{ "schema_version": 1, "builder_plan": { "scenario": "Start with one repeated product task that has a measurable failure or cost.", "change": "Read the methods and identify one change you can isolate in that workflow.", "baseline": "Your current implementation on the same held-out tasks.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful outcomes, response time, human rework, and total cost per successful task.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.16363", "title": "FSNIC: A Low-Latency Flow-Based Intrusion Detection Architecture for FPGA SmartNICs", "summary": "The method replaces CPU-based or stateless packet-level intrusion detection with a stateful flow-level IDS (P4 parsing plus a LogicNets model in RTL) running inside an FPGA SmartNIC data plane. The cost is requiring FPGA SmartNIC hardware, P4/RTL development expertise, and a restricted model capacity imposed by fitting inference into 846 LUTs with no on-chip memory. It can fail on traffic distributions unlike UNSW-NB15/CICIDS2017, under encrypted traffic where flow features carry less signal, and when evasion or concept drift invalidates a model that is expensive to update in RTL.", "rationale": "The technique targets network data-plane hardware security, not LLM inference or training, and requires FPGA SmartNICs and hardware design skills outside the reader's infrastructure and production scope.", "technique": "FPGA SmartNIC flow-based intrusion detection", "family": "outro", "recommendation": "nao_aplica", "published": "2026-09-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.16363", "independent_implementations": 0, "total_implementations": 0, "stars": 0, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces CPU-based or stateless packet-level intrusion detection with a stateful flow-level IDS (P4 parsing plus a LogicNets model in RTL) running inside an FPGA SmartNIC data plane. The cost is requiring FPGA SmartNIC hardware, P4/RTL development expertise, and a restricted model capacity imposed by fitting inference into 846 LUTs with no on-chip memory. It can fail on traffic distributions unlike UNSW-NB15/CICIDS2017, under encrypted traffic where flow features carry less signal, and when evasion or concept drift invalidates a model that is expensive to update in RTL.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.16363", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Flow-based stateful classification raises detection accuracy from 86.92% to 97.68% over stateless packet-level classification on UNSW-NB15; hardware inference latency is 6 ns using 846 LUTs with no BRAM or DSP.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.16363", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "no_equations", "core_kind": "", "equations_fetched_at": "2026-10-13", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }