Mitigating Attacks on Internet Infrastructure Using eBPF
Universities are increasingly becoming targets of Layer 7 DDoS attacks, particularly those aimed at their authoritative DNS name servers, which can disrupt critical services. The project developed a defense strategy for the SURF network using Linux eBPF programs that filter DNS traffic in real time within the kernel. This allows for high-speed inspection and filtering of packets, which is necessary to limit the impact of large-scale attacks on critical servers.
To effectively filter out malicious traffic, we used BGP to dynamically route DNS traffic to a dedicated eBPF “washer.” This washer, equipped with our optimized eBPF filters and Bloom filter configurations, analyzes and cleans the traffic before it reaches the targets—the authoritative DNS nameservers. A key part of the research involved optimizing the Bloom filter configurations, which enable the rapid detection of malicious DNS queries. In this TechTalk, I’ll delve deeper into the design of the eBPF filters, the BGP routing to the washer, and the performance analysis of the selected Bloom filters, and I’ll share the challenges and insights we’ve gained while strengthening academic network security.
Speaker
