{"id":13471044,"url":"https://github.com/CN-TU/machine-learning-in-ebpf","last_synced_at":"2025-03-26T13:30:43.871Z","repository":{"id":99291931,"uuid":"324657771","full_name":"CN-TU/machine-learning-in-ebpf","owner":"CN-TU","description":"This repository contains the code for the paper \"A flow-based IDS using Machine Learning in eBPF\", Contact: Maximilian Bachl","archived":false,"fork":false,"pushed_at":"2024-04-19T08:25:43.000Z","size":555,"stargazers_count":86,"open_issues_count":0,"forks_count":5,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-10-30T02:58:08.539Z","etag":null,"topics":["decision-trees","ebpf","linux","machine-learning","tree-based-methods"],"latest_commit_sha":null,"homepage":"https://arxiv.org/abs/2102.09980","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CN-TU.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-12-27T00:18:19.000Z","updated_at":"2024-10-15T07:11:38.000Z","dependencies_parsed_at":null,"dependency_job_id":"cdd41504-0fd3-45b5-95cd-725f8e1268d7","html_url":"https://github.com/CN-TU/machine-learning-in-ebpf","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CN-TU%2Fmachine-learning-in-ebpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CN-TU%2Fmachine-learning-in-ebpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CN-TU%2Fmachine-learning-in-ebpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CN-TU%2Fmachine-learning-in-ebpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CN-TU","download_url":"https://codeload.github.com/CN-TU/machine-learning-in-ebpf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245662717,"owners_count":20652068,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["decision-trees","ebpf","linux","machine-learning","tree-based-methods"],"created_at":"2024-07-31T16:00:38.807Z","updated_at":"2025-03-26T13:30:43.476Z","avatar_url":"https://github.com/CN-TU.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# machine-learning-in-ebpf\nContact: Maximilian Bachl\n\nThis repository contains the code for the paper *A flow-based IDS using Machine Learning in eBPF* ([arXiv](https://arxiv.org/abs/2102.09980)).\n\nRequires Linux kernel \u003e= 5.3 because 5.3 adds support for loops in eBPF. All code was run on *Debian Buster*. \n\nTested with Python 3.7.9; Python 3.8 or newer does not seem to work. Requires py-virtnet 1.0.1 (Install with ```sudo pip3.7 install py-virtnet```).\n\nCompiled with g++ 10.2.1. \n\nYou'll need the bcc library, which can be installed with ```sudo apt install bcc``` on Debian. \n\nMoreover you need the bcc headers, which can be installed with ```sudo apt install libbpfcc-dev``` on Debian. \n\nAlso, some generic kernel headers might be needed. Install them with `sudo apt install linux-headers-$(uname -r)` on Debian. \n\nIf you encounter some problems, [the resolution of this issue](https://github.com/CN-TU/machine-learning-in-ebpf/issues/1) might help. \n\n## Run in userspace\n\n    g++ -DUSERSPACE -fpermissive -I/usr/include/bcc ebpf_wrapper.cc -lbcc -o ebpf_wrapper\n    \n    sudo python3.7 test.py --run_scenario just_one_flow\n    \n## Run as eBPF\n\n    g++ -fpermissive -I/usr/include/bcc ebpf_wrapper.cc -lbcc -o ebpf_wrapper\n    \n    sudo python3.7 test.py --run_scenario just_one_flow\n\nBy default packets are not dropped for benchmarking reasons. If you want to actually drop packets, you have to make sure to return 0 for \"malicious\" packets (see ebpf.c, search for a comment starting with \"IMPORTANT\"). \n\n## Train a decision tree\n\nTo train a decision tree, check out the [decision_tree branch of the adversarial-recurrent-ids repository](https://github.com/CN-TU/adversarial-recurrent-ids/tree/decision_tree) and follow the instructions there to make it work. Train a decision tree like this: \n\n    ./learn.py --dataroot flows.pickle --function train_dt\n    \nYour trained decision tree will be output in the ```runs``` folder. Change the ```prefix_path``` in ```ebpf_wrapper.cc``` to point to the directory containing your new decision tree and recompile it (see above ([Run in userspace](#run-in-userspace)) or ([Run as eBPF](#run-as-ebpf))). \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCN-TU%2Fmachine-learning-in-ebpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCN-TU%2Fmachine-learning-in-ebpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCN-TU%2Fmachine-learning-in-ebpf/lists"}