A Real-Time eBPF-Based Intrusion Detection Framework for Adaptive and Scalable Linux Kernel Security
DOI:
https://doi.org/10.65405/ee569x23Keywords:
eBPF, Linux Kernel Security, Intrusion Detection System (IDS), Machine Learning, Runtime MonitoringAbstract
The Linux kernel represents a critical attack surface due to its privileged execution level, making it a frequent target for attacks such as privilege escalation and advanced persistent
threats (APTs). Traditional intrusion detection systems (IDS)typically operate in user space and rely on static or signature based techniques, limiting visibility into kernel-level activities.
This paper presents a real-time intrusion detection framework based on Extended Berkeley Packet Filter (eBPF). The framework utilizes eBPF programs attached to kernel trace points and kprobes to capture runtime events with low overhead, enabling fine-grained system observability without requiring kernel modification or system restart.
The proposed approach adopts behavior-based detection using contextual runtime features and a Random Forest classifier for runtime classification. Dynamic policy adaptation is supported
through eBPF maps .The framework was evaluated using a controlled dataset containing approximately 38,000 kernel runtime events collected from benign activities and controlled attack scenarios.
Experimental results achieved 99.92% accuracy and 0.99 recall while maintaining CPU utilization below 1% during continuous monitoring. Additional evaluation using the public DongTing benchmark dataset achieved 99.60% accuracy, demonstrating strong generalization capability across heterogeneous kernel behavior environments.
The results indicate that combining eBPF monitoring with lightweight machine learning provides an effective and scalable approach for kernel-level intrusion detection in Linux systems.
Downloads
References
[1] S.-Y. Wang and J.-C. Chang, “Design and implementation of an intrusion detection system by using extended BPF in the Linux kernel,” Journal of Network and Computer Applications, vol. 198, p. 103283, 2022.
[2] H. J. Hadi, M. Adnan, Y. Cao, F. B. Hussain, N. Ahmad, M. A. Alshara, and Y. Javed, “iKern: Advanced intrusion detection and prevention at the kernel-level using eBPF,” Technologies, vol. 12, no. 8, p. 122, 2024.
[3] S. Remya, M. J. Pillai, B. Niranjan, and P. M. A. Kumar, “eBPF-based runtime detection of semantic DDoS attacks in Linux containers,” IEEE Access, vol. 13, pp. 1–15, 2025.
[4] B. Gbadamosi et al., “The eBPF runtime in the Linux kernel,” arXiv preprint arXiv:2410.00026, 2024.
[5] M. Bachl, J. Fabini, and T. Zseby, “A flow-based IDS using machine learning in eBPF,” arXiv preprint arXiv:2102.09980, 2021.
[6] G. Duan, Y. Fu, M. Cai, H. Chen, and J. Sun, “DongTing: A large-scale dataset for anomaly detection of the Linux kernel,” Journal of Systems and Software, vol. 203, p. 111745, 2023.
[7] M. A. M. Vieira, M. S. Castanho, R. D. G. Pacífico, E. R. S. Santos, E. P. M. Câmara Júnior, and L. F. M. Vieira, “Fast packet processing with eBPF and XDP: Concepts, code, challenges, and applications,” ACM Computing Surveys, vol. 53, no. 1, pp. 16:1–16:36, 2020.
[8] T. Høiland-Jørgensen et al., “The eXpress data path: Fast programmable packet processing in the Linux kernel,” in Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies (CoNEXT), 2018.
[9] J. Gallego-Madrid et al., “Machine learning-powered traffic processing in commodity hardware with eBPF,” Computer Networks, vol. 245, p. 110295, 2024.
[10] J. Zhang, P. Chen, Z. He, H. Chen, and X. Li, “Real time intrusion detection and prevention with neural network in kernel using eBPF,” in Proceedings of the 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2024, pp. 416 428.
[11] T. Farasat, J. Kim, and J. Posegga, “SmartX Intelligent Sec: A security framework based on machine learning and eBPF/XDP,” arXiv preprint arXiv:2410.20244, 2024.
[12] The Linux Foundation, “eBPF documentation and refer ence guide,” https://ebpf.io, 2024.
[13] Aqua Security, “Tracee: Runtime security and threat detec tion using eBPF,” https://github.com/aquasecurity/tracee, 2024.
[14] Sysdig, “Falco: Cloud native runtime security,” https://falco.org, 2024.
[15] T. Hara and M. Sasabe, “Practicality of in-kernel/user space packet processing empowered by lightweight neural network and decision tree,” Computer Networks, vol. 240, p. 110188, 2024.
[16] A. Brodzik et al., “Ransomware detection using ma chine learning in the Linux kernel,” arXiv preprint arXiv:2409.06452, 2024.
