p4SD: A Lightweight Port Scan Detection for Programmable Networks

To address the challenge of detecting stealthy port scans in high-speed networks, this paper introduces p4SD, a lightweight anomaly detection system that identifies reconnaissance activities directly within programmable data planes. Leveraging the P4 language, p4SD uses a cyclic fingerprint buffer and frequency analysis to monitor for anomalous traffic without relying on attack signatures. The system is designed to detect both fast and slow port scans, as its method of measuring relative changes in distinct fingerprints between cycles effectively identifies both the rapid spikes from fast scans and the gradual increases from slow scans. The proof-of-concept demonstrates resource efficiency, achieving throughput close to the hardware's theoretical limits, detecting scan activity in near real-time, and enabling timely responses to potential threats. With over 99% detection accuracy for slow scans, these findings establish p4SD as a practical and scalable solution for real-time, in-network threat detection in modern SDN environments.