Leveraging eBPF/XDP for Real-Time Machine Learning Traffic Classification in 5G User Plane Networks

• José Silvestre da Silva Galvão IFPB https://orcid.org/0009-0006-3921-1704
• Flávio Geraldo Coelho Rocha UFG https://orcid.org/0000-0002-7635-5735
• Ruan Delgado Gomes IFPB https://orcid.org/0000-0003-4700-7843
• Leandro C. de Almeida IFPB https://orcid.org/0000-0003-4342-3030

DOI: https://doi.org/10.5753/wiarc.2026.23145

Resumo

5G networks impose stringent requirements, such as low latency and high throughput, that challenge traditional traffic classification mechanisms within the UPF. These approaches often become bottlenecks due to the overhead and latency of user-space processing. To address the challenges, this work proposes a methodology for real-time traffic classification using In-Kernel Machine Learning with eBPF/XDP. The implementation employs C headers and leverages native eBPF mechanisms to manage verifier constraints. Experimental results demonstrate that In-Kernel ML significantly outperforms user space execution, achieving over 36× faster inference speed, reduced CPU usage from 15.79% to 12.87%, and maintaining 99.91% of accuracy.

Referências

Bachl, M., Fabini, J., and Zseby, T. (2021). A flow-based ids using machine learning in ebpf.

Chowdhury, A. (2020). The impact of 5g network on industry 4.0.

do Amaral, T. A. N., Rosa, R. V., Moura, D. F. C., and Rothenberg, C. E. (2021). An in-kernel solution based on xdp for 5g upf: Design, prototype and performance evaluation. In 2021 17th International Conference on Network and Service Management (CNSM), pages 146–152.

European Telecommunications Standards Institute (ETSI) (2024). 5g; system architecture for the 5g system (5gs) (3gpp ts 23.501 version 18.5.0 release 18).

Fei, X., Martins, P., and Lu, J. (2023). Real-time traffic classification for 5g nsa encrypted data flows with physical channel records. In IEEE VTC 2023-Fall.

Gallego-Madrid, J., Bru-Santa, I., Ruiz-Rodenas, A., Sanchez-Iborra, R., and Skarmeta, A. (2024). Machine learning-powered traffic processing in commodity hardware with ebpf. Computer Networks, 243:110295.

Kalør, A. E., Guillaume, R., Nielsen, J. J., Mueller, A., and Popovski, P. (2018). Network slicing in industry 4.0 applications: Abstraction methods and end-to-end analysis. IEEE Transactions on Industrial Informatics, 14(12):5419–5427.

Kawasaki, J., Koyama, D., Miyasaka, T., and Otani, T. (2023). Failure prediction in cloud native 5g core with ebpf-based observability. In 2023 IEEE 97th Vehicular Technology Conference (VTC2023-Spring), pages 1–6.

Monteiro, J. and Sousa, B. (2024). ebpf intrusion detection system with xdp offload support. In 2024 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), pages 1–6.

Rice, L. (2023). Learning eBPF: Programming the Linux Kernel for Enhanced Observability, Networking, and Security. O’Reilly Media, 1 edition.

Siegmund, F., Kundel, R., Meuser, T., and Steinmetz, R. (2026). User plane performance in beyond 5g networks: Comprehensive analysis and evaluation. Computer Communications, 247:108397.

Vieira, M. A. M., Castanho, M. S., Pacífico, R. D. G., Santos, E. R. S., Júnior, E. P. M. C., and Vieira, L. F. M. (2020). Fast packet processing with ebpf and xdp: Concepts, code, challenges, and applications. ACM Comput. Surv., 53(1).

Zhang, J., Chen, P., He, Z., Chen, H., and Li, X. (2024). Real-time intrusion detection and prevention with neural network in kernel using ebpf. In 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 416–428.

Zhou, J., Ma, Z., Tu, W., Qiu, X., Duan, J., Li, Z., Li, Q., Zhang, X., and Li, W. (2023). Cable: A framework for accelerating 5g upf based on ebpf. Computer Networks, 222:109535.