iKern: Advanced Intrusion Detection and Prevention at the Kernel Level Using eBPF

被引:2
作者
Hadi, Hassan Jalil [1 ]
Adnan, Mubashir [2 ]
Cao, Yue [1 ]
Hussain, Faisal Bashir [2 ]
Ahmad, Naveed [3 ]
Alshara, Mohammed Ali [3 ,4 ]
Javed, Yasir [3 ]
机构
[1] Wuhan Univ, Sch Cyber Sci & Engn, Wuhan 430072, Peoples R China
[2] Bahria Univ, Dept Comp Sci, Islamabad 44220, Pakistan
[3] Prince Sultan Univ, Coll Comp & Informat Sci, Riyadh 11586, Saudi Arabia
[4] Al Imam Muhammad Ibn Saud Islamic Univ, Coll Comp Sci & Informat Educ & Qual Affairs, Riyadh 11432, Saudi Arabia
关键词
eBPF; intrusion prevention system (IPS); intrusion detection system (IDS); virtual network functions (VNF); kernel-level packet filtering; DDoS; FRAMEWORK; ATTACKS;
D O I
10.3390/technologies12080122
中图分类号
T [工业技术];
学科分类号
08 ;
摘要
The development of new technologies has significantly enhanced the monitoring and analysis of network traffic. Modern solutions like the Extended Berkeley Packet Filter (eBPF) demonstrate a clear advancement over traditional techniques, allowing for more customized and efficient filtering. These technologies are crucial for influencing system performance as they operate at the lowest layer of the operating system, such as the kernel. Network-based Intrusion Detection/Prevention Systems (IDPS), including Snort, Suricata, and Bro, passively monitor network traffic from terminal access points. However, most IDPS are signature-based and face challenges on large networks, where the drop rate increases due to limitations in capturing and processing packets. High throughput leads to overheads, causing IDPS buffers to drop packets, which can pose serious threats to network security. Typically, IDPS are targeted by volumetric and multi-vector attacks that overload the network beyond the reception and processing capacity of IDPS, resulting in packet loss due to buffer overflows. To address this issue, the proposed solution, iKern, utilizes eBPF and Virtual Network Functions (VNF) to examine and filter packets at the kernel level before forwarding them to user space. Packet stream inspection is performed within the iKern Engine at the kernel level to detect and mitigate volumetric floods and multi-vector attacks. The iKern detection engine, operating within the Linux kernel, is powered by eBPF bytecode injected from user space. This system effectively handles volumetric Distributed Denial of Service (DDoS) attacks. Real-time implementation of this scheme has been tested on a 1Gbps network and shows significant detection and reduction capabilities against volumetric and multi-vector floods.
引用
收藏
页数:23
相关论文
共 40 条
[1]   Machine learning assisted snort and zeek in detecting DDoS attacks in software-defined networking [J].
AbdulRaheem M. ;
Oladipo I.D. ;
Imoize A.L. ;
Awotunde J.B. ;
Lee C.-C. ;
Balogun G.B. ;
Adeoti J.O. .
International Journal of Information Technology, 2024, 16 (3) :1627-1643
[2]   InKeV: In-Kernel distributed network virtualization for DCN [J].
Ahmed Z. ;
Alizai M.H. ;
Syed A.A. .
Computer Communication Review, 2018, 46 (03)
[3]  
Alshathri S., 2023, COMPUT SYST SCI ENG, V46, P819, DOI [10.32604/csse.2023.034095, DOI 10.32604/CSSE.2023.034095]
[4]  
Arya A., 2023, P 2023 14 INT C COMP, P1
[5]   SNORT based early DDoS detection system using Opendaylight and open networking operating system in software defined networking [J].
Badotra, Sumit ;
Panda, Surya Narayan .
CLUSTER COMPUTING-THE JOURNAL OF NETWORKS SOFTWARE TOOLS AND APPLICATIONS, 2021, 24 (01) :501-513
[6]  
Bashah N.S.K., 2023, Int. J. Adv. Technol. Eng. Explor, V10, P962
[7]   Accelerating Linux Security with eBPF iptables [J].
Bertrone, Matteo ;
Miano, Sebastiano ;
Risso, Fulvio ;
Tumolo, Massimo .
SIGCOMM'18: PROCEEDINGS OF THE ACM SIGCOMM 2018 CONFERENCE: POSTERS AND DEMOS, 2018, :108-110
[8]   Improving SIEM alert metadata aggregation with a novel kill-chain based classification model [J].
Bryant, Blake D. ;
Saiedian, Hossein .
COMPUTERS & SECURITY, 2020, 94
[9]  
Canakci B., 2022, Ph.D. Thesis
[10]   The rise of eBPF for non-intrusive performance monitoring [J].
Cassagnes, Cyril ;
Trestioreanu, Lucian ;
Joly, Clement ;
State, Radu .
NOMS 2020 - PROCEEDINGS OF THE 2020 IEEE/IFIP NETWORK OPERATIONS AND MANAGEMENT SYMPOSIUM 2020: MANAGEMENT IN THE AGE OF SOFTWARIZATION AND ARTIFICIAL INTELLIGENCE, 2020,