Open access
Aug 2026
A hybrid eBPF/ML intrusion detection system with two-model heterogeneous ensemble learning and real-time gateway-mode network blocking
A hybrid architecture that pushes 23-dimensional flow-feature extraction into the Linux kernel using an eXpress Data Path (XDP) eBPF program, and combines it with a heterogeneous, calibrated two-model ensemble in user space is presented.
Y. Alnattaf, Hanaa F. Mahmood
· Journal of King Saud Univers... · 0 citations