eBPF-Based Runtime Detection of Semantic DDoS Attacks in Linux Containers
S Remya, Manu J. Pillai, Bhupendra Niranjan, P. Hemanth Kumar, K Merin Shaju, Kunal Raj, Somula Ramasubbareddy, Yongyun Cho · IEEE Access · 2025
Modern Distributed Denial-of-Service (DDoS)attacks increasingly target the application layer to exhaust CPU resources and disrupt service availability, particularly in containerized environments where isolation and diverse implementations complicate traditional detection mechanisms. Existing solutions like CODA(Containerized Denial-of-Service Attack detection) monitor CPU burst times between accept() and close() system calls but fail when attackers maintain persistent connections without triggering close() calls. To address this limitation, we propose CODAX (Container-aware DDoS Attack detection using eXtended Berkeley Packet Filter), a lightweight CPU-time-based detection method that identifies longrunning malicious connections by monitoring system calls at the kernel level using extended Berkeley Packet Filter (eBPF) probes. Unlike prior methods such as CODA that rely on measuring CPU burst time between accept() and close() system calls, our approach tracks CPU usage thresholds from the moment of the accept() call using a global map of 64-bit Unix timestamps, enabling early detection of ongoing attacks before connection closure. The experimental evaluation demonstrates significant performance improvements over existing solutions. The proposed system achieves faster detection times, high attack detection accuracy (ADR: 0.92), and maintains low false positive rates (FPR: 0.02). Statistical validation using paired t-tests confirms that our eBPF-based approach reduces detection latency by an average of 1,772.3ms compared to CODA, representing a 94.2% relative reduction from CODA’s baseline performance (p<0.0001). The system operates efficiently with 30% CPU utilization and demonstrates high scalability for production environments. This research provides a timely and efficient mechanism for mitigating CPU exhaustion DDoS attacks in containerized applications, offering substantial improvements in responsiveness and reliability over existing detection frameworks.