting flow maturity
- 11:19Experimental setup
- 12:00Early detection results
- 13:26Sketch denoising evaluation
- 14:49Memory configuration
- 15:12Performance latency
- 15:34Conclusion
related talks
12mToward Nearly-Zero-Error Sketching via Compressive Sensing
41mBuilding Generative Image & Video models at Scale
20mSLEIGHT: Real-time Closed-Loop Attack Analytics Framework for Holistic Intrusion...
12mEfficient Workflow Serving for Diffusion Models with Many Adapters
10mDiffusion models
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
14mBrain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic...
01h 21mGenerative AI with Diffusion Models