Real-Time eBPF/XDP-Based Deep Learning Framework for Anomaly Traffic Detection in Internet of Things Networks

Internet of Things (IoT) networks face resource constraints yet require real-time anomaly detection across diverse protocols. We propose a dynamic, feature-selective framework for heterogeneous IoT networks. It integrates an extended Berkeley packet filter/express data path (eBPF/XDP) in the driver path with a pretrained lightweight deep learning model in user space, enabling two-stage adaptive feature selection. The feature-selective engine dynamically identifies the most discriminative traffic characteristics under evolving attacks. We validate generalizability using CICDDoS2019, IoT-23, and TON_IoT datasets. For example, on CICDDoS2019, our model trims 77 features down to only five while maintaining nearly identical accuracy (93.3% versus 92.73%). On a Raspberry Pi 4B, packet interception averages 1.85 μs and inference 10.38 ms, with negligible CPU overhead. Results confirm both responsiveness and accuracy, addressing security challenges in IoT networks and edge computing systems.