---
格式版本: 2
标题: "XNET: Intelligent Dynamic Sampling for High-Speed Network Security Monitoring"
原文链接: "https://arxiv.org/abs/2608.18349"
发布日期: "2026-08-18"
发布时间校准状态: "found"
发布时间需复核: "否"
发布时间来源: "rule:local:strict_original_body"
发布时间证据: "**\\[v1\\]** Tue, 18 Aug 2026 22:05:30 UTC (810 KB)"
发布时间校准原因: "规则确认唯一严格发布时间，来源 local:strict_original_body"
发布时间校准置信度: "high"
发布时间候选数量: 18
发布时间严格候选数量: 6
发布时间原页读取状态: "source template page reused from URL open"
发布时间未找到原因: ""
发布时间校准时间: "2026-08-20T14:22:30+08:00"
发布时间仲裁状态: "skipped"
发布时间仲裁尝试次数: 0
发布时间仲裁耗时毫秒: 0
发现时间: "2026-08-20T14:19:36+08:00"
入库时间: "2026-08-20T06:22:30.670Z"
来源平台: "arXiv 学术论文搜索"
搜索渠道: "source_template"
搜索词: "https://arxiv.org/search/?query=Scale-up&searchtype=all"
匹配关键词:
  - "Scale-up"
相关厂家:
  []
相关专家:
  []
内容类型: "网页"
抓取工具: "Free Fetch + Defuddle"
清洗工具: "Defuddle Markdown + Defuddle/Readability 正文提取"
原始附件:
  []
AI优质: "否"
AI打分: 5
AI分档: "非优质"
AI质检状态: "不通过"
AI打分理由: "页面为arXiv搜索入口，实际论文主题是网络安全监控（XNET动态采样），与超节点/AI Rack/机柜级AI基础设施完全无关，无技术或商业信号。"
AI质检模型: "ali-deepseek-v4-flash"
AI质检时间: "2026-08-20T14:23:06+08:00"
AI主题相关性: 0
AI来源权威性: 5
AI新颖性: 0
AI技术细节: 0
AI商业部署信号: 0
AI完整性: 5
AI摘要: "XNET是一个基于Linux XDP的高速网络安全监控系统，通过按安全价值动态采样，在商用硬件上以线速放大多被忽略的低速率威胁流量。真实网络部署表明，它能减少84%流量且无丢包，并将IDS检测率提升至99.6%。"
AI摘要模型: "ali-deepseek-v4-flash"
AI摘要时间: "2026-09-07T03:20:56.953Z"
采集批次: "2026年8月20日14点19分32秒"
采集批次ID: "20260820-141932-079"
去重键: "https://arxiv.org/abs/2608.18349"
---

## Computer Science > Cryptography and Security

## Title:XNET: Intelligent Dynamic Sampling for High-Speed Network Security Monitoring

[View PDF](https://arxiv.org/pdf/2608.18349) [HTML (experimental)](https://arxiv.org/html/2608.18349v1)

> Abstract:Growing network speeds, with 100GbE line rates becoming common in modern enterprise networks, pose challenges to operators and security applications, as they struggle to scale their operational efficiency accordingly, without relying on costly hardware, excessive sampling, or complex distributed deployments. Unintentional loss due to stochastic packet sampling often produces low-quality traffic, further risking missed detection of critical security incidents, particularly those hidden in typically low-rate traffic, such as APT/malware command-and-control communications. In this paper, we introduce XNET, a system that monitors traffic at line rate using commodity hardware and applies dynamic sampling to amplify the visibility of high security value traffic. XNET leverages Linux's XDP technology to process packets efficiently, classify them based on their security value, and sample them as per configured policies. The outcome is a reduced packet stream in which the security-relevant portion of the traffic is amplified at the expense of less interesting traffic segments. XNET is a highly flexible, scalable and dynamic system that can be adapted based on a network's needs. We deployed XNET in a large real-world network using only commodity hardware, where our results show that XNET can achieve up to 84% traffic reduction with no packet loss while increasing the visibility of otherwise negligible traffic fivefold. With controlled stress tests, we further demonstrate XNET's scalability up to 100Gbps. Additionally, we show that XNET sampling led to a detection rate of 99.6% in an IDS application.

| Comments: |  |
| --- | --- |
| Subjects: | Cryptography and Security (cs.CR); Networking and Internet Architecture (cs.NI) |
| ACM classes: | C.2.3; C.2.0; D.4.4; C.4 |
| Cite as: | [arXiv:2608.18349](https://arxiv.org/abs/2608.18349) \[cs.CR\] |
|  | (or [arXiv:2608.18349v1](https://arxiv.org/abs/2608.18349v1) \[cs.CR\] for this version) |
|  | [https://doi.org/10.48550/arXiv.2608.18349](https://doi.org/10.48550/arXiv.2608.18349) |

## Submission history

From: Thomas Papastergiou \[[view email](https://arxiv.org/show-email/fdba8b2f/2608.18349)\]  
**\[v1\]** Tue, 18 Aug 2026 22:05:30 UTC (810 KB)

[Which authors of this paper are endorsers?](https://arxiv.org/auth/show-endorsers/2608.18349) | Disable MathJax ([What is MathJax?](https://info.arxiv.org/help/mathjax.html))