Monitoring network traffic and detecting attacks using eBPF

Abstract

Network safety is a vital aspect of our current life. Lots of servers are becoming targets for attackers who want to reduce their performance or even get access to sensitive data. To prevent attacks, constant monitoring and analysis of network traffic is highly recommended and even required. eBPF is an interesting technology of Linux that allows investigation and extension of kernel behavior, including access to raw network packets and their processing. The main goal of this thesis is to explore the possibilities of eBPF in the context of creating a program for network traffic monitoring and analysis for attack prevention. The project is open-sourced and will be available for further expansion and modification.