What question did this study set out to answer?

To develop and evaluate a low-latency network intrusion detection and prevention architecture that combines in-kernel feature extraction with an ensemble machine learning classifier in user space.

August 19, 2026Journal of King Saud University - Computer and Information Sciences0 citationsOpen Access

A hybrid eBPF/ML intrusion detection system with two-model heterogeneous ensemble learning and real-time gateway-mode network blocking

YAYahya Alnattaf HMHanaa F. Mahmood

Key Points

To develop and evaluate a low-latency network intrusion detection and prevention architecture that combines in-kernel feature extraction with an ensemble machine learning classifier in user space.
Extracted 23-dimensional per-flow features inside the Linux kernel via an eXpress Data Path (XDP) eBPF program, transmitting data through a 4 MB lock-free ring buffer.
Combined a Deep Neural Network and an isotonic-calibrated Random Forest using weighted voting, confidence gating, and consecutive-attack confirmation rules.
Evaluated performance using chronological train/val/test splits on CIC-IDS2018 and cross-dataset evaluation on CIC-IDS2017 with 1,000-resample bootstrap 95% confidence intervals.
Achieved an accuracy of 0.9567, precision of 0.9242, recall of 0.8920, F1 score of 0.9079 (95% CI: [0.9046, 0.9124]), FPR of 0.0230, and ROC-AUC of 0.9707 on the chronological CIC-IDS2018 test split.
Maintained a median end-to-end kernel-to-decision latency of 1.4 ms on a single core while performing real-time packet dropping via XDP_DROP and iptables.

Abstract

Network intrusion detection systems (IDS) face a persistent trade-off between detection accuracy and processing latency. Conventional ML-based IDS implementations operate entirely in user space, introducing per-packet overhead from kernel-to-user-space context switches and memory copies which becomes the dominant cost at moderate-to-high traffic rates. We present a hybrid architecture that pushes 23-dimensional flow-feature extraction into the Linux kernel using an eXpress Data Path (XDP) eBPF program, and combines it with a heterogeneous, calibrated two-model ensemble in user space. The kernel program parses Ethernet/IP/TCP/UDP headers, maintains bidirectional per-flow state in an LRU hash map, and submits cumulative features to user space through a 4 MB lock-free ring buffer. A sliding-window detector then feeds two complementary supervised models—a Deep Neural Network (DNN) and an isotonic-calibrated Random Forest (RF) —whose probabilities are blended through validation-selected weighted voting under a confidence gate and a consecutive-attack confirmation rule. We further describe a gateway-mode deployment that turns the IDS host into the network gateway for protected devices, enabling true device-level isolation through paired eBPF XDPDROP and iptables-FORWARD blocking. To address methodological concerns of an earlier draft, the system is re-evaluated under a strict per-day, per-attack-type chronological train/validation/test split on CIC-IDS2018, with held-out hyperparameter selection (including a one-dimensional grid search over w ₃₍₍ with w ₑ₅=1-w ₃₍₍), a component ablation matrix, /k/ window sensitivity sweeps, a per-attack false-negative breakdown, 1 000-resample bootstrap 95% confidence intervals, and a cross-dataset evaluation on CIC-IDS2017 (same models, same pipeline, with explicit transfer experiments in both directions). On the CIC-IDS2018 chronological test fold (mean across three seeds) the validation-tuned DNN + RF ensemble achieves accuracy 0. 9567, precision 0. 9242, recall 0. 8920, F1 0. 9079, FPR 0. 0230 and ROC-AUC 0. 9707 (95% bootstrap CIs on F1: 0. 9046, 0. 9124) ; the in-distribution F1 is statistically indistinguishable from a pure-RF model, but the cross-dataset transfer to CIC-IDS2017 illustrates the value of the heterogeneous blend. End-to-end kernel-to-decision latency is 1. 4 ms median on a single Intel i7-12700H core. A web dashboard provides per-model vote visualisation, blocking controls, and operator telemetry. All code, models, hyperparameters, random seeds, and the full container recipe required to reproduce every reported number are released alongside the manuscript.

Ask AI

Helpful

Bookmark

View Full Paper