Network intrusion detection on small devices balances speed and accuracy
A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs
Cryptography and SecurityDistributed, Parallel, and Cluster ComputingNetworking and Internet Architecture
Summary
DDoS attacks overload internet networks and are a big problem for telecom companies. The authors built a system that detects these attacks on small devices like Raspberry Pi by watching network traffic carefully. They found that the choice of the detection method matters more for catching attacks than how the data is sent inside the system. Their method can catch subtle attacks better and works fast enough for small, resource-limited devices.
What this means in practice
- •For network security engineers: Deploy resource-efficient DDoS detection on limited hardware by choosing detection algorithms over transport methods to maximize accuracy.
- •For telecommunications network operators: Use embedded NIDS integrated with kernel-level packet filtering to improve early detection of large-scale DDoS attacks on transport networks.
Authors
Shiqi Wu, Oleksii Koshovyi, Georgios Pseiridis Pseiras, Victor Morel, Romaric Duvignau
Abstract
Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring solutions, or to assess recent algorithms for improving attack detection. This paper presents a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. Building on a statistical baseline, we improve detection effectiveness with an Isolation Forest trained on a wider set of flow features, extracted by GoFlowMeter, our open-source Go implementation of CICFlowMeter, and we integrate eBPF/XDP so that the NIDS filters real traffic at the kernel level. We further compare three deployments, monolithic, Kafka-based, and gRPC-based microservices, on a Raspberry Pi 5 testbed replaying the CIC-DDoS2019 dataset as real network traffic. Detection quality is governed mainly by the choice of detector rather than by the transport: the Isolation Forest raises recall and F1 score (0.965 live in the monolithic variant) over the baseline by flagging low-volume attack windows that the baseline misses. The transport is not neutral, however: gRPC reaches almost the same accuracy as the monolithic variant while adding less than 2 milliseconds of transport time per window, whereas the asynchronous Kafka pipeline trails by roughly nine percentage points and adds about 27 milliseconds. These findings clarify the trade-off between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware.