  eBPF is a new technology which allows dynamically loading pieces of code into
the Linux kernel. It can greatly speed up networking since it enables the
kernel to process certain packets without the involvement of a userspace
program. So far eBPF has been used for simple packet filtering applications
such as firewalls or Denial of Service protection. We show that it is possible
to develop a flow based network intrusion detection system based on machine
learning entirely in eBPF. Our solution uses a decision tree and decides for
each packet whether it is malicious or not, considering the entire previous
context of the network flow. We achieve a performance increase of over 20%
compared to the same solution implemented as a userspace program.
