eBPF as an Active Security Enforcement Layer Stop DNS Data Breaches : Beyond Passive Observability
Talkat Linux Security Summit North America 2025 · on Friday, 2025-06-27· at 15:40· Bluebird Ballroom (BBB) 3GH·
summary
A kernel-integrated enforcement framework uses eBPF TC and sockets, BPF LSM and tracepoints to intercept DNS at the endpoint, perform DPI and either clone-redirect or SKB-redirect packets to userspace for classification, and terminate parent processes when thresholds hit. Real deployment uses ONNX inference in userspace with a dense NN trained on ≈3.8–8M domains, achieves ~99% accuracy with a 0.885 decision threshold, blocks exfiltration in ~316 µs on average, costs ~0.3–5% CPU and ~320–340 MB RAM, and shows throughput loss from IPC/redirect overhead.
AI-written summary · about
chapters (11)
- 0:00DNS breach prevention intro
- 2:32DNS as malware C2 channel
- 5:21Limitations of DNS security
- 8:50Real-time DNS enforcement framework
- 13:30Kernel endpoint security architecture
- 18:21Kernel deep packet inspection
- 25:46DNS exfiltration detection model
- 29:18Model training metrics
- 35:45eBPF verification chain proposal
- 39:25Future research directions
- 42:11Q&A
related talks
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
32meBPF: The Next Power Tool of SREs
36meBPF for Runtime Security
32mReal Time Security - eBPF for Preventing attacks
20mClosing Perspectives
43meBPF Superpowers for SRE
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
33meBPF: exploring use case of BPF kernel infrastructure