Identifying DDoS Attacks In-Kernel via eBPF/XDP and Knowledge Distillation

Identifying Distributed Denial of Service (DDoS) plays a vital role in network security as DDoS attacks have grown rapidly and become one of the most serious threats to network security. However, most existing DDoS identification methods run in user space on hardware servers, which increases the traffic load and delays the response. In this work, we propose a method for fast identification of DDoS attacks in the Linux kernel. This method uses the eXpress Data Path (XDP) as a hook to attach an extended Berkeley Packet Filter (eBPF) program to the device driver to process data packets at a very early stage and at high speed. Furthermore, to break through the computing/memory limitations of the devices and ensure the accuracy of DDoS attack identification, we use Knowledge Distillation (KD) techniques to transform the DDoS identification knowledge of a complex Multi-Layer Perceptron (MLP) into a simple Decision Tree (DT) model, and implement the DT model as an eBPF program. Experimental results show that the proposed method can quickly and accurately identify DDoS attacks. Compared to the baseline models, the Macro F1 Score has increased by 1.1%, reaching 97.6%.