PacketScope: Bridging eBPF and LLMs for In-Stack Defense Against Subtle TCP/IP Exploits

Abstract

The TCP/IP protocol suite underpins today’s Internet infrastructure, yet emerging attacks increasingly exploit subtle semantic flaws in protocol interactions to bypass traditional defenses and inflict severe damage. In this article, we introduce PacketScope, a framework that integrates kernel-level observability via the extended Berkeley Packet Filter (eBPF) with reasoning and policy synthesis driven by large language models (LLMs), enabling comprehensive and effective in-stack defense against a wide range of subtle TCP/IP exploits. Specifically, PacketScope follows a three-stage workflow. First, leveraging eBPF, it performs per-packet inspection within the kernel to construct protocol interaction graphs (PIGs) across layers and protocols, capturing long-context semantics and fine-grained session dynamics. Second, it employs an LLM to reason over PIGs, identifying anomalous interactions and generating enforcement policies expressed as eBPF rules. Finally, these rules are enforced in-kernel for real-time blocking, mitigating attacks directly within the TCP/IP stack. We implement a Linux prototype that instruments critical TCP/IP components with eBPF hooks and integrates LLMs (e.g., DeepSeek, TrafficLLM) for semantic analysis. Evaluation with real-world traffic traces, synthetic attack scenarios, and stress-test environments involving mixed protocol interactions shows that PacketScope detects a wide spectrum of attacks - including cross-protocol interference, state desynchronization, and covert connection manipulation - while incurring less than 2.5% performance loss. Unlike existing packet- or flow-level approaches based on signatures or classification, PacketScope demonstrates that coupling kernel-level observability with AI-driven semantic reasoning enables practical, effective, and lightweight in-stack defenses.