# Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF
## 2 Related Work  
In this section, we discuss recent studies on the eBPF, microservices, DDOS, and the application of the eBPF to various containerized services on Kubernetes. Several researchers [12; 13; 14], and [15; 16; 17] have proposed different strategies and solutions for the use of eBPF on different aspects of emerging technologies. We provided a brief description of the related studies in Table 1.  
The above-mentioned studies can be classified into two categories: (1) studies that focused on the use of eBPF in the complex network structure and also the filtering of the kernel packets at the userspace, which will further help to formulate different intrusion patterns [12; 13; 19]; (2) studies that discussed the mitigation of the DDoS attack on the server side and also bypassing the kernel and filtering out all the detailed information on the user side, which will overcome the overhead on the Linux network stack [16; 17]. In [15; 18], the accuracy and efficiency of the observability and monitoring based on the microservices were discussed, along with using a framework for Network Function Virtualization to achieve flexibility. In [14], the authors have discussed the offloading mechanism of the packet using eBPF. In [12; 13], the kernel used eBPF for detection duties like looking for page faults and monitoring the distribution of memory, among other things. The benefit and success \begin{table}
\begin{tabular}{c c c c} \hline \hline
**S.No.** & **Existing Work** & **Summary** & **Limitations** \\ \hline
1 & [13] & For the first time, eBPF was used for the detection tasks of the kernel like observing the page faults, over-viewing the memory distribution, etc. The author(s) has encountered the advantage and success factor of eBPF when developing complex networks. & While focusing on the numerous complicated services, the proposed design should also assess the system overhead. \\ \hline
2 & [12] & The author(s) have proposed a solution for the Intrusion detection of the system by using eBPF at the kernel which filtered the huge amount of network packets using the matching rule set of the snorting method. & It seems that there should be state-of-the-art comparison with other features to evaluate the performance of the system \\ \hline
3 & [16] & The aim is to implement an efficient and effective processing pipeline that will help to prevent Distributed Denial of Service (DDoS) attacks. The authors have increased the mitigation power at the server end which will drop the DDoS by using the specific ruleset. eBPF is a flexible tool that will help to sample the network traffic of the operating system using hardware-based filtering. \\ \hline
4 & [17] & The author has proposed a solution based on eBPF which bypasses the kernel and filters all the network packets at the userspace which usually skips the overhead of the Linux network stack. The proposed solution has overcome the performance issue that arises when packets are filtered and analyzed at kernel space. \\ \hline
5 & [15] & The author(s) proposed a non-intrusive protocol-independent intelligent analytics system, more efficient and accurate and also provides the point-to-point observability solution with works on eBPF. It also enables the transparency of the packets for an application like Kubernetes in which we have nodes, clusters, pods, containers, etc. \\ \hline
6 & [18] & A framework was introduced by the author on Network Functions Virtualization to enhance its capability for in-kernel packet processing applications which provides flexibility dynamically in the run-time environment. The framework used for the development of the complex networks provides efficiency in the kernel data plane and flexible user-space control plane for the persistence environment. \\ \hline
7 & [14] & The author(s) have highlighted the benefits of XDP and eBPF using the offloading mechanism based on eBPF to the kernel space from the userspace. The offloading-based mechanism is an optimized solution for the packet processing. \\ \hline \hline \end{tabular}
\end{table}