Using P2P DMA

AI-based Web Application Firewall

As smart devices increasingly challenge traditional CPU-centric architectures, the need for more efficient and secure web applications has never been greater.

Our latest white paper explores how AI can enhance web security, focusing on the innovative use of P2P DMA between NVIDIA GPUs and DPUs. Learn how this approach bypasses the CPU, improving both security and performance in web application firewalls.

The main topics covered in this white paper:

The CPU-centric packet path compared with P2P DMA from DPU to GPU
Solution architecture split across BlueField-2 DPU, host CPU and GPU
SQL injection detection with mobilebert-sql-injection-detect via PyTorch CUDA Graphs
HTTP header extraction on the DPU to reduce PCI traffic to the GPU
Next steps: DOCA Flow stream blocking, an ML framework, storage uses

AI-based Web Application Firewall — document render

Why download this white paper?

How does P2P DMA take the CPU out of the packet path?
Selected packet data travels straight from the BlueField-2 DPU to the GPU, where an AI model decides whether to drop or forward each packet. The host CPU stays idle during firewall traffic processing and is free for HTTP requests or other work.
What does the proof of concept look like inside?
The whitepaper splits the solution across DPU, CPU and GPU and follows a packet step by step, from HTTP header extraction on the DPU to the DMA read of the model's verdict. Sending only part of each packet to the GPU reduces PCI traffic and improves performance and latency.
Which AI model guards the application?
The proof of concept runs the mobilebert-sql-injection-detect model to catch SQL injection, scheduled from the GPU itself with PyTorch CUDA Graphs. The paper also explains what another model needs to take its place: input the DPU can fill through memory operations.
Where can the approach go next?
The paper outlines blocking whole traffic streams with DOCA Flow, detecting DDoS attacks, and a framework for building ML and DPU-based solutions around any model. It also points to network monitoring, media streaming and content delivery as fields for P2P DMA.