Accelerated data movement between data processing unit (DPU) and graphics processing unit (GPU) to address real-time cybersecurity requirements
Apparatuses, systems, and techniques for detecting that a host device is subject to a malicious network attack using a machine learning (ML) detection system are described. A computing system includes a graphics processing unit (GPU) and an integrated circuit with a network interface, and a hardware acceleration engine. The integrated circuit hosts a hardware-accelerated security service to extract features from network data and metadata from the hardware acceleration engine and sends the extracted features to the GPU. Using the ML detection system, the GPU determines whether the host device is subject to a malicious network attack using the extracted features. The GPU can send an enforcement rule to the integrated circuit responsive to a determination that the host device is subject to the malicious network activity.
1. A computing system comprising:
a graphics processing unit (GPU) comprising a cybersecurity platform with one or more accelerated machine learning pipelines; and
a data processing unit (DPU) coupled to the GPU, wherein the DPU comprises:
a network interface operatively coupled to a network, the network interface to receive network traffic directed to a host device from a second device over the network;
a host interface operatively coupled to the host device, the DPU to send the network traffic to the host device over the host interface;
an acceleration hardware engine operatively coupled to the network interface and the GPU, wherein the acceleration hardware engine is to host a hardware-accelerated security service to:
extract first feature data from the network traffic;
extract second feature data from telemetry data generated and stored by the acceleration hardware engine, wherein the telemetry data is associated with operations of the acceleration hardware engine;
send the first feature data and the second feature data to the cybersecurity platform to determine whether the host device is subject to a malicious network attack using the one or more accelerated machine learning pipelines;
receive an enforcement rule from the cybersecurity platform responsive to a determination by the cybersecurity platform that the host device is subject to the malicious network attack; and
perform an action, associated with the enforcement rule, on subsequent network traffic directed to the host device from the second device.
2. The computing system of claim 1 , wherein the cybersecurity platform is to:
receive the first feature data and the second feature data from the hardware-accelerated security service;
determine whether the host device is subject to the malicious network attack using a classification model of the one or more accelerated machine learning pipelines, the classification model being trained to classify the first and second feature data as malicious or benign; and
send the enforcement rule to the hardware-accelerated security service responsive to the determination that the host device is subject to the malicious network attack.
3. The computing system of claim 2 , wherein the cybersecurity platform comprises feature extraction logic to tokenize the first feature data into tokens and extract numeric features from the second feature data, and wherein the classification model comprises:
an embedding layer to receive the tokens as an input sequence of tokens and generate an input vector based on the input sequence of tokens;
a Long Short-Term Memory (LSTM) layer trained to generate an output vector based on the input vector; and
a neural network layer trained to classify the first and second feature data as malicious or benign using the output vector from the LSTM layer and the numeric features of the second feature data.
4. The computing system of claim 1 , wherein the DPU is a programmable data center infrastructure on a chip.
5. The computing system of claim 4 , further comprising:
a central processing unit (CPU) operatively coupled to the acceleration hardware engine and the GPU, wherein the acceleration hardware engine to handle network data path processing, wherein the CPU is to control path initialization and exception processing.
6. The computing system of claim 1 , wherein the host device resides in a first computing domain, wherein the hardware-accelerated security service and the cybersecurity platform reside in a second computing domain different than the first computing domain.
7. The computing system of claim 1 , wherein the host device resides in a first computing domain, wherein the hardware-accelerated security service resides in a second computing domain different than the first computing domain, and wherein the cybersecurity platform resides in a third computing domain different than the first computing domain and the second computing domain.
8. The computing system of claim 1 , wherein the telemetry data is stored in at least of i) one of one or more registers of the acceleration hardware engine or ii) a hardware counter of the acceleration hardware engine.