A decision tree is implemented in a switch by using P4 language. Multiple forwarding tables are used to implement decision tree branch. Therefore, our solution can achieve high accurate malicious traffic detection with low network latency.

Traditional switch can only detect malicious traffic by matching packet fields that limits the ability of the detection. We rely on existing switch to run decision tree in switches to detect malicious traffic with higher accuracy and lower latency.

Switch providers can apply our solution to their product and add malicious traffic detection and prevention abilities in their switches. In addition, network service providers can leverage the switch with our solution to provide more accurate network traffic scanning without affecting network performance. The latency requirement of 5G networks can be achieved, while network security is provided.