WebScreen+: Web Traffic Screening Performance Enhancement with eBPF Filtering

Abstract

Web applications attract different cyber attacks as they often deal with sensitive information like banking transactions. Web Application Firewalls are used to screen incoming requests and detect such attacks. A busy web server may receive large number of requests and hence screening can become performance bottleneck. Our contributions in this paper are two-fold. First, we present a novel Deep Packet Inspection (DPI) based method for detecting attacks against a web server. This method employs attack-specific signatures encoded as regular expressions, enabling precise screening of incoming HTTP requests. We describe an approach to semi-automatically generate these signatures using Jaccard index, which measures the similarity between invariant character sets extracted from known malicious HTTP requests. Second, we filter non-essential traffic at the network interface card level to achieve scalability. We evaluate the effectiveness of both the detection method and performance enhancement strategy rigorously through experiments conducted in a live network environment. © 2025 IEEE.