# A flow-based IDS using Machine Learning in eBPF

arXiv: https://arxiv.org/abs/2102.09980 · HTML: https://mlsanity.com/paper/2102.09980/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 8 references that are in the map.
- First posted on arXiv 19 Feb 2021.

## Builds on (most cited first, 1 of 1)

- [Explainability and Adversarial Robustness for RNNs](https://mlsanity.com/paper/1912.09855/) (2019)

## Built on by (most cited first, 3 of 3)

- [Ransomware Detection Using Machine Learning in the Linux Kernel](https://mlsanity.com/paper/2409.06452/) (2024)
- [KEN: Kernel Extensions using Natural Language](https://mlsanity.com/paper/2312.05531/) (2023)
- [When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization](https://mlsanity.com/paper/2401.05641/) (2024)

## Abstract (arXiv)

eBPF is a new technology which allows dynamically loading pieces of code into the Linux kernel. It can greatly speed up networking since it enables the kernel to process certain packets without the involvement of a userspace program. So far eBPF has been used for simple packet filtering applications such as firewalls or Denial of Service protection. We show that it is possible to develop a flow based network intrusion detection system based on machine learning entirely in eBPF. Our solution uses a decision tree and decides for each packet whether it is malicious or not, considering the entire previous context of the network flow. We achieve a performance increase of over 20% compared to the same solution implemented as a userspace program.