[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-126854-en":3,"doc-seo-126854-105":30,"detail-sidebar-cat-0-en-105":84},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},126854,1099523882367,"Hazel","https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc",6,"Technology","When eBPF Meets Machine Learning - On-the-fly OS Kernel Compartmentalization - Abstract and Evaluation","Compartmentalization prevents initial corruption from escalating into a successful attack by restricting damage to the vulnerable kernel component while keeping the rest of the system functioning. This paper introduces O2C, a system that enforces OS kernel compartmentalization on-the-fly in response to sudden threats. O2C leverages runtime-instrumented eBPF to perform enforcement actions and embeds a machine learning model into kernel space. Experiments show damage confinement, negligible overhead, and good scalability, with decision trees optimized for tabular features and eBPF constraints.","When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization  \nZicheng Wang  \nNanjing University University of Colorado Boulder  \nTiejin Chen Arizona State University  \nQinrun Dai University of Colorado Boulder  \nYueqi Chen University of Colorado Boulder  \nHua Wei Arizona State University  \nQingkai Zeng Nanjing University  \narXiv :2401 .05641v1 [ cs .OS] 11 Jan 2024  \nAbstract  \nCompartmentalization effectively prevents initial corruption from turning into a successful attack. This paper presents O2C, a pioneering system designed to enforce OS kernel compartmentalization on the fly. It not only provides immediate remediation for sudden threats but also maintains consistent system availability through the enforcement process.  \nO2C is empowered by the newest advancements of theeBPF ecosystem which allows to instrument eBPF programs that perform enforcement actions into the kernel at runtime. O2C takes the lead in embedding a machine learning model into eBPF programs, addressing unique challenges in on-thefly compartmentalization. Our comprehensive evaluation shows that O2C effectively confines damage within the compartment. Further, we validate that decision tree is optimally suited for O2C owing to its advantages in processing tabular data, its explainable nature, and its compliance with the eBPF ecosystem. Last but not least, O2C is lightweight, showing negligible overhead and excellent sacalability system-wide.  \n1 Introduction  \nA successful attack is a multi-step process. From an initial corruption, attackers need to leverage a sequence of exploitation techniques to obtain exploitable primitives, escalate privileges of the compromised system, until achieve the ultimate goals such as unauthorized access to sensitive information. Compartmentalization is an effective defense to prevent initial corruption from turning into a successful attack. It constrains the damage within the vulnerable component so that the rest of the system continues to operate well.  \nA variety of compartmentalization solutions have been proposed for Operating System kernels. Notable examples include methods that harness hardware features such as NOOKS [66] and HAKC [44], and those utilize hypervisors, including HUKO [74], LXD [50], LVD [51], and KSplit [27] . Additionally, there are software-based approaches like SFI [72], XFI [23], BGI [18] and LXFI [40] .  \nThough these solutions can achieve the compartmentalization goal technique-wise, when applied to the real world, they are hindered from producing the best results. On the one hand, security incidents often happen all of sudden [2],  \nObject number  \n107  \n105  \n103  \n101  \n0 200 400 600 800 1000  \nLife span (seconds)  \nFigure 1. Distribution of object, profiled in 20 minutes.  \nand there is no prior indication of which kernel component may be vulnerable. As a result, compartmentalization can be enforced only after the disclosure of security threats. On the other hand, existing solutions, no matter whether hardware-based, hypervisor-based, or software-based, are all offline compartmentalization techniques. They require pre-reserving memory, pre-configuring hardware or hypervisor, or instrumenting kernel during compilation time. Asa consequence, to enforce compartmentalization, we have no choice but to disrupt running computation services torecompile and reboot the system.  \nTo maximize the protection effect of kernel compartmentalization, it is invaluable to have on-the-fly solutions that not only provide immediate remediation for sudden threats but also maintain consistent system availability. However, achieving on-the-fly compartmentalization presents three unique challenges. First, on-the-fly scenarios lack pre-arranged utilities: both hardware and hypervisor features require configuration before system bootup, and instrumentation must be done during compilation. Second, the assets of the compartment and the rest ofthe kernel, such as stack and heap, are intertwined. It is difficu","cbCaikQmxaWCxVND","https://ap.wps.com/l/cbCaikQmxaWCxVND","pdf",748253,1,16,"English","en",105,"# Introduction\n## Background and motivation\n## Challenges of on-the-fly compartmentalization\n## O2C design approach\n# Abstract\n## System overview and key contributions\n## Evaluation summary","[{\"question\":\"Why is a decision tree used in O2C?\",\"answer\":\"The paper reports that decision trees fit O2C because they handle tabular data well, are explainable, and comply with eBPF ecosystem constraints.\"}]","When eBPF Meets Machine Learning - On-the-fly OS Kernel Compartmentalization - Abstract and Evaluation | PDF",1785935248,40,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":79,"head_meta":81,"extra_data":83,"updated_unix":28},"when-ebpf-meets-machine-learning-on-the-fly-os-kernel-compartmentalization-abstract-and-evaluation","",{"@graph":36,"@context":78},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/technology/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/when-ebpf-meets-machine-learning-on-the-fly-os-kernel-compartmentalization-abstract-and-evaluation/126854/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-24","2026-08-05",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72],{"name":73,"@type":74,"acceptedAnswer":75},"Why is a decision tree used in O2C?","Question",{"text":76,"@type":77},"The paper reports that decision trees fit O2C because they handle tabular data well, are explainable, and comply with eBPF ecosystem constraints.","Answer","https://schema.org",{"og:url":52,"og:type":80,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":82,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":85},[86,90,94,98,103,106,110,115,120,123,127],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":87,"show_sort_weight":88,"slug":89},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":91,"show_sort_weight":92,"slug":93},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Exam",70,"exam",{"id":99,"doc_module":4,"doc_module_name":46,"category_name":100,"show_sort_weight":101,"slug":102},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":104,"slug":105},50,"technology",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":29,"slug":109},7,"Healthcare","healthcare",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},8,"Research & Report",30,"research-report",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":46,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":99,"slug":130},19,"General","general"]