US 2025/0030714 A1 · KERNEL SPACE FEATURE GENERATION FOR USER SPACE MACHINE LEARNING-BASED MALICIOUS NETWORK TRAFFIC DETECTION

Abstract

An in-kernel virtual machine (“VM”) instantiated in the kernel space of a physical or virtual machine (“machine”) attaches code hooks at a network interface of the machine. The code hooks redirect network traffic from the network interface to a module that generates feature values at the kernel space from protocol data units of network traffic received by the network interface. The machine passes the feature values from kernel space to user space via zero-copy shared memory and a machine learning model in the user space obtains network traffic verdicts as outputs from inputting the feature values. The machine passes the verdicts from user space to kernel space via the zero-copy shared memory and the in-kernel VM performs corrective action based on malicious verdicts.

Claims20

Dependent claims

A method comprising:

generating, at a kernel space, a one or more feature values comprising inputs to a machine learning model from network traffic at the data link layer of a network stack;
passing the one or more feature values from the kernel space to a user space, wherein the user space processes network traffic at the application layer of the network stack;
inputting the one or more feature values into the machine learning model at the user space to obtain a verdict as output, wherein the verdict indicates malicious or benign network traffic;
and
passing the verdict from the user space to the kernel space.

2 more elements

An apparatus comprising:

a processor;
a network interface;
and
a machine-readable medium, the machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to:
receive network traffic at the network interface, wherein the network traffic comprises network traffic at the data link layer of a network stack implementation for the apparatus;
based on receipt of the network traffic triggering a first of one or more code hooks, process the network traffic to generate one or more feature values of the network traffic;
pass the one or more features value from the data link layer to the application layer of the network stack implementation;
input the one or more feature values into a machine learning model at the application layer of the network stack implementation to obtain a verdict for the network traffic, wherein the verdict indicates whether the network traffic is malicious or benign;
and
pass the verdict from the application layer to the data link layer of the network stack implementation.

7 more elements

Dependencies are inferred from the claim text.

Kernel space feature generation for user space machine learning-based malicious network traffic detection

Life of this patent

Kernel space feature generation for user space machine learning-based malicious network traffic detection

Life of this patent

Abstract

Claims20