System and Method of Blocking Malicious Connections Based on Application Layer State into EBPF Program
A method of blocking malicious connections based on application layer state into eBPF program is disclosed. The method includes receiving HTTP requests, associated with connections, from users and uniquely identifying and track each connection by assigning a unique identifier. Next, the method maintains the application layer state in the eBPF program for each connection by storing headers of corresponding kernel function calls and analyzing content associated with the received HTTP requests to detect malicious content by inspecting headers, payloads, and/or request parts of corresponding HTTP request via eBPF program to identify potentially harmful and unauthorized requests. Thereafter, the method includes blocking the connections associated with the detected malicious content based on the assigned unique identifier of the connections.
1 . A system of blocking malicious connections based on application layer state into extended Berkeley Packet Filter (eBPF) program, the system comprising:
a receiver module to receive one or more Hypertext Transfer Protocol (HTTP) requests from one or more user devices, wherein the one or more HTTP requests are associated with one or more connections;
a connection identifier module to uniquely identify and track each of the one or more connections by assigning a unique identifier to each connection based at least on one of: a combination of a process identity (ID) and a file descriptor for a non-Transport Layer Security (TLS) connection, and a memory address of Secure Socket Layer (SSL) struct in user program for a TLS connection;
a connection state maintenance module to maintain the application layer state in the eBPF program for each of the one or more connections by storing headers of corresponding kernel function calls of each connection;
a content analysis module to analyze content associated with the received one or more HTTP requests to detect malicious content, wherein the analysis is performed by inspecting at least one of: headers, payloads, and relevant request parts of corresponding HTTP request via the eBPF program to identify potentially harmful and unauthorized requests; and
a blocking module to block the one or more connections associated with the detected malicious content based on the assigned unique identifier of the one or more connections.
2 . The system of claim 1 , wherein the connection state maintenance module maintains the connection using a combination of connection id, data associated with each kernel function calls, and previous state information.
3 . The system of claim 1 , wherein the connection state maintenance module is further configured to maintain protocol state so that next execution of the eBPF program starts the processing from last state and overcome the issue associated with instruction limit of the eBPF program.
4 . The system of claim 3 , wherein the connection state maintenance module is further configured to maintain state by attaching the eBPF program multiple times by adding a pre-defined number (N) of probes to a function to result in N×32 program execution, wherein N is configurable in user space if the limit of processing is known.
5 . The system of claim 1 , further comprises a buffer management module configured to manage fixed-size buffers for connections, including reading data into buffers as needed and moving buffers to accommodate incoming data.
6 . The system of claim 1 , wherein the content identifier module to perform string matching using eBPF maps for specific content in the one or more HTTP requests.
7 . The system of claim 1 , wherein the blocking module is further configured to:
attach the eBPF program at one or more Linux Security Module (LSM) hooks for processing data to determine if read and write calls are allowed;
prevent call from succeeding if the data is malicious by the attached program via the one or more LSM hooks, such that application receives EPERM as the return code of such prevented call; and
mark connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.
8 . The system of claim 1 , wherein the blocking module is further configured to:
set return code of a probed function by utilizing a helper function provided by the eBPF, wherein the helper function is bpf_override_return;
prevent call from succeeding if data is malicious by the helper function, such that application receive EPERM as the return code of such prevented call; and
mark connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.
9 . A method of blocking malicious connections based on application layer state into extended Berkeley Packet Filter (eBPF) program, the method comprising:
receiving one or more Hypertext Transfer Protocol (HTTP) requests from one or more user devices, wherein the one or more HTTP requests are associated with one or more connections;
uniquely identifying and tracking each of the one or more connections by assigning a unique identifier to each connection based at least on one of: a combination of a process identity (ID) and a file descriptor for a non-Transport Layer Security (TLS) connection, and a memory address of Secure Socket Layer (SSL) struct in user program for a TLS connection;
maintaining the application layer state in the eBPF program for each of the one or more connections by storing headers of corresponding kernel function calls of each connection;
analyzing content associated with the received one or more HTTP requests to detect malicious content, wherein the analysis is performed by inspecting at least one of: headers, payloads, and relevant request parts of corresponding HTTP request via the eBPF program to identify potentially harmful and unauthorized requests; and
blocking the one or more connections associated with the detected malicious content based on the assigned unique identifier of the one or more connections.
10 . The method of claim 9 , further comprises maintaining the connection using a combination of connection id, data associated with each kernel function calls, and previous state information.
11 . The method of claim 9 , further comprising maintaining protocol state so that next execution of the eBPF program starts the processing from last state and overcome the issue associated with instruction limit of the eBPF program.
12 . The method of claim 11 , further comprising attaching the eBPF program multiple times by adding a pre-defined number (N) of probes to a function to result in N×32 program execution, wherein N is configurable in user space if the limit of processing is known.
13 . The method of claim 9 , further comprises managing fixed-size buffers for connections, including reading data into buffers as needed and moving buffers to accommodate incoming data.
14 . The method of claim 9 , further comprises performing string matching using eBPF maps for specific content in the one or more HTTP requests.
15 . The method of claim 9 , further comprises:
attaching the eBPF program at one or more Linux Security Module (LSM) hooks for processing data to determine if read and write calls are allowed;
preventing call from succeeding if the data is malicious by the attached program via the one or more LSM hooks, such that application receives EPERM as the return code of such prevented call; and
marking connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.
16 . The method of claim 9 , further comprises:
setting return code of a probed function by utilizing a helper function provided by the eBPF, wherein the helper function is bpf_override_return;
preventing call from succeeding if data is malicious by the helper function, such that application received EPERM as the return code of such prevented call; and
marking connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.
17 . A computer program product comprising at least one non-transitory computer-readable storage medium having computer-executable program code portions stored therein, the computer program product configured to:
receive one or more Hypertext Transfer Protocol (HTTP) requests from one or more user devices, wherein the one or more HTTP requests are associated with one or more connections;
uniquely identify and track each of the one or more connections by assigning a unique identifier to each connection based at least on one of: a combination of a process identity (ID) and a file descriptor for a non-Transport Layer Security (TLS) connection, and a memory address of Secure Socket Layer (SSL) struct in user program for a TLS connection;
maintain the application layer state in an extended Berkeley Packet Filter (eBPF) program for each of the one or more connections by storing headers of corresponding kernel function calls of each connection;
analyze content associated with the received one or more HTTP requests to detect malicious content, wherein the analysis is performed by inspecting at least one of: headers, payloads, and relevant request parts of corresponding HTTP request via the eBPF program to identify potentially harmful and unauthorized requests; and
block the one or more connections associated with the detected malicious content based on the assigned unique identifier of the one or more connections.
18 . The computer program product of claim 17 , further comprises:
maintain the connection using a combination of connection id, data associated with each kernel function calls, and previous state information;
maintain protocol state so that next execution of the eBPF program starts the processing from last state and overcome the issue associated with instruction limit of the eBPF program;
attach the eBPF program multiple times by adding a pre-defined number (N) of probes to a function to result in N×32 program execution, wherein N is configurable in user space if the limit of processing is known;
manage fixed-size buffers for connections, including reading data into buffers as needed and moving buffers to accommodate incoming data; and
perform string matching using eBPF maps for specific content in the one or more HTTP requests.
19 . The computer program product of claim 17 , further comprises:
attach the eBPF program at one or more Linux Security Module (LSM) hooks for processing data to determine if read and write calls are allowed;
prevent call from succeeding if the data is malicious by the attached program via the one or more LSM hooks, such that application receives EPERM as the return code of such prevented call; and
mark connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.
20 . The computer program product of claim 17 , further comprises:
set return code of a probed function by utilizing a helper function provided by the eBPF, wherein the helper function is bpf_override_return;
prevent call from succeeding if data is malicious by the helper function, such that application received EPERM as the return code of such prevented call; and
mark connection state as blocked in internal structure by the eBPF program for forcing the application to close the connection.