{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,15]],"date-time":"2026-05-15T17:51:33Z","timestamp":1778867493514,"version":"3.51.4"},"reference-count":65,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2024,11,18]],"date-time":"2024-11-18T00:00:00Z","timestamp":1731888000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Nordic University Hub on Industrial IoT (HI2OT) by NordForsk, VMware, and Innovate UK","award":["10056403"],"award-info":[{"award-number":["10056403"]}]},{"name":"SmartEdge EU","award":["101092908"],"award-info":[{"award-number":["101092908"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2024,11,30]]},"abstract":"<jats:p>The expanding use of Internet-of-Things (IoT) has driven machine learning (ML)-based traffic analysis. 5G networks\u2019 standards, requiring low-latency communications for time-critical services, pose new challenges to traffic analysis. They necessitate fast analysis and response, preventing service disruption or security impact on network infrastructure. Distributed intelligence on IoT edge has been studied to analyze traffic, but introduces delays and raises privacy concerns. Federated learning can address privacy concerns, but does not meet latency requirements. In this article, we propose FLIP4: an efficient federated learning-based framework for in-network traffic analysis. Our solution introduces a lightweight federated tree-based model, offloaded and running within network devices. FLIP4 consumes less resources than previous solutions and reduces communication overheads, making it well-suited for IoT edge traffic analysis. It ensures prompt mitigation and minimal impact on services in the presence of false alerts using two approaches (metering and dropping), thereby balancing learning accuracy and privacy requirements.<\/jats:p>","DOI":"10.1145\/3696354","type":"journal-article","created":{"date-parts":[[2024,9,26]],"date-time":"2024-09-26T11:14:53Z","timestamp":1727349293000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Federated In-Network Machine Learning for Privacy-Preserving IoT Traffic Analysis"],"prefix":"10.1145","volume":"24","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6278-1282","authenticated-orcid":false,"given":"Mingyuan","family":"Zang","sequence":"first","affiliation":[{"name":"DTU Electro, Technical University of Denmark, Kgs Lyngby, Denmark"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1894-722X","authenticated-orcid":false,"given":"Changgang","family":"Zheng","sequence":"additional","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom of Great Britain and Northern Ireland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1218-6258","authenticated-orcid":false,"given":"Tomasz","family":"Koziak","sequence":"additional","affiliation":[{"name":"Netlight, Copenhagen, Denmark"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3655-2873","authenticated-orcid":false,"given":"Noa","family":"Zilberman","sequence":"additional","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom of Great Britain and Northern Ireland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3660-6165","authenticated-orcid":false,"given":"Lars","family":"Dittmann","sequence":"additional","affiliation":[{"name":"Technical University of Denmark, Lyngby, Denmark"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,11,18]]},"reference":[{"key":"e_1_3_1_2_2","volume-title":"Study on Application Architecture for Enabling Edge Applications 3GPP TR 23.758","year":"2019","unstructured":"3GPP. 2019. Study on Application Architecture for Enabling Edge Applications 3GPP TR 23.758. 3rd Generation Partnership Project (3GPP)."},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3544216.3544263"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656890"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_1_6_2","unstructured":"Coralie Busse-Grawitz Roland Meier Alexander Dietm\u00fcller Tobias B\u00fchler and Laurent Vanbever. 2019. pforest: In-network Inference with Random Forests. Retrieved from https:\/\/arxiv:1909.05680."},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108661"},{"key":"e_1_3_1_8_2","unstructured":"DELL Technologies. 2023. Dell EMC Edge Gateway 5200 Software User\u2019s Guide. Retrieved from https:\/\/dl.dell.com\/content\/manual77941191-dell-emc-edge-gateway-5200-software-user-s-guide"},{"key":"e_1_3_1_9_2","volume-title":"Cybersecurity\u2013Attack and Defense Strategies: Counter Modern Threats and Employ State-of-the-art Tools and Techniques to Protect your Organization Against Cybercriminals","author":"Diogenes Yuri","year":"2019","unstructured":"Yuri Diogenes and Erdal Ozkaya. 2019. Cybersecurity\u2013Attack and Defense Strategies: Counter Modern Threats and Employ State-of-the-art Tools and Techniques to Protect your Organization Against Cybercriminals. Packt Publishing Ltd."},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"e_1_3_1_11_2","volume-title":"Service Requirements for the 5G System (3GPP TS 22.261 Version 16.14.0 Release 16)","author":"ETSI TS 122 261","year":"2021","unstructured":"ETSI TS 122 261 2021. Service Requirements for the 5G System (3GPP TS 22.261 Version 16.14.0 Release 16). 3rd Generation Partnership Project (3GPP)."},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394528"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/3482898.3483356"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.pmcj.2023.101818"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93387-0_13"},{"key":"e_1_3_1_16_2","volume-title":"Proceedings of the Conference on Neural Information Processing Systems (NeurIPS\u201922)","author":"Grinsztajn L\u00e9o","year":"2022","unstructured":"L\u00e9o Grinsztajn, Edouard Oyallon, and Ga\u00ebl Varoquaux. 2022. Why do tree-based models still outperform deep learning on typical tabular data? In Proceedings of the Conference on Neural Information Processing Systems (NeurIPS\u201922)."},{"key":"e_1_3_1_17_2","volume-title":"Proceedings of the P4 Workshop","author":"Gurevich Vladimir","year":"2021","unstructured":"Vladimir Gurevich and Andy Fingerhut. 2021. P4-16 programming for Intel Tofino using intel P4 studio. In Proceedings of the P4 Workshop."},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3139937.3139944"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102033"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/3546037.3546057"},{"key":"e_1_3_1_21_2","unstructured":"Intel. 2021. P4_16 Intel Tofino Native Architecture\u2014Public Version. Retrieved from https:\/\/github.com\/barefootnetworks\/Open-Tofino\/blob\/master\/PUBLIC_Tofino-Native-Arch.pdf"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/GCWkshps56602.2022.10008548"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2018.8585560"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-020-05440-2"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3088938"},{"key":"e_1_3_1_26_2","unstructured":"Q. Li Zeyi Wen and Bingsheng He. 2019. Practical federated gradient boosting decision trees. Retrieved from https:\/\/abs\/1911.04206"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3124599"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2991401"},{"key":"e_1_3_1_29_2","unstructured":"Heiko Ludwig et\u00a0al. 2020. IBM Federated Learning: An Enterprise Framework White Paper V0.1. Retrieved from https:\/\/arXiv:2007.10987"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560687"},{"key":"e_1_3_1_31_2","unstructured":"H. Brendan McMahan Eider Moore Daniel Ramage and Blaise Ag\u00fcera y Arcas. 2016. Federated Learning of Deep Networks using Model Averaging. Retrieved from https:\/\/arXiv:1602.05629"},{"key":"e_1_3_1_32_2","first-page":"2177","volume-title":"Proceedings of the IEEE 37th International Conference on Distributed Computing Systems (ICDCS\u201917)","author":"Miettinen Markus","year":"2017","unstructured":"Markus Miettinen, Samuel Marchal, Ibbad Hafeez, N. Asokan, Ahmad-Reza Sadeghi, and Sasu Tarkoma. 2017. IoT sentinel: Automated device-type identification for security enforcement in IoT. In Proceedings of the IEEE 37th International Conference on Distributed Computing Systems (ICDCS\u201917). 2177\u20132184."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.11"},{"key":"e_1_3_1_34_2","first-page":"756","article-title":"D\u00cfoT: A federated self-learning anomaly detection system for IoT","author":"Nguyen Thien Duc","year":"2018","unstructured":"Thien Duc Nguyen, Samuel Marchal, Markus Miettinen, Hossein Fereidooni, N. Asokan, and Ahmad-Reza Sadeghi. 2018. D\u00cfoT: A federated self-learning anomaly detection system for IoT. In Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS\u201918). 756\u2013767.","journal-title":"Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS\u201918)"},{"key":"e_1_3_1_35_2","unstructured":"Council of European Union. 2016. General Data Protection Regulation. Retrieved from https:\/\/https:\/\/gdpr-infor.eu"},{"key":"e_1_3_1_36_2","unstructured":"Office of the California Attorney General. 2020. California Consumer Privacy Act (CCPA): First Modified Regulations. Retrieved from https:\/\/oag.ca.gov\/sites\/all\/fles\/agweb\/pdfs\/privacy\/ccpa-text-of-mod-clean-020720.pdf"},{"key":"e_1_3_1_37_2","unstructured":"National People\u2019s Congress of the People\u2019s Republic of China. 2021. Personal Information Protection Law of the People\u2019s Republic of China. Retrieved from https:\/\/personalinformationprotectionlaw.com\/"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1002\/spy2.158"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3173664"},{"key":"e_1_3_1_40_2","volume-title":"Software-defined Networks: A Systems Approach","author":"Peterson Larry L.","year":"2021","unstructured":"Larry L. Peterson, Carmelo Cascone, Brian O\u2019Connor, Thomas Vachuska, and Bruce Davie. 2021. Software-defined Networks: A Systems Approach. Systems Approach LLC."},{"key":"e_1_3_1_41_2","first-page":"352","volume-title":"IFIP Networking","author":"Qin Qiaofeng","year":"2020","unstructured":"Qiaofeng Qin, Konstantinos Poularakis, Kin K. Leung, and Leandros Tassiulas. 2020. Line-speed and scalable intrusion detection at the network edge via federated learning. In IFIP Networking. IEEE, 352\u2013360."},{"key":"e_1_3_1_42_2","volume-title":"Edge\/Fog Computing Paradigm: The Concept, Platforms and Applications.","author":"Raj Pethuru","year":"2022","unstructured":"Pethuru Raj, Kavita Saini, and Chellammal Surianarayanan. 2022. Edge\/Fog Computing Paradigm: The Concept, Platforms and Applications.Academic Press."},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1049\/iet-ifs.2010.0041"},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179468"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2019.2956472"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP52444.2021.9651915"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"e_1_3_1_48_2","first-page":"513","volume-title":"Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI\u201922)","author":"Siracusano Giuseppe","year":"2022","unstructured":"Giuseppe Siracusano et\u00a0al. 2022. Re-architecting traffic analysis with neural network interface cards. In Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI\u201922). 513\u2013533."},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487833"},{"key":"e_1_3_1_50_2","first-page":"151","volume-title":"Proceedings of the ACM\/IEEE Symposium on Architectures for Networking and Communication Systems (ANCS\u201922)","author":"Stoyanov Radostin","year":"2022","unstructured":"Radostin Stoyanov, Adam Wolnikowski, Robert Soul\u00e9, S\u00e1ndor Laki, and Noa Zilberman. 2022. Building an internet router with P4Pi. In Proceedings of the ACM\/IEEE Symposium on Architectures for Networking and Communication Systems (ANCS\u201922). 151\u2013156."},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507726"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3276365"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3448300.3467827"},{"key":"e_1_3_1_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2022.3212913"},{"key":"e_1_3_1_55_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2007.06.013"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2019.1800358"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM38437.2019.9013892"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2023.3323771"},{"key":"e_1_3_1_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485730.3493444"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2023.3344351"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","DOI":"10.1145\/3607504.3609291"},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/3629136"},{"key":"e_1_3_1_64_2","article-title":"IIsy: Hybrid in-network classification using programmable switches","author":"Zheng Changgang","year":"2024","unstructured":"Changgang Zheng, Zhaoqi Xiong, Thanh T. Bui, Siim Kaupmees, Riyad Bensoussane, Antoine Bernabeu, Shay Vargaftik, Yaniv Ben-Itzhak, and Noa Zilberman. 2024. IIsy: Hybrid in-network classification using programmable switches. IEEE\/ACM Trans. Netw. 32, 3 (2024), 2555\u20132570.","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.1145\/3687230.3687232"},{"key":"e_1_3_1_66_2","volume-title":"Proceedings of the USENIX Security Symposium","author":"Zhou Guangmeng","year":"2023","unstructured":"Guangmeng Zhou, Zhuotao Liu, Chuanpu Fu, Qi Li, and Ke Xu. 2023. An efficient design of intelligent network data plane. In Proceedings of the USENIX Security Symposium."}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3696354","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3696354","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:10:11Z","timestamp":1750295411000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3696354"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,18]]},"references-count":65,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2024,11,30]]}},"alternative-id":["10.1145\/3696354"],"URL":"https:\/\/doi.org\/10.1145\/3696354","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,11,18]]},"assertion":[{"value":"2024-01-15","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-08-21","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-11-18","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}