# pForest: In-Network Inference with Random Forests

arXiv: https://arxiv.org/abs/1909.05680 · HTML: https://mlsanity.com/paper/1909.05680/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Sep 2019.

## Built on by (most cited first, 10 of 10)

- [FENXI: Deep-learning Traffic Analytics at the Edge](https://mlsanity.com/paper/2105.11738/) (2021)
- [Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed](https://mlsanity.com/paper/2403.11090/) (2024)
- [IIsy: Practical In-Network Classification](https://mlsanity.com/paper/2205.08243/) (2022)
- [Landing AI on Networks: An equipment vendor viewpoint on Autonomous Driving Networks](https://mlsanity.com/paper/2205.08347/) (2022)
- [Credence: Augmenting Datacenter Switch Buffer Sharing with ML Predictions](https://mlsanity.com/paper/2401.02801/) (2024)
- [FlowWise: Stateful Fast-Slow Model Serving for Streaming Traffic Intelligence](https://mlsanity.com/paper/2402.03694/) (2024)
- [Non-uniformity is All You Need: Efficient and Timely Encrypted Traffic Classification With ECHO](https://mlsanity.com/paper/2406.01852/) (2024)
- [Automating In-Network Machine Learning](https://mlsanity.com/paper/2205.08824/) (2022)
- [Optimal In-Network Distribution of Learning Functions for a Secure-by-Design Programmable Data Plane of Next-Generation Networks](https://mlsanity.com/paper/2411.18384/) (2024)
- [Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection](https://mlsanity.com/paper/2607.16348/) (2026)

## Abstract (arXiv)

When classifying network traffic, a key challenge is deciding when to perform the classification, i.e., after how many packets. Too early, and the decision basis is too thin to classify a flow confidently; too late, and the tardy labeling delays crucial actions (e.g., shutting down an attack) and invests computational resources for too long (e.g., tracking and storing features). Moreover, the optimal decision timing varies across flows. We present pForest, a system for "As Soon As Possible" (ASAP) in-network classification according to supervised machine learning models on top of programmable data planes. pForest automatically classifies each flow as soon as its label is sufficiently established, not sooner, not later. A key challenge behind pForest is finding a strategy for dynamically adapting the features and the classification logic during the lifetime of a flow. pForest solves this problem by: (i) training random forest models tailored to different phases of a flow; and (ii) dynamically switching between these models in real time, on a per-packet basis. pForest models are tuned to fit the constraints of programmable switches (e.g., no floating points, no loops, and limited memory) while providing a high accuracy. We implemented a prototype of pForest in Python (training) and P4 (inference). Our evaluation shows that pForest can classify traffic ASAP for hundreds of thousands of flows, with a classification score that is on-par with software-based solutions.