# Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF
## 1 Introduction
In addition, it provides the interface platform for the application that needs to provide high availability and scalability through its microservices [5]. Users of Kubernetes test the deployment features of an application by diverting traffic between different containers. On the other hand, malicious users may compromise Kubernetes clusters to control other users' containers. Over the past years, methods and gadgets for launching an attack have drastically improved. DoS (Denial of Service) or DDoS (Distributed Denial of Service) are potentially the most renowned attacks. The goal behind DoS or DDoS attacks is to bring the server out of reach for others and it will create a potential gap in the performance overhead of the system. eBPF is a revolutionary technology in a Linux kernel that handles everyday tasks and affects the processes running on the server. eBPF has a significant impact on system performance because of different complexities and the frequency of the events. It can be used to perform various tasks ranging from package isolation to opening a particular document in the file system. Unlike other ways to change the behavior of a part, eBPF does not require part recompilation or part module assembly and is protected from execution by security checks by stacking code verifiers. Each second is important in detecting malicious packets so that particular prevention methods can be applied. Express Data Path (XDP) [6] gives the quick execution of group dealing with and programmable association way in the cycle of Linux. XDP generally processes the packages' level of the stack, which prompts the quick presentation without compromising the programmability. In the past few years, detection and prevention approaches have been topics of interest in the fields of networks and cybersecurity. One of the major security risks to many networks in the last ten years is a DDoS attack. It can not only stop authorized users from using and accessing network resources, but it can also destroy the network [7]. Cloud services and microservices are at high risk of DDOS attacks [8]. In 2019, it is reported that a Kubernetes cluster that was being utilized to host a cryptocurrency mining operation came under attack from a distributed denial-of-service (DDoS) attack. The attack, which wrecked the Kubernetes cluster and halted the mining process, was launched by the attackers using a huge number of compromised machines. A DdoS attack against a Kubernetes cluster hosting a machine learning platform was reported by researchers in 2020. The attack was carried out by the attackers using a large number of compromised devices, which led to the collapse of the Kubernetes cluster. In [9; 10], it was highlighted that these types of cyber attacks are not only limited to a specific area but operate in a different area as well, which helps the potential attackers use the open and less privileged loophole and then make the entire system compromised. We have analyzed the detailed review of the existing cloud solutions to review the loopholes in the cloud application and also investigate the overhead in the cloud solutions related to the attacks. The literature on these existing solutions is comprehensively reviewed from well-known conferences and journals. The review of the papers mostly contains the major aspects of observability, detection, mitigation, overheads of cloud computing, architecture, cloud types, etc. In addition, we investigated and analyzed the issues related to the performance of the existing solutions. We have investigated the identified research problem by analyzing current experiments on cloud orchestration tools like Kubernetes. Existing cloud solutions are implemented using Kafka, etc. These existing solutions contain many overheads, latency issues, accuracy, etc. However, detecting DDoS attacks in the Kubernetes network remains a challenging problem. High-load traffic attacks are the primary type of DDoS attack through which different network machines produce unnecessary load toward the server.