August 2025 – We are proud to announce that the paper “eIDPS: A Comprehensive Comparative Analysis of Packet-Level and Flow-Level Intrusion Detection and Prevention” by Stamatios Kostopoulos, Dimitra Papatsaroucha, Ioannis Kefaloukos, and Evangelos Markakis (Hellenic Mediterranean University) has been accepted at the prestigious 2025 IEEE Conference on Cybersecurity and Resilience.
Advancing the State of Network Security
As cyber threats evolve, the debate between packet-level (granular but resource-intensive) and flow-level (scalable but coarser) intrusion detection grows increasingly critical. This research delivers a comparison of both approaches within a unified eBPF-based Intrusion Detection and Prevention System (eIDPS), offering actionable insights for enterprise security architects.
Key Contributions
- First Comparative Framework
- Rigorously benchmarks packet-level vs. flow-level detection using metrics like F1-score (98.8%), CPU overhead (1.45% median).
- eBPF/XDP Optimization
- Achieves kernel-native ML inference by adapting neural networks to eBPF’s fixed-point arithmetic constraints.
- Sanitized hot updates enable secure model evolution without downtime.
- Real-World Validation
- Tested against CIC-IDS2017 and live attacks (Slowloris, GoldenEye, SSH brute force).
- Outperforms Zhang’s flow-based solution in precision (98.8% vs. 97.7%) and F1-score (98.8% vs. 98.5%).
Why This Research Matters
Modern networks face a critical trade-off: flow-based intrusion detection scales efficiently but delays threat response, while packet-level inspection offers real-time precision at higher computational costs. As cyberattacks grow more sophisticated (e.g., zero-day exploits, encrypted threats), enterprises need solutions that balance speed, accuracy, and resource efficiency.
eIDPS bridges this gap by leveraging eBPF/XDP for kernel-level packet processing and machine learning for adaptive threat detection. Unlike flow-based systems, eIDPS:
✔ Prevents collateral damage: Drops only malicious packets, not entire flows, preserving legitimate traffic.
✔ Defends in real time: Identifies threats at line speed (20ns per packet), crucial for 5G/edge environments.
✔ Adapts dynamically: Secure hot updates allow ML models to evolve without kernel reboots.
With 78% of enterprises adopting hybrid networks (ENISA 2024), eIDPS provides a blueprint for next-gen cloud-native firewalls, IoT security, and zero-trust architectures.
Conference Presentation & Availability
The authors will present their findings at IEEE Cybersecurity and Resilience 2025 (August 4-6, Crete, Greece).
