# When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization

arXiv: https://arxiv.org/abs/2401.05641 · HTML: https://mlsanity.com/paper/2401.05641/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 82 references that are in the map.
- First posted on arXiv 11 Jan 2024.

## Builds on (most cited first, 6 of 6)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Neural Oblivious Decision Ensembles for Deep Learning on Tabular Data](https://mlsanity.com/paper/1909.06312/) (2019)
- [A flow-based IDS using Machine Learning in eBPF](https://mlsanity.com/paper/2102.09980/) (2021)
- [In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication](https://mlsanity.com/paper/2112.07213/) (2021)
- [D-Box: DMA-enabled Compartmentalization for Embedded Applications](https://mlsanity.com/paper/2201.05199/) (2022)
- [Assessing the Impact of Interface Vulnerabilities in Compartmentalized Software](https://mlsanity.com/paper/2212.12904/) (2022)

## Abstract (arXiv)

Compartmentalization effectively prevents initial corruption from turning into a successful attack. This paper presents O2C, a pioneering system designed to enforce OS kernel compartmentalization on the fly. It not only provides immediate remediation for sudden threats but also maintains consistent system availability through the enforcement process. O2C is empowered by the newest advancements of the eBPF ecosystem which allows to instrument eBPF programs that perform enforcement actions into the kernel at runtime. O2C takes the lead in embedding a machine learning model into eBPF programs, addressing unique challenges in on-the-fly compartmentalization. Our comprehensive evaluation shows that O2C effectively confines damage within the compartment. Further, we validate that decision tree is optimally suited for O2C owing to its advantages in processing tabular data, its explainable nature, and its compliance with the eBPF ecosystem. Last but not least, O2C is lightweight, showing negligible overhead and excellent sacalability system-wide.