{"id":"https://openalex.org/W4410090060","doi":"https://doi.org/10.1145/3696410.3714742","title":"Helios: Learning and Adaptation of Matching Rules for Continual In-Network Malicious Traffic Detection","display_name":"Helios: Learning and Adaptation of Matching Rules for Continual In-Network Malicious Traffic Detection","publication_year":2025,"publication_date":"2025-04-22","ids":{"openalex":"https://openalex.org/W4410090060","doi":"https://doi.org/10.1145/3696410.3714742"},"language":"en","primary_location":{"id":"doi:10.1145/3696410.3714742","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714742","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714742","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714742","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100765739","display_name":"Zhenning Shi","orcid":"https://orcid.org/0009-0004-9194-7810"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenning Shi","raw_affiliation_strings":["Tsinghua University, Shenzhen, China and Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0004-9194-7810","affiliations":[{"raw_affiliation_string":"Tsinghua University, Shenzhen, China and Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793","https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100899183","display_name":"Dan Zhao","orcid":"https://orcid.org/0000-0001-9016-5594"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dan Zhao","raw_affiliation_strings":["Peng Cheng Laborotary, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0001-9016-5594","affiliations":[{"raw_affiliation_string":"Peng Cheng Laborotary, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060860275","display_name":"Yijia Zhu","orcid":null},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yijia Zhu","raw_affiliation_strings":["School of Artificial Intelligence, Xidian University, Xian, China"],"raw_orcid":"https://orcid.org/0009-0006-6289-8209","affiliations":[{"raw_affiliation_string":"School of Artificial Intelligence, Xidian University, Xian, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078895699","display_name":"Guorui Xie","orcid":"https://orcid.org/0000-0001-7532-9116"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guorui Xie","raw_affiliation_strings":["Peng Cheng Laborotary, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0001-7532-9116","affiliations":[{"raw_affiliation_string":"Peng Cheng Laborotary, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100734609","display_name":"Qing Li","orcid":"https://orcid.org/0000-0002-6071-473X"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qing Li","raw_affiliation_strings":["Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-6071-473X","affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101626204","display_name":"Yong Jiang","orcid":"https://orcid.org/0000-0002-4260-1395"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Jiang","raw_affiliation_strings":["Tsinghua University, Shenzhen, China and Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-4260-1395","affiliations":[{"raw_affiliation_string":"Tsinghua University, Shenzhen, China and Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793","https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.0247,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.97640896,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"2319","last_page":"2329"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adaptation","display_name":"Adaptation (eye)","score":0.7910846471786499},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7441455125808716},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.7126618027687073},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4355275332927704},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3703521490097046}],"concepts":[{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.7910846471786499},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7441455125808716},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.7126618027687073},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4355275332927704},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3703521490097046},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3696410.3714742","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714742","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714742","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3696410.3714742","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714742","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714742","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4410090060.pdf","grobid_xml":"https://content.openalex.org/works/W4410090060.grobid-xml"},"referenced_works_count":29,"referenced_works":["https://openalex.org/W1977556410","https://openalex.org/W1994926493","https://openalex.org/W2065890363","https://openalex.org/W2295598076","https://openalex.org/W2296509296","https://openalex.org/W2342408547","https://openalex.org/W2789828921","https://openalex.org/W2914982603","https://openalex.org/W2983123278","https://openalex.org/W2990138404","https://openalex.org/W3047608117","https://openalex.org/W3164964481","https://openalex.org/W3173170122","https://openalex.org/W3193293525","https://openalex.org/W3203321737","https://openalex.org/W3213142719","https://openalex.org/W4224314826","https://openalex.org/W4283207618","https://openalex.org/W4381786040","https://openalex.org/W4386083133","https://openalex.org/W4387086808","https://openalex.org/W4388856929","https://openalex.org/W4389065390","https://openalex.org/W4396723284","https://openalex.org/W4396757496","https://openalex.org/W4401856724","https://openalex.org/W4403154250","https://openalex.org/W6600405510","https://openalex.org/W6600538214"],"related_works":["https://openalex.org/W2961085424","https://openalex.org/W4306674287","https://openalex.org/W4387369504","https://openalex.org/W4394896187","https://openalex.org/W3170094116","https://openalex.org/W4386462264","https://openalex.org/W3107602296","https://openalex.org/W4364306694","https://openalex.org/W4312192474","https://openalex.org/W4283697347"],"abstract_inverted_index":{"Network":[0],"Intrusion":[1],"Detection":[2],"Systems":[3],"(NIDS)":[4],"are":[5,27],"critical":[6],"for":[7,21,47,62,200],"web":[8],"security":[9],"by":[10],"identifying":[11,178],"and":[12,37,102,111,118,131,141,155,173,192,198],"blocking":[13],"malicious":[14,58],"traffic.":[15],"In-network":[16],"NIDS":[17],"leverage":[18],"programmable":[19],"switches":[20],"high-speed":[22],"traffic":[23,59],"processing.":[24],"However,":[25],"they":[26,44],"unable":[28],"to":[29,83,121],"reconcile":[30],"the":[31,38,88,92],"fine-grained":[32],"classification":[33,101],"of":[34,40],"known":[35,99,168],"classes":[36,169],"identification":[39,105],"unseen":[41,103,179],"attacks.":[42],"Moreover,":[43],"lack":[45],"support":[46],"incremental":[48,138],"updates.":[49],"In":[50],"this":[51],"paper,":[52],"we":[53,69,114],"propose":[54],"Helios,":[55],"an":[56],"in-network":[57,133],"detection":[60],"system,":[61],"continual":[63],"adaptation":[64],"in":[65,166,171,184],"attack-incremental":[66],"scenarios.":[67],"First,":[68],"design":[70,115],"a":[71,152],"novel":[72],"Supervised":[73],"Mixture":[74],"Prototypical":[75],"Learning":[76],"(SMPL)":[77],"method":[78],"combined":[79],"with":[80],"clustering":[81],"initialization":[82],"learn":[84],"prototypes":[85,110,124],"that":[86,161],"encapsulate":[87],"knowledge,":[89],"based":[90],"on":[91,151,157],"weighted":[93],"infinity":[94],"norm":[95],"distance.":[96],"SMPL":[97],"enables":[98],"class":[100],"attack":[104],"through":[106],"similarity":[107],"comparison":[108],"between":[109],"samples.":[112],"Then,":[113],"boundary":[116],"calibration":[117],"overlap":[119],"refinement":[120],"transform":[122],"learned":[123],"into":[125],"priority-guided":[126],"matching":[127],"rules,":[128],"ensuring":[129],"precise":[130],"efficient":[132],"deployment.":[134,202],"Additionally,":[135],"Helios":[136,150,162,186],"supports":[137],"prototype":[139],"learning":[140],"rule":[142],"updates,":[143],"achieving":[144],"low-cost":[145],"hardware":[146],"reconfiguration.":[147],"We":[148],"implement":[149],"Tofino":[153],"switch":[154],"evaluation":[156],"three":[158],"datasets":[159],"shows":[160],"achieves":[163],"superior":[164],"performance":[165],"classifying":[167],"(92%+":[170],"ACC":[172],"F1)":[174],"as":[175,177],"well":[176],"attacks":[180],"(62%":[181],"-":[182],"98%":[183],"TPR).":[185],"has":[187],"also":[188],"reduced":[189],"resource":[190],"consumption":[191],"reconfiguration":[193],"time,":[194],"demonstrating":[195],"its":[196],"scalability":[197],"efficiency":[199],"real-world":[201]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":2}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}