Multi-Memristor Based Distributed Decision Tree Circuit for Cybersecurity Applications

Cybersecurity at the edge requires fast computing in energy-constrained environments. Decision trees can provide an explainable solution for network intrusion detection with high detection accuracy at the packet level. However, their hardware implementation needs to support efficient real-time operation. In this paper, we propose a spatially distributed decision tree for network intrusion detection, using memristor-based chiplet leaves. Each chiplet processes an input by comparing it to a predefined boundary stored in the memristor cell and provides a binary output to select one of the interconnected leaves on the lower level, with an estimated power consumption in a 130nm node design of 389 <tex-math notation="LaTeX">μ</tex-math> W. The delay is 2.5 <tex-math notation="LaTeX">μ</tex-math> s for one inference decision. This chiplet approach is reconfigurable and in line with the natural architecture of decision trees. It also supports the prototyping with known good dies, overcoming the non-idealities challenge prevalent in memristor technologies. Our memristor-based decision trees show high intrusion detection accuracy of 82%, 84%, and 73% on the benchmark UNSW, CIC-IDS, and ACI-IoT datasets respectively, considering 6-bit device precision in one memristor vs. three memristor per boundary configurations. This distributed approach opens the way to utilizing memristor technology despite device defects for applications in need of local real-time computing.