A High-Performance IPv6 Fragment Evasion Threat Detection Method Based on eBPF and XDP

The IPv6 fragment header can be exploited by threateners to evade security systems like firewalls, leading to IPv6 fragment evasion threats. Current detection techniques for these threats face limitations in identification capabilities and poor detection performance. To address these issues, a high-performance threat detection method based on eBPF and XDP (named FragEva6-Guard) is proposed. First, XDP is employed at the network driver level to filter IPv6 packets in real time, allowing threat packets to be identified and processed at the earliest stage. Then, an eBPF program is used to further analyze packets that have passed the initial filtering and detect potential threats. A feature matching based upper-layer header integrity detection method is introduced to identify IPv6 fragment evasion threats. FragEva6-Guard extracts critical threat features and performs feature matching during packet analysis. Finally, the XDP decision making module executes appropriate actions based on the feature matching results to complete the detection process. Experimental results show that FragEva6-Guard successfully detects all 16 types of IPv6 fragment evasion threats from the Frag6-TestSuite, achieving an average detection rate of approximately 99.98% across various threat intensities, FragEva6-Guard outperforms both Baseline and Suricata. In terms of processing latency, FragEva6-Guard reduces delays by an average of 99.96% compared to Baseline and by approximately 8% compared to Suricata, while also lowering CPU usage by an average of 95.03% and 85.77%, respectively. Additionally, FragEva6-Guard has minimal impact on network performance, maintaining a consistent packet loss rate of 0%.