Virtualized container environment monitoring device and method based on eBPF

Abstract

The invention discloses a virtualized container environment monitoring device and method based on eBPF, and aims to solve the problems of poor isolation, insufficient security and platform adaptation deficiency in a virtualized container environment. According to the method, time sequence data of monitored events in a virtualized container environment are collected in real time through an eBPF technology, the time sequence data are transmitted to a data analysis module through eBPF mapping and message queues, data are analyzed through a long-short-term memory network, the deviation degree of the current time sequence data and historical data is calculated, abnormal behaviors are judged, and an alarm is given. According to the method, the user-defined program is operated under the condition that kernel codes do not need to be modified, intelligent analysis and abnormal behavior recognition are conducted on the collected data, comprehensive monitoring and dynamic detection of complex threats are achieved, the safety, stability and compatibility of the system are improved, and the method is suitable for virtual environments under cloud computing and big data scenes.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric digital data processing, and further relates to a virtualized container environment monitoring device and method in the technical field of virtualized container environment monitoring based on an extended Berkeley Packet Filter (eBPF). The present invention can be used to detect abnormal container behaviors in the virtualized container deployment environment in a target platform to be monitored. Background Art

[0002] In the modern era of cloud computing and big data, containerization technology has become increasingly popular due to its high efficiency, flexibility, and lightweight characteristics. Container technology achieves environmental consistency and rapid deployment by packaging an application program and its dependencies into a container. The underlying principle of containerized deployment involves kernel mechanisms of the operating system, including namespaces and control groups (Cgroups). Namespaces provide a lightweight isolation, enabling each container to have its own independent user space instance, while control groups are used for resource allocation and limitation to ensure that applications within the container do not overuse system resources. However, precisely because containers share the host kernel, their isolation is not as good as that of virtual machines, which may lead to security vulnerabilities and attack risks. For example, the container escape risk allows an attacker to break through the container's isolation mechanism and access the host; the image vulnerability risk involves potential security vulnerabilities in the container image; and the network attack risk involves the network configuration of the container, making it vulnerable to external attacks. In terms of container escape attacks, vulnerabilities in the container runtime may be exploited by an attacker to escape from the container and gain access to the host system.

[0003] Shanghai Jiao Tong University proposed a host-side lightweight container traffic monitoring system and method in its patent document "Host-side lightweight container traffic monitoring system and method based on eBPF" (application number CN 202211481213.1, authorization announcement number CN 115834448 B). The method implemented by this technical solution is to use eBPF technology to monitor container network traffic on the host side, and by mounting an eBPF program on the container network interface, traffic data is captured and analyzed in real time. However, this method still has the following two deficiencies: First, this method only focuses on network traffic and cannot monitor internal container behavior events such as system calls and file accesses. Second, this method only monitors and visually displays container traffic without analyzing it and detecting abnormal situations.

[0004] Sichuan QiruiKe Technology Co., Ltd. proposed a container runtime security detection method based on behavior monitoring in its patent document "A Container Runtime Security Detection Method Based on Behavior Monitoring" (Application Publication No. CN 115576649 A, Application No. CN 202211301948.1). This method monitors kernel behavior by implanting a kernel behavior monitoring module in the system kernel. At the same time, it judges the true source of the behavior according to the user group to which the behavior belongs, and realizes container runtime security monitoring based on real-time behavior analysis inside the container, which can ensure the security during the container runtime. However, this method still has the following deficiencies: The traditional Inotify technology is used for file monitoring, and it is impossible to obtain more detailed file operation event context information; This method only uses a data analysis method based on rule matching and cannot cope with the threats in the complex and changeable container runtime environment; This method is not adapted to the domestic Feiteng platform, and there may be compatibility risks in actual deployment and application. Summary of the Invention

[0005] The object of the present invention is to address the deficiencies of the above-mentioned existing technologies, and propose a virtualized container environment monitoring device and method based on eBPF, aiming to solve the problems of poor isolation between containers in virtualization, insufficient system stability, difficulty in ensuring security, and lack of adaptation to the Feiteng platform in complex scenarios of cloud computing, big data processing, and microservices architecture.

[0006] The technical idea for achieving the object of the present invention is to adopt the eBPF technology to realize the real-time monitoring of the internal behavior of containers in the virtualized container environment on the target platform to be monitored, and use machine learning and deep learning algorithms to perform intelligent analysis and anomaly detection on the collected data. Since the present invention uses the eBPF technology, which has the outstanding substantial feature of efficient and flexible monitoring in the operating system kernel, it can capture and process key behavioral events such as system calls, file accesses, and network communications inside the container in real time, thus effectively making up for the deficiencies in the prior art such as the insufficiently fine data collection granularity and the large performance loss due to frequent switching between the user space and the kernel space. At the same time, the present invention uses deep learning algorithms to perform intelligent analysis on the collected data and intelligently identify abnormal behaviors, further solving the defect in the prior art of relying on static rule matching and being difficult to cope with complex threats. Through dynamic analysis technology, the present invention can flexibly respond to new security threats and improve the accuracy and efficiency of detection. In addition, in view of the compatibility problem that the prior art does not adapt to the Feiteng platform, the present invention fully considers the kernel architecture and characteristics of the Feiteng platform and customizes the development of eBPF programs to ensure the efficient operation and compatibility of the system. Through the above technical means, the present invention not only realizes the improvement of the security of the containerized deployment environment, but also enhances the stability and adaptability of the system, effectively overcoming the defects in the prior art such as limited monitoring scope, insufficient event correlation, and lack of adaptation to the Feiteng platform, and providing a more reliable guarantee for the virtualized environment in cloud computing and big data scenarios.

[0007] To achieve the above object, the monitoring device of the present invention includes a data collection module, a data transmission module, a data analysis module, and an abnormal behavior warning module, wherein:

[0008] The data collection module is used to implement its function using the eBPF technology based on the characteristics of the target platform to be monitored and the virtualized container environment. By deploying the data collection module to the loading point of the monitored event in the operating system kernel of the target platform to be monitored, it can obtain and collect the original data of the monitored event in real time;

[0009] The data transmission module is used to transmit the original data collected by the data collection module to the eBPF user space program through the eBPF map, and then the eBPF user space program transmits the data to the data processing module through the message queue;

[0010] The data analysis module is used to process the real-time received events into time series data; use a long short-term memory network to analyze the time series data, calculate the deviation degree of the current time series data compared with the historical time series data; determine the time series data with a deviation degree greater than or equal to the threshold as abnormal behavior;

[0011] The abnormal behavior warning module is used to warn and display the abnormal behaviors occurring in the virtualized container environment.

[0012] The specific steps of the monitoring method of the present invention are as follows:

[0013] Step 1, based on the characteristics of the target platform to be monitored and the virtualized container environment, use eBPF technology to implement the functions of the data acquisition module, and deploy the data acquisition module to the loading point of the monitored event in the operating system kernel of the target platform to be monitored, and obtain and collect the original timing data of the monitored event in real time;

[0014] Step 2, the data transmission module transmits the original timing data collected by the data acquisition module to the eBPF user space program through the eBPF map, and then the eBPF user space program transmits the data to the data analysis module through the message queue;

[0015] Step 3, the data analysis module uses the long short-term memory network to analyze the timing data and calculate the deviation degree of the current timing data compared with the historical timing data;

[0016] Step 4, the data analysis module determines the timing data with a deviation degree greater than or equal to the threshold as abnormal behavior and then executes Step 5;

[0017] Step 5, the abnormal behavior warning module warns and displays the abnormal behavior occurring in the virtualized container environment.

[0018] Further, the implementation of the functions of the data acquisition module using eBPF technology means writing eBPF programs according to the characteristics of the target platform to be monitored and the virtualized container environment. Subsequently, the just-in-time interpreter of the Linux kernel converts these eBPF programs into machine instructions for a specific CPU architecture. Through the kernel dynamic probe mechanism, use the eBPF program to capture the operation of the process in the container to open a file, capture the path information of the file operation, and obtain the detailed information of the file system name and file path through parsing. At the same time, capture the network transmission behavior between containers and parse the source address and target address information of the data packet.

[0019] Further, the loading point of the monitored event refers to: the pre-defined or dynamically probed mounting positions in the operating system kernel that are closely related to container behavior, including but not limited to the entry and exit of system calls, the function call points of file system operations, and the key functions in the network protocol stack; the eBPF programs mounted through the loading point capture system call parameters, file paths, and the source and destination addresses of network data packets.

[0020] Furthermore, the timing data refers to: a sequence of container behavior events with timestamps captured and recorded by the data acquisition program at the loading point of the monitored event. These data include but are not limited to the type, frequency and parameters of system calls, the path and operation type of file access, the source address, destination address and amount of data transmitted of network communications. These data are organized in chronological order and reflect the behavior patterns of the internal processes of the container at different time points.

[0021] Furthermore, the long short-term memory network refers to a recurrent neural network architecture, whose structure consists of multiple interconnected memory units; each memory unit contains three gating structures, namely an input gate, a forget gate and an output gate, and a cell state for storing information; the input gate controls the degree of update of the cell state by the current input data through an activation function, the forget gate determines the retention ratio of historical information in the cell state through an activation function, and the output gate adjusts the output information amount of the cell state to the hidden state through an activation function; the interaction between the gating structure and the cell state is realized through a fully connected layer and a nonlinear activation function; the historical time series data is input into the long short-term memory network, and the network parameters are optimized through a back-propagation algorithm.

[0022] Furthermore, the steps of analyzing the time series data using the long short-term memory network are as follows:

[0023] The first step is to preprocess the time series data received from the data processing module, perform data cleaning operations in sequence, identify and remove noise and outliers in the time series data through statistical methods, fill in the missing values in the data, fill in the missing parts according to the average value of adjacent data points or the entire data set, and convert the data with different characteristics into a unified scale with a mean of 0 and a standard deviation of 1 by calculating the mean and standard deviation of each data point;

[0024] The second step is to input the preprocessed time series data into the long short-term memory network for prediction. The long short-term memory network uses its internal memory unit and gate structure to analyze the input time series data time by time step, and learns the long-term dependencies and patterns in it in combination with historical data. After receiving the input data of the current time step, the model calculates the output of the current time step through forward propagation based on the previous hidden state and cell state, that is, the predicted value corresponding to the actual observed value of the currently collected time series data. The predicted value represents the model's expected result for the current behavior pattern;

[0025] Furthermore, the degree of deviation of the current time series data from the historical time series data is obtained by the following formula:

[0026]

[0027] Among them, S represents the deviation degree between the actual observed value and the predicted value of the current collected time-series data, T represents the total number of data points within the time window, and x k , respectively represent the actual observed value and the LSTM model predicted value at the k-th time step in the time-series data in the virtualized container environment.

[0028] Furthermore, the threshold value is a preset value based on the analysis of historical data on the characteristics of the virtualized environment and security requirements and empirical knowledge under different scenarios.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] First, since the present invention uses the eBPF technology to penetrate into the execution level of the operating system kernel of the target platform to be monitored, and collects and transmits the data of the monitored events in real time, it overcomes the defect of the prior art that only focuses on network traffic and cannot monitor the internal behavior of containers, enabling the present invention to directly obtain the data of the monitored events, significantly expanding the monitoring scope and achieving a comprehensive insight into container behavior. At the same time, the present invention also overcomes the deficiency of the traditional Inotify technology lacking detailed context information when monitoring file operations, enabling the present invention to capture the complete context of file operations, including but not limited to paths and process identifiers, greatly improving the depth and accuracy of monitoring.

[0031] Second, since the present invention uses the eBPF technology to run custom programs without modifying the kernel code, it overcomes the performance overhead caused by the frequent switching between the user space and the kernel space in the prior art, enabling the present invention to significantly reduce the consumption of system resources, thereby ensuring the high efficiency and stability of the system.

[0032] Third, the present invention uses deep learning algorithms to perform intelligent analysis on the collected data and intelligently identify abnormal behaviors, further solving the defects of the prior art that rely on static rule matching, cannot adapt to the changing runtime environment, and are difficult to cope with complex threats. Enabling the present invention to flexibly respond to various security threats through dynamic analysis technology, improving the accuracy and efficiency of detection.

[0033] Fourth, aiming at the compatibility problem of the prior art not being adapted to the Feiteng platform, the present invention fully considers the operating system kernel architecture and characteristics of the Feiteng platform in the design, and customizes and develops a data acquisition module to ensure the efficient operation and compatibility of the device. Effectively overcoming the defects of the prior art in terms of limited monitoring scope, insufficient event correlation, and lack of adaptation to the Feiteng platform. Enabling the present invention to not only improve the security of the virtualized container environment, but also enhance the stability and adaptability of the system. Description of the Drawings

[0034] Figure 1It is the architecture diagram of the monitoring device of the present invention;

[0035] Figure 2 It is the flowchart of the implementation steps of the method of the embodiment of the present invention;

[0036] Figure 3 It is the schematic diagram of the abnormal behavior warning module of the embodiment of the present invention. Detailed implementation manners

[0037] Next, in combination with the drawings and embodiments, the present invention will be further described in detail.

[0038] The embodiment of the present invention specially customizes the eBPF program for the kernel architecture and characteristics of the Feiteng platform to ensure its compatibility and efficient operation on the Feiteng platform. As an important part of the domestic operating system, there are significant differences between the operating system kernel and hardware instruction set of the Feiteng platform and the general platform. The operating system kernel version of the Feiteng platform is based on Linux 4.19 or 5.10. The eBPF program ensures that it can correctly parse system call parameters and kernel data structures by adapting to the BPF type format information of these versions. In addition, for the characteristics of the ARM64 instruction set of the Feiteng platform, the eBPF program generates bytecode compatible with the Feiteng processor during compilation and is converted into machine instructions through the just-in-time compiler of the operating system kernel to reduce the runtime overhead. The data acquisition module fully considers the specific static trace points and dynamic probe positions of the Feiteng kernel during development, and mainly uses two types of eBPF programs: Tracepoint and XDP. Tracepoint loads the eBPF program through the static trace points of the Linux kernel, and can capture specific behaviors of processes in containers, including but not limited to system calls, file operations, and memory allocation. This method can accurately intercept information at specified kernel events to ensure efficient monitoring of the detected events. The XDP program is mainly used for network traffic monitoring, and realizes packet filtering and traffic monitoring operations by quickly processing traffic on the network interface card.

[0039] Refer to Figure 1 , and the architecture of the monitoring device of the present invention will be further described.

[0040] The detection device of the present invention is composed of four core modules: a data acquisition module deployed in the operating system of the monitored target platform; a data transmission module used to transmit the original time-series data collected by the data acquisition module to the data analysis module; a data analysis module used to process the collected data; an abnormal behavior warning module used to warn and display abnormal behaviors occurring in the virtualized container environment. The data transmission module and the data analysis module use a message queue for data interaction. The data processing module is deployed on an independent machine to reduce the impact on the performance of the monitored target platform. The specific descriptions of the core modules are as follows:

[0041] Data acquisition module: Deployed in the kernel space of the operating system of the monitored target platform, it is responsible for collecting various behavioral timing data from the virtualized container environment, including but not limited to system call frequencies, system call sequences, file accesses, network communications, and IO events. The data acquisition module has a specially customized eBPF program to ensure efficient operation and compatibility on the Feiteng FT-2000 / 4 and D2000 processors. The operating system kernel of the Feiteng platform is based on the upstream Linux 4.19 and 5.10 versions, with specific system call tables, memory management mechanisms, and interrupt handling logics. The eBPF program correctly parses system call parameters and kernel data structures by adapting to the BPF type format information of these kernel versions. During development, the eBPF program uses an eBPF compiler to generate bytecodes compatible with the Feiteng processor, and converts them into machine instructions of the Feiteng platform instruction set through the just-in-time compiler of the operating system kernel. This module uses eBPF technology to achieve efficient kernel-level data acquisition, ensuring the real-time and accuracy of data.

[0042] Data transmission module: Deployed in the user space of the operating system of the monitored target platform, it transmits the raw data collected by the data acquisition module to the eBPF user space program through eBPF maps, and then the eBPF user space program transmits the data to the data processing module through a message queue.

[0043] Data processing module: Deployed in an independent machine, it receives the timing data sent by the data transmission module, conducts data interaction through a message queue, and uses machine learning and deep learning algorithms to process and analyze the data to automatically identify abnormal behaviors. This module also conducts control interaction with the acquisition module through the Hypertext Transfer Protocol to achieve dynamic adjustment and optimization of the data acquisition process.

[0044] Abnormal behavior warning module: Deployed on the same side as the data processing module, it warns and displays the abnormal behaviors in the virtualized container environment analyzed by the data processing module.

[0045] Refer to Figure 2 , and further describe the implementation steps of the monitoring method of the embodiment of the present invention.

[0046] Step 1, use eBPF technology to implement the functions of the data acquisition module; deploy the data acquisition module to the monitored event loading point to obtain and collect the original timing data of these events in real time.

[0047] For monitoring system call events in a virtualized container environment, embodiments of the present invention employ eBPF programs of the Tracepoint type. This program utilizes the static tracing mechanism of the operating system kernel to capture events and parses the parameters of tracepoints through BPF Type Format (BTF) information. Through BTF information, the parameters of system calls can be effectively parsed and analyzed, thereby providing data support for subsequent abnormal behavior detection. In the embodiments of the present invention, special system calls such as chmod and mkdir are selected for key monitoring, and the tail call mechanism is used to optimize the processing process. The tail call mechanism allows, when executing the eBPF program, to jump to a specified handler based on the system call ID, thereby performing special processing on specific system calls.

[0048] For monitoring file access events in a virtualized container environment, embodiments of the present invention choose to use the do_filp_open() function in the source code of the operating system kernel as the loading point. This function is stable and has clear parameter meanings, so it is suitable for mounting eBPF programs to monitor file access events. This method uses the dynamic probe mechanism of the operating system kernel to capture the operations of processes in the container opening files with an eBPF program. The eBPF program can capture the path information of file operations and obtain detailed information such as the file system name and file path by parsing. In this way, the file access behavior in the container can be accurately monitored, and then it can be analyzed whether there are improper file operations.

[0049] For monitoring network communication events in a virtualized container environment, embodiments of the present invention perform traffic monitoring by using the __tcp_transmit_skb() and tcp_v4_do_rcv() kernel functions in the operating system kernel of the target platform to be monitored as the loading points. These functions are stable and do not have inlining optimizations, making them suitable for mounting eBPF programs. Through this program, the network transmission behavior between containers can be captured, the source address and destination address information of the data packets can be parsed, and it can be checked whether there is abnormal communication traffic. The eBPF program can efficiently process network packets, filter out the data packets that do not conform to the rules, and thus achieve the monitoring of network communication events.

[0050] Step 2, the data transmission module sends the original time-series data collected by the data acquisition module to the data analysis module.

[0051] In the embodiments of the present invention, after the data acquisition module successfully captures and processes the event data in the container, the next task is to transfer this data from the kernel space to the user space for further analysis and processing.

[0052] To ensure that the collected data can be efficiently transmitted to the user space, two main data transmission mechanisms are adopted in the embodiments of the present invention. For events with high real-time requirements, large data volume, and short life cycle, the embodiments of the present invention utilize the ring buffer mechanism in the kernel space to put the processed event data into a pre-allocated ring buffer. By calling the bpf_ringbuf_reserve and bpf_ringbuf_submit interfaces, the data is written into the ring buffer in a low-latency manner for the user space program to read in a polling or event-driven manner. For key data that needs to be stored for a long time or further statistically analyzed, the embodiments of the present invention adopt the eBPF map mechanism and store the data into the eBPF map through the bpf_map_update_elem interface.

[0053] The eBPF map is an efficient in-memory data structure that allows sharing information between the kernel space and the user space. In the embodiments of the present invention, the data collection module stores each captured monitored event in the eBPF map in a predetermined data format. The storage structure design of the data can be customized according to specific requirements, including but not limited to storing the timestamp, process ID, event type, and parameters of the event. In this way, the present invention ensures the efficient storage of the monitored event data collected in real time by the data collection module and enables these data to be accessed in real time by the eBPF user space program.

[0054] Once the eBPF user space program successfully reads the monitored event time series data in the virtualized container environment, it will further process the data. These processes include but are not limited to data format conversion, deduplication, and aggregation. The processed event data will be transmitted to the data analysis module through a message queue. The message queue is an efficient message passing mechanism that can ensure the order, reliability, and efficiency of the data. Through the message queue, the eBPF user space program can transmit the monitored event time series data in the large-scale virtualized container environment to the data analysis module in batches.

[0055] Step 3, the data analysis module analyzes the time series data and calculates the deviation degree of the current time series data compared with the historical time series data.

[0056] In the embodiments of the present invention, the data analysis module is responsible for analyzing the monitored transaction time series data of the virtualized container environment received from the data transmission module and determining whether there are abnormal behaviors in the container. During the analysis process, the data analysis module adopts a deep learning algorithm based on long short-term memory to capture the time series characteristics of the container behavior and identify potential abnormal behavior patterns.

[0057] The Long Short-Term Memory (LSTM) network is a special type of Recurrent Neural Network (RNN) designed to address the problems of vanishing gradients and exploding gradients faced by traditional RNNs when dealing with long-term dependencies. The LSTM network can effectively capture long-term temporal information through its unique cell structure and learn complex temporal dependencies in sequential data. Therefore, the LSTM network is very suitable for analyzing the temporal data of container behavior because the behavior of containers is usually time-series data, which contains the temporality of events and long-term dependencies.

[0058] Before the LSTM network is trained and inferred, first, it is necessary to preprocess the monitored transactional temporal data of the virtualized container environment received from the data transmission module. Container behavior data includes system calls, file accesses, and network request information, which are often unordered and may contain noise or missing values. Therefore, the goal of data preprocessing is to clean the data, fill in the missing values, and perform normalization processing to better adapt to the training requirements of the LSTM network model. The specific preprocessing steps include:

[0059] Data cleaning: Remove invalid data and fill in the missing values. The methods for filling in the missing values include, but are not limited to, interpolation method and mean filling method.

[0060] Feature extraction and normalization: Extract key features from the original temporal data and perform normalization processing to reduce the impact of different feature scale differences.

[0061] Temporal construction: Organize the data into a temporal data sequence in chronological order so that the LSTM network can capture the temporal dependencies in the data.

[0062] After the data preprocessing is completed, the data analysis module can input the processed data into the LSTM network for training.

[0063] Step 4, the data analysis module determines the temporal data with a deviation degree greater than or equal to the threshold as abnormal behavior.

[0064] In the embodiments of the present invention, the data analysis module uses the LSTM network to learn the pattern of normal behavior based on the temporal data of container behavior and can predict future behavior. If the container behavior deviates from the normal pattern, the LSTM network will identify the abnormal behavior by calculating the difference (residual) between the predicted value and the actual observed value.

[0065] The output of the long short-term memory network (LSTM) is a scalar, representing the predicted value of the container behavior at the current moment. During the anomaly detection process, the present invention first compares the residual of each behavior with a preset threshold. If the residual exceeds the threshold, the behavior is considered an abnormal behavior. In this way, the data analysis module can identify possible abnormal operations in the container. The threshold is a preset value based on the analysis of historical data and empirical knowledge of the characteristics and security requirements of the virtualized container environment under different scenarios.

[0066] Step 5: The abnormal behavior warning module alarms and displays the abnormal behaviors identified by the data analysis module.

[0067] Figure 3 The schematic diagram of the abnormal behavior warning module shown demonstrates the operation process and detection results of the detection device in the embodiment of the present invention. Figure 3 The architecture of the operating system of the target platform to be monitored by the present invention is shown above the example page, and PUT, GET, and CMD operation buttons for deploying example applications in virtualized containers are provided. Among them, the PUT and GET commands are normal functions provided by the example application for deploying virtualized containers, and the CMD command is used for injecting abnormal situations. The results analyzed by the algorithm analysis module are output in real time below the example page.

Claims

1. A virtualized container environment monitoring device based on eBPF, characterized in that, The monitoring device includes a data acquisition module, a data transmission module, a data analysis module, and an abnormal behavior warning module, where: The data acquisition module is used to implement its functions using the eBPF technology based on the characteristics of the target platform to be monitored and the virtualization container environment. By deploying the data acquisition module to the loading point of the monitored event in the operating system kernel of the target platform to be monitored, it can obtain and collect the original data of the monitored event in real time; The data transmission module is used to transmit the original data collected by the data acquisition module to the eBPF user space program through the eBPF map, and then the eBPF user space program transmits the data to the data processing module through the message queue; The data analysis module is used to process the real-time received events into time series data; use the long short-term memory network to analyze the time series data, and calculate the deviation degree of the current time series data compared with the historical time series data; determine the time series data with a deviation degree greater than or equal to the threshold as abnormal behavior; The abnormal behavior warning module is used to warn and display the abnormal behavior that occurs in the virtualization container environment.

2. The method for monitoring a virtualized container environment based on eBPF according to claim 1, wherein The specific steps of this monitoring method are as follows: Step 1: Based on the characteristics of the target platform to be monitored and the virtualization container environment, use the eBPF technology to implement the functions of the data acquisition module, and deploy the data acquisition module to the loading point of the monitored event in the operating system kernel of the target platform to be monitored, and obtain and collect the original time series data of the monitored event in real time; Step 2: The data transmission module transmits the original time series data collected by the data acquisition module to the eBPF user space program through the eBPF map, and then the eBPF user space program transmits the data to the data analysis module through the message queue; Step 3: The data analysis module uses the long short-term memory network to analyze the time series data, and calculates the deviation degree of the current time series data compared with the historical time series data; Step 4: After the data analysis module determines the time series data with a deviation degree greater than or equal to the threshold as abnormal behavior, execute Step 5; Step 5: The abnormal behavior warning module warns and displays the abnormal behavior that occurs in the virtualization container environment.

3. The monitoring method according to claim 2, wherein The use of the eBPF technology to implement the functions of the data acquisition module in Step 1 means that eBPF programs are written according to the characteristics of the target platform to be monitored and the virtualization container environment. Subsequently, the just-in-time interpreter of the Linux kernel converts these eBPF programs into machine instructions for a specific CPU architecture. Through the kernel dynamic probe mechanism, the eBPF programs are used to capture the operations of processes in the container to open files, capture the path information of file operations, and obtain the detailed information of the file system name and file path by parsing. At the same time, the network transmission behavior between containers is captured, and the source address and target address information of the data packet are parsed.

4. The monitoring method according to claim 2, wherein The loading point of the monitored event in Step 1 refers to: the pre-defined or dynamically probed mounting positions in the operating system kernel that are closely related to container behavior, and these positions include but are not limited to the entry and exit of system calls, the function call points of file system operations, and the key functions in the network protocol stack; The eBPF program mounted through the loading point captures system call parameters, file paths, and source and destination addresses of network packets.

5. The monitoring method according to claim 2, characterized in that The timing data described in step 1 refers to: a sequence of container behavior events with timestamps captured and recorded by the data collection program at the loading point of the monitored event. These data include, but are not limited to, the types, frequencies, and parameters of system calls, the paths and operation types of file accesses, the source addresses, destination addresses, and transmitted data volumes of network communications. These data are organized in chronological order and reflect the behavior patterns of processes inside the container at different time points.

6. The monitoring method according to claim 2, wherein The long short-term memory network described in step 3 refers to a recurrent neural network architecture composed of multiple interconnected memory units; each memory unit contains three gating structures: an input gate, a forget gate, and an output gate, as well as a cell state for storing information; the input gate controls the degree of update of the current input data to the cell state through an activation function, the forget gate determines the retention ratio of historical information in the cell state through an activation function, and the output gate regulates the amount of information output from the cell state to the hidden state through an activation function; the interaction between the gating structures and the cell state is achieved through fully connected layers and non-linear activation functions; historical timing data is input into the long short-term memory network, and the network parameters are optimized through the backpropagation algorithm.

7. The monitoring method according to claim 5, wherein The steps of analyzing the timing data using the long short-term memory network described in step 3 are as follows: In the first step, preprocess the timing data received from the data processing module, and sequentially perform data cleaning operations. Identify and remove noise and outliers in the timing data through statistical methods, fill in missing values in the data, and complete the missing part according to the average value of adjacent data points or the entire data set. Convert the data with different features into a unified form with a mean of 0 and a standard deviation of 1 by calculating the mean and standard deviation of each data point. In the second step, input the preprocessed timing data into the long short-term memory network for prediction. The long short-term memory network uses its internal memory units and gating structures to analyze the input timing data step by step in time. Combining historical data, it learns the long-term dependencies and patterns. After receiving the input data at the current time step, the model calculates the output at the current time step through forward propagation based on the previous hidden state and cell state, that is, the predicted value corresponding to the actual observed value of the currently collected timing data. This predicted value represents the expected result of the model for the current behavior pattern.

8. The monitoring method according to claim 2, wherein The degree of deviation of the current timing data from the historical timing data described in step 3 is obtained by the following formula: Among them, S represents the deviation degree between the actual observed value and the predicted value of the currently collected time-series data, T represents the total number of data points within the time window, and x k and respectively represent the actual observed value and the LSTM model predicted value at the k-th time step in the time-series data in the virtualized container environment.

9. The monitoring method according to claim 2, wherein The threshold described in step 4 is a value preset according to the characteristics of the virtualization environment and historical data analysis and empirical knowledge of security requirements in different scenarios.

Images