Binocular: Dual-Plane Anomaly Detection with In-Switch Inference and Control-Plane Refinement

Modern networks increasingly operate at line rate, yet most Intrusion Detection Systems (IDSs) still rely on off-path servers to analyze mirrored traffic, resulting in latency, bandwidth overhead, and scalability bottlenecks. As high-throughput, low-latency infrastructures become the norm, there is a pressing need for intrusion detection that operates directly within the network fabric itself. In this work, we address the challenge of bringing intelligent anomaly detection into the data plane without sacrificing performance or adaptability. We present Binocular, an in-network anomaly-detection framework that embeds a compact neural network within a programmable switch and augments it with a control-plane refinement loop to enable confidence-aware decisions and continuous model adaptation. Our results show that our solution sustains line-rate inference with microsecond-scale latency, achieves up to 95% F1 on standard intrusion-detection benchmarks, and leverages confidence-aware retraining to recover over 70% of lost F1 under traffic distribution shifts.