Implementation and Evaluation of an FPGA-Based NIPS with Server Response Time–Aware Dynamic Classification Ratio Control

Abstract

In this study, we implement a machine learning–based NIPS on an FPGA to detect and block DDoS attacks, and propose a false-positive reduction method that considers server load. The proposed method periodically measures traffic volume and server response time to estimate the server load. By adopting the larger classification ratio determined from these two metrics, the system performs stepwise blocking control that suppresses unnecessary blocking under low-load conditions while ensuring detection performance under high-load conditions. In the accuracy evaluation, Precision, Recall, F1-score, FPR, and FNR were calculated for each classification ratio, and we quantitatively demonstrated the trade-off whereby Recall and F1-score improve as the classification ratio increases, while FPR also increases. Compared with the previous approach that relies solely on traffic volume as an indicator of server load, the introduction of response time provides a more flexible basis for load-dependent control and suggests the potential to better address low-traffic DDoS attacks under the evaluated conditions. However, in this study, the classification ratio update interval and threshold values are configured as representative examples for system validation. In addition, the response time measurement mechanism is applicable only to TCP traffic. Therefore, the reported results demonstrate the feasibility and effectiveness of the proposed approach within this scope, rather than providing a generalized validation across all attack types and protocols. In the implementation evaluation, a minimum latency of approximately 730 ns was achieved, and it was confirmed that throughput
equivalent to approximately 10 Gbps can be processed without packet loss under multiple packetsize conditions. Furthermore, even when the classification ratio update period was changed to 0.5, 1, and 2 s, the latency variation remained below 0.5 %, and 10 Gbps traffic was processed stably, demonstrating the processing stability against changes in the update period.