eBPF/XDP Based Network Traffic Visualization and DoS Mitigation for Intelligent Service Protection

Choe, YoungEun; Shin, Junsik; Lee, Seunghyung; Kim, Jong-Won

doi:10.1007/978-3-030-39746-3_47

Cited by 8 publications

(5 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The architecture of speed network typically consists of the following components: The Network In Card (NIC), which is a hardware component that connects the computer to the n server. The classification of its speed as bits or bytes is discussed above in Table [58] Sensors 2023, 23, x FOR PEER REVIEW 4 of 25 are 40 Gigabit Ethernet, 100 Gigabit Ethernet, and InfiniBand [22]. A Cisco Report predicted that the internet protocol may cross 4.3 zettabytes in 2023, which is 1879 exabytes higher than 2018 [3].…”

Section: Architecture Of High-speed Networkmentioning

confidence: 99%

High-Speed Network DDoS Attack Detection: A Survey

Haseeb-ur-rehman,

Aman,

Hasan

et al. 2023

Sensors

View full text Add to dashboard Cite

Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber–Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.

show abstract

Section: Architecture Of High-speed Networkmentioning

confidence: 99%

High-Speed Network DDoS Attack Detection: A Survey

Haseeb-ur-rehman,

Aman,

Hasan

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…[34] suggests using AI to identify performance irregularities using eBPF. eBPF is used in [35], [36] and also [37] in order to build countermeasures for DoS assaults. They don't make use of ML at all.…”

Section: Related Workmentioning

confidence: 99%

High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

ANAND,

Aakula

2023

Preprint

View full text Add to dashboard Cite

Denial of Service (DoS) and Distributed DoS (DDoS) attacks are standard prob-lems organizations that rely on network services face. Detecting these attackspromptly and accurately is crucial to mitigating the damage caused. This paperproposes an Intrusion Detection System (IDS) that utilizes the extended Berke-ley Packet Filter (eBPF) with machine learning algorithms, namely Decision Tree(DT), Random Forest (RF), Support Vector Machine (SVM), and TwinSVM.eBPF is a bytecode-based virtual machine that runs programs without modifyingthe kernel source code. It can implement various services, such as observabil-ity, security, and networking. Socket filters are an eBPF program attached tothe socket in the Linux kernel that allows for efficient filtering and manip-ulation of network packets at the socket after packets are received from thenetwork stack. Packets that are filtered at the socket level before enteringthe user space. The steps involved in the proposed model are: a) collectingdata from famous repository, CIC-IDS-2017. b) Once the raw data is obtained,it undergoes preprocessing, which includes data transmission, cleaning, reduc-tion, and discretization. c) Following the preprocessing step, an ANOVA F-testextracts specific features from the preprocessed data. d) Lastly, the extractedfeatures are analyzed for intrusion detection using various ML algorithms:DT, RF, SVM, and TwinSVM. e) The eBPF program captures network traf-fic and utilizes trained model parameters to detect attacks within the kernel.Our experimental results show that the accuracy of our proposed ML algo-rithms, DT, RF, SVM, and TwinSVM, outperforms the existing related work:99.38, 99.44, 88.73, and 93.82, respectively. The experimental code available inhttps://github.com/NemalikantiAnand/Project.git

show abstract

“…BPF extensions have achieved phenomenal adoptions in recent years, including security [36,40,44,45] , storage [30,59,70,76], profiling [2,13,42] and networking [11,31,37,38,43,51,63,69,71,74,77,78]. Recent advances on safe BPF infrastructures and implementations [33,47,48,55,56,61,65,66,75,78] further eliminate the barrier of adoptions.…”

Section: Related Workmentioning

confidence: 99%

Verified programs can party

Kuo

Chen

et al. 2022

Proceedings of the Seventeenth European Conference on Computer Systems

View full text Add to dashboard Cite

Operating system (OS) extensions are more popular than ever. For example, Linux BPF is marketed as a "superpower" that allows user programs to be downloaded into the kernel, verified to be safe and executed at kernel hook points. So, BPF extensions have high performance and are often placed at performance-critical paths for tracing and filtering.However, although BPF extension programs execute in a shared kernel environment and are already individually verified, they are often executed independently in chains. We observe that the chain pattern has large performance overhead, due to indirect jumps penalized by security mitigations (e.g., Spectre), loops, and memory accesses.In this paper, we argue for a separation of concerns. We propose to decouple the execution of BPF extensions from their verification requirements-BPF extension programs can be collectively optimized, after each BPF extension program is individually verified and loaded into the shared kernel.We present KFuse, a framework that dynamically and automatically merges chains of BPF programs by transforming indirect jumps into direct jumps, unrolling loops, and saving memory accesses, without loss of security or flexibility. KFuse can merge BPF programs that are (1) installed by multiple principals, (2) maintained to be modular and

show abstract

eBPF/XDP Based Network Traffic Visualization and DoS Mitigation for Intelligent Service Protection

Cited by 8 publications

References 3 publications

High-Speed Network DDoS Attack Detection: A Survey

High-Speed Network DDoS Attack Detection: A Survey

High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

Verified programs can party

Contact Info

Product

Resources

About