In-Kernel Traffic Sketching for Volumetric DDoS Detection

Emerging network technologies like cloud computing provide flexible services but also introduce vulnerabilities to host servers, such as exposure to Distributed Denial of Service (DDoS) attacks. Traditional host-based detection tools operate in the user space, which can delay detection because network traffic must pass through the kernel space first. Moving detection to the kernel space speeds up the process but limits traffic processing capabilities. We propose using a memory-efficient sketch-based data structure for kernel-space DDoS detection, allowing attacks to be identified immediately upon arrival at the host. We also introduce double-sketch and adaptive-threshold mechanisms to circumvent some inefficiencies of eBPF and to optimize this design for dynamic network traffic. Experiments in a controlled environment show that our approach achieves over 90% detection performance and accelerates it to a sub-microsecond level compared to the millisecond level in classical user-space methods.