🛡️ Lynceus

High-Performance, Dual-Stack (IPv4/IPv6), Stateful Network Feature Extractor Powered by 100% C-eBPF.
Version: 1.0

📌 Abstract

Lynceus is a next-generation network traffic feature extractor designed to resolve the systematic biases and performance bottlenecks in legacy IDS benchmarking. By unrolling the extraction logic into a 100% End-to-End C Architecture utilizing eBPF/XDP for the Data Plane and a deeply optimized libbpf daemon for the Control Plane, it achieves high-throughput processing with minimal overhead.

It implements a Unified Dual-Stack Engine through IPv4-Mapped IPv6 address space, ensuring that both IPv4 and IPv6 traffic are processed through the same O(1) statistical pipeline.

🎓 Etymology & Concept

The name is inspired by Lynceus, the Argonaut possessing legendary vision. In Greek mythology, Lynceus was capable of seeing through any physical barrier—be it earth, stone, or deep water. This serves as the perfect metaphor for this engine's mission: utilizing eBPF/XDP to provide deep, "X-ray" introspection into kernel-space network flows, exposing features that are invisible to traditional observation methods.

🎯 Key Features

1. Stateful eBPF Interception: Implements stateful tracking via lock-free BPF_MAP_TYPE_HASH tables to ensure stability during high-volume traffic.
2. Native Tunnel Decapsulation (GRE/VXLAN): Performs recursive dissection of encapsulated traffic (GRE/VXLAN) directly in the kernel fast-path, capturing Tunnel IDs (GRE Keys / VXLAN VNIs) for infrastructure-aware telemetry.
3. Deep L7 Visibility (Kernel-Space):
   • DNS: Advanced parser with support for compression pointers (0xC0) and label-skipping (up to 16 labels). Extracts QType, QClass, and AnswerCount.
   • NTP/SNMP/SSDP: Native extraction of NTP Mode/Stratum, SNMP PDU Types, and SSDP methods directly from UDP payloads.
4. High-Scalability I/O (SPSC Lock-free): Utilizes a Single-Producer Single-Consumer circular buffer per core with C11 Atomics (stdatomic.h), ensuring linear scalability and zero thread contention.
5. O(1) Statistics via Welford's Algorithm: Bidirectional flow features (Standard Deviation, Mean, IAT, Skewness, Kurtosis) are calculated iteratively, ensuring minimal memory footprint.
6. Online Median Estimation: Implements the P² algorithm for online quantile estimation (Payload, IAT, and Window sizes).
7. Comprehensive Feature Matrix: Provides 494 features per flow record, including 80-bin distribution histograms.

---

🏛️ Architecture Blueprint

graph TD
    A([Raw Traffic]) -->|Ingress Rx| XDP{XDP Hook / C-eBPF}
    
    subgraph KERNEL_SPACE [Data Plane - XDP]
    XDP -->|Decap| TUNNEL[GRE / VXLAN Parser]
    TUNNEL -->|L7 Parse| L7[DNS / NTP / SNMP / SSDP]
    L7 -->|Aggregate| MAP[(Hash Map: Flow Cache)]
    L7 -->|Event Export| RB[BPF RingBuffer]
    end
    
    subgraph USER_SPACE [Control Plane - libbpf]
    RB -->|Poll| WORKERS(Worker Threads)
    WORKERS -->|Math| STATS[Welford & P2 Engine]
    STATS -->|Push| SPSC[SPSC Lock-free Queues]
    SPSC -->|Consume| WRITER(Dedicated Writer Thread)
    WRITER --> CSV([Unified flows.csv])
    end

Loading

---

🛠️ Build & Usage

Prerequisites

• Linux Kernel 5.15+
• clang, llvm, libbpf

Compilation

make clean && make all

Execution

sudo ./build/loader <interface_name>

---

⚖️ License

Distributed under the GNU General Public License v2.0. Designed for high-performance network analysis and community-driven security research.

---

Lynceus: Precise Vision, Absolute Integrity.