# Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF
## 6 Conclusions  
In conclusion, detecting and observing DDoS attacks in Kubernetes using eBPF is a highly effective way to improve the security of containerized applications. With the increasing popularity of Kubernetes for deploying and managing containerized applications, the risk of DDoS attacks is also increasing. eBPF provides a powerful way to monitor and analyze network traffic at the kernel level, allowing for highly granular and real-time visibility into the behaviour of the system. By using eBPF, we can detect and observe DDoS attacks in real time, identifying attacks by detecting and observing them before they cause significant damage to the system. This not only improves the security of the system but also helps maintain the high availability and uptime of the applications running in Kubernetes. The use of eBPF can also significantly reduce the workload of security teams, automating the process of detecting and mitigating attacks and enabling faster incident response times. Compared to conventional methods, using eBPF for DDoS detection in Kubernetes has many advantages. The effective execution of programs on live network packets is made possible by the high-performance technology known as eBPF, which is crucial for real-time DDoS detection. Additionally, eBPF has a low overhead, allowing it to be used in production settings without degrading the cluster's performance, which we also observe in our results and discussion sections. Kubernetes' eBPF for DDoS detection can boost the cluster's security and dependability. DDoS attacks can be prevented using eBPF's real-time detection and mitigation, which guarantees that users can continue to access services while the cluster is protected. In this approach, eBPF can significantly contribute to the safety and stability of Kubernetes clusters. We have presented the detection and observation of the DDOS attack in Kubernetes using eBPF, which is based on the cloud. To perform the detection and observation, we have implemented the BPF script on each node of the Kubernetes cluster, which is running on different VMs. Afterwards, we evaluated the detection and observation of the DDoS attack which the help of the implemented scripts. The detection will be done on the incoming packets on their extrapolated full load toward the targeted victim node. On the behalf of the results, we have evaluated the evaluation metrics which are based on the overhead of CPU utilization and memory usage. It is also observed from the evaluation metrics that using eBPF generates low overhead on CPU and memory and it is more effective while using detecting and observing DDOS attacks. The proposed solution is quite an effective technique for microservices like Kubernetes. To the best of our knowledge, no one has detected and observed DDoS in the research. The technique that is used for the cluster's nodes is very effective, and the script does not overburden the nodes working on different VMs. Our proposed solution is lightweight, efficient, and scalable. Figure 7: Worker Node Memory Overhead Analysis. The proposed solution for the observation and detection of the DDOS attack has some limitations. While using eBPF to detect and observe DDoS attacks in a Kubernetes cluster has its benefits, it also has some limitations and areas for future work. Some of these include the adoption of this technology by organizations may be difficult due to the complexity of eBPF programs and the lack of standards in the eBPF ecosystem. As Kubernetes clusters continue to scale, it will be important to ensure that eBPF programs can scale with them. eBPF can be integrated with other Kubernetes technologies to provide a more complete picture of network traffic and security and it will help to create easiness to adopt and use. Overall, the use of eBPF for detecting and observing DDoS attacks in Kubernetes is a highly effective and scalable solution that can significantly improve the security and reliability of containerized applications.