【採択】学部3年 大崎君の研究が国際会議 The 19th Asian Internet Engineering Conference (AINTEC 2024) にacceptされました.– ‘ Dynamic Fixed-point Values in eBPF: a Case for Fully In-kernel Anomaly Detection’
Abstract:
eBPF and XDP are promising technologies that are capable of accelerating packet processing inside the Linux kernel. Despite these benefits, eBPF is constrained by a number of rigorous restrictions that are imposed to protect the kernel. One such restriction is the lack of support for floating-point values, which was introduced to achieve faster execution and avoid non-deterministic behavior. However, this has become a significant obstacle to expanding the functionality of eBPF programs with advanced algorithms. In this paper, we propose dynamic fixed-point as a solution to overcome this challenge within the restrictions of eBPF. Dynamic fixed-point values are an expansion from traditional fixed-point values, with the bit allocation adjusted dynamically. Benefit of dynamic fixed-point is that the accuracy of calculations are improved, which is one of the critical shortcomings of fixed-point. To demonstrate the effectiveness of our approach, we have designed and implemented a prototype of an entropy-based traffic anomaly detection framework and have reported on its performance and the detection accuracy. Our prototype, which employs dynamic fixed-point, has achieved an 18% improvement in throughput while also matching the detection accuracy of a similar system that employs floating-point values in user space.
Osaki, A., Poisson, M., Makino, S., Shiiba, R., Fukuda, K., Okoshi, T., & Nakazawa, J. (2024, August). Dynamic Fixed-point Values in eBPF: a Case for Fully In-kernel Anomaly Detection. In Proceedings of the Asian Internet Engineering Conference 2024 (pp. 46-54).
