Diagnosing Programmable Data Plane Attacks with Provenance Observability
This work presents ProvP4, a provenance-based cross-plane observer designed to observe and analyze stateful data plane attacks in programmable networks, and demonstrates that ProvP4 imposes minimal overhead in terms of storage and performance, while significantly enhancing security analysis capabilities.