Kernel Space Feature Generation for Network Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting malicious network traffic using machine learning models suffer from high latency due to the need to pass protocol data units (PDUs) between the data link layer and the application layer of a network stack.
Innovation Solution
The implementation of eBPF to attach code hooks to a network interface at the kernel space, redirecting network traffic to a virtual machine that generates feature values directly from PDUs at the data link layer, and passing these feature values to a machine learning model in the user space via zero-copy shared memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If protocol data units are passed between data link layer and application layer for machine learning-based malicious traffic detection, then detection capability is provided, but latency increases
Solution Approach 1:
The patent introduces a new architectural dimension by implementing eBPF-based code hooks at the kernel network interface layer, creating a parallel processing path that extracts features directly from incoming traffic before it traverses the traditional network stack to the application layer. This spatial-temporal repositioning of feature extraction operations reduces the time dimension of data transmission while maintaining detection reliability.
Solution Approach 2:
The system performs preliminary feature extraction operations at the kernel layer before traffic reaches the application layer. By pre-processing network traffic and extracting relevant features using eBPF programs at the point of entry, the system prepares detection-ready data in advance, eliminating the need to wait for complete PDU traversal through multiple layers and thereby reducing detection latency.
2Reliability
If feature values are extracted and passed from kernel space to user space, then machine learning model can process traffic, but data copying overhead increases latency
Solution Approach 1:
The patent employs shared memory mechanisms that allow the kernel-space eBPF program and user-space machine learning model to access the same memory region simultaneously. This eliminates the need for traditional data copying operations between kernel and user space, as both components read/write to the same memory location, thereby removing the copying overhead that previously increased latency.
3Speed
If code hooks are attached at network interface in kernel space, then feature generation occurs closer to data link layer, but system complexity increases
Solution Approach 1:
The patent introduces eBPF (extended Berkeley Packet Filter) as an intermediary technology that bridges kernel-space network interface access and user-space machine learning processing. This intermediary provides a standardized, sandboxed environment for running feature extraction code directly at the network interface, simplifying the integration complexity while enabling fast feature generation through direct kernel-space access to incoming traffic.
Data Source
AI summary
An in-kernel virtual machine (“VM”) instantiated in the kernel space of a physical or virtual machine (“machine”) attaches code hooks at a network interface of the machine. The code hooks redirect network traffic from the network interface to a module that generates feature values at the kernel space from protocol data units of network traffic received by the network interface. The machine passes the feature values from kernel space to user space via zero-copy shared memory and a machine learning model in the user space obtains network traffic verdicts as outputs from inputting the feature values. The machine passes the verdicts from user space to kernel space via the zero-copy shared memory and the in-kernel VM performs corrective action based on malicious verdicts.