Abstract

Enterprise networks now carry traffic volumes and encryption levels that traditional monitoring tools were never designed for, forcing security teams towards kernel-level telemetry and machine-learning-based detection. This article evaluates the extended Berkeley Packet Filter (eBPF) as a telemetry substrate for artificial-intelligence-driven network anomaly detection, combining an expanded review of current literature with an original, testbed-based empirical study. The review examines eBPF's architecture, its established role in network observability, the machine-learning and deep-learning methods used for anomaly detection, how the two are integrated in practice, the explainability barriers to security-operations-centre (SOC) adoption, and the performance trade-offs reported to date. The empirical study then measures detection accuracy, end-to-end latency and host CPU overhead across three telemetry-collection methods and five detection models on a controlled 10 GbE testbed. A hybrid random-forest-plus-LSTM model achieved the highest detection accuracy (98.6%) and F1-score (98.0%), while eBPF/XDP-based collection sustained under 4.1% CPU overhead at 10 Gbps against roughly 30% and 39% for agent-based and libpcap-based collection respectively. The results support the case for eBPF as an efficient telemetry layer for AI-driven detection while highlighting that model accuracy gains carry real latency and complexity costs that the wider literature rarely reports alongside overhead figures. The article closes with limitations and concrete directions for further empirical work.