Abstract: Recently,the expansion of the Internet and the evolution of application ecosystems have posed unprecedented challenges to cybersecurity.An increasing number of attacks exploit semantic vulnerabilities in end-to-end TCP/IP interactions,breaking protocol boundaries and directly compromising end hosts,leading to problems such as service disruption,session hijacking,and data poisoning.Traditional defenses based on static signature detection and classification are no longer effective.To address these issue,this paper proposes PacketScope,the first eBPF-based end-host defense system empowered by large language model(LLM).PacketScope leverages eBPF to dynamically observe packet processing within the protocol stack,construct fine-grained interaction graphs,and pinpoint risks and performance bottlenecks.Through XDP,real-time traffic is fed into LLM for long-context semantic analysis of protocol interactions,enabling socket behavior classification,attack detection,and automatic generation of eBPF rules for in-stack defense.Implemented and open-sourced on Linux 6.8,PacketScope reconstructs a complete panorama of packet interactions and,with the help of models such as TrafficLLM and DeepSeek,effectively identifies and blocks DoS and TCP hijacking attacks with less than 1.9% overhead.

Key words: TCP/IP protocol stack, Network attacks, Traffic analysis, In-kernel filtering, Large language model