Sripath Mishra

Sripath Mishra

CS PhD candidate at Purdue. Anomaly and intrusion detection for edge and distributed systems — explainable AI, low-latency inference, federated learning, retrieval, GNNs. Seeking Applied Scientist / ML Engineer roles, 2027 start.

FlowRAG — Two-Stage Edge–Cloud Intrusion Detection

Paper · Evaluated on UAV-CAS · Code: not yet public

Intrusion detection for UAV swarms where topology, traffic, and threats all move mid-mission — and where the detector runs on the drone.

The finding the design is built on: profiling the deployment showed that on-device latency, not accuracy, is the binding constraint. That inverts the usual question from “how much accuracy do we lose by shrinking the model” to “what can we decide locally inside the budget, and what is worth spending a radio transmission on.”

Architecture. A fast path — random forest, on-device — screens every flow window in 4.78 ms mean / 6.16 ms P99 on a Raspberry Pi 4B with the process pinned to two cores. Ambiguous windows escalate to a slow path: BallTree retrieval at the base station. An escalation is compact enough to fit in a single MTU (~800 bytes per window).

Operating point. Escalating 10% of flows — ~90% resolved on-device — is not the F1-maximizing choice; 30% scores higher. But 10% reaches 97.5% of maximum achievable F1 while leaving the link free for mission telemetry, which is the constraint an operator actually cares about. Result: +16% F1 over the strongest baseline under mobility-induced drift.

Retrieval, not generation. Retrieval regenerates the training set for the current operating regime rather than generating text — no language model in the loop. This lets the detector absorb new attack variants as the distribution moves: +7–10 F1 points over baselines (0.81–0.82 vs. 0.72–0.75) across 5–20-UAV swarms.

My role: end-to-end — problem framing, architecture, on-device profiling, training, and evaluation under drift.

Stack: Python, scikit-learn, PyTorch, Containernet, Raspberry Pi 4B.

Links