PaperlayerView exact revision on arXiv

Source-linked AI summary

eBPF-Based Cybersecurity Mechanisms: A Systematic Literature Review

Stamatios Kostopoulos, Panagiotis Tsakonas, Evangelos K. Markakis

arXiv:2608.27511v1cs.CR

TL;DR

Existing eBPF cybersecurity research is fragmented across domains, methods, and deployment assumptions, while comprehensive security-focused synthesis and standardized comparison remain limited. This review applies PRISMA screening and thematic coding to 54 primary studies, organizing them into seven domains and examining threat scenarios, deployment contexts, and architectural constraints. The synthesis finds broad deployment versatility and domain-specific security mechanisms, while identifying verifier, portability, expertise, meta-security, and production-validation challenges.

  • Problem

    Existing literature lacks a comprehensive cybersecurity-focused synthesis, comparative analysis of security use cases, and standardized benchmarking for eBPF mechanisms.

  • Method

    The review applies PRISMA screening and thematic coding to classify 54 primary studies by security objective, deployment layer, enforcement mechanism, evaluation context, and dominant functional domain.

  • Results

    The 54 studies span seven domains and computing environments, with 66.6% (36/54) demonstrating deployment-agnostic security primitives and mechanisms addressing threats including DDoS, intrusion, container cryptojacking, and microservice risks.

  • Takeaways & Limitations

    The synthesis identifies decentralized security, observability-first defense, and hardware-software co-design as recurring architectural patterns across the reviewed eBPF security literature.

  • Takeaways & Limitations

    Verifier constraints, low-level expertise requirements, and kernel-version heterogeneity limit expressiveness, usability, and portability across deployments.

Abstract

from arXiv · show

Extended Berkeley Packet Filter (eBPF) has emerged as a kernel-level framework enabling dynamic security enforcement in modern operating systems. While eBPF's cybersecurity potential has attracted significant attention, existing work remains fragmented across domains, evaluation methodologies, and deployment contexts. This systematic literature review applies PRISMA methodology to identify, categorize, and synthesize peer-reviewed research on eBPF-based cybersecurity mechanisms. Following a structured screening of 3,735 records from six databases, 54 primary studies (2018-2026) were analyzed and organized into a seven-domain taxonomy: DDoS mitigation, intrusion detection, IoT security, container security, microservice protection, networking, and security tools. Analysis reveals eBPF enables low-overhead security enforcement (median 2.4% CPU overhead [1.1-8.6%], ranging from nanosecond-scale costs for infrequent hooks to 10-20% for kernel hot paths) with high detection accuracy (94-99%). It particularly excels in kernel-level monitoring, real-time packet processing, and cloud-native workload protection. However, significant challenges persist: verifier-imposed constraints limit algorithm complexity, 85.1% (46/54) of studies require low-level programming expertise, kernel version fragmentation hinders portability, and 96.2% (52/54) of research fails to address eBPF's own vulnerabilities. This review identifies critical research gaps in multi-tenant isolation, adversarial machine learning (ML) robustness, production validation, and standardized evaluation frameworks. By consolidating fragmented knowledge and highlighting architectural trade-offs between safety and expressiveness, this work provides a foundation for next-generation eBPF security systems and actionable directions for kernel programmability research.

1 Introduction

eBPF provides a kernel-level framework for efficient, dynamic system instrumentation, but cybersecurity research remains fragmented and lacks a comprehensive security-focused synthesis. This review addresses that gap through a PRISMA-based, security-exclusive taxonomy and analysis of architectural trade-offs.

  • Background: eBPF combines in-kernel verification, just-in-time compilation, and event-driven execution for programmable system security across modern environments.The framework supports cloud-native infrastructures, containerized platforms, and IoT deployments.
  • Research gap: Existing cybersecurity research is fragmented across application domains, evaluation methods, and deployment assumptions, limiting unified assessment of eBPF’s effectiveness and constraints.Prior work includes intrusion detection, workload protection, kernel integrity monitoring, and DDoS mitigation.
  • Research gap: Prior surveys lack a comprehensive synthesis focused specifically on eBPF cybersecurity mechanisms, standardized benchmarking, and emerging areas such as explainable or AI-assisted in-kernel analytics.The review positions these omissions as gaps in systematic design and evaluation.
  • Contribution: The review uses PRISMA guidelines, formal inclusion and exclusion criteria, and structured screening across six databases to improve transparency and methodological rigor.Its search and screening process targets peer-reviewed security-oriented eBPF research.
  • Contribution: The review introduces a structured taxonomy spanning seven security domains with explicit mappings among threats, mechanisms, and efficacy.The taxonomy covers threat types and deployment contexts that prior work did not systematically categorize.
  • Challenges: The review synthesizes verifier constraints, kernel-version fragmentation, safety–expressiveness trade-offs, multi-tenant isolation, and eBPF subsystem protection as architectural issues.It also identifies production validation as an unresolved concern in the reviewed literature.

2 Theoretical background

eBPF enables high-performance packet processing and runtime observability through kernel hooks, supporting low-latency security enforcement. However, verifier guarantees constrain the complexity and expressiveness of advanced detection logic.

  • Core capabilities: eBPF uses just-in-time compilation and event-driven kernel-hook attachment for packet processing, system tracing, and runtime observability with low overhead.These capabilities reduce reliance on user-space monitoring approaches.
  • Packet processing: XDP enables packet inspection and filtering before traversal of traditional kernel networking stacks, supporting low-latency intrusion detection, DDoS mitigation, and traffic-policy enforcement.The same interception point provides telemetry for behavioral and anomaly analysis.
  • Safety and expressiveness: Verifier-enforced bounded loops, restricted memory access, and program-complexity limits preserve kernel safety but restrict advanced stateful analysis, deep packet inspection, and in-kernel ML.Security mechanisms therefore balance detection capability against verifier constraints.

3 PRISMA METHODOLOGY

The review applies a transparent PRISMA process to identify and screen peer-reviewed eBPF cybersecurity studies across six databases. The resulting corpus contains 54 studies, concentrated in IEEE and ACM venues, with publication activity increasing as eBPF matured.

  • Screening procedure: The review uses PRISMA flow tracking, formal criteria, and structured multi-reviewer screening to guide identification, eligibility, and inclusion decisions.A third reviewer handled conflicts, while borderline cases were re-examined against the criteria.
  • Search strategy: Six digital libraries were searched using a five-layer Boolean strategy covering eBPF, security, observability, networking, and application domains.The layers were joined with AND, and searches were limited to English publications from 2018–2026.
  • Study selection: 3,735 records were initially identified, 2,646 entered initial screening, 379 remained after title-and-abstract screening, and 54 primary studies formed the final corpus.The process excluded duplicates, non-English and non-peer-reviewed works, inaccessible reports, and studies outside cybersecurity.
  • Database distribution: IEEE Xplore contributed 25 papers (46.2%) and ACM Digital Library 19 papers (35.1%), together accounting for 81.3% [44/54] of studies.The remaining studies came from SpringerLink, USENIX, and MDPI venues.
  • Corpus composition: 54 studies passed all screening steps and comprised 30 conference papers, 23 journal articles, and one book chapter.Conference papers represented 55% of the evidence base, reflecting rapid dissemination in this field.
  • Temporal distribution: Publication output rose from 3 studies in 2018 and 7 in 2019 to 11 in 2021 and 12 in 2023.The review links this trajectory to stabilization of kernel capabilities including XDP, BTF, and bounded-loop support, while noting indexing lag for 2024–2026.

4 Results and Discussion

The review organizes 54 studies across seven eBPF cybersecurity domains and shows broad coverage of deployment contexts and threat scenarios. The studies collectively illustrate eBPF’s progression from packet filtering toward adaptive, hardware-integrated, and kernel-level security mechanisms.

  • Review method: Thematic coding assigns each study to one functional domain using its primary research objective rather than its evaluation environment.This resolves overlaps between DDoS-specific detection, general attack detection, container runtime security, and service-level security.
  • Taxonomy and coverage: Seven categories cover IoT edge devices, containers, microservices, networking stacks, and general-purpose security tools.The taxonomy addresses both deployment environments and eBPF’s role as a versatile kernel programmability layer.
  • Threat scenarios: The reviewed works address DDoS, intrusion detection, traffic analysis, container security, and microservice protection through documented threat models and empirical evaluations.Networking and tools studies additionally cover traffic privacy, covert channels, and related security scenarios.
  • Taxonomy and coverage: 54 studies spanning 2018–2026 are organized across seven domains, with IDS the largest category at 11 studies (20.3%).Container Security includes 10 studies (18.5%), while Tools & Frameworks includes 9 (16.6%).
  • DDoS mitigation: DDoS research progresses from packet filtering toward multi-tier defenses combining hardware acceleration, kernel monitoring, and application-aware resource tracking.Reported approaches include early packet processing, anomaly-triggered external mitigation, and SmartNIC-assisted detection at 1–2 Mbps for 100G links.
  • Intrusion detection: IDS work spans ML classifiers, peripheral protection, microarchitectural monitoring, distributed frameworks, and serverless protection, indicating substantial technical diversity.One port-scan study identifies XGBoost as the best classifier with 99.98% accuracy, while LBM reports overhead approaching 1 µs per packet.

4.4 Container Security

Container-security studies use eBPF to retrofit protection onto shared-kernel environments through auditing, policy automation, runtime monitoring, and adaptive malware detection. The evidence also exposes security risks from cross-host attacks and misuse of eBPF capabilities.

  • Container protection: eBPF supports container hardening through runtime monitoring, automated policy generation, and exploit mitigation in shared-kernel architectures.These mechanisms target the isolation and operational-flexibility challenges inherent to containers.
  • Auditing and access control: saBPF integrates container auditing, intrusion detection, and lightweight access control with Kubernetes without extensive kernel modifications.Its evaluations report performance and security comparable to state-of-the-art kernel-based audit systems.
  • Cross-host defense: P4CONTROL prevents cross-host container attacks in real time through decentralized in-network information-flow control and programmable switching.The approach targets the lack of end-to-end flow visibility in containerized environments.
  • Policy automation: Automated Seccomp profile generation uses eBPF tracing to monitor syscall patterns and replace cumbersome manual configuration with application-specific policies.The stated goal is to make custom profiles viable for production with minimal requirements.
  • Policy automation: Bastion implements container security enforcement with eBPF maps and XDP, improving performance by 25.4% for single-host and 17.7% for cross-host communication.It combines packet monitoring, per-container control, and an administrator policy assistant.
  • ML-based detection: The RNN-based detector achieves 99.75% detection accuracy with 2.98% latency overhead for memory-centric and I/O-intensive tasks.eBPF traces runtime system calls and forwards labeled behavior to ML detection models.
  • ML-based detection: Container research converges on adaptive defenses, with ML used in 3 of 7 studies (42.9%) for cryptojacking and behavioral threat detection.The reviewed mechanisms include automated policy generation, auditing, anomaly detection, and malware detection.
  • Security risks: Container studies also identify offensive eBPF use, including authorized access that can enable attackers to steal host-sensitive data from compromised services.The cited work compromised five online Jupyter shell services and compared latency and overhead with existing systems.

4.7 Security Tools and Frameworks

Security-tool research extends eBPF across behavioral monitoring, zero-trust enforcement, verification, optimization, privacy, and storage. Cross-domain analyses emphasize decentralized, observability-first designs while revealing tooling, scalability, and in-kernel ML constraints.

  • Zero-trust systems: SYS FLOW applies eBPF to system-level zero trust by modeling process-file, process-network, and process-process flows with separated data and control planes.The framework reports reduced detection and enforcement latency with minimal overhead.
  • Cloud-native security: A review of 15 cloud-native security tools finds no single tool addresses all critical features, leaving opportunities for comprehensive eBPF-based solutions.The analysis covers Docker, Kubernetes, and Istio vulnerabilities and their enabled attacks.
  • Verifier and compiler tooling: Zone-domain abstract interpretation improves eBPF bytecode verification by reducing false alarms, supporting broader program classes, and improving asymptotic complexity.The approach is presented as scalable and high precision without extensive abstraction of bounded regions.
  • Verifier and compiler tooling: K2 synthesizes optimized BPF bytecode with formal memory-bound and termination guarantees, reducing code size and packet-processing latency while increasing throughput against clang-compiled baselines.The compiler maintains correctness while optimizing generated programs.
  • Tool diversity: Tools and frameworks span steganography detection, zero-trust enforcement, formal verification, adaptive monitoring, storage I/O optimization, and resource scheduling.This breadth extends eBPF beyond packet filtering into broader kernel programmability applications.
  • Architectural shifts: Decentralized enforcement appears in 83% of IoT studies and 83.3% of microservice frameworks, replacing centralized trust models across distributed deployments.The review describes edge-local IoT enforcement and distributed microservice policy enforcement.
  • Architectural shifts: Runtime observability is prioritized by 50% of container studies and integrated by 100% of microservice studies for behavioral threat detection.eBPF provides kernel-level visibility without application modification in the cited systems.
  • ML integration: 64% of IDS studies use eBPF for feature extraction into userspace ML models, but only 18% perform in-kernel ML inference because of instruction-limit constraints.The architecture combines 10–100 Gbps capture with 94–99% anomaly-detection accuracy.

5 Cross-domain patterns and synergies in eBPF-based cybersecurity

The literature clusters eBPF cybersecurity research into seven domains and reveals recurring technical synergies between related security objectives. Across these domains, effectiveness is accompanied by verifier, portability, operational, and evaluation constraints.

  • Cross-domain taxonomy: Seven categories organize the literature: IoT, DDoS mitigation, container security, microservices, intrusion detection, networking, and tools and frameworks.
  • Cross-domain taxonomy: Studies are assigned to their primary security objective and dominant eBPF usage, while secondary applications create recurring inter-category patterns.Table 5 maps subcategory relations in rows and broader patterns in columns; Figure 7 quantifies unique studies by pattern.
  • IDS and DDoS synergies: IDS and DDoS studies share eBPF-based packet filtering and anomaly detection, while DDoS mechanisms additionally emphasize granular rate limiting and traffic policing.Some implementations also trace user-level system calls and aggregate telemetry to detect malicious activity.
  • Cloud-native synergies: Container and microservice security overlap through network observability, high-fidelity auditing, and cross-service attack mitigation in cloud-native architectures.Microservice studies additionally integrate Zero Trust frameworks and cloud-based intrusion detection systems.
  • Effectiveness and constraints: 85.1% (46/54) of studies require low-level kernel programming expertise, while only 9.2% (5/54) provide high-level abstractions.Debugging remains limited, and portability is constrained by heterogeneous kernel versions across deployments.
  • Evaluation and trade-offs: Synthetic workloads, Linux-only evaluation, and cloud-centric coverage limit representativeness, while complex security functions incur higher overhead than simple filtering.Studies evaluating <1% overhead generally implement simple filtering; comprehensive security functions report 3-6% overhead.
  • Research and deployment gaps: 96.2% of studies leave eBPF meta-security unaddressed, alongside gaps in multi-tenant isolation, adversarial ML robustness, production validation, and reproducibility.Seven studies report production deployments, and HyperBee is identified as a demonstrated eBPF defense solution.

6 Conclusion and Future Work

This review synthesizes 54 studies to characterize eBPF cybersecurity mechanisms across deployment contexts and threat domains. It reports strong performance and architectural versatility, while identifying unresolved gaps that future work must address to support broader security engineering at scale.

  • 54 primary studies published between 2018-2026 were analyzed to examine eBPF-based cybersecurity mechanisms.
  • 66.6% (36/54) of studies demonstrate deployment-agnostic security primitives spanning IoT, containers, microservices, high-speed networking, and security frameworks.
  • Three architectural shifts emerge: decentralized security models, observability-first defense strategies, and hardware-software co-design.The reported shares are 83% (5/6) for IoT decentralization, 71% (5/7) for microservices, and 60% (6/10) for container observability; hardware-software co-design achieves 10-100× throughput improvements.
  • Future research should improve verifier expressiveness, adversarially robust in-kernel ML, multi-tenant isolation, production-scale evaluation, meta-security auditing, and cross-platform portability.
  • The review concludes that eBPF has strong potential for next-generation security, but adoption at scale requires better verifier expressiveness, ecosystem tooling, and production validation.

Appendix A: Complete Search Query

The appendix specifies a Boolean search query applied uniformly across six databases, with minimal database-specific syntax adaptations. The query combines eBPF terms with cybersecurity and systems-performance terms.

  • The search covered IEEE Xplore, ACM Digital Library, Scopus, SpringerLink, MDPI, and Google Scholar.
  • The query combined “extended Berkeley Packet Filter” or “eBPF” with security terms including intrusion detection, runtime security, zero-trust, DDoS mitigation, and malware detection.
  • The query also included observability, real-time monitoring, packet filtering, latency, throughput, scalability, traffic analysis, telemetry, and related systems terms.
  • Database-specific adaptations were minimal and mainly adjusted syntax for supported field-specific searches, such as title, abstract, and keyword limits.

Declarations

The declarations report funding from the European Union’s Horizon Framework Programme, no conflicts of interest, and article-contained datasets and documentation. The listed materials include the primary studies, PRISMA screening process, inclusion criteria, and search query.

  • Funding and transparency: The research is supported by the European Union’s Horizon Framework Programme under the INTACT project, Grant Agreement No. 101168438.
  • Funding and transparency: The authors declare that they have no conflict of interest.
  • Data availability: Datasets supporting the findings are included within the article and its appendices.
  • Data availability: Tables 3 and 4 provide the complete list of 54 primary studies, while Figure 2 documents the PRISMA screening process.
  • Data availability: Table 2 details inclusion and exclusion criteria, and the complete search query appears in the appendix.

Appendix A

The appendix notes that review materials and all analyzed studies are accessible through specified channels, and records the authors’ contributions and approval of the manuscript.

  • The data extraction spreadsheet, including study characteristics, evaluation details, performance metrics, and quality scores, is available from the corresponding author upon reasonable request.
  • The screening decisions log and borderline-case resolution documentation are available upon request.
  • All 54 primary studies can be retrieved from their publishers using the DOIs in the reference list.
  • Author Contributions: Stamatios Kostopoulos led conceptualization, methodology, literature search, data extraction, formal analysis, drafting, and visualization.
  • Author Contributions: Panagiotis Tsakonas contributed to conceptualization, methodology, validation, and manuscript review and editing.
  • Author Contributions: Evangelos K. Markakis contributed to methodology, validation, manuscript review and editing, and project administration; all authors approved the final manuscript.
Loading 2608.27511v1…