|
An Effective and Efficient Approach to
Improve Visibility 2National
Inter-university Consortium for Telecommunications (CNIT), S2N Lab, Genoa,
Italy 3CNIT,
IMATI RU Abstract Modern applications and services increasingly leverage network infrastructures, cyber-physical systems and distributed computing paradigms to offer unprecedented pervasive and immersive experience to users. Unfortunately, the massive usage of virtualization models, the mix of public and private infrastructures, and the large adoption of service-oriented architectures make the deployment and operation of traditional cyber-security appliances difficult. Although cyber-security architectures are already migrating towards distributed models and smarter detectors to account for ever-evolving forms of malware and attacks, they still miss effective and efficient mechanisms to programmatically inspect these new environments. In this paper, we investigate the use of the extended Berkeley Packet Filter for inspecting network communications. We show how this framework can be employed to selectively gather various information describing a network conversation (e.g., packet headers), in order to spot emerging threats like malicious software taking advantage of hidden communications. Results indicate that our approach can be used to inspect network traffic in a more efficient way compared to other traditional mechanisms. Keywords: eBPF, network covert channels, network monitoring +: Corresponding author: Marco Zuppelli Journal of Wireless Mobile Networks, Ubiquitous Computing, and
Dependable Applications (JoWUA) Vol. 12, No. 4, pp. 89-108, December 2021 [pdf] Received:
June 25, 2021; Accepted: September 2, 2021; Published: December 31, 2021 DOI: 10.22667/JOWUA.2021.12.31.089 |