  Programmable data planes offer precise control over the low-level processing
steps applied to network packets, serving as a valuable tool for analysing
malicious flows in the field of intrusion detection. Albeit with limitations on
physical resources and capabilities, they allow for the efficient extraction of
detailed traffic information, which can then be utilised by Machine Learning
(ML) algorithms responsible for identifying security threats. In addressing
resource constraints, existing solutions in the literature rely on compressing
network data through the collection of statistical traffic features in the data
plane. While this compression saves memory resources in switches and minimises
the burden on the control channel between the data and the control plane, it
also results in a loss of information available to the Network Intrusion
Detection System (NIDS), limiting access to packet payload, categorical
features, and the semantic understanding of network communications, such as the
behaviour of packets within traffic flows. This paper proposes P4DDLe, a
framework that exploits the flexibility of P4-based programmable data planes
for packet-level feature extraction and pre-processing. P4DDLe leverages the
programmable data plane to extract raw packet features from the network
traffic, categorical features included, and to organise them in a way that the
semantics of traffic flows are preserved. To minimise memory and control
channel overheads, P4DDLe selectively processes and filters packet-level data,
so that only the features required by the NIDS are collected. The experimental
evaluation with recent Distributed Denial of Service (DDoS) attack data
demonstrates that the proposed approach is very efficient in collecting compact
and high-quality representations of network flows, ensuring precise detection
of DDoS attacks.
