When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866914637376651264 |
|---|---|
| author | Wang, Zicheng Chen, Tiejin Dai, Qinrun Chen, Yueqi Wei, Hua Zeng, Qingkai |
| author_facet | Wang, Zicheng Chen, Tiejin Dai, Qinrun Chen, Yueqi Wei, Hua Zeng, Qingkai |
| contents | Compartmentalization effectively prevents initial corruption from turning into a successful attack. This paper presents O2C, a pioneering system designed to enforce OS kernel compartmentalization on the fly. It not only provides immediate remediation for sudden threats but also maintains consistent system availability through the enforcement process.
O2C is empowered by the newest advancements of the eBPF ecosystem which allows to instrument eBPF programs that perform enforcement actions into the kernel at runtime. O2C takes the lead in embedding a machine learning model into eBPF programs, addressing unique challenges in on-the-fly compartmentalization. Our comprehensive evaluation shows that O2C effectively confines damage within the compartment. Further, we validate that decision tree is optimally suited for O2C owing to its advantages in processing tabular data, its explainable nature, and its compliance with the eBPF ecosystem. Last but not least, O2C is lightweight, showing negligible overhead and excellent sacalability system-wide. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2401_05641 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization Wang, Zicheng Chen, Tiejin Dai, Qinrun Chen, Yueqi Wei, Hua Zeng, Qingkai Operating Systems Cryptography and Security Machine Learning Compartmentalization effectively prevents initial corruption from turning into a successful attack. This paper presents O2C, a pioneering system designed to enforce OS kernel compartmentalization on the fly. It not only provides immediate remediation for sudden threats but also maintains consistent system availability through the enforcement process. O2C is empowered by the newest advancements of the eBPF ecosystem which allows to instrument eBPF programs that perform enforcement actions into the kernel at runtime. O2C takes the lead in embedding a machine learning model into eBPF programs, addressing unique challenges in on-the-fly compartmentalization. Our comprehensive evaluation shows that O2C effectively confines damage within the compartment. Further, we validate that decision tree is optimally suited for O2C owing to its advantages in processing tabular data, its explainable nature, and its compliance with the eBPF ecosystem. Last but not least, O2C is lightweight, showing negligible overhead and excellent sacalability system-wide. |
| title | When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization |
| topic | Operating Systems Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2401.05641 |