A Programmable Security Architecture for Layer 3 Network Defense Based on P4

With the rapid development of the internet, cybersecurity threats, including malicious attacks, data breaches, and network viruses, have become increasingly severe. Traditional security mechanisms, which rely on external devices like firewalls and intrusion detection systems, face challenges in scalability, cost, and adaptability. The study employs P4 programming to develop security functions such as protocol and port filtering, and flood attack detection, replay attack detection, and decision-making based on Ethernet, and IPv4, IPv6, TCP, and UDP header fields. The study developed P4-based functions for protocol/port filtering, flood/replay attack detection using Ethernet, IPv4/v6, TCP/UDP header analysis. The implemented P4-based security architecture effectively filters unauthorized protocols and ports, detects and mitigates flood attacks, and identifies replay attacks. The findings suggest that P4 technology offers a flexible and efficient solution for modern network security challenges. Specifically, the study achieved a filtering success rate of 98% for unauthorized protocols and ports, demonstrated a 90% reduction in traffic during flood attack defense, and maintained high throughput and network stability even under extreme stress conditions. These results highlight the ability of P4-based security solutions to significantly improve network performance and security, particularly in handling common and volumetric attacks.