System and method of blocking malicious connections based on application layer state into ebpf program

Abstract

A method of blocking malicious connections based on application layer state into eBPF program is disclosed. The method includes receiving HTTP requests, associated with connections, from users and uniquely identifying and track each connection by assigning a unique identifier. Next, the method maintains the application layer state in the eBPF program for each connection by storing headers of corresponding kernel function calls and analyzing content associated with the received HTTP requests to detect malicious content by inspecting headers, payloads, and/or request parts of corresponding HTTP request via eBPF program to identify potentially harmful and unauthorized requests. Thereafter, the method includes blocking the connections associated with the detected malicious content based on the assigned unique identifier of the connections.