A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs
eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.
The paper presents a DDoS-focused network intrusion detection system for transport networks built with Ericsson, combining a statistical baseline with an Isolation Forest trained on flow features from GoFlowMeter, an open-source Go implementation of CICFlowMeter, plus eBPF/XDP kernel-level traffic filtering. On a Raspberry Pi 5 testbed replaying CIC-DDoS2019 as real traffic, the Isolation Forest achieves 0.965 recall/F1 live in the monolithic variant, catching low-volume attack windows the baseline misses. gRPC microservices nearly match monolithic accuracy adding under 2ms per window, while the Kafka pipeline trails by roughly nine percentage points and adds about 27ms.
- Isolation Forest over GoFlowMeter features reaches 0.965 live F1, beating statistical baseline
- eBPF/XDP filters real traffic at the kernel level
- gRPC transport matches monolithic accuracy within 2ms; Kafka trails ~9 points at ~27ms
- Deployments evaluated on Raspberry Pi 5 replaying CIC-DDoS2019 dataset
From the original article
1 min read at arxiv.orgDistributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring solutions, or to assess recent algorithms for improving attack detection.
By Shiqi Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.