# Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF
## 3 Architecture of the Proposed Solution
### Algorithm(s) Used for the Proposed Solution  
In this subsection, we discuss our proposed algorithms for the observation and detection of DDoS attacks in Kubernetes using eBPF. Our proposed algorithm, which is presented as a pseudocode, addresses the issues of the detection and observation of DDoS attacks. Our suggested method uses the given approach to gather data. The following are the main problems that we suggested the approach attempts to solve:  
* To detect the IP address used for the attack. * To observe or monitor the running processes. Figure 1: Schematic block diagram of the proposed solution. The algorithms that were utilized to gather the information for these measures are listed below:  
* Algorithm 1: To detect the IP Address with the help of payload. * Algorithm 2: To observe the running processes with respect to process ID (PID). Algorithm 1 specifies how the IP address of the attack is determined on the targeted node and is used to detect DDoS attacks. ```
Require: Define a variable to hold the number of connections from each IP address Initialization of the System Read the values
1 Read the values
2 Ensure:kprobe_tcp_v4_connect, tcp_probe>ipv4.connect
3 IPaddressSet_IP_of_the_connection
4 Count_Array\(\leftarrow\)Increment_count_for_IP_address_in_connection
5 Ensure:tracepoint_raw_syscalls_sys_enter_connect
6 Show the number of connections from each IP address
7 if(Count_Array\(\geq\) 10) then
8 src_dst\(\leftarrow\)tcp_probe.ip4.saddr, tcp_probe.ip4.daddr
9 get_load\(\leftarrow\)tcp_probe.ip4.payload
10 c_payload\(\leftarrow\)bpf_skb_load_bytes(get_load, BPF_CURENT_CPU)
11 if(c_payload is malicious) then
12 Possible DDOS attack from the IP address
13 end if
14 end
```  
**Algorithm 1**Detection of the attack Pseudocode  
In Algorithm 1, we have presented the detection of the DDOS attack on the Kubernetes cluster in the form of the pseudocode. In this algorithm, firstly, we have declared all the variables like IPaddress and Count_Array for holding the numbers of the nodes' IP along with their connection. In line 1, the system will start reading the values. In Line 2, we have defined BPF hooks which will be triggered when a TCP connection is established. In line 3, with the help of the BPF hook, we can have the different IPs that are connected. In Line 4, the count_array will increment the counter of the DDOS attack against each IP. Lines 5 and 6 provide information to the user about the connection on the targeted node. In Line 7, we have checked the threshold value of each connection request. In Lines 8 and 9, we have to get the source and destination IP address which helps to get the source attack IP. In line 10, we have gathered the payload which is sent from the attacking node. In line 11, we analyzed the payload using the BPF hook to check the malicious content. In the last line, it will show the potential attack from the IP address. Algorithm 1 is used to detect the attack, which is coming from multiple nodes, i.e., different IPs with the same type of request and payload. The connections are built on the extrapolated scale, so its DDOS can be shown in Figure 2 that the detection is from different nodes. In addition, the payload helps to detect multiple requests, i.e., DDOS requests or the genuine request of GET or POST that are generated from different IPs. The script works by monitoring network traffic in real time and tracking the number of connections from each IP address. The threshold of ten connections is arbitrary and can be adjusted to suit the specific needs of the network being monitored. A higher threshold may be more appropriate for networks that experience high volumes of legitimate traffic, while a lower threshold may be more effective for networks that are more susceptible to DDOS attacks. In general, setting a threshold for the number of connections from a single IP address can help to identify potential DDOS attacks by detecting patterns of traffic that are inconsistent with normal network behavior.