A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs

Isolation Forest and gRPC microservices deliver high detection quality with minimal overhead on resource-constrained hardware

Shiqi Wu; Oleksii Koshovyi; Georgios Pseiridis Pseiras; Victor Morel; Romaric Duvignau· 2026· DOI 10.48550/arXiv.2609.12605

The core problem

Distributed Denial-of-Service (DDoS) attacks continue to threaten transport networks, with recent attack volumes exceeding 30 Tbps and the telecommunications industry being a primary target. Existing research has not sufficiently examined how the hosting software architecture impacts network monitoring solutions, nor has it thoroughly assessed recent algorithms for improving attack detection. This paper addresses these gaps by presenting a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. The system builds on a statistical baseline and enhances detection effectiveness using an Isolation Forest trained on a wider set of flow features. These features are extracted by GoFlowMeter, an open-source Go implementation of CICFlowMeter. Additionally, the NIDS integrates eBPF/XDP to filter real traffic at the kernel level, enabling efficient packet processing. The study compares three deployment architectures—monolithic, Kafka-based, and gRPC-based microservices—on a Raspberry Pi 5 testbed, replaying the CIC-DDoS2019 dataset as real network traffic. The goal is to clarify the trade-offs between detection quality and a

The evaluation reveals that detection quality is primarily determined by the choice of detector rather than the transport architecture. The Isolation Forest significantly improves recall and F_{1} score over the statistical baseline, achieving an F_{1} score of 0.965 in the live monolithic variant. It successfully flags low-volume attack windows that the baseline misses. Regarding transport performance, the gRPC-based microservices deployment achieves almost the same accuracy as the monolithic variant while adding less than 2 milliseconds of transport time per window. In contrast, the asynchronous Kafka pipeline trails by approximately nine percentage points in detection quality and adds about 27 milliseconds of overhead. These results highlight that while the detector is the dominant factor, the transport mechanism still impacts overall system performance, especially in resource-constrained environments.

Distributed Denial-of-Service (DDoS) attacks continue to threaten transport networks, with recent attack volumes exceeding 30 Tbps and the telecommunications industry being a primary target. Existing research has not sufficiently examined how the hosting software architecture impacts network monitoring solutions, nor has it thoroughly assessed recent algorithms for improving attack detection. This paper addresses these gaps by presenting a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. The system builds on a statistical baseline and enhances detection effectiveness using an Isolation Forest trained on a wider set of flow features. These features are extracted by GoFlowMeter, an open-source Go implementation of CICFlowMeter. Additionally, the NIDS integrates eBPF/XDP to filter real traffic at the kernel level, enabling efficient packet processing. The study compares three deployment architectures—monolithic, Kafka-based, and gRPC-based microservices—on a Raspberry Pi 5 testbed, replaying the CIC-DDoS2019 dataset as real network traffic. The goal is to clarify the trade-offs between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware.

The NIDS is designed for DDoS detection in transport networks, leveraging a combination of statistical baseline and machine learning. The Isolation Forest algorithm is trained on a comprehensive set of flow features extracted by GoFlowMeter, which captures network traffic characteristics. To ensure real-time processing, eBPF/XDP is employed to filter traffic at the kernel level, reducing user-space overhead. The system is evaluated on a Raspberry Pi 5 testbed, where the CIC-DDoS2019 dataset is replayed as live network traffic to simulate realistic conditions. Three deployment architectures are compared: (1) monolithic, where all components run in a single process; (2) Kafka-based microservices, using asynchronous message passing; and (3) gRPC-based microservices, using synchronous remote procedure calls. Performance metrics include detection quality (recall, F_{1} score) and transport overhead (latency per window). The experimental setup allows for a controlled comparison of how architecture affects both detection and resource usage.

The findings clarify the trade-off between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware. The Isolation Forest's superior performance demonstrates the value of using advanced machine learning algorithms trained on rich flow features. The gRPC-based microservices architecture offers a compelling balance, providing near-monolithic accuracy with minimal latency overhead, making it suitable for embedded deployments. The Kafka-based approach, while asynchronous and potentially more scalable, introduces significant latency and reduces detection quality, likely due to message queuing delays and potential packet loss. The integration of eBPF/XDP proves effective for kernel-level filtering, enabling real-time traffic processing without excessive CPU load. Overall, the study suggests that for embedded NIDS, a monolithic or gRPC-based microservices architecture with an Isolation Forest detector is preferable, while Kafka may be better suited for scenarios where scalability outweighs latency concerns. Future work could explore adaptive architectures that dynamically switch based on traffic conditions.

CS practitioners and researchers

Opening member content…