Machine learning is increasingly used in programmable data planes, such as switches and smartNICs, to enable real-time traffic analysis and security monitoring at line rate. Decision trees (DTs) are particularly well-suited for these tasks due to their interpretability and compatibility with the Reconfigurable Match-Action Table (RMT) architecture. However, current DT implementations require collecting all features upfront, which limits scalability and accuracy due to constrained data plane resources. This paper introduces SpliDT, a scalable framework that reimagines DT deployment as a partitioned inference problem over a sliding window of packets. By dividing inference into sequential subtrees—each using its own set of top-k features—SpliDT supports more stateful features without exceeding hardware limits. An in-band control channel manages transitions between subtrees and reuses match keys and registers across partitions, implemented using P4 for packet recirculation and control-plane coordination. This design allows physical resources to be shared efficiently while maintaining line-rate processing. To maximize accuracy and scalability, SpliDT employs a custom training and design-space-exploration (DSE) workflow that jointly optimizes feature allocation, tree depth, and partitioning. Evaluations show that SpliDT supports up to 5x more features, scales to millions of flows, and outperforms baselines, with low overhead and minimal time-to-detection (TTD).
Murayyiam Parvez is a Ph.D. candidate in the Department of Computer Science at Purdue University, advised by Professor Muhammad Shahbaz and Professor Sonia Fahmy. Her research focuses on designing the next generation of hybrid software–hardware abstractions and architectures for emerging network security and machine learning applications, with an emphasis on leveraging programmable switches to enable high-performance, in-network intelligence.
