USING eBPF TO PROTECT AUTOMOTIVE CONTAINERIZED ENVIRONMENTS
DOI:
https://doi.org/10.28925/2663-4023.2025.35.1438Keywords:
automotive electronics, automotive cybersecurity, vehicle networks, data encryption, message authentication, intrusion detection technology, trusted platform module, Crypto-Engine conceptAbstract
Software-defined vehicles increasingly rely on Linux platforms, centralized compute nodes and containerized applications. A shared operating system kernel creates risks of isolation breaches, privilege escalation and unauthorized access of containers to vehicle resources and in-vehicle networks. The aim of this work is to systematize approaches to using eBPF for runtime monitoring, threat detection and security policy enforcement in automotive containerized environments. The methodology is based on an analysis of scientific publications and Linux kernel documentation and on a comparison of protection mechanisms for containers and automotive networks. The functions of eBPF (monitoring, detection, access control, SocketCAN control, correlation, response) are systematized, and the main limitation of each in the automotive setting is identified. The paper substantiates the separation of event logging from synchronous blocking via BPF LSM; two-level control of SocketCAN interaction that separately checks the right to use a CAN interface and the conformity of transmissions with the service’s purpose; mode-specific behavior profiles; and an explicit distinction between established, probable and unknown event origin when correlating container activity with CAN traffic. A three-component architecture (kernel-level mechanisms, a local analytics agent, a policy management component) and evaluation criteria are proposed: event collection completeness, telemetry loss rate, false alarms per operating hour, unjustified blocks and impact on application timing. The practical value lies in defining requirements for protection tools and a staged procedure for their validation on automotive Linux platforms. Future work concerns experimental validation of the proposed solutions on automotive-grade hardware.
Downloads
References
Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S., Koscher, K., Czeskis, A., Roesner, F., & Kohno, T. (2011). Comprehensive experimental analyses of automotive attack surfaces. In Proceedings of the 20th USENIX Security Symposium (USENIX Security 11). USENIX Association. https://www.usenix.org/conference/usenix-security-11/comprehensive-experimental-analyses-automotive-attack-surfaces
Gwak, S., Doan, T.-P., & Jung, S. (2023). Container instrumentation and enforcement system for runtime security of Kubernetes platform with eBPF. Intelligent Automation & Soft Computing, 37(2), 1773–1786. https://doi.org/10.32604/iasc.2023.039565
Findlay, W., Barrera, D., & Somayaji, A. (2021). BPFContain: Fixing the soft underbelly of container security (arXiv:2102.06972). arXiv. https://doi.org/10.48550/arXiv.2102.06972
Jarkas, O., Ko, R., Dong, N., & Mahmud, R. (2025). A container security survey: Exploits, attacks, and defenses. ACM Computing Surveys, 57(7). https://doi.org/10.1145/3715001
Jolak, R., Rosenstatter, T., Mohamad, M., Strandberg, K., Sangchoolie, B., Nowdehi, N., & Scandariato, R. (2022). CONSERVE: A framework for the selection of techniques for monitoring containers security. Journal of Systems and Software, 186, Article 111158. https://doi.org/10.1016/j.jss.2021.111158
Kifor, C. V., & Popescu, A. (2024). Automotive cybersecurity: A survey on frameworks, standards, and testing and monitoring technologies. Sensors, 24(18), Article 6139. https://doi.org/10.3390/s24186139
Kim, R., Ryu, J., Kim, S., Lee, S., & Kim, S. (2025). Detecting cryptojacking containers using eBPF-based security runtime and machine learning. Electronics, 14(6), Article 1208. https://doi.org/10.3390/electronics14061208
Lampe, B., & Meng, W. (2023). Intrusion detection in the automotive domain: A comprehensive review. IEEE Communications Surveys & Tutorials, 25(4), 2356–2426. https://doi.org/10.1109/COMST.2023.3309864
Lampe, B., & Meng, W. (2023). A survey of deep learning-based intrusion detection in automotive applications. Expert Systems with Applications, 221, Article 119771. https://doi.org/10.1016/j.eswa.2023.119771
Lim, S. Y., Stelea, B., Han, X., & Pasquier, T. (2021). Secure namespaced kernel audit for containers (arXiv:2111.02481). arXiv. https://doi.org/10.48550/arXiv.2111.02481
Lin, X., Lei, L., Wang, Y., Jing, J., Sun, K., & Zhou, Q. (2018). A measurement study on Linux container security: Attacks and countermeasures. In Proceedings of the 34th Annual Computer Security Applications Conference (pp. 418–429). ACM. https://doi.org/10.1145/3274694.3274720
Lokman, S.-F., Othman, A. T., & Abu-Bakar, M.-H. (2019). Intrusion detection system for automotive Controller Area Network (CAN) bus system: A review. EURASIP Journal on Wireless Communications and Networking, 2019, Article 184. https://doi.org/10.1186/s13638-019-1484-3
Nam, J., Lee, S., Porras, P., Yegneswaran, V., & Shin, S. (2023). Secure inter-container communications using XDP/eBPF. IEEE/ACM Transactions on Networking, 31(2), 934–947. https://doi.org/10.1109/TNET.2022.3206781
Pan, F., Rickert, M., Betz, T., Wen, L., Lin, J., Petrovic, N., Lienkamp, M., & Knoll, A. (2024). Toward software-defined vehicles: From model-based engineering to virtualization-based deployment. IEEE Access, 12, 192127–192145. https://doi.org/10.1109/ACCESS.2024.3512002
Rajapaksha, S., Kalutarage, H., Al-Kadri, M. O., Petrovski, A., Madzudzo, G., & Cheah, M. (2023). AI-based intrusion detection systems for in-vehicle networks: A survey. ACM Computing Surveys, 55(11), Article 237. https://doi.org/10.1145/3570954
Shin, H., Jo, M., Yoo, H., Lee, Y., & Tak, B. (2024). A technique for accurate detection of container attacks with eBPF and AdaBoost. Journal of the Korea Society of Computer and Information, 29(6), 39–51. https://doi.org/10.9708/jksci.2024.29.06.039
Young, C., Zambreno, J., Olufowobi, H., & Bloom, G. (2019). Survey of automotive controller area network intrusion detection systems. IEEE Design & Test, 36(6), 48–55. https://doi.org/10.1109/MDAT.2019.2899062
International Organization for Standardization. (2021). Road vehicles — Cybersecurity engineering (ISO/SAE Standard No. 21434:2021). https://www.iso.org/standard/70918.html
International Organization for Standardization. (2018). Road vehicles — Functional safety — Part 1: Vocabulary (ISO Standard No. 26262-1:2018). https://www.iso.org/standard/68383.html
The kernel development community. (n.d.). eBPF verifier. The Linux Kernel documentation. Retrieved October 14, 2026, from https://docs.kernel.org/bpf/verifier.html
The kernel development community. (n.d.). LSM BPF programs. The Linux Kernel documentation. Retrieved October 14, 2026, from https://docs.kernel.org/bpf/prog_lsm.html
The kernel development community. (n.d.). BPF ring buffer. The Linux Kernel documentation. Retrieved October 14, 2026, from https://docs.kernel.org/bpf/ringbuf.html
Cho, K.-T., & Shin, K. G. (2016). Fingerprinting electronic control units for vehicle intrusion detection. In Proceedings of the 25th USENIX Security Symposium (USENIX Security 16) (pp. 911–927). USENIX Association. https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/cho
Lim, S. Y., Prasad, T., Han, X., & Pasquier, T. (2024). SafeBPF: Hardware-assisted defense-in-depth for eBPF kernel extensions (arXiv:2409.07508). arXiv. https://doi.org/10.48550/arXiv.2409.07508
The kernel development community. (n.d.). SocketCAN — Controller Area Network. The Linux Kernel documentation. Retrieved October 14, 2026, from https://docs.kernel.org/networking/can.html
The kernel development community. (n.d.). J1939 documentation. The Linux Kernel documentation. Retrieved October 14, 2026, from https://docs.kernel.org/networking/j1939.html
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Анастасія Журавчак, Даниїл Журавчак, Юрій Журавчак
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
