The invention discloses an eBPF-based
protocol stack cross-layer interaction security
vulnerability automatic defense method and
system, and the method comprises the steps: randomly generating a hash key value through a
monitoring program module, and transmitting the hash key value to a BPF Map; in a BPF program module, a stateless ICMP
Error message filter and an ICMP input rate
limiter are respectively operated, the two components are combined, a combined program is compiled into a BPF
byte code through an llvm / clang tool chain, an eBPF module in a kernel verifies the legality of the BPF
byte code, the BPF
byte code is translated into a
machine language through a JIT instant
compiler and executed, and the BPF
byte code is converted into the BPF
byte code. Carrying out interactive reading and writing with the BPF Map; and reading the BPF Map to obtain log information generated when the stateless ICMP
Error message filter and the ICMP input rate
limiter run, and writing the log information into a log file. According to the method, compiling of a defense mechanism is completed through eBPF, the defense mechanism is compiled into BPF byte codes through an llvm tool chain, the BPF byte codes are loaded into a kernel through a BPF
loader compiled in a
user space, and therefore
automatic filtering and defense are effectively achieved.