TechTalk: Mitigating attacks on internet infrastructure with eBPF programs

Universities are increasingly becoming targets of layer-7 DDoS attacks, particularly attacks that target their DNS authoritative name servers and can disrupt critical services. This project focused on developing a robust defense strategy within the SURF network by using Linux eBPF programs for real-time, in-kernel filtering of DNS traffic. This approach makes it possible to inspect and filter packets at extremely high speeds, which is crucial for limiting the impact of these high-volume attacks on essential servers.

To effectively cleanse malicious traffic, we deployed BGP to dynamically route DNS traffic to a dedicated eBPF "washer." This washer, equipped with our optimized eBPF filters and Bloom filter configurations, analyzes and cleans the traffic before it reaches its targets, the DNS authoritative name servers. An important part of our research was optimizing these Bloom filter configurations, which are essential for quickly identifying malicious DNS queries. In this TechTalk, I will delve deeper into the design of the eBPF filters, the BGP routing to the washer, and the performance analysis of the chosen Bloom filters, and I will share the challenges and insights we have gained in strengthening academic network security.