# Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF
## 5 Results and Discussion  
The evaluations we conducted in the previous section are all discussed in this section, along with an empirical analysis of the suggested solution. We have carried out several experiments to achieve the desired outcomes for detecting and observing. To evaluate the evaluation metric based on the elements described in the previous section, we primarily aim to observe and detect the DDoS attack on the Kubernetes cluster using eBPF. The evaluation findings of the performance of VM with various Kubernetes nodes are also covered. The proposed solution provides the features of observing and detecting DDoS attacks in Kubernetes using eBPF. Our proposed solution is efficient, accurate, and lightweight due to its working on user mode and low overhead producing mechanism. The evaluation process for observation and detection capabilities is presented in this section. The graphical information is displayed to assess the performance. To verify the effectiveness of our suggested solution, the following feature is measured, i.e., overhead.  
If the microservice, in collaboration with the eBPF solution, creates a reasonable performance overhead on the system, it is not a good solution, even if the other features of that solution are fine; however, creating a fair overhead renders it unacceptable. In this part, we evaluate the overhead of our suggested solution and demonstrate that it has no noticeable impact on either the master node or the worker nodes of the Kubernetes cluster. To evaluate the overhead on the overall cloud system, we measure the following attributes on the node of the Kubernetes cluster, i.e., master node or worker nodes. To measure the overhead of our proposed solution, we have executed the nodes on which the VMs are deployed and launched using different operating system images.  
Table 2 demonstrates the high efficiency of our proposed solution, which is attributed to the effective utilization of BPF hooks for detecting and monitoring DDOS attacks. The proposed solution effectively captures the traffic load of requests by utilizing BPF hooks and probes. The payload detection BPF hook is highly effective at handling the load of incoming requests, ensuring that all requests sent from various nodes are thoroughly checked. Our Kubernetes cluster network is distributed, and all nodes share the same kernel from the host machine. This allows the eBPF to work on the host server and enables all nodes to detect attacks, regardless of the number of containerized applications deployed on the cluster. Each node in the cluster has established a varying number of connections, which our algorithm evaluates by analyzing the number of requests that exceed a predetermined threshold value. The payload allows for the identification of DDOS attacks versus genuine requests. As a result, our eBPF-based solution has proven to be highly efficient and effective. In [20; 21], various network policies, pod policies, and generic policies were implemented to secure the Kubernetes cluster from unwanted traffic and external unauthorized users. In addition, these measures help to prevent unexpected attacks on the Kubernetes cluster network.