A Lightweight Modular Design for Time Synchronization DDoS Defense with XDP/eBPF

Time synchronization is a foundational component of modern Internet infrastructure, supporting time-sensitive applications and security protocols by ensuring precise clock alignment. Despite its importance, the NTP remains vulnerable to a range of attacks that exploit its connectionless nature, potentially disrupting systems that depend on precise time synchronization. Current built-in defenses are insufficient, and NTP-specific firewalls have seen limited exploration in both academic research and practical deployments, leaving critical infrastructure exposed to potential threats. In this paper, we introduce a lightweight, modular design for mitigating NTP-based DDoS attacks using XDP and eBPF. Our solution leverages highperformance, programmable packet filtering and applies defense modules to both ingress and egress traffic. Each module is carefully designed to reduce asymmetric delays while maintaining the precision and reliability of time synchronization. The modular architecture enables flexible deployment and scalability across diverse NTP implementations and operational environments. We demonstrate the effectiveness of our approach through the implementation of defense modules and experiments conducted in a controlled environment.