The rise of programmable data plane (PDP) and in-network computing (INC) paradigms paves the way for the development of network devices (switches, network interface cards, etc.) capable of performing advanced computing tasks. This allows to execute algorithms of various nature, including machine learning ones, within the network itself to support user and network services. In particular, this paper delves into the issue of implementing in-network learning models to support distributed intrusion detection systems (IDS). It proposes a model that optimally distributes the IDS workload, resulting from the subdivision of a "Strong Learner" (SL) model into lighter distributed "Weak Learner" (WL) models, among data plane devices; the objective is to ensure complete network security without excessively burdening their normal operations. Furthermore, a meta-heuristic approach is proposed to reduce the long computational time required by the exact solution provided by the mathematical model, and its performance is evaluated. The analysis conducted and the results obtained demonstrate the enormous potential of the proposed new approach to the creation of intelligent data planes that effectively act as a first line of defense against cyber attacks, with minimal additional workload on network devices.

本研究解决了网络中实施学习模型以支持分布式入侵检测系统（IDS）的问题。提出了一种模型，通过将“强学习者”（SL）模型分割为更轻的分布式“弱学习者”（WL）模型，以最佳方式分配IDS工作负载，从而确保网络安全，同时不会过度增加网络设备的正常操作负担。研究表明，该新方法在创建智能数据平面以有效抵御网络攻击方面具有巨大潜力。

面向下一代网络的安全设计可编程数据平面中学习功能的最佳网络内分配