当 eBPF 遇上机器学习：动态操作系统内核隔离
When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization
AI总结：
本文提出 O2C 系统，利用 eBPF 在运行时动态注入内核隔离策略，并首次将机器学习模型嵌入 eBPF 程序，其中决策树因可解释性和表格数据处理优势被验证为最优选择，实现轻量、可扩展的即时内核防护。
摘要：
隔离机制能够有效阻止初始破坏演变为成功的攻击。本文提出了 O2C，这是一个开创性的系统，旨在动态执行操作系统内核隔离。它不仅能够对突发威胁提供即时修复，还能在执行过程中保持系统持续可用。O2C 借助 eBPF 生态系统的最新进展，能够在运行时将执行强制操作的 eBPF 程序注入内核。O2C 率先将机器学习模型嵌入 eBPF 程序中，解决了动态隔离中的独特挑战。我们的综合评估表明，O2C 能够有效地将损害限制在隔离区内部。此外，我们验证了决策树最适合 O2C，因为它具有处理表格数据的优势、可解释性以及与 eBPF 生态系统的兼容性。最后，O2C 非常轻量，系统范围内开销可忽略不计，并展现出出色的可扩展性。
英文摘要：
Compartmentalization effectively prevents initial corruption from turning into a successful attack. This paper presents O2C, a pioneering system designed to enforce OS kernel compartmentalization on the fly. It not only provides immediate remediation for sudden threats but also maintains consistent system availability through the enforcement process. O2C is empowered by the newest advancements of the eBPF ecosystem which allows to instrument eBPF programs that perform enforcement actions into the kernel at runtime. O2C takes the lead in embedding a machine learning model into eBPF programs, addressing unique challenges in on-the-fly compartmentalization. Our comprehensive evaluation shows that O2C effectively confines damage within the compartment. Further, we validate that decision tree is optimally suited for O2C owing to its advantages in processing tabular data, its explainable nature, and its compliance with the eBPF ecosystem. Last but not least, O2C is lightweight, showing negligible overhead and excellent sacalability system-wide.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
