WebScreen+: Web Traffic Screening Performance Enhancement with eBPF Filtering
Neminath Hubballi, Pratibha Khandait · 2025
Web applications attract different cyber attacks as they often deal with sensitive information like banking transactions. Web Application Firewalls are used to screen incoming requests and detect such attacks. A busy web server may receive large number of requests and hence screening can become performance bottleneck. Our contributions in this paper are two-fold. First, we present a novel Deep Packet Inspection (DPI) based method for detecting attacks against a web server. This method employs attack-specific signatures encoded as regular expressions, enabling precise screening of incoming HTTP requests. We describe an approach to semi-automatically generate these signatures using Jaccard index, which measures the similarity between invariant character sets extracted from known malicious HTTP requests. Second, we filter non-essential traffic at the network interface card level to achieve scalability. We evaluate the effectiveness of both the detection method and performance enhancement strategy rigorously through experiments conducted in a live network environment.