Blog Details

Invented by Deng; Suiqiang, Fu; Yu, Lai; Weiming, Devulapalli; Biraja

Welcome to a new era of network security. In this article, we’ll open the hood on a fresh patent application for deep learning in the data plane of security hardware. We’ll explore why this technology matters, how it fits into the busy world of cybersecurity, how it builds on what came before, and what makes it truly special. If you’ve ever wondered how firewalls are getting smarter at stopping bad actors, keep reading.

Background and Market Context

Computers are everywhere. They talk to each other all day—at work, at home, and in the cloud. This constant chatter is called network traffic. It helps people work, shop, play, and learn. But there’s a problem: some of this traffic isn’t friendly. Malware sneaks in, often hidden in what looks like normal messages or files. Malware is just a word for bad software that tries to steal, spy, or break things. It comes in many shapes—viruses, ransomware, spyware, or tools for hackers.

For years, companies have used firewalls to block out these threats. Firewalls are like locked doors. They check each packet of data and decide if it gets in or stays out. At first, firewalls just looked at simple details, like where data came from or where it was going. Later, they learned to look deeper, checking what type of program was being used or what kind of file was inside. Modern “next-generation” firewalls can even spot known attacks by comparing bits of traffic to a list of dangerous files or addresses, like a bouncer with a list of banned guests.

But here’s the snag: hackers are clever. They make new kinds of malware every day. They hide their code, change their addresses, and use tricks to look normal. These tricks make it hard for old-style firewalls and security tools to keep up. If the firewall doesn’t have a signature—a fingerprint—for the new malware, it might let it through. This is especially risky for “zero-day” threats, which are so new that nobody has found them before.

Some companies started sending suspicious traffic to the cloud for deep inspection. In the cloud, powerful computers run smart models—like deep learning networks—to look for weird patterns that might mean trouble. But sending data to the cloud takes time and uses up bandwidth. It can slow down the network and isn’t always possible for every bit of traffic. Because of this, only a tiny slice of traffic—about 1 percent—gets this advanced check.

So, what’s the big challenge? Companies want to scan much more traffic, in real time, without slowing everything down. They need tools that are both fast and smart, able to spot new tricks by bad actors right as the data flows by. That’s the context for this patent: bringing deep learning straight into the core of the firewall or security appliance, so it can scan traffic as it happens, not after the fact.

In simple words, this shift means more traffic gets checked closely, bad stuff is caught sooner, and the network keeps running smoothly—no long waits, no heavy costs, and no easy hiding spots for malware. As threats grow and attacks get smarter, this new approach is quickly becoming a must-have in the market for network security.

Scientific Rationale and Prior Art

Let’s look at what’s been tried before, and why it’s not enough anymore. Traditional malware detection relied on known patterns or “signatures.” Imagine a guard with a photo album of known criminals. If the guard sees someone who matches a photo, he sounds the alarm. But what if a criminal puts on a disguise or there’s a new crook no one’s seen? The guard is fooled.

To catch these sneaky threats, security tools added more layers. They started looking at what programs do (behavior analysis) or checked files in safe, isolated environments called “sandboxes.” The sandbox would run a file and watch for suspicious actions—like trying to steal data or connect to a bad server. If it acted up, the file was stopped. But sandboxes are slow and need lots of computer power.

More recently, companies started using machine learning—a way for computers to spot patterns in huge piles of data. Machine learning is good at noticing things that are a little off, even if they don’t match a known pattern. The best machine learning models, called deep learning models, use big networks of “neurons” (tiny steps in the computer’s brain) to make sense of complex data, like traffic logs or file contents.

But there’s a catch: deep learning models are heavy. They need lots of memory and computing muscle. That’s why, until now, most deep learning malware checks happened in the cloud, not inside the firewall itself. The firewall would send just the most suspicious data to the cloud, and the cloud would send back a verdict. This helped, but only a small amount of traffic could be checked this way, because sending data up and down takes time and can slow everything down. The round trip—sending data to the cloud and waiting for an answer—could take 100 milliseconds or more, which is a lot in network terms.

Some systems tried to fix this by pre-filtering: using simple rules to pick out the riskiest traffic and only sending that to the cloud. But this means most traffic never gets the deep check. Plus, hackers keep inventing ways to look normal, making it harder for pre-filters to spot what’s bad.

There have been improvements in hardware, too. New CPUs (the brains of computers) are faster and support special instructions for machine learning. Some devices use FPGAs or ASICs—special chips made for a single job—to speed things up. But fitting a deep learning model into a firewall’s limited memory, and making it run fast enough to keep up with gigabytes of traffic per second, is still a big technical hurdle.

Previous inventions have tried to bridge this gap, but they rarely put the full power of deep learning right inside the data plane—the part of the firewall that handles live traffic. They also didn’t solve the problem of keeping the models up to date, or making sure they were small enough and fast enough for real-world use.

This new patent builds on all that history. It takes the best of deep learning, shrinks and tunes the models for fast, local use, and puts them right where they’re needed: at the front line, inside the firewall or security appliance itself. This lets much more traffic be checked, right away, with less delay and better results.

Invention Description and Key Innovations

Now let’s get into the heart of the invention. What exactly does it do, and why does it matter?

At its core, this system puts a deep learning model directly inside the hardware or software that protects a network—like a firewall or security gateway. Instead of sending suspicious traffic to the cloud and waiting for a response, the system checks traffic right as it passes through, using a local deep learning model. Think of it like giving every guard dog at the gate a super-smart nose, able to sniff out new threats as soon as they show up.

Here’s how it works in a simple way:

The security platform (like a firewall) watches each network session—basically, every ongoing conversation between computers. As data flows through, the system can run a deep learning model right on that data. This model has been trained to spot signs of trouble—like the fingerprints of malware, strange command-and-control messages, or fishy web addresses.

If the model thinks the traffic is bad, the system can act right away. It might drop the data, block the connection, send an alert, log what happened, quarantine the device, or, if needed, send the traffic to the cloud for even deeper analysis. All of this happens in real-time, as the traffic flows by.

What makes this different and special? First, the deep learning model isn’t just any model—it’s been optimized to run fast, use less memory, and fit inside the limited resources of security hardware. Techniques like quantization (shrinking the data the model uses), pruning (cutting out unnecessary parts), and careful design make it possible to run these models on the same CPUs that handle live traffic, often in less than a millisecond per check.

The system can also update its models regularly, downloading the newest versions from a secure cloud. That way, it stays smart and ready for the latest tricks from hackers. The platform also supports different types of models for different jobs: catching malware in web traffic, spotting command-and-control messages, filtering dangerous URLs, or watching for odd DNS requests. Each model can focus on a specific threat, making detection sharper and more accurate.

Another key trick is “tokenization.” Before the model checks traffic, the system turns raw data into a set of tokens—simple numbers that represent key words or patterns. For example, in an HTTP request, “GET” might become 100, “HTTP” might be 103, and so on. This makes it easier for the model to spot patterns, even if hackers try to hide their intent by using weird formats or extra spaces.

The system uses a clever process to decide when to apply the deep learning model. It can run a quick pre-filter to weed out obviously safe or irrelevant traffic, keeping the heavy checks for the most likely threats. This saves resources and lets the platform handle high speeds without slowing down.

If the local model isn’t sure, or if the threat seems truly new, the system can still send data to the cloud for a second opinion. But now, much more traffic gets scanned deeply, right at the edge, and only the trickiest cases need extra analysis.

This approach brings several big benefits:

• Far more traffic can be checked by deep learning, making it much harder for malware to slip by unseen.
• Decisions happen almost instantly, so there’s no delay for users and no bottleneck in the network.
• The system stays up-to-date, always learning from new threats and adapting quickly.
• Resource use is balanced, so high-speed networks can stay fast and protected at the same time.
• All of this happens in a way that’s modular and extendable—new models can be added as new types of threats emerge.

In plain language, this invention gives security platforms the brains of the cloud, right at the front line. It’s like putting a security expert in every firewall, making decisions in real time, at scale.

The patent also covers how these models are managed, updated, and validated. For example, the models are downloaded securely, checked for size and integrity, and kept in shared memory so they can be used by all parts of the security platform without wasting space. The system can even handle different rules—for example, deciding when to just log a threat, when to block it outright, or when to reset a connection.

Finally, the invention isn’t limited to one type of malware or threat. It can be trained to spot all sorts of bad behavior: from phishing, to ransomware, to sneaky command-and-control traffic. It can work in physical hardware, in virtual machines, or even in cloud or containerized environments, making it flexible for all types of networks and businesses.

Conclusion

As networks grow and threats get smarter, the tools we use to defend them must get smarter and faster, too. This patent application marks a big step forward. By fitting powerful deep learning models right into the devices that guard our data, it closes the gap between detection and action. More traffic gets checked, more threats are caught, and businesses can keep moving at top speed.

For anyone building or running a network, this approach offers a practical, forward-looking way to stay ahead of attackers. It blends the best of machine learning with the demands of real-time, high-speed environments. In a world where every second counts and every byte might hide a threat, deep learning in the data plane is set to become a cornerstone of modern security.

Stay tuned—because in cybersecurity, the only thing constant is change. And with inventions like this, defenders are getting a new edge.

Click here https://ppubs.uspto.gov/pubwebapp/ and search 20250337773.