eBPF Based Network Functions: Utilizing XDP Programs for High-Speed Packet Filtering and Ddos Mitigation in Nigeria
Abstract
DDoS attacks exploit the weakest links in Linux and Software Defined Networks . Many available defenses work by intercepting malicious packets and deciding whether to forward them based on rules stored in a central controller. However, rules are only effective after packets are fully processed by lower level networking components. The eXpress Data Path and the Extended Berkeley Packet Filter allow packets to be filtered and dropped at higher networking component layers. This work develops AXDP-Guard. eXDP- Guard is implemented in user space and is designed for high speed, low latency DDoS attacks mitigation. this work presents controlled system simulation to evaluate AXDP-Guard, and compares the results to related work. To examine the performance of AXDP-Guard in a DDoS attack scenario, 40 independent test cases are run to simulate attacks at various volumes and compare results to iptables/nftables, XDP, native AXDP, and controller based SDNs. The assessment analyzes legitimate goodput, protected service availability, CPU burden, latency, low-rate attack detection, and statistical stability. The results demonstrate an important systems trade-off. XDP in its native form demonstrates the best raw performance of all the fast paths, but AXDP-Guard, in trade-off to fast path performance, provides the best adaptive low-rate attack defense and control. Native XDP, at 10-15 Mpps, lost about 0.3% legitimate goodput, whereas AXDP-Guard lost about 1.3% in the same conditions. However, AXDP-Guard out performed native XDP in low-rate DoS attacks, achieving a detecting and mitigating F1 of 0.978, compared to native XDP's F1 of 0.922. Low-rate attacks are best protected against by integration of detection and defense mechanisms at the transport and application layers. XDP is best suited to provide such mechanisms.
Keywords
XDP; DDoS protection; high-speed transport layer; eBPF; Nigeria
References
Adeniji, O. D., Adekeye, D., Ajagbe, S. A., & Adesina, A. O. (2022). Development of DDoS attack detection approach in software defined network using support vector machine classifier. In Pervasive Computing and Social Networking (pp. 319-331). Springer. https://doi.org/10.1007/978-981-19-2840-6_25 Akanji, O. S., Abisoye, O. A., & Iliyasu, M. A. (2021). Mitigating slow hypertext transfer protocol distributed denial of service attacks in software defined networks. Journal of Information and Communication Technology, 20(3), 277-304. https://doi.org/10.32890/jict2021.20.3.1 Behl, D., Huang, H., Kodeswaran, P., & Sen, S. (2023). On eBPF extensions to Kubernetes CNI datapath. In 2023 15th International Conference on COMmunication Systems & NETworkS (COMSNETS). IEEE. https://doi.org/10.1109/COMSNETS56262.2023.10041357 Bertrone, M., Miano, S., Risso, F., & Tumolo, M. (2018). Accelerating Linux security with eBPF iptables. In Proceedings of the ACM SIGCOMM 2018 Conference on Posters and Demos (pp. 108-110). Association for Computing Machinery. https://doi.org/10.1145/3234200.3234228 Brunella, M. S., Belocchi, G., Bonola, M., Pontarelli, S., Siracusano, G., Bianchi, G., Cammarano, A., Palumbo, A., Petrucci, L., & Bifulco, R. (2020). hXDP: Efficient software packet processing on FPGA NICs. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20) (pp. 973-990). USENIX Association. https://www.usenix.org/conference/osdi20/presentation/brunella Cassagnes, C., Trestioreanu, L., Joly, C., & State, R. (2020). The rise of eBPF for non- intrusive performance monitoring. In 2020 IEEE/IFIP Network Operations and Management Symposium. IEEE. https://doi.org/10.1109/NOMS47738.2020.9110434 Chen, Z., Kong, H., Ding, S., Lv, Q., & Wei, G. (2024). Efficient DDoS detection and mitigation in cloud data centers using eBPF and XDP. In 2024 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (pp. 1869-1874). IEEE. https://doi.org/10.1109/TrustCom63139.2024.00258 Choe, Y., Shin, J.-S., Lee, S., & Kim, J. (2020). eBPF/XDP based network traffic visualization and DoS mitigation for intelligent service protection. In Advances in Internet, Data and Web Technologies (pp. 458-468). Springer. https://doi.org/10.1007/978-3-030-39746-3_47 Deri, L., Sabella, S., & Mainardi, S. (2019). Combining system visibility and security using eBPF. In ITASEC 2019. CEUR Workshop Proceedings. https://ceur-ws.org/Vol- 2315/paper-13.pdf Elzoghbi, M., & He, H. (2026). Kernel-level LDoS attack detection in SDN networks: An eBPF/XDP framework with dynamic thresholding. Computer Networks, 275, 111939. https://doi.org/10.1016/j.comnet.2025.111939 Fasidi, F. O., & Adebayo, O. T. (2019). Detecting distributed denial-of-service attacks. Current Trends in Computer Sciences & Applications, 1(2). https://doi.org/10.32474/CTCSA.2019.01.000110 Gallego-Madrid, J., Molina-Zarca, A., Sanchez-Iborra, R., Ortiz, J., & Skarmeta, A. F. (2024). Fast traffic processing in multi-tenant 5G environments: A comparative performance evaluation of P4 and eBPF technologies. Engineering Science and Technology, an International Journal, 52, 101678. https://doi.org/10.1016/j.jestch.2024.101678 Ghigoff, Y., Sopena, J., Lazri, K., Blin, A., & Muller, G. (2021). BMC: Accelerating IJCSMT IJCSMT Memcached using safe in-kernel caching and pre-stack processing. In 18th USENIX Symposium on Networked Systems Design and Implementation (NSDI 21) (pp. 487- 501). USENIX Association. https://www.usenix.org/conference/nsdi21/presentation/ghigoff Haeberle, M., Steinert, B., Weiss, M., & Menth, M. (2025). ELVIS: eBPF-based extensions of Linux hosts for using virtual network functions with service function chaining and in-band network telemetry. Computer Networks, 273, 111773. https://doi.org/10.1016/j.comnet.2025.111773 Hirsi, A., Alhartomi, M. A., Audah, L., Salh, A., Sahar, N. M., Ahmed, S., Ansa, G. O., & Farah, A. (2025). Comprehensive analysis of DDoS anomaly detection in software- defined networks. IEEE Access, 13, 23013-23071. https://doi.org/10.1109/ACCESS.2025.3535943 Honda, T. (2026). Realization of DDoS resilience through XDP-based communication control with individual identification tokens in UDP data. IEEE Access, 14, 33034- 33045. https://doi.org/10.1109/ACCESS.2026.3665591 Høiland-Jørgensen, T., Brouer, J. D., Borkmann, D., Fastabend, J., Herbert, T., Ahern, D., & Miller, D. (2018). The eXpress Data Path: Fast programmable packet processing in the operating system kernel. In Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies (CoNEXT 2018) (pp. 54-66). Association for Computing Machinery. https://doi.org/10.1145/3281411.3281443 Idris, I., Fabian, O. B., Abdulhamid, S. M., Olalere, M., & Meshach, B. (2017). Distributed denial of service detection using multi layered feed forward artificial neural network. International Journal of Computer Network and Information Security, 9(12), 29-35. https://doi.org/10.5815/ijcnis.2017.12.04 Loureiro, L., Pereira, V., Cruz, T. J., & Simões, P. (2024). Enhancing 5G core security with eBPF/XDP. In 2024 IEEE Network Operations and Management Symposium (pp. 1-6). IEEE. https://doi.org/10.1109/NOMS59830.2024.10575063 Miano, S., Bertrone, M., Risso, F., Tumolo, M., & Vásquez Bernal, M. (2018). Creating complex network services with eBPF: Experience and lessons learned. In 2018 IEEE 19th International Conference on High Performance Switching and Routing . IEEE. https://doi.org/10.1109/HPSR.2018.8850758 Miano, S., Doriguzzi-Corin, R., Risso, F., Siracusa, D., & Sommese, R. (2019). Introducing SmartNICs in server-based data plane processing: The DDoS mitigation use case. IEEE Access, 7, 107161-107170. https://doi.org/10.1109/ACCESS.2019.2933491 Miano, S., Risso, F., Vásquez Bernal, M., Bertrone, M., & Lu, Y. (2021). A framework for eBPF-based network functions in an era of microservices. IEEE Transactions on Network and Service Management, 18(1), 133-151. https://doi.org/10.1109/TNSM.2021.3055676 Miziński, K., & Przyłucki, S. (2025). The impact of using eBPF technology on the performance of networking solutions in a Kubernetes cluster. Journal of Computer Sciences Institute, 35, 150-158. https://doi.org/10.35784/jcsi.7110 Nigerian Communications Commission. (2026). Industry statistics. https://ncc.gov.ng/industry-statistics Odusami, M., Misra, S., Abayomi-Alli, O., Abayomi-Alli, A., & Fernandez-Sanz, L. (2020). A survey and meta-analysis of application-layer distributed denial-of-service attack. International Journal of Communication Systems. https://doi.org/10.1002/dac.4603 Okide, C. P., Ahaneku, M. A., Nwawelu, U. N., Chijindu, V. C., Ezeja, O. M., & Ekengwu, B. O. (2025). Deployment of smart contracts on blockchain technology in early mitigation of distributed denial of service in software defined networks. Nigerian IJCSMT IJCSMT Journal of Technology, 44(1), 105-113. https://doi.org/10.4314/njt.v44i1.12 Olakanmi, O. O., & Odeyemi, K. O. (2021). Throttle: An efficient approach to mitigate distributed denial of service attacks on software-defined networks. Security and Privacy, 4(4), e158. https://doi.org/10.1002/spy2.158 Remya, S., Pillai, M. J., Niranjan, B., Ajith Kumar, P. M., Shaju, K. M., Raj, K. D., Ramasubbareddy, S., & Cho, Y. (2025). eBPF-based runtime detection of semantic DDoS attacks in Linux containers. IEEE Access, 13, 169178-169219. https://doi.org/10.1109/ACCESS.2025.3614389 Salva-Garcia, P., Ricart-Sanchez, R., Chirivella-Perez, E., Wang, Q., & Alcaraz-Calero, J. M. (2022). XDP-based SmartNIC hardware performance acceleration for next-generation networks. Journal of Network and Systems Management, 30, Article 75. https://doi.org/10.1007/s10922-022-09687-z Sangiorgi, A., Pinto, A., Tourani, R., & Esposito, F. (2025). Mitigating de-authentication DoS attacks in 802.11 via eBPF and XDP. In 2025 IEEE 11th International Conference on Network Softwarization (NetSoft). IEEE. https://doi.org/10.1109/NetSoft64993.2025.11080545 Scholz, D., Raumer, D., Emmerich, P., Kurtz, A., Lesiak, K., & Carle, G. (2018). Performance implications of packet filtering with Linux eBPF. In 30th International Teletraffic Congress (ITC 2018) (pp. 209-217). IEEE. https://doi.org/10.1109/ITC30.2018.00039 Soldani, D., Nahi, P., Bour, H., Jafarizadeh, S., Soliman, M. F., Di Giovanna, L., Monaco, F., Ognibene, G., & Risso, F. (2023). eBPF: A new approach to cloud-native observability, networking and security for current (5G) and future mobile networks (6G and beyond). IEEE Access, 11, 57174-57202. https://doi.org/10.1109/ACCESS.2023.3281480 Tolay, A. (2025). eBPF-based real-time DDoS mitigation for IoT edge devices. arXiv. https://arxiv.org/abs/2508.00851 Vieira, M. A. M., Castanho, M. S., Pacífico, R. D. G., Santos, E. R. S., Câmara Júnior, E. P. M., & Vieira, L. F. M. (2020). Fast packet processing with eBPF and XDP: Concepts, code, challenges, and applications. ACM Computing Surveys, 53(1), Article 16, 1-36. https://doi.org/10.1145/3371038 Wabi, A. A., Idris, I., Olaniyi, O. M., & Ojeniyi, J. A. (2024). DDoS attack detection in SDN: Method of attacks, detection techniques, challenges and research gaps. Computers & Security, 139, 103652. https://doi.org/10.1016/j.cose.2023.103652 Wabi, A. A., Idris, I., Olaniyi, O. M., Ojeniyi, J. A., & Adebayo, O. S. (2024). Modeling DDoS attacks in SDN and detection using Random Forest classifier. Journal of Cyber Security Technology, 8(4), 229-242. https://doi.org/10.1080/23742917.2023.2264435 Xhonneux, M., Duchene, F., & Bonaventure, O. (2018). Leveraging eBPF for programmable network functions with IPv6 segment routing. In Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies (CoNEXT 2018) (pp. 67-72). Association for Computing Machinery. https://doi.org/10.1145/3281411.3281426 Zang, M., De Iaco, F., Wu, J., & Savi, M. (2025). In-kernel traffic sketching for volumetric DDoS detection. In ICC 2025 - IEEE International Conference on Communications (pp. 2180-2185). IEEE. https://doi.org/10.1109/ICC52391.2025.11161251 Zhao, B., Qin, Y., Yang, W., Fan, P., & Zhou, X. (2022). SRA: Leveraging AF_XDP for programmable network functions with IPv6 segment routing. In 2022 IEEE 47th Conference on Local Computer Networks (pp. 455-462). IEEE. https://doi.org/10.1109/LCN53696.2022.9843244
More Articles from INTERNATIONAL JOURNAL OF COMPUTER SCIENCE AND MATHEMATICAL THEORY
The Imperative of Electronic Voting System for Transparent and Credible Elections in Nigeria
Author: Nwagu Okwudiri Godswill
The Role of Trust and Security in Cryptocurrency Acceptance for Business Transactions in Nigeria
Author: Abdullahi Muhammad Haruna, Babandi Usman, Haruna Ibrahim, Suleiman Musa Ibrahim, Abdurrahman Shuaibu Aliyu
A Flexible Role Based Secure Messaging System: An Information System Perspective
Author: Ositanwosu Obiajulu E., Ajonuma Michael E.