High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

Abstract

Denial of Service (DoS) and Distributed DoS (DDoS) attacks are standard prob-lems organizations that rely on network services face. Detecting these attackspromptly and accurately is crucial to mitigating the damage caused. This paperproposes an Intrusion Detection System (IDS) that utilizes the extended Berke-ley Packet Filter (eBPF) with machine learning algorithms, namely Decision Tree(DT), Random Forest (RF), Support Vector Machine (SVM), and TwinSVM.eBPF is a bytecode-based virtual machine that runs programs without modifyingthe kernel source code. It can implement various services, such as observabil-ity, security, and networking. Socket filters are an eBPF program attached tothe socket in the Linux kernel that allows for efficient filtering and manip-ulation of network packets at the socket after packets are received from thenetwork stack. Packets that are filtered at the socket level before enteringthe user space. The steps involved in the proposed model are: a) collectingdata from famous repository, CIC-IDS-2017. b) Once the raw data is obtained,it undergoes preprocessing, which includes data transmission, cleaning, reduc-tion, and discretization. c) Following the preprocessing step, an ANOVA F-testextracts specific features from the preprocessed data. d) Lastly, the extractedfeatures are analyzed for intrusion detection using various ML algorithms:DT, RF, SVM, and TwinSVM. e) The eBPF program captures network traf-fic and utilizes trained model parameters to detect attacks within the kernel.Our experimental results show that the accuracy of our proposed ML algo-rithms, DT, RF, SVM, and TwinSVM, outperforms the existing related work:99.38, 99.44, 88.73, and 93.82, respectively. The experimental code available inhttps://github.com/NemalikantiAnand/Project.git