Situation awareness element extraction method and system based on eBPF technology

Abstract

The invention provides a situation awareness element extraction method and system based on an eBPF technology, and the method comprises the steps: building an eBPF user area monitoring program based on a situation awareness element extraction demand; the method comprises the steps that an eBPF kernel program used for kernel object collection is constructed based on a kernel object of a predefined situation awareness element, the eBPF kernel program is obtained through compiling after safety verification based on a pre-constructed eBPF machine code, and the eBPF kernel program is executed in a kernel area; and based on a kernel object collected by an eBPF kernel program, the eBPF user area monitoring program obtains a corresponding situation awareness element from the kernel object based on a loading strategy, and executes a corresponding security measure based on the obtained situation awareness element.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a situation awareness element extraction method and system based on eBPF technology. Background Art

[0002] Situational awareness elements refer to the key factors for comprehensively understanding and grasping the current security status, dynamic changes, and possible future developments in a network environment, usually including threat intelligence, abnormal network traffic, log events, vulnerabilities, data leaks, and other security situations. The process of obtaining these situational elements is currently a common method of using function call stack observation tools such as profile, offcputime, and memleak to obtain the core data elements of key function call stacks, that is, using these tools to capture and analyze the runtime behavior of the system or application to identify, understand, and resolve potential abnormal situations.

[0003] The current solution has many related tools, and each tool has different problems. For example, the profile tool is mainly used for on_cpu call stack sampling. It captures the function call stack being executed on the CPU by setting the sampling frequency. It has a relatively simple function and can only perform on_cpu sampling. It cannot provide off_cpu call stack information, which limits the ability to analyze other types of problems (such as I / O waiting); another example is the offcputime tool, which is used to collect off_cpu call stacks, that is, call stack information when the CPU is idle or the process is waiting for resources, but it cannot display the data in real time and needs to analyze the collected data afterwards. In addition, the data volume is large, the processing and analysis are complex, and the application scenarios of real-time debugging are limited. The memleak tool is dedicated to collecting call stack information related to memory leaks to help developers identify the code path that causes memory leaks in the program. It cannot display the user-mode call stack normally and may miss key memory leak information. In addition, when it comes to child processes, the effectiveness and accuracy of memleak are also limited, and it is impossible to fully analyze memory leak problems. These solutions collect a large amount of data and output complex information. Call stack data is usually output in text form, which is voluminous and inconvenient to directly view and analyze. Analyzing this data requires further tool support. Summary of the invention

[0004] The embodiments of the present invention provide a situation awareness element extraction method and system based on the eBPF (extended Berkeley Packet Filter) technology to solve the problem that the existing methods cannot extract situation awareness elements quickly and accurately.

[0005] An embodiment of the present invention provides a situation awareness element extraction method based on eBPF technology, including:

[0006] Based on the situation awareness element extraction requirements, an eBPF user area monitoring program is constructed, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the strategies in the pre-built situation awareness element extraction strategy library, obtain the corresponding situation awareness elements based on the loaded strategies, and execute the corresponding security measures;

[0007] Based on the predefined kernel objects of the situational awareness elements, an eBPF kernel program for kernel object acquisition is constructed, wherein the eBPF kernel program is based on the pre-constructed eBPF machine code, compiled after security verification, and executed in the kernel area;

[0008] Based on the kernel objects collected by the eBPF kernel program, the eBPF user area monitoring program obtains corresponding situational awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situational awareness elements.

[0009] Furthermore, based on the situational awareness element extraction requirements, an eBPF user area monitoring program is constructed, specifically: based on the situational awareness element extraction requirements in the current scenario, a corresponding strategy is selected from a pre-built situational awareness element extraction policy library to implement policy configuration; the configured strategy is loaded through the eBPF user area monitoring program, relevant situational awareness elements are collected according to the configured strategy, and the obtained situational awareness elements are judged to execute corresponding security measures.

[0010] Furthermore, the situational awareness elements include threat intelligence, abnormal network traffic, log events, vulnerabilities, and security situations faced by data leaks.

[0011] Furthermore, the eBPF userland monitoring program obtains corresponding situational awareness elements from the kernel object based on the loaded policy, specifically: building a communication path between the eBPF kernel program and the eBPF userland monitoring program based on the eBPF mapping and the eBPF ring buffer; wherein the eBPF ring buffer is used to store data collected by the eBPF kernel program; and the eBPF mapping is used to push the data in the eBPF ring buffer to the eBPF userland monitoring program.

[0012] Furthermore, the user area monitoring program is implemented in C / C++ language, and specifically performs the following functions: reads the strategies in the pre-built situational awareness element extraction strategy library, and passes the strategies to the kernel's eBPF Maps data structure, and after kernel processing, obtains the corresponding situational awareness elements from the data collected by the eBPF kernel program, and returns the results to the JavaScript calling function.

[0013] Furthermore, the Node.js-based JS engine is used for the execution of the eBPF user area monitoring program, which loads the extension module through the Node.js module system and provides an interactive interface with the extension module to implement the eBPF user area monitoring program's call to the kernel area system resources and library functions.

[0014] Another aspect of the present invention provides a situation awareness element extraction system based on eBPF technology, including:

[0015] A user monitoring program construction unit, which is used to construct an eBPF user area monitoring program based on the situational awareness element extraction requirements, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the policies in the pre-built situational awareness element extraction policy library, obtain the corresponding situational awareness elements based on the loaded policies, and execute the corresponding security measures;

[0016] An eBPF kernel program construction unit, which is used to construct an eBPF kernel program for kernel object acquisition based on a kernel object of a predefined situational awareness element, wherein the eBPF kernel program is based on a pre-constructed eBPF machine code, compiled after security verification, and executed in a kernel area;

[0017] A situation awareness element extraction unit is used for kernel objects collected based on the eBPF kernel program. The eBPF user area monitoring program obtains corresponding situation awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situation awareness elements.

[0018] An embodiment of the present invention further provides an electronic device, comprising a processor, wherein the processor is used to implement the situation awareness element extraction method based on the eBPF technology as described above when executing a computer program stored in a memory.

[0019] An embodiment of the present invention further provides a non-transitory readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method for extracting situational awareness elements based on the eBPF technology as described above is implemented.

[0020] Finally, an embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the situation awareness element extraction method based on the eBPF technology.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] (1) The scheme described in the present invention provides a situational awareness factor extraction method and system based on eBPF technology. The scheme is based on eBPF technology and combined with JavaScript technology. The huge situational awareness factor extraction code in the prior art is divided into eBPF user area code running in the background and eBPF kernel program running in the kernel space. While realizing the lightweight of the eBPF kernel program, the execution efficiency of the situational awareness factor extraction code is effectively improved; at the same time, combined with the constructed Node.js-based JS engine, the eBPF kernel program calls the kernel area system resources and library functions and the communication between the eBPF kernel program and the eBPF user area monitoring program is realized. Efficient data access is achieved through JavaScript, thereby eliminating the heavy burden of developers constantly inserting piles, and providing monitoring and diagnosis capabilities from code to infrastructure for extracting situational awareness elements.

[0023] (2) Through the design of the eBPF user area monitoring program and the situation awareness element extraction strategy library, the present invention can load different strategies through the eBPF user area monitoring program according to needs, and can effectively respond to the needs of different scenarios.

[0024] (3) The solution described in the present invention utilizes eBPF to monitor system call events, file system events, memory management events, process management events, security events, and network data packet processing capabilities, and utilizes JavaScript virtual machine technology to achieve zero-intrusion, full-stack metrics, tracking, call logs, and function analysis data collection, and generate a process mechanism for situational awareness elements.

[0025] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0027] Figure 1 It is a schematic diagram of the overall process of a situation awareness element extraction method based on eBPF technology described in an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of the internal call of Node.js described in an embodiment of the present invention;

[0029] Figure 3 Schematic diagram of the calling process of the extension module in the embodiment of the present invention;

[0030] Among them, 101, JS engine; 102, eBPF policy file; 103, eBPF userland program; 104, eBPF Maps; 105, Node Binding; 106, JavaScript context environment; 107, eBPF machine code; 108, eBPF verifier; 109, JIT compiler; 110, eBPF kernel program; 111, Landlock module; 112, eBP time trigger mechanism. DETAILED DESCRIPTION

[0031] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0032] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0033] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0034] After introducing the technical solutions of the embodiments of the present invention, various non-limiting implementation methods of the present application are described in detail below.

[0035] Glossary:

[0036] eBPF userland program: A program running in user space, loaded and managed using specific system calls such as bpf(), written in C / C++. It first reads the policy in JSON format (i.e., which situational awareness elements to monitor), and then passes the policy to the kernel's eBPF Maps data structure. After the kernel processes it, it returns the result to the JavaScript calling function.

[0037] eBPF machine code: A bytecode generated by compiling the pre-built eBPF code that runs in the kernel. This bytecode represents the binary form of the eBPF virtual machine instruction set and needs to meet the kernel's security verification (verifier) ​​requirements to ensure that it does not pose a risk to the stability and security of the kernel. After verification, it is compiled by the JIT compiler to produce an eBPF kernel program that can run in the kernel.

[0038] eBPF kernel program: A program that runs in kernel space, loads eBPF machine code into the kernel, can be attached to various mount points of the kernel (such as network packet processing, kprobes, tracepoints, cgroups, etc.), and can be used to monitor network traffic, collect performance data, detect malicious behavior, and other key elements of situational awareness.

[0039] See first Figure 1 ,A situation awareness element extraction method based on eBPF technology mainly includes the following processing steps:

[0040] Step 1: Based on the situational awareness element extraction requirements, an eBPF user area monitoring program is constructed, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the strategies in the pre-built situational awareness element extraction strategy library, obtain the corresponding situational awareness elements based on the loaded strategies, and execute the corresponding security measures;

[0041] In the specific implementation, the eBPF user area monitoring program is constructed based on the situational awareness element extraction needs, specifically: based on the situational awareness element extraction needs in the current scenario, the corresponding strategy is selected from the pre-built situational awareness element extraction policy library to implement policy configuration; the configured strategy is loaded through the eBPF user area monitoring program, the relevant situational awareness elements are collected according to the configured strategy, and the obtained situational awareness elements are judged and corresponding security measures are executed.

[0042] Among them, the situational awareness elements include threat intelligence, abnormal network traffic, log events, vulnerabilities, and security situations faced by data leaks.

[0043] In a specific implementation, the user area monitoring program is implemented in C / C++ language (C++ is taken as an example here), and the Node.js-based JS engine is used to execute the eBPF user area monitoring program. It loads the C++ extension module through the module system of Node.js (the eBPF user area program is written in C++, and Node.js calls this C++ program through the C++ extension module. The extension module is Node.js Addon. Through this extension module, the C++ code can be bound to the JavaScript context, so that the JavaScript code can directly call these C++ programs), and provides an interactive interface with the C++ extension module to enable the eBPF user area monitoring program to call kernel area system resources and library functions.

[0044] Specifically, Figure 1 As shown, the Node.js-based JavaScript engine 101 is mainly responsible for executing JavaScript code. This engine loads C++ extension modules through the Node.js module system and provides interfaces for interacting with these modules. When the JavaScript code (wherein JavaScript is responsible for calling the eBPF user area program and is the calling entry point for the end user) calls the function in the C++ extension, the engine will forward these calls to the C++ code for execution, thereby implementing the code logic of calling the eBPF kernel program at the front end.

[0045] The eBPF policy file 102 in JSON format is mainly used to define and manage complex policy rules. These rules can be used in various application scenarios such as access control, security monitoring, network filtering, etc., and provide a policy dynamic configuration function for collecting situational awareness elements.

[0046] The following is an example of the JSON format of the IP and port of the network data packet of the monitoring situational awareness element. This format can be dynamically configured by the user:

[0047]

[0048]

[0049] The eBPF user area program 103 loads and applies these policies through the written eBPF program to achieve fine-grained access control, capture and record suspicious activities in real time, collect situational awareness elements and take corresponding security measures, wherein the collection of situational awareness elements is specifically: collecting the situational awareness elements defined in the read-in JSON format eBPF policy; the taking of corresponding security measures is specifically: judging whether the situational awareness elements and actions defined in JSON that need to be collected conform to the structure defined by the eBPF Map, and ignoring them if they do not conform, thereby ensuring kernel security.

[0050] Specifically, Figure 2 As shown in the figure, Node.js is based on the Webkit V8 engine, and has been encapsulated and improved to allow JavaScript to run on non-browser backends. It is an independently running virtual machine. Node.js Addon is a native extension module written in C / C++ that allows Node.js applications to call underlying operating system functions or C / C++ libraries. Node.js Addon interacts with the V8 JavaScript engine of Node.js to bind C / C++ code to the JavaScript context, allowing JavaScript code to directly call these native functions.

[0051] like Figure 3 As shown, the detailed calling process is as follows:

[0052] Calling C / C++ methods is essentially calling the dynamic library generated by C / C++ code, which can be loaded into Node.js using the require() function, just like using a normal Node.js module.

[0053] (1) Use C or C++ to write the function called by Node.js. This function mainly implements the monitoring function of the eBPF kernel, such as implementing the add() function in C language.

[0054] (2) Use the compilation tool node-gyp to compile the C++ program into a Native Addon binary file with the suffix .node, which is essentially a dynamic link library, such as generating a jsagent.so file.

[0055] (3) By calling the require() function, the addon module is introduced. This module provides the binding function, so that the C function and the eBPF function in the JavaScript virtual machine can communicate with each other.

[0056] (4) Call functions in the eBPF dynamic library and process the corresponding data types, such as calling the add() function.

[0057] (5) Run the Javascript code and execute it using node.js to obtain the return value of the add() function.

[0058] By using eBPF programs in JavaScript, eBPF applications can not only obtain JavaScript's high performance and access to system interfaces, but also enjoy JavaScript's sandbox, flexibility, cross-platform, and dynamic loading capabilities, making it easy to distribute and manage eBPF programs.

[0059] Step 2: Based on the predefined kernel objects of the situational awareness elements, an eBPF kernel program for kernel object acquisition is constructed, wherein the eBPF kernel program is based on the pre-constructed eBPF machine code, compiled after security verification, and executed in the kernel area;

[0060] In a specific implementation, the written eBPF machine code 107 is an executable code that is compiled and runs in a JavaScript environment. By setting hook points of multiple situational awareness elements, it can monitor various system and user state events, including system behaviors such as system calls, kernel functions, user state functions, network events, and specific events.

[0061] The eBPF machine code 107 needs to pass through the eBPF verifier 108 to ensure that it is safe in kernel application scenarios, such as no infinite loops, memory out-of-bounds, etc. The verifier checks all memory access operations of the eBPF program to ensure that the program can only access legal memory areas. The main functions include memory access security checks, program correctness checks, resource limit checks, and other functional checks.

[0062] And by using the JIT (Just-In-Time) compiler 109, the eBPF machine code (because the eBPF machine code is interpreted, it can be directly executed as native machine code after JIT compilation, which can effectively improve efficiency) is dynamically compiled into instructions for native machine code to be executed on the CPU, reducing the overhead of the interpreter and thus improving the execution efficiency of the eBPF program, achieving high-performance kernel-level monitoring and data processing.

[0063] The eBPF kernel program 110 after JIT compilation is used to collect kernel objects of defined situational awareness elements.

[0064] Step 3: Based on the kernel objects collected by the eBPF kernel program, the eBPF user area monitoring program obtains corresponding situational awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situational awareness elements.

[0065] In a specific implementation, the eBPF userland monitoring program obtains corresponding situational awareness elements from the kernel object based on the loaded policy, specifically: building a communication path between the eBPF kernel program and the eBPF userland monitoring program based on the eBPF mapping and the eBPF ring buffer; wherein the eBPF ring buffer is used to store data collected by the eBPF kernel program; the eBPF mapping is used to push the data in the eBPF ring buffer to the eBPF user monitoring program.

[0066] Specifically, Figure 1 As shown, eBPF Maps 104 (i.e., eBPF mappings) is a core data structure mainly used for storing and exchanging data. It acts as a bridge between the eBPF program and the user space, allowing efficient sharing of data and status. The situational awareness element data collected in the kernel is pushed to the user space through eBPF Maps. At the same time, the ring buffer of RingBuffer is used to achieve real-time perception of dynamic data. The ring buffer adopts a lock-free synchronization mechanism and uses atomic operations to manage the read and write pointers of the buffer, so that the eBPF program in the kernel space can write events to the buffer, and the user space program can read events from the buffer.

[0067] Node Bindings105, Binding is a bridge used to connect the JavaScript engine with the underlying C / C++ code, allowing JavaScript code to call and operate the underlying system resources and library functions. Here it mainly executes the eBPF C / C++ code. This connection is achieved by writing a Node.js native plug-in addon.

[0068] The JavaScript context 106 is an environment for executing JavaScript code, and manages the execution of all JavaScript code and related resources, including variables, functions, objects, scope chains, event loops, etc. Combined with the LandLock restriction of eBPF, security can be further enhanced, and the access of the JavaScript context to system resources can be controlled, thereby ensuring system security.

[0069] In the specific implementation, it is necessary to use Linux's Landlock module 111 to ensure the security of JS context execution. Landlock is a security feature of the Linux kernel. It enhances the security of the system by providing an application-level access control mechanism. It allows non-privileged users to define their own security policies and limit the files and resources that their processes can access, thereby reducing potential security risks.

[0070] In the specific implementation, the eBPF event triggering mechanism includes a variety of hooks and probes, which can monitor and intercept various events in the kernel and user space, covering most events from the kernel to the user space, and supporting efficient system monitoring, performance analysis, security auditing and network processing, including Uprobe, KProbe, Tracepoints, XDP, TC, PerfEvents, Trace Events, LSM Hooks and Cgroup Sockets.

[0071] In one or more implementations, this embodiment provides a situation awareness element extraction system based on the eBPF technology based on the above-mentioned situation awareness element extraction method, including:

[0072] A user monitoring program construction unit, which is used to construct an eBPF user area monitoring program based on the situational awareness element extraction requirements, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the policies in the pre-built situational awareness element extraction policy library, obtain the corresponding situational awareness elements based on the loaded policies, and execute the corresponding security measures;

[0073] An eBPF kernel program construction unit, which is used to construct an eBPF kernel program for kernel object acquisition based on a kernel object of a predefined situational awareness element, wherein the eBPF kernel program is based on a pre-constructed eBPF machine code, compiled after security verification, and executed in a kernel area;

[0074] A situation awareness element extraction unit is used for kernel objects collected based on the eBPF kernel program. The eBPF user area monitoring program obtains corresponding situation awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situation awareness elements.

[0075] In more embodiments:

[0076] An electronic device is also provided, comprising a processor, wherein the processor is used to implement the situational awareness element extraction method based on the eBPF technology as described above when executing a computer program stored in a memory.

[0077] A non-transitory readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the situational awareness element extraction method based on the eBPF technology as described above is implemented.

[0078] A computer program product is also provided, comprising a computer program. When the computer program is executed by a processor, the method for extracting situational awareness elements based on the eBPF technology is implemented.

Claims

1. A situation awareness element extraction method based on eBPF technology, characterized in that: include: Based on the situation awareness element extraction requirements, an eBPF user area monitoring program is constructed, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the strategies in the pre-built situation awareness element extraction strategy library, obtain the corresponding situation awareness elements based on the loaded strategies, and execute the corresponding security measures; Based on the predefined kernel objects of the situational awareness elements, an eBPF kernel program for kernel object acquisition is constructed, wherein the eBPF kernel program is based on the pre-constructed eBPF machine code, compiled after security verification, and executed in the kernel area; Based on the kernel objects collected by the eBPF kernel program, the eBPF user area monitoring program obtains corresponding situational awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situational awareness elements.

2. A situation awareness element extraction method based on eBPF technology as claimed in claim 1, characterized in that: The method of constructing an eBPF user area monitoring program based on the situation awareness element extraction demand is specifically as follows: based on the situation awareness element extraction demand in the current scenario, a corresponding strategy is selected from a pre-built situation awareness element extraction policy library to implement policy configuration; the configured strategy is loaded through the eBPF user area monitoring program, relevant situation awareness elements are collected according to the configured strategy, and the obtained situation awareness elements are judged to execute corresponding security measures.

3. A situation awareness element extraction method based on eBPF technology as claimed in claim 3, characterized in that: The situational awareness elements include threat intelligence, abnormal network traffic, log events, vulnerabilities, and security situations faced by data leaks.

4. The situation awareness element extraction method based on eBPF technology as claimed in claim 1, characterized in that: The eBPF userland monitoring program obtains corresponding situational awareness elements from the kernel object based on the loaded policy, specifically: building a communication path between the eBPF kernel program and the eBPF userland monitoring program based on the eBPF map and the eBPF ring buffer; wherein the eBPF ring buffer is used to store data collected by the eBPF kernel program; the eBPF map is used to push the data in the eBPF ring buffer to the eBPF user monitoring program.

5. The situation awareness element extraction method based on eBPF technology as claimed in claim 1, characterized in that: The user area monitoring program is implemented in C / C++ language, and specifically performs the following functions: reads the strategies in the pre-built situational awareness element extraction strategy library, and passes the strategies to the kernel's eBPF Maps data structure. After kernel processing, it obtains the corresponding situational awareness elements from the data collected by the eBPF kernel program, and returns the results to the JavaScript calling function.

6. The situation awareness element extraction method based on eBPF technology as claimed in claim 1, characterized in that: The Node.js-based JS engine is used for the execution of the eBPF user area monitoring program. It loads the extension module through the module system of Node.js and provides an interactive interface with the extension module to enable the eBPF user area monitoring program to call the kernel area system resources and library functions.

7. A situation awareness element extraction system based on eBPF technology, characterized in that: include: A user monitoring program construction unit, which is used to construct an eBPF user area monitoring program based on the situational awareness element extraction requirements, wherein the eBPF user area monitoring program is run in the background and runs in a JS engine based on Node.js; the eBPF user area monitoring program is used to load the policies in the pre-built situational awareness element extraction policy library, obtain the corresponding situational awareness elements based on the loaded policies, and execute the corresponding security measures; An eBPF kernel program construction unit, which is used to construct an eBPF kernel program for kernel object acquisition based on a kernel object of a predefined situational awareness element, wherein the eBPF kernel program is based on a pre-constructed eBPF machine code, compiled after security verification, and executed in a kernel area; A situation awareness element extraction unit is used for kernel objects collected based on the eBPF kernel program. The eBPF user area monitoring program obtains corresponding situation awareness elements from the kernel objects based on the loaded policies, and executes corresponding security measures based on the obtained situation awareness elements.

8. An electronic device, comprising a processor, characterized in that: The processor is used to implement a situation awareness element extraction method based on eBPF technology as described in any one of claims 1 to 6 when executing a computer program stored in the memory.

9. A non-transitory readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for extracting situational awareness elements based on the eBPF technology as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that: When the computer program is executed by a processor, a situation awareness element extraction method based on eBPF technology as described in any one of claims 1 to 6 is implemented.

Images