Exploring Host Security with eBPF: Building a Deep Kernel‑Level Monitoring Loop

Background and Motivation

In cloud‑native and hybrid infrastructures, host security is a foundational protection layer. Traditional host‑security agents struggle with blind spots and latency, while eBPF offers a way to bridge user‑space and kernel‑space monitoring.

Core Advantages of eBPF

Kernel‑level visibility : Direct, real‑time access to system events (processes, network, etc.) eliminates user‑space blind spots.

Extreme performance : JIT compilation and an event‑driven model keep overhead minimal.

Dynamic programmability : Programs can be loaded, updated, or unloaded at runtime without reboot, with a strict verifier ensuring safety.

Security Benefits

Real‑time monitoring : Accurate data collection, process‑to‑file relationship profiling, and support for forensic analysis.

Fast response : Immediate blocking of sensitive‑file exfiltration, ransomware encryption, webshell drops, etc.

Advanced evasion resistance : Overcomes user‑space evasion techniques.

Risks

Mounting eBPF programs in the kernel introduces modest CPU overhead and stability risks, requiring careful engineering.

eBPF Mechanism Overview

eBPF consists of a user‑space loader and a kernel‑space program. The loader compiles source with LLVM/Clang, passes the bytecode to the kernel via the bpf() syscall, the verifier checks safety, the JIT compiler translates it to native code, and the program is attached to hook points. Communication between user and kernel occurs through eBPF maps.

Typical hook points include:

Tracepoints (e.g., tracepoint/syscalls)

Kprobes/Uprobes (kernel and user functions)

Network hooks such as XDP, TC, and socket filters

Perf events and LSM security hooks

Host‑Security eBPF Architecture

The design follows a closed‑loop: architecture design → scenario implementation → multi‑dimensional validation → continuous optimization . In the kernel, hooks load eBPF programs managed by an eBPF Manager; events are stored in maps. In user space, a host agent controls loading, configuration, and forwards events to security detection modules. The server side handles configuration, stability monitoring, and emergency response.

Process Collection Example

By attaching to tracepoints such as sched_process_exec and kprobes like do_execveat, the eBPF program captures PID, PPID, command line, and executable path at the moment of process creation, storing them in maps. This avoids the loss of data that occurs when a short‑lived malicious process exits before a user‑space agent can read /proc.

Network Collection Example

Hooks on tcp_connect, inet_sock_set_state, and udp_sendmsg capture the association between a process’s task_struct and its socket, building a real‑time PID‑5‑tuple map without parsing /proc or text logs.

Compilation and Loading

The BPF source is compiled with clang to produce an object file, which the host agent loads using bpftool prog list and bpftool map list to inspect programs and maps.

Result Comparison

In a command‑audit scenario, Netlink captures only PID, requiring user‑space to fill missing fields, which fails for short‑lived processes. eBPF captures full process metadata, achieving a success rate of 92.04% versus Netlink’s 73.34% (≈18% improvement).

Performance Metrics

Tests on a 4‑core/16 GB machine using stress‑ng measured kernel CPU (sys) and memory (slab) overhead. For both process and network workloads, eBPF increased total kernel CPU usage by ~0.5% compared to Netlink, while memory impact was negligible.

Stability Monitoring

The host agent periodically collects eBPF program ID, load time, call count, total and average CPU time, and raises alerts when thresholds are crossed (e.g., sudden CPU spikes). A 30‑second monitoring window is used for trend analysis.

Emergency Handling

When anomalies such as verifier failures, load/unload errors, or resource exhaustion occur, the agent can automatically unload eBPF programs, switch to a Netlink‑based fallback, and push alerts to a central server and Feishu group. Remote debugging tools (e.g., fetching vmlinux.h, enabling debug logs) are also provided.

Conclusion and Future Directions

eBPF substantially improves host‑security data capture and real‑time monitoring while keeping resource overhead low. Ongoing work should focus on optimizing instruction efficiency, integrating AI‑driven analysis, and extending kernel‑level detection to build complete attack‑chain evidence.