💻 computer science

A Memory-Safe eBPF/GPU Data Plane for Adaptive 5G Backdoor Detection

This paper presents a memory-safe, tiered eBPF and GPU-accelerated data plane for 5G networks that successfully detects adaptive BPFDoor backdoors by leveraging an immutable kernel socket invariant, outperforming traditional hand-written CUDA implementations while maintaining zero memory-safety violations under adversarial LLM attacks.

Original authors: Michail Alexandros Kourtis, George Xilouris

Published 2026-11-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Michail Alexandros Kourtis, George Xilouris

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern world, our mobile networks are no longer just a collection of physical towers and wires; they have evolved into vast, flexible software systems running on shared computer servers. This shift, known as cloud-native deployment, allows network operators to update their services quickly and efficiently, but it also changes the nature of the threats they face. Instead of an intruder breaking into a single, isolated machine, an attacker can now hide a malicious program inside the very software that manages the flow of data for millions of users. These hidden programs, often called backdoors, are designed to be invisible. They do not open a door that security guards can see; instead, they wait silently for a secret signal, a specific pattern of data that only the attacker knows, to wake them up and let them steal information. The challenge for defenders is that these signals can be changed instantly. If a security system is built to look for one specific pattern, the attacker can simply alter the pattern, rendering the security system blind. This creates a constant game of cat and mouse where the rules change faster than the rules can be written.

Researchers at the National Centre of Scientific Research "Demokritos" in Greece have tackled this problem by building a new kind of security system that does not rely on guessing the secret signal. Instead of trying to memorize the ever-changing patterns of the intruder, they focused on a fundamental truth about how these hidden programs must work. To function, a passive backdoor needs to listen to every possible path a signal could take, including those that are hidden inside complex tunnels used by mobile networks. To do this, the program must open a specific type of listening socket in the computer's operating system that is bound to a special setting allowing it to see all traffic, regardless of which network interface it arrives on. The researchers discovered that this requirement is not a choice the attacker can make; it is a mechanical necessity. If the attacker changes the setting to hide the program, the program stops working because it can no longer receive the secret signal. This unchangeable requirement is what the researchers call a behavioral invariant.

To test this idea, the team constructed a realistic 5G network in their laboratory, complete with simulated base stations and user devices. They then set up an automated contest between two artificial intelligence agents. One agent, acting as the attacker, was tasked with constantly mutating the hidden backdoor, changing its secret signals, its hiding spots, and its internal structure to avoid detection. The other agent, acting as the defender, was tasked with hunting the backdoor down. The researchers pitted these agents against each other over thousands of rounds. They found that the traditional method of looking for specific code patterns failed almost every time the attacker changed the signal. However, the new method, which looked for the unchangeable requirement of the listening socket, succeeded every single time. Even when the attacker tried to adapt its strategy based on the defender's actions, the backdoor could not hide without breaking its own ability to function. The invariant held firm in twenty-five out of twenty-five trials against different types of intelligent attackers.

The researchers also had to solve a difficult engineering problem: how to check for this requirement fast enough to keep up with the speed of a modern 5G network without slowing it down. They designed a two-tiered system. The first tier runs deep inside the computer's core, filtering out obvious traffic at incredible speed. The second tier, which handles the complex analysis, runs on a specialized graphics processor. This processor was programmed using a modern, safety-focused language that prevents a whole class of common computer errors, such as memory leaks or crashes, which often plague security software. The team measured the performance of this new system and found that while it was slightly slower than older, less safe methods for very simple tasks, it became significantly faster and more efficient as the complexity of the analysis increased. The entire system ran on a modest amount of power, roughly sixty-six watts, proving that high-security, memory-safe analysis is possible at the edge of the network.

The study confirms that while attackers can change the appearance of their tools, they cannot change the physical laws that govern how those tools must operate to succeed. By focusing on the unchangeable mechanics of the intrusion rather than its fleeting appearance, the researchers demonstrated a way to detect adaptive threats that is immune to the rapid mutation of the attacker. The results show that a system built on these principles can withstand the pressure of an intelligent, evolving adversary, offering a path toward more resilient mobile networks where the security does not rely on the hope that the attacker will make a mistake, but on the certainty that the attacker cannot hide without being exposed.

Technical Summary: A Memory-Safe eBPF/GPU Data Plane for Adaptive 5G Backdoor Detection

1. Problem Statement

The transition of 5G mobile cores toward cloud-native deployments exposes the User Plane Function (UPF) to persistent, host-resident threats. A documented example is BPFDoor, an Advanced Persistent Threat (APT) backdoor that utilizes an AF_PACKET raw socket guarded by a Berkeley Packet Filter (BPF) to receive trigger packets without opening a listening port.

Traditional signature-based Network Intrusion Detection Systems (NIDS) like Suricata or Snort are inherently brittle against such implants because they rely on matching byte patterns (e.g., hardcoded "magic" values). These signatures can be easily evaded by polymorphic implants that mutate their wire-level indicators. This vulnerability is exacerbated by two converging trends:

Adversarial LLM Agents: Large Language Models can autonomously mutate implant parameters faster than human analysts can generate detection signatures.
Memory Safety Gaps: Security-critical network functions are often written in unsafe languages (C/CUDA C), leaving them susceptible to memory-safety defects that attackers can exploit.

The core challenge is to design a detection data plane that is resilient to adaptive mutation, free of memory-safety defects, and capable of operating at line rate within the 5G data path.

2. Methodology and System Architecture

The authors propose a tiered, memory-safe detection data plane that couples in-kernel filtering with a memory-safe GPU-based analysis function. The system is evaluated on a live six-node Open5GS/UERANSIM testbed using adversarial LLM agents.

A. The Behavioral Invariant

The study identifies a behavioral invariant that a functional passive backdoor cannot mutate away without ceasing to function.

The Invariant: To receive trigger packets across all interfaces (including GTP-U decapsulated traffic), a passive backdoor must open an AF_PACKET raw socket bound to ETH_P_ALL (protocol 0x0003) with the interface index set to zero (iface=0).
Mechanism: Binding to a specific interface (e.g., ens19) would sacrifice the ability to receive triggers on other paths (e.g., the GTP-U tunnel). Therefore, iface=0 is a necessary condition for functionality.
Detection: The system queries the kernel socket table for this specific binding. Legitimate monitoring tools typically bind to specific interfaces, providing a zero-false-positive discriminator.

B. Tiered Data Plane

The detection workload is distributed based on computational intensity and expressiveness:

Tier 1: In-Kernel eBPF/XDP: Executes at line rate on the UPF receive path. It performs parsing and light signature/invariant checks. It is bounded by the eBPF verifier; if the program complexity exceeds the verifier's ceiling (measured at $K \ge 96$ operations/packet), the program is rejected.
Tier 2: Memory-Safe GPU CNF: Suspicious or sampled flows are escalated to a Cloud-Native Network Function (CNF) written in NVIDIA cuTile-Rust. This tier handles compute-heavy tasks, such as exhaustive mutation-space sweeps and deep inspection. It is designed to be memory-safe by construction.

C. Adversarial Evaluation Loop

The system is tested using a closed-loop adversarial framework:

Red Agent: An LLM that autonomously mutates the implant (altering magic values, payload offsets, protocols, and socket bindings), recompiles, and redeploy it.
Blue Agent: An LLM that queries live kernel interfaces and the tiered detector to synthesize a verdict.
Game-Theoretic Model: The interaction is formalized as a Stackelberg game where the defender commits to the invariant strategy. The authors prove that the invariant induces a defender strategy with an empty evasion set, meaning no functional mutation can evade detection.

3. Key Contributions

Identification of a Non-Mutatable Invariant: The paper demonstrates that the iface=0 socket binding is a structural necessity for passive backdoors, making it immune to mutation.
Exhaustive Mutation-Space Evaluation: Using a GPU-parallel sweep, the authors evaluated 2,555,904 signature variants (combinations of magic values, offsets, and protocols). The static signature was evaded in approximately all cases, while the behavioral invariant was evaded by none.
Memory-Safe GPU Acceleration: The authors implemented the detection kernel in cuTile-Rust, a memory-safe GPU programming model. They quantified the performance cost, showing that while memory safety incurs a penalty on trivial, memory-bound kernels, it reaches parity with hand-written CUDA C at moderate arithmetic intensity and outperforms CUDA C at higher intensities.
Measured Placement Strategy: Rather than assuming optimal placement, the study measured the crossover point where eBPF/XDP hits the verifier ceiling and the GPU becomes the most cost-effective execution point for heavy compute.
Adversarial Robustness: The invariant held at 25/25 against three distinct attacker LLMs (including qwen2.5:32b, llama3.1:8b, and qwen2.5:14b) and against a closed-loop attacker that adapted to detection verdicts.

4. Experimental Results

Detection Rates:
- Static Signature: Evaded in nearly all mutation cases (Evasion Entropy $\approx 21.3$ bits).
- Behavioral Invariant: Detected in 100% of functional mutations (Evasion Entropy $-\infty$ ).
- Tiered System: Against strong attackers, the Tier-1 signature caught only 3/25 attempts, but the Tier-2 invariant caught all 25/25.
Performance & Cost:
- eBPF/XDP: Achieved 13–75 ns/packet for light filtering but hit the verifier ceiling at $K \ge 96$ .
- GPU CNF: Reached parity with hand-written CUDA C at an arithmetic intensity of $K \approx 64$ and outperformed it by a factor of ~1.6 at $K=4096$ .
- Power: The GPU CNF operated within a 66 W power envelope (edge power limit), with a sustained throughput of $9.8 \times 10^{10}$ mutations/second.
- Latency: Warm steady-state latency for a full sweep was 15–38 $\mu$ s, six orders of magnitude faster than LLM-in-the-loop detection.
Memory Safety:
- A systematic fault-injection campaign across six bug classes (out-of-bounds read/write, use-after-free, data races, etc.) resulted in zero sanitizer errors for the cuTile kernel, whereas the unsafe CUDA C twin triggered hundreds of errors.
Generalization: The invariant was shown to apply to sibling families (Symbiote, Drovorub, Reptile) as they all require a raw socket to function, though the observation point must be network-side to bypass host-level hiding techniques.

5. Significance and Claims

The paper claims that the proposed approach fundamentally shifts the defender's position in the security game. Unlike signature-based detection, which is reactive and dependent on the attacker's "clumsiness," the behavioral invariant provides a dominant strategy with an empty evasion set. The attacker cannot mutate the invariant without breaking the implant's functionality.

Furthermore, the work demonstrates that memory safety does not require a performance tax in compute-bound network functions; in fact, safe Rust kernels can outperform unsafe C implementations at realistic workloads. By combining a deterministic invariant with a memory-safe, GPU-accelerated data plane, the authors present a deployable architecture for 5G user-plane security that is resilient to both adaptive AI-driven attacks and memory-safety exploits.

Limitations Acknowledged:

The testbed used virtio interfaces, so absolute line-rate figures are indicative of overhead ratios rather than raw hardware throughput.
The streaming ingest path is currently bounded by host-to-device transfer; zero-copy solutions (GPUDirect) are required for full line-rate streaming.
The trusted base is not yet end-to-end memory-safe, as the GPU driver stack remains in C.
The resilience against host-level tampering (e.g., a root implant modifying /proc/net/packet) is addressed by the network-side observation architecture, but full evaluation against actively tampering implants is left for future work.