Mitigating DDoS Attacks on Virtualized Environments with eBPF and XDP
A DDoS (Distributed Denial of Service) attack is an attempt to disrupt computer infrastructure. In such an attack, a distributed group of computers sends network traffic to a single target. If enough computers participate, the target becomes overloaded and can no longer process the traffic. As a result, legitimate traffic is also no longer handled properly. An important metric is how many incoming packets per second (pps) a system can handle before it drops packets. There are various strategies for packet processing, each with its own advantages and disadvantages.
This study investigated whether eBPF/XDP can mitigate incoming DDoS attacks in cloud environments.
Cloud Environments and Virtualization
"Cloud" refers to servers managed by a third party, allowing companies to rent resources instead of operating their own data center. The provider manages and maintains the servers for its customers. In cloud environments, virtualization is used to isolate customers from one another and allocate resources more efficiently.
Virtualized environments require specific optimizations to provide the guest operating system (OS) with maximum speed and throughput. One such optimization is VirtIO, a standard for network and disk drivers that are aware they are running in a virtualized environment. This technique, known as paravirtualization, improves speed and throughput because the drivers are adapted to the virtualized environment.
eBPF and XDP for High-Speed Packet Processing
A program often needs to interact with hardware, such as writing to storage or receiving network packets. The Linux kernel handles these requests to the hardware via system calls. System calls place a load on the system and reduce overall performance.
With eBPF (Extended Berkeley Packet Filter), programs run at the kernel level without requiring any modifications to the Linux kernel source code. This improves performance because eBPF programs can access hardware directly without being interrupted by system calls.
Simply running an eBPF program is not enough for fast packet processing. XDP (eXpress Data Path) adds a hook to the network interface card (NIC) driver. This allows the eBPF program to process packets immediately as soon as the NIC receives them, bypassing the kernel's network stack. This makes packet processing significantly faster.
Relevance for DDoS Mitigation in Virtualized Environments
DDoS attacks are growing in scale, so infrastructure must process an increasing number of packets to effectively drop malicious traffic. eBPF combined with XDP is a proven technique that allows systems to process significantly more packets than with traditional packet processing in the Linux kernel. Infrastructure providers, such as Internet service providers and server providers, are increasingly migrating to cloud environments with extensive virtualization. However, little research has been conducted on whether eBPF and XDP can effectively mitigate DDoS attacks in virtualized cloud environments.
This study examined whether eBPF and XDP are suitable for use in virtualized environments to improve performance and mitigate DDoS attacks, and whether the technology is ready for production use.
