With L4 you mean the transport layer? I’m a bit confused because in your examples you show layer 3 (IP).

This eBPF-based package dropper using machine learning (decision tree) might be of interest to you: https://github.com/CN-TU/machine-learning-in-ebpf