A flow-based IDS using Machine Learning in eBPF

02/19/2021
by   Maximilian Bachl, et al.
0

eBPF is a new technology which allows dynamically loading pieces of code into the Linux kernel. It can greatly speed up networking since it enables the kernel to process certain packets without the involvement of a userspace program. So far eBPF has been used for simple packet filtering applications such as firewalls or Denial of Service protection. We show that it is possible to develop a flow based network intrusion detection system based on machine learning entirely in eBPF. Our solution uses a decision tree and decides for each packet whether it is malicious or not, considering the entire previous context of the network flow. We achieve a performance increase of over 20 compared to the same solution implemented as a userspace program.

READ FULL TEXT

page 1

page 2

research
10/03/2018

Generating Labeled Flow Data from MAWILab Traces for Network Intrusion Detection

A growing issue in the modern cyberspace world is the direct identificat...
research
03/03/2020

Adversarial Network Traffic: Toward Evaluating the Robustness of Deep Learning Based Network Traffic Classification

Network traffic classification is used in various applications such as n...
research
05/11/2023

Anomaly Detection Dataset for Industrial Control Systems

Over the past few decades, Industrial Control Systems (ICSs) have been t...
research
04/30/2021

Flow-Packet Hybrid Traffic Classification for Class-Aware Network Routing

Network traffic classification using machine learning techniques has bee...
research
01/04/2021

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Deep packet inspection (DPI) has been extensively investigated in softwa...
research
02/10/2020

SparseIDS: Learning Packet Sampling with Reinforcement Learning

Recurrent Neural Networks (RNNs) have been shown to be valuable for cons...
research
05/17/2022

Multibit Tries Packet Classification with Deep Reinforcement Learning

High performance packet classification is a key component to support sca...

Please sign up or login with your details

Forgot password? Click here to reset