When eBPF Meets Machine Learning: On-the-fly OS Kernel
  Compartmentalization
Zicheng Wang Tiejin Chen Qinrun Dai Yueqi Chen Hua Wei Qingkai Zeng
Compartmentalization effectively prevents initial corruption from turning
into a successful attack. This paper presents O2C, a pioneering system designed
to enforce OS kernel compartmentalization on the fly. It not only provides
immediate remediation for sudden threats but also maintains consistent system
availability through the enforcement process.
  O2C is empowered by the newest advancements of the eBPF ecosystem which
allows to instrument eBPF programs that perform enforcement actions into the
kernel at runtime. O2C takes the lead in embedding a machine learning model
into eBPF programs, addressing unique challenges in on-the-fly
compartmentalization. Our comprehensive evaluation shows that O2C effectively
confines damage within the compartment. Further, we validate that decision tree
is optimally suited for O2C owing to its advantages in processing tabular data,
its explainable nature, and its compliance with the eBPF ecosystem. Last but
not least, O2C is lightweight, showing negligible overhead and excellent
sacalability system-wide.