Fast Packet Processing with eBPF and XDP

Vieira, Marcos A. M.; Castanho, Matheus S.; Pacífico, Racyus D. G.; Santos, Élerson R. S.; Júnior, Eduardo P. M. Câmara; Vieira, Luiz F. M.

doi:10.1145/3371038

Cited by 144 publications

(20 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An Extended Barkley packet filtering (eBPF) and express data path are presented by M. A. Vieira [ 81 ] to introduce new technology for packet filtering and provide an example of a standard procedure of these technologies. The XDP program is written in the C or P4 languages, and the instructions are processed through the kernel and other programmable devices, such as a smart network interface card.…”

Section: Ddos Attack Detection In High-speed Networkmentioning

confidence: 99%

High-Speed Network DDoS Attack Detection: A Survey

Haseeb-ur-rehman,

Aman,

Hasan

et al. 2023

Sensors

View full text Add to dashboard Cite

Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber–Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.

show abstract

Section: Ddos Attack Detection In High-speed Networkmentioning

confidence: 99%

High-Speed Network DDoS Attack Detection: A Survey

Haseeb-ur-rehman,

Aman,

Hasan

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Author [2] states that eBPF enables runtime modification, interaction, and kernel programmability. XDP (eXpress Data Path) framework utilizes eBPF to write programs to process packets closer to the NIC for fast packet processing.…”

Section: Related Workmentioning

confidence: 99%

High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

ANAND,

Aakula

2023

Preprint

View full text Add to dashboard Cite

Denial of Service (DoS) and Distributed DoS (DDoS) attacks are standard prob-lems organizations that rely on network services face. Detecting these attackspromptly and accurately is crucial to mitigating the damage caused. This paperproposes an Intrusion Detection System (IDS) that utilizes the extended Berke-ley Packet Filter (eBPF) with machine learning algorithms, namely Decision Tree(DT), Random Forest (RF), Support Vector Machine (SVM), and TwinSVM.eBPF is a bytecode-based virtual machine that runs programs without modifyingthe kernel source code. It can implement various services, such as observabil-ity, security, and networking. Socket filters are an eBPF program attached tothe socket in the Linux kernel that allows for efficient filtering and manip-ulation of network packets at the socket after packets are received from thenetwork stack. Packets that are filtered at the socket level before enteringthe user space. The steps involved in the proposed model are: a) collectingdata from famous repository, CIC-IDS-2017. b) Once the raw data is obtained,it undergoes preprocessing, which includes data transmission, cleaning, reduc-tion, and discretization. c) Following the preprocessing step, an ANOVA F-testextracts specific features from the preprocessed data. d) Lastly, the extractedfeatures are analyzed for intrusion detection using various ML algorithms:DT, RF, SVM, and TwinSVM. e) The eBPF program captures network traf-fic and utilizes trained model parameters to detect attacks within the kernel.Our experimental results show that the accuracy of our proposed ML algo-rithms, DT, RF, SVM, and TwinSVM, outperforms the existing related work:99.38, 99.44, 88.73, and 93.82, respectively. The experimental code available inhttps://github.com/NemalikantiAnand/Project.git

show abstract

“…Because an IVN is built on embedded devices, packet transmission and reception (i.e., Tx/Rx) operations are optimized with a fine-grained procedure due to limited system resources. In order to achieve optimization, a number of fast packet processing frameworks have been applied and tested in the IVN, such as the Data Plane Development Kit (DPDK) and eXpress Data Path (XDP) [19], [20]. The DPDK is a user space micro-kernel solution that can accelerate packet-processing speed by skipping the conventional Operating System (OS) kernel space [19].…”

Section: A Automotive Ethernetmentioning

confidence: 99%

Resilient Raw Format Live Video Streaming Framework for an Automated Driving System on an Ethernet-Based In-Vehicle Network

Go,

Shin

2023

IEEE Access

View full text Add to dashboard Cite

The automotive Ethernet is an emerging area for exploiting the high network bandwidth and scalable network design in automated driving systems. Low-latency live video streaming over the automotive Ethernet is a challenging part of this concept because of its significance for driving situation awareness in real time. In order to achieve low-latency live video streaming on resource-constrained automotive electric control units, the streaming needs to be conducted with a fine-grained resource control. This article proposes a raw format live video streaming framework that resiliently controls the number of raw format video packets with consideration of available CPU resources. The evaluation on a testbed demonstrates that the proposed framework achieves low-latency live video streaming by securing available CPU resources.INDEX TERMS automotive Ethernet, raw format live video streaming, autonomous driving, low-latency, embedded system I. INTRODUCTION

show abstract

Fast Packet Processing with eBPF and XDP

Cited by 144 publications

References 15 publications

High-Speed Network DDoS Attack Detection: A Survey

High-Speed Network DDoS Attack Detection: A Survey

High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

Resilient Raw Format Live Video Streaming Framework for an Automated Driving System on an Ethernet-Based In-Vehicle Network

Contact Info

Product

Resources

About