Data monitoring method, device and system
By intercepting system call events in the operating system kernel space and using EBPF to capture and parse network packets, the performance and versatility issues of existing network traffic monitoring solutions are resolved, achieving efficient, real-time, and non-intrusive multi-protocol monitoring.
Patent Information
- Application Number
- CN202511851046.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-02-06
AI Technical Summary
Existing network traffic monitoring solutions suffer from high performance overhead, inability to meet real-time monitoring needs, complex deployment, intrusiveness to user applications, increased development and maintenance costs, inability to monitor all network interactions, monitoring blind spots, and a lack of versatility and scalability.
The system intercepts system call events in the operating system's kernel space, captures packets through the Extended Berkeley Packet Filter (EBPF), checks the status of protocol monitoring switches, identifies application protocol types using identification strategies, parses the data using a parser, generates structured monitoring data, and adaptively sends it to user space.
It achieves full-coverage network data monitoring, reduces performance overhead, improves real-time performance and versatility, reduces system resource consumption, supports monitoring of multiple protocols, and ensures the continuity and efficiency of data monitoring without requiring system restarts.