Host-side lightweight container traffic monitoring system and method based on eBPF

Abstract

The present invention provides a host-side lightweight container traffic monitoring system and method based on eBPF, including: a container information management module: collects and automatically maintains container information; a kernel eBPF module: a BPF program executed in the kernel, obtains data traffic information and passes it to the user space; an eBPF program management module: cooperates with the container information management module and the user interaction module to manage the kernel eBPF program, extracts the obtained data traffic information and passes it to the user interaction module; the user interaction module: accepts the input container traffic control rules, and converts them into eBPF program logic to realize system functions. The present invention is based on eBPF technology, has the characteristics of convenient use and high efficiency. In terms of traffic monitoring, the transmission path between data traffic receiving and being captured is shorter, and the system response speed is also faster.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a host-side lightweight container traffic monitoring system and method based on eBPF. Background Art

[0002] With the development of computer software and hardware technology, traditional software deployment models are gradually being replaced by cloud scenarios. The development of 5G and the Internet of Things has also led more and more companies to embrace cloud native and deploy their products to the cloud. Data shows that Google creates 200 million containers per week using its own container orchestration system Kubernetes (hereinafter referred to as K8s). Netflix creates 2 million containers in the Amazon cloud on average per week. These data reflect the current booming status of container and cloud native technologies.

[0003] Compared with the traditional physical host deployment mode, applications in cloud scenarios generally have more convenient deployment processes, higher resource utilization, and more accessible application interfaces. Behind these many advantages is the core of the continuous development of cloud native technology - container technology. As a more lightweight virtualization technology, container technology implements operating system-level virtualization based on resource isolation mechanisms such as namespace and Cgroups of the Linux system. Different containers running on the same physical host directly share the host kernel without the need for their own hardware virtualization. Therefore, compared with traditional virtualization technologies such as VMware that require hardware virtualization, containers have faster startup speeds, simpler deployment processes, and lower resource usage during lightweight runtime.

[0004] Although it has many advantages mentioned above, the rapid development of containers and cloud native has also brought new challenges to the field of network security that cannot be ignored. These security challenges mainly come from three aspects. First, since applications deployed in the cloud often need to bear more network access, the attack surface exposed by container applications on the network side is also larger. In recent years, there have been frequent incidents of cloud applications being attacked by networks, and most of these security issues are caused by insecure containers that expose too many network interfaces. Secondly, due to the characteristic of shared kernel in container technology, it is less secure than traditional hardware-based virtualization technology. The resource isolation mechanism between containers is easily broken by vulnerabilities in container images, container runtimes, host kernels, etc., causing containers to escape. If one container is affected, it will affect all containers on the entire cloud host. Finally, as an emerging technology field, the characteristics of container technology have also made the working scenarios of many traditional security fields different in container environments, and past technical methods often perform poorly.

[0005] In the field of traffic monitoring, related work takes network traffic packets as the main analysis object, and monitors and manages network traffic through steps such as packet capture, traffic feature extraction, and rule matching, thereby preventing the transmission of network packets that violate the policy, displaying the overall operation status of the system network, resisting attacks on the network side, and ensuring network security. Therefore, traffic monitoring work is of great significance for network performance optimization and network side intrusion detection. In the traditional application deployment mode, the data scale of network traffic generated by the server host is mostly within the predictable range due to the relatively fixed running programs, and the traffic characteristics are relatively obvious, and the difficulty of traffic information extraction and traffic monitoring is relatively low. In the cloud scenario, a physical host as a server may run dozens or even hundreds of containers at the same time, and each container runs different microservice programs. Moreover, the life cycle of modern containers spans a large span. Containers with a short life cycle may go from startup to destruction within a few seconds, while containers with a long life cycle may remain in operation for several months. On the one hand, the large container density increases the network traffic in the host environment in the cloud scenario, and the overall data volume of network traffic is difficult to estimate. On the other hand, the rapidly changing container status and a wide variety of microservices also make the network traffic characteristics in the host significantly different, which significantly increases the difficulty of extracting traffic characteristics and traffic monitoring. These requirements require specific traffic monitoring solutions for container scenarios to solve, and the research content of network traffic monitoring in container scenarios has gradually received more and more attention.

[0006] Patent document CN112333163A (application number: CN202011149615.2) discloses a method for monitoring traffic between containers and a traffic monitoring management system. The method for monitoring traffic between containers includes: obtaining traffic data sent by the SDN controller, the traffic data including traffic data between each target container and the downstream container corresponding to the target container collected by the SDN switch; for each target container, judging whether there is a traffic anomaly between the target container and the corresponding downstream container according to the traffic data corresponding to the target container; in the case of a traffic anomaly between the target container and the corresponding downstream container, temporarily blocking the target container and the corresponding downstream container from subsequent data interaction. However, the invention is not based on eBPF technology to enable it to function in the kernel. Summary of the invention

[0007] In view of the defects in the prior art, the object of the present invention is to provide a host-side lightweight container traffic monitoring system and method based on eBPF.

[0008] According to the present invention, a host-side lightweight container traffic monitoring system based on eBPF is provided, comprising:

[0009] Container information management module: collects and automatically maintains container information;

[0010] Kernel eBPF module: BPF program executed in the kernel, obtains data flow information and passes it to user space;

[0011] eBPF program management module: cooperates with the container information management module and the user interaction module to manage the kernel eBPF program, extracts the acquired data flow information and passes it to the user interaction module;

[0012] User interaction module: accepts input container traffic control rules and converts them into eBPF program logic to implement system functions.

[0013] Preferably, in the container information management module:

[0014] Runs in user space; collects container information in the preprocessing phase after system startup, detects containers running in the current host during system startup, collects container-related information including virtual network device names, filters out containers without network functions, determines monitoring objects, and obtains metadata required for monitoring;

[0015] The container information collection in the preprocessing stage focuses on containers that have network functions and are in operation. The collected information fields are the container ID, container name, container virtual network device identification information, the network type used by the container, and the IP address of the container in its network isolation environment.

[0016] During system operation, the system continuously monitors container life state change events, dynamically maintains the information of the containers that need to be monitored, and automatically maintains the container information to ensure that the current container information set is consistent with the current host environment.

[0017] During the system operation phase, the docker events mechanism is used to obtain the pipeline containing docker container events, and a coroutine is started to continuously monitor the event information in the pipeline, filtering out key events including container start, stop, and creation and connection of docker custom networks;

[0018] The container information management module uses the Docker client development library to collect container information and captures container lifecycle change information through the Docker events mechanism, thereby maintaining the container information that needs to be monitored and guiding the subsequent behavior of the system.

[0019] The docker events mechanism exists in the form of a pipeline. The container status change information transmitted in the pipeline includes network connection and disconnection, container start and stop, and volume mounting and unmounting. After filtering out information that is not related to changes in the container network environment, the remaining information is of reference significance for container traffic monitoring.

[0020] Preferably, in the kernel eBPF module:

[0021] It runs in kernel space and runs in the form of bytecode in the eBPF virtual machine located in the Linux kernel. It focuses on the network stack of the container virtual network device, obtains traffic information at different network stack levels of the virtual network device through different types of eBPF programs loaded, and uses the eBPF map mechanism as the transmission medium to transfer the traffic information captured in the kernel space from the kernel space to the user space.

[0022] The kernel eBPF module contains one or more eBPF programs running in the kernel virtual machine. Each eBPF program corresponds to a monitored running container. The eBPF program types in the module include xdp and tc, which are used to capture information about network traffic at different layers of the network stack.

[0023] For the data traffic captured by the kernel eBPF program, the system focuses on the source IP address and destination IP address of the traffic data, and combines it with the IP address of the container in its own network isolation environment, and displays it to the user. It also obtains other fields of the data traffic information based on the custom rules entered by the user.

[0024] Preferably, in the eBPF program management module:

[0025] Runs in user space, and manages kernel eBPF programs in cooperation with the container information management module and the user interaction module according to user operations and the addition and reduction of containers. The management work includes loading, unloading, and updating operations of eBPF programs.

[0026] Extract the captured traffic data from the map object owned by the existing eBPF program and pass it to the user interaction module;

[0027] The automatic loading and unloading operations of the eBPF program occur as the monitored container object changes. When a new container is detected to be created, the new eBPF program will be loaded into the kernel. When a monitored container is detected to be stopped, the corresponding eBPF program will be unloaded.

[0028] Preferably, in the user interaction module:

[0029] It runs in user space and provides users with different command options in the form of command lines, including data display and rule operation instructions. Users enter instructions in the command line to view container network traffic monitoring data and add and delete traffic control rules between containers. The user interaction module is responsible for accepting container traffic control rules entered by users and converting them into eBPF program logic in the kernel to realize system functions.

[0030] The user interaction module provides functions including container network traffic information display and custom rule input. By reading the map structure of the eBPF program in the kernel, the container traffic data information captured by the eBPF program is obtained, and then it is displayed to the user after formatting. It provides rule forms for blocking or allowing network traffic interaction between specific containers. The user inputs the rules, which are then parsed and converted into specific logic of the eBPF program. The relevant rules are implemented in the kernel, which are specifically reflected in the different return values ​​of the hook functions in the eBPF program.

[0031] According to a host-side lightweight container traffic monitoring method based on eBPF provided by the present invention, the host-side lightweight container traffic monitoring system based on eBPF is adopted to perform the following steps:

[0032] Step S1: perform container detection and metadata collection, and dynamically maintain existing information;

[0033] Step S2: Based on the obtained container information, a corresponding eBPF program is created for each container with network functions, and the kernel eBPF program captures the container traffic data;

[0034] Step S3: passing the network data packet information captured by the kernel eBPF program from the kernel space to the user space;

[0035] Step S4: The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules input by the user, converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring.

[0036] Preferably, in step S1:

[0037] Perform container detection and metadata collection, use the Docker tool set to collect information about containers that are running and have network functions on the current host, and perform container lifecycle detection based on the Docker events mechanism to dynamically maintain existing information;

[0038] The method for detecting container information is that after the system is started, the docker client development library is used to communicate with the dockerd daemon on the host to obtain the container information on the current host, filter out the running container information with network functions, and obtain the information of each container according to the container identification ID, including the container name, network mode, network to which it belongs, and veth pair virtual network device information, and use these containers as the list of containers to be monitored in the initial state; during the operation of the system, there is an independent listening coroutine, which obtains a pipeline for storing container event information through the docker events mechanism, and filters out event information that will affect the container network environment on the current host from the pipeline, and dynamically changes the list of containers to be monitored according to the information, and sends signals to other modules to trigger the execution of subsequent steps.

[0039] Preferably, in step S2:

[0040] Based on the obtained container information, a corresponding eBPF program is created for each container with network functions and compiled to generate BPF bytecode, which is then loaded into the kernel and connected to the hook point of the network stack of the container virtual network device.

[0041] The method for the kernel eBPF program to capture container traffic data is to generate xdp and tc type eBPF programs and connect them to the kernel network stack of the container virtual network device; the xdp type eBPF program acts on the bottom layer of the network stack. When the device driver processes the traffic data packet, the traffic data packet will pass through the hook point where xdp acts, and thus be captured by the xdp type eBPF program; after passing through the bottom layer of the network stack, the traffic data packet goes up layer by layer, undergoes more processing, and is captured by the tc type eBPF program at the third layer of the network stack.

[0042] Preferably, in step S3:

[0043] Through the map object mechanism provided by the eBPF technology, the network packet information captured by the kernel eBPF program is passed from the kernel space to the user space;

[0044] After the kernel eBPF program obtains the traffic data, it passes it to the user space through the LRU_HASH and ARRAY type map objects provided by eBPF. The user interaction module in the user space accesses the file descriptor of the map object to obtain the monitoring data, and then formats the monitoring data and displays it on the command line interface.

[0045] Preferably, in step S4:

[0046] The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules entered by the user. It then converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring.

[0047] The implementation method of user-defined rules is to change the eBPF program related to a specific container in the kernel and modify the return value of the hook function. When the user enters the rule, the rule needs to meet the preset format, which is parsed by the user interaction module and triggers the update behavior of the eBPF program management module. The eBPF program management module then generates, loads, unloads and updates the kernel eBPF program according to the rule content, completes the implementation of the custom rules, and intervenes in the traffic interaction behavior of a specific container.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention is based on eBPF technology, which is an emerging Linux kernel technology that is easy to use and highly efficient. Since the eBPF program works directly in the kernel, the transmission path from receiving to capturing data traffic is shorter in terms of traffic monitoring, and the system response speed is also faster;

[0050] 2. In view of the widespread cloud-native scenarios today, the present invention performs traffic monitoring on containers rather than hosts, with finer monitoring granularity, and provides more specific information for subsequent possible operations. Therefore, the location process for specific problems in the subsequent process will be faster and more effective;

[0051] 3. The scope of the container concerned by the present invention is limited to the single entity of the host. Compared with the existing container traffic monitoring system that targets a container cluster composed of multiple nodes, the system provided by the present invention has the advantages of being lightweight and easy to deploy;

[0052] 4. The present invention automatically detects changes in container information of the current host, and automatically maintains the currently running eBPF program according to changes in container objects, thereby reducing the manual maintenance of eBPF program code operations, and the system is convenient, fast, simple and effective to use;

[0053] 5. In addition to simple monitoring and data display functions, the system proposed in the present invention also provides a user-defined rule function; users can enter rules that conform to specific patterns to perform customized intervention operations on the network traffic interaction behavior of the container, thereby realizing traffic management operations beyond monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0055] Figure 1 It is a flow chart of the host-side lightweight container traffic monitoring method based on eBPF of the present invention;

[0056] Figure 2 This is a structural diagram of the host-side lightweight container traffic monitoring system based on eBPF of the present invention. DETAILED DESCRIPTION

[0057] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0058] Embodiment 1;

[0059] The present invention relates to network security, container virtualization, traffic analysis, and Linux system kernel fields. The present invention provides a host-side lightweight container traffic monitoring method and system based on eBPF. The method and system can perform lightweight host-side container granularity traffic monitoring based on eBPF, an emerging Linux kernel technology. Specifically, container detection and metadata collection are first performed, and the container information that is in a running state and has network functions on the current host is collected using the docker tool set, and the container life cycle detection is performed based on the docker events mechanism to dynamically maintain the existing information; then, according to the obtained container information, a corresponding eBPF program is created for each container with network functions and compiled to generate BPF bytecode, which is then loaded into the kernel and connected to the hook point of the network stack of the container virtual network device; through the map object mechanism provided by the eBPF technology, the network data packet information captured by the kernel eBPF program is transferred from the kernel space to the user space; the user space displays the network traffic monitoring information of the container granularity, and accepts the traffic control rules input by the user, and then the rules are converted into the execution logic of the corresponding eBPF program in the kernel and the eBPF program is updated to achieve further traffic monitoring.

[0060] According to a host-side lightweight container traffic monitoring method based on eBPF provided by the present invention, Figure 1-Figure 2 As shown, the execution includes:

[0061] Step S1: perform container detection and metadata collection, and dynamically maintain existing information;

[0062] Specifically, in step S1:

[0063] Perform container detection and metadata collection, use the Docker tool set to collect information about containers that are running and have network functions on the current host, and perform container lifecycle detection based on the Docker events mechanism to dynamically maintain existing information;

[0064] The method for detecting container information is that after the system is started, the docker client development library is used to communicate with the dockerd daemon on the host to obtain the container information on the current host, filter out the running container information with network functions, and obtain the information of each container according to the container identification ID, including the container name, network mode, network to which it belongs, and veth pair virtual network device information, and use these containers as the list of containers to be monitored in the initial state; during the operation of the system, there is an independent listening coroutine, which obtains a pipeline for storing container event information through the docker events mechanism, and filters out event information that will affect the container network environment on the current host from the pipeline, and dynamically changes the list of containers to be monitored according to the information, and sends signals to other modules to trigger the execution of subsequent steps.

[0065] Step S2: Based on the obtained container information, a corresponding eBPF program is created for each container with network functions, and the kernel eBPF program captures the container traffic data;

[0066] Specifically, in step S2:

[0067] Based on the obtained container information, a corresponding eBPF program is created for each container with network functions and compiled to generate BPF bytecode, which is then loaded into the kernel and connected to the hook point of the network stack of the container virtual network device.

[0068] The method for the kernel eBPF program to capture container traffic data is to generate xdp and tc type eBPF programs and connect them to the kernel network stack of the container virtual network device; the xdp type eBPF program acts on the bottom layer of the network stack. When the device driver processes the traffic data packet, the traffic data packet will pass through the hook point where xdp acts, and thus be captured by the xdp type eBPF program; after passing through the bottom layer of the network stack, the traffic data packet goes up layer by layer, undergoes more processing, and is captured by the tc type eBPF program at the third layer of the network stack.

[0069] Step S3: passing the network data packet information captured by the kernel eBPF program from the kernel space to the user space;

[0070] Specifically, in step S3:

[0071] Through the map object mechanism provided by the eBPF technology, the network packet information captured by the kernel eBPF program is passed from the kernel space to the user space;

[0072] After the kernel eBPF program obtains the traffic data, it passes it to the user space through the LRU_HASH and ARRAY type map objects provided by eBPF. The user interaction module in the user space accesses the file descriptor of the map object to obtain the monitoring data, and then formats the monitoring data and displays it on the command line interface.

[0073] Step S4: The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules input by the user, converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring.

[0074] Specifically, in step S4:

[0075] The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules entered by the user. It then converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring.

[0076] The implementation method of user-defined rules is to change the eBPF program related to a specific container in the kernel and modify the return value of the hook function. When the user enters the rule, the rule needs to meet the preset format, which is parsed by the user interaction module and triggers the update behavior of the eBPF program management module. The eBPF program management module then generates, loads, unloads and updates the kernel eBPF program according to the rule content, completes the implementation of the custom rules, and intervenes in the traffic interaction behavior of a specific container.

[0077] Embodiment 2:

[0078] Embodiment 2 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0079] The present invention also provides a host-side lightweight container flow monitoring system based on eBPF. The host-side lightweight container flow monitoring system based on eBPF can be implemented by executing the process steps of the host-side lightweight container flow monitoring method based on eBPF, that is, those skilled in the art can understand the host-side lightweight container flow monitoring method based on eBPF as a preferred implementation of the host-side lightweight container flow monitoring system based on eBPF.

[0080] According to the present invention, a host-side lightweight container traffic monitoring system based on eBPF is provided, comprising:

[0081] Container information management module: collects and automatically maintains container information;

[0082] Specifically, in the container information management module:

[0083] Runs in user space; collects container information in the preprocessing phase after system startup, detects containers running in the current host during system startup, collects container-related information including virtual network device names, filters out containers without network functions, determines monitoring objects, and obtains metadata required for monitoring;

[0084] The container information collection in the preprocessing stage focuses on containers that have network functions and are in operation. The collected information fields are the container ID, container name, container virtual network device identification information, the network type used by the container, and the IP address of the container in its network isolation environment.

[0085] During system operation, the system continuously monitors container life state change events, dynamically maintains the information of the containers that need to be monitored, and automatically maintains the container information to ensure that the current container information set is consistent with the current host environment.

[0086] During the system operation phase, the docker events mechanism is used to obtain the pipeline containing docker container events, and a coroutine is started to continuously monitor the event information in the pipeline, filtering out key events including container start, stop, and creation and connection of docker custom networks;

[0087] The container information management module uses the Docker client development library to collect container information and captures container lifecycle change information through the Docker events mechanism, thereby maintaining the container information that needs to be monitored and guiding the subsequent behavior of the system.

[0088] The docker events mechanism exists in the form of a pipeline. The container status change information transmitted in the pipeline includes network connection and disconnection, container start and stop, and volume mounting and unmounting. After filtering out information that is not related to changes in the container network environment, the remaining information is of reference significance for container traffic monitoring.

[0089] Kernel eBPF module: BPF program executed in the kernel, obtains data flow information and passes it to user space;

[0090] Specifically, in the kernel eBPF module:

[0091] It runs in kernel space and runs in the form of bytecode in the eBPF virtual machine located in the Linux kernel. It focuses on the network stack of the container virtual network device, obtains traffic information at different network stack levels of the virtual network device through different types of eBPF programs loaded, and uses the eBPF map mechanism as the transmission medium to transfer the traffic information captured in the kernel space from the kernel space to the user space.

[0092] The kernel eBPF module contains one or more eBPF programs running in the kernel virtual machine. Each eBPF program corresponds to a monitored running container. The eBPF program types in the module include xdp and tc, which are used to capture information about network traffic at different layers of the network stack.

[0093] For the data traffic captured by the kernel eBPF program, the system focuses on the source IP address and destination IP address of the traffic data, and combines it with the IP address of the container in its own network isolation environment, and displays it to the user. It also obtains other fields of the data traffic information based on the custom rules entered by the user.

[0094] eBPF program management module: cooperates with the container information management module and the user interaction module to manage the kernel eBPF program, extracts the acquired data flow information and passes it to the user interaction module;

[0095] Specifically, in the eBPF program management module:

[0096] Runs in user space, and manages kernel eBPF programs in cooperation with the container information management module and the user interaction module according to user operations and the addition and reduction of containers. The management work includes loading, unloading, and updating operations of eBPF programs.

[0097] Extract the captured traffic data from the map object owned by the existing eBPF program and pass it to the user interaction module;

[0098] The automatic loading and unloading operations of the eBPF program occur as the monitored container object changes. When a new container is detected to be created, the new eBPF program will be loaded into the kernel. When a monitored container is detected to be stopped, the corresponding eBPF program will be unloaded.

[0099] User interaction module: accepts input container traffic control rules and converts them into eBPF program logic to implement system functions.

[0100] Specifically, in the user interaction module:

[0101] It runs in user space and provides users with different command options in the form of command lines, including data display and rule operation instructions. Users enter instructions in the command line to view container network traffic monitoring data and add and delete traffic control rules between containers. The user interaction module is responsible for accepting container traffic control rules entered by users and converting them into eBPF program logic in the kernel to realize system functions.

[0102] The user interaction module provides functions including container network traffic information display and custom rule input. By reading the map structure of the eBPF program in the kernel, the container traffic data information captured by the eBPF program is obtained, and then it is displayed to the user after formatting. It provides rule forms for blocking or allowing network traffic interaction between specific containers. The user inputs the rules, which are then parsed and converted into specific logic of the eBPF program. The relevant rules are implemented in the kernel, which are specifically reflected in the different return values ​​of the hook functions in the eBPF program.

[0103] Embodiment 3:

[0104] Embodiment 3 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0105] A host-side lightweight container traffic monitoring method and system based on eBPF, characterized in that the eBPF technology is used to implement container-granular traffic monitoring to reduce the occurrence of security issues in a single-host container cluster scenario, including a container information management module, an eBPF program module running in the kernel, an eBPF program management module, and a user interaction module:

[0106] Container information management module: Detect the containers running in the current host during the system startup phase, collect relevant information such as the names of the container's virtual network devices, and filter out containers that do not have network functions. During the system operation, continuously monitor container life state change events and dynamically maintain the information of the containers that need to be monitored.

[0107] Kernel eBPF module: The BPF program executed in the kernel focuses on the network stack of each container virtual network device, captures data flow information passing through the virtual network device, and passes this information from kernel space to user space.

[0108] eBPF program management module: automatically loads, unloads, updates, and other operations of eBPF programs based on user operations and the increase and decrease of containers to realize system functions.

[0109] User interaction module: Located in the user space, it is responsible for accepting container traffic control rules input by users and converting them into eBPF program logic in the kernel to implement system functions.

[0110] The container information management module uses the Docker client development library to collect container information and captures container lifecycle change information through Docker's events mechanism, thereby maintaining the container information that needs to be monitored and guiding the subsequent behavior of the system.

[0111] Filtering of docker events information. The docker events mechanism exists in the form of a pipeline. The container status change information transmitted in the pipeline includes network connection and disconnection, container start and stop, volume mounting and unmounting, etc. After filtering out information that is not related to changes in the container network environment, the remaining information is of reference significance for container traffic monitoring.

[0112] The kernel eBPF module contains one or more eBPF programs running in the kernel virtual machine. Each eBPF program corresponds to a monitored running container. The module includes eBPF programs such as xdp and tc, which are used to capture information about network traffic at different layers of the network stack.

[0113] The eBPF program management module is responsible for the automatic loading and unloading of eBPF programs. These operations occur as the monitored container objects change. When a new container is detected to be created, a new eBPF program will be loaded into the kernel. When a monitored container is detected to be stopped, the corresponding eBPF program will be unloaded.

[0114] The user interaction module provides functions such as displaying container network traffic information and inputting custom rules. By reading the map structure of the eBPF program in the kernel, the container traffic data information captured by the eBPF program can be obtained, and then formatted and displayed to the user in a user-friendly form. At the same time, it also provides rules to block or allow network traffic interaction between specific containers. The user inputs the rules, which are then parsed and converted into the specific logic of the eBPF program. The relevant rules are implemented in the kernel, which are specifically reflected in the different return values ​​of the hook function in the eBPF program.

[0115] Embodiment 4:

[0116] Embodiment 4 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0117] The method and system proposed in the present invention are based on the eBPF technology of the Linux kernel, and are combined with technical principles and means such as the underlying principle of the container and network traffic analysis to realize lightweight host-side container traffic monitoring. First, in the preprocessing stage after the system is started, the container information in the current host in the running state is obtained through the docker client development library, the containers without network functions are filtered out, and then the virtual network device identification information of the remaining containers is obtained. Then, a corresponding kernel eBPF program with monitoring function is created for the virtual network device of each container, and the kernel network stack connected to the virtual network device is loaded. Finally, the traffic monitoring information transmitted by the eBPF program in the kernel space is obtained in the user space and displayed to the user. At the same time, according to the rules entered by the user, the update of the eBPF program corresponding to the kernel is executed to implement further management operations such as interception of specific traffic.

[0118] To achieve the above objectives, the present invention adopts the following technical solutions.

[0119] The present invention proposes a host-side lightweight container traffic monitoring system based on eBPF. The system comprises four main modules, namely, a container information management module, a kernel eBPF module, an eBPF program management module, and a user interaction module.

[0120] Container information management module: runs in user space, and its operation logic consists of two parts. First, it performs initial container information collection in the preprocessing phase after system startup to determine the monitoring object and obtain the metadata required for monitoring. Second, it performs automatic maintenance of container information during the system operation phase to ensure that the current container information set is consistent with the current host environment.

[0121] Preferably, the container information collection in the preprocessing stage mainly focuses on containers that have network functions and are in operation, and the collected information fields are the container's identification ID, the container's name, the container's virtual network device identification information, the network type used by the container, and the container's IP address in its network isolation environment.

[0122] Preferably, during the system operation phase, the docker events mechanism is used to obtain a pipeline containing docker container events, and a coroutine is started to continuously monitor the event information in the pipeline to filter out key events including container start, stop, creation and connection of docker custom networks, etc.

[0123] Kernel eBPF module: runs in kernel space and runs in the form of bytecode in the eBPF virtual machine located in the Linux kernel. It mainly focuses on the network stack of the container virtual network device and obtains traffic information at different network stack levels through different types of loaded eBPF programs. It also uses the eBPF map mechanism as the transmission medium to conveniently and accurately pass the traffic information captured in the kernel space to the program in the user space.

[0124] Preferably, for the data traffic captured by the kernel eBPF program, the system mainly focuses on the source IP address and destination IP address of the traffic data, and combines it with the IP address of the container in the network isolation environment to which it belongs, and displays it to the user. Other fields of the data traffic information are obtained according to the custom rules entered by the user.

[0125] eBPF program management module: runs in user space, and its operation logic consists of two parts. First, it cooperates with the container information management module and the user interaction module to manage the kernel eBPF program. The management work mainly includes loading, unloading and updating operations of the eBPF program. Second, it extracts the captured traffic data from the map object owned by the existing eBPF program and passes it to the user interaction module.

[0126] User interaction module: runs in user space and provides users with different command options in the form of command lines, mainly including data display and rule operation instructions. Users can enter instructions in the command line to view container network traffic monitoring data, and can also add and delete traffic control rules between containers.

[0127] Embodiment 5:

[0128] Embodiment 5 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0129] The structure diagram of a host-side lightweight container traffic monitoring system based on eBPF provided by a preferred embodiment of the present invention is as follows: Figure 2 The host-side lightweight container traffic monitoring system based on eBPF provided by the present invention comprises four main functional modules, namely, a container information management module, a kernel eBPF module, an eBPF program management module and a user interaction module.

[0130] Among them, the container information management module plays a role first. In the preprocessing stage after the system is started, it interacts with the dockerd daemon through the docker client development library to obtain the container information in the current host, filter out containers without network functions, and then obtain the virtual network device identification information of the remaining containers. Then the eBPF program management module creates the corresponding eBPF program according to the monitored container object, compiles and loads it into the kernel, connects to the virtual network device of the container for monitoring, and forms a kernel eBPF module. The kernel eBPF module runs in the kernel eBPF virtual machine, focusing on the hook points at different levels of the network stack of the container virtual network device. According to the different network levels where the hook points are located, the eBPF programs contained in this module can be divided into xdp and tc types. During the operation of the system, the user interaction module completes continuous interaction with the user, including the display of traffic information obtained by monitoring and the input of user-defined rules. The input of user-defined rules will cause the eBPF program management module to update the running eBPF program.

[0131] Specifically, the container information collection in the preprocessing stage mainly focuses on containers that have network functions and are in running state. The collected information fields are the container's identification ID, the container's name, the container's virtual network device identification information, the network type used by the container, and the container's IP address in its network isolation environment.

[0132] Specifically, during the system operation phase, the docker events mechanism is used to obtain the pipeline containing docker container events, and a coroutine is started to continuously monitor the event information in the pipeline, filtering out key events including container start, stop, creation and connection of docker custom networks, etc.

[0133] Specifically, for the data traffic captured by the kernel eBPF program, the system focuses on the source IP address and destination IP address of the traffic data, and combines it with the IP address of the container in its own network isolation environment to display it to the user. Other fields of data traffic information are obtained based on the custom rules entered by the user.

[0134] The present invention provides a host-side lightweight container traffic monitoring system based on eBPF, whose operation includes processes such as container information detection, eBPF program generation, compilation and loading, data transmission and display, rule parsing and implementation, etc., which can realize host-side container traffic monitoring for cloud scenarios, and realize the effect of container-granular traffic data monitoring and intervention container traffic interaction. The host-side lightweight container traffic monitoring system based on eBPF provided by the present invention can be implemented through the step flow of the host-side lightweight container traffic monitoring method based on eBPF. Those skilled in the art can understand the host-side lightweight container traffic monitoring system method based on eBPF as a preferred example of the host-side lightweight container traffic monitoring system based on eBPF.

[0135] The preferred examples are further described below.

[0136] First, the method of container information detection is to communicate with the dockerd daemon on the host through the docker client development library after the system is started, obtain the container information on the current host, filter out the running container information with network functions, and then obtain the information of each container according to the container identification ID, including the container name, network mode, network to which it belongs, and veth pair virtual network device information, and then use these containers as the list of containers to be monitored in the initial state. During the operation of the system, there is an independent monitoring coroutine, which obtains a pipeline for storing container event information through the docker events mechanism, and filters out event information that will affect the container network environment on the current host from the pipeline, and dynamically changes the list of containers to be monitored based on this information, and sends signals to other modules to trigger the execution of subsequent steps.

[0137] Secondly, the kernel eBPF program captures container traffic data by generating xdp and tc type eBPF programs and connecting them to the kernel network stack of the container virtual network device. The xdp type eBPF program acts on the bottom layer of the network stack. After the device driver processes the traffic data packet, the traffic data packet will pass through the hook point where xdp acts, and thus be captured by the xdp type eBPF program. After passing through the bottom layer of the network stack, the traffic data packet goes up layer by layer, undergoes more processing, and is captured by the tc type eBPF program at the third layer of the network stack. The two-level eBPF program can obtain the main information of the traffic data and has a shorter traffic capture response time.

[0138] After the kernel eBPF program obtains the traffic data, it is mainly passed to the user space through the LRU_HASH and ARRAY type map objects provided by eBPF. Both the LRU_HASH type and the ARRAY type map have project data restrictions, so the system will not cause a significant performance drop due to too many containers. The user interaction module in the user space accesses the file descriptor of the map object to obtain the monitoring data, and then formats the monitoring data and displays it in a user-friendly form on the command line interface.

[0139] Finally, the implementation method of user-defined rules is to change the eBPF program related to a specific container in the kernel and modify the return value of the hook function. Taking the xdp type eBPF program as an example, if the hook function returns XDP_DROP, the data packet will be discarded, and if it returns XDP_PASS, the data packet will pass normally and be passed to the subsequent layers of the network stack for further processing. When the user enters the rules, the rules need to meet the pre-set format, which will be parsed by the user interaction module and trigger the update behavior of the eBPF program management module. The eBPF program management module then generates, loads, unloads, and updates the kernel eBPF program according to the content of the rules, and finally completes the implementation of the custom rules, intervening in the traffic interaction behavior of a specific container.

[0140] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0141] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A host-side lightweight container traffic monitoring system based on eBPF, characterized in that: include: Container information management module: collects and automatically maintains container information; Kernel eBPF module: BPF program executed in the kernel, obtains data flow information and passes it to user space; eBPF program management module: cooperates with the container information management module and the user interaction module to manage the kernel eBPF program, extracts the acquired data flow information and passes it to the user interaction module; User interaction module: accepts input container traffic control rules and converts them into eBPF program logic to implement system functions; In the container information management module: Runs in user space; collects container information in the preprocessing phase after system startup, detects containers running in the current host during system startup, collects container-related information including virtual network device names, filters out containers without network functions, determines monitoring objects, and obtains metadata required for monitoring; The container information collection in the preprocessing stage focuses on containers that have network functions and are in operation. The collected information fields are the container ID, container name, container virtual network device identification information, the network type used by the container, and the IP address of the container in its network isolation environment. During system operation, the system continuously monitors container life state change events, dynamically maintains the information of the containers that need to be monitored, and automatically maintains the container information to ensure that the current container information set is consistent with the current host environment. During the system operation phase, the docker events mechanism is used to obtain the pipeline containing docker container events, and a coroutine is started to continuously monitor the event information in the pipeline, filtering out key events including container start, stop, and creation and connection of docker custom networks; The container information management module uses the Docker client development library to collect container information and captures container lifecycle change information through the Docker events mechanism, thereby maintaining the container information that needs to be monitored and guiding the subsequent behavior of the system. The docker events mechanism exists in the form of a pipeline. The container status change information transmitted in the pipeline includes network connection and disconnection, container start and stop, and volume mounting and unmounting. After filtering out information that is not related to changes in the container network environment, the remaining information is of reference significance for container traffic monitoring. In the kernel eBPF module: It runs in kernel space and runs in the form of bytecode in the eBPF virtual machine located in the Linux kernel. It focuses on the network stack of the container virtual network device, obtains traffic information at different network stack levels of the virtual network device through different types of eBPF programs loaded, and uses the eBPF map mechanism as the transmission medium to transfer the traffic information captured in the kernel space from the kernel space to the user space. The kernel eBPF module contains one or more eBPF programs running in the kernel virtual machine. Each eBPF program corresponds to a monitored running container. The eBPF program types in the module include xdp and tc, which are used to capture information about network traffic at different layers of the network stack. For the data traffic captured by the kernel eBPF program, the system focuses on the source IP address and destination IP address of the traffic data, and combines it with the IP address of the container in its own network isolation environment to display it to the user. It also obtains other fields of the data traffic information based on the custom rules entered by the user. In the eBPF program management module: Runs in user space, and manages kernel eBPF programs in cooperation with the container information management module and the user interaction module according to user operations and the addition and reduction of containers. The management work includes loading, unloading, and updating operations of eBPF programs. Extract the captured traffic data from the map object owned by the existing eBPF program and pass it to the user interaction module; The automatic loading and unloading of eBPF programs occurs as the monitored container objects change. When a new container is detected to be created, a new eBPF program will be loaded into the kernel. When a monitored container is detected to be stopped, the corresponding eBPF program will be unloaded. In the user interaction module: It runs in user space and provides users with different command options in the form of command lines, including data display and rule operation instructions. Users enter instructions in the command line to view container network traffic monitoring data and add and delete traffic control rules between containers. The user interaction module is responsible for accepting container traffic control rules entered by users and converting them into eBPF program logic in the kernel to realize system functions. The user interaction module provides functions including container network traffic information display and custom rule input. By reading the map structure of the eBPF program in the kernel, the container traffic data information captured by the eBPF program is obtained, and then it is displayed to the user after formatting. It provides rule forms for blocking or allowing network traffic interaction between specific containers. The user inputs the rules, which are then parsed and converted into specific logic of the eBPF program. The relevant rules are implemented in the kernel, which are specifically reflected in the different return values ​​of the hook functions in the eBPF program.

2. A host-side lightweight container traffic monitoring method based on eBPF, characterized in that: The eBPF-based host-side lightweight container traffic monitoring system of claim 1 is used to perform the following steps: Step S1: perform container detection and metadata collection, and dynamically maintain existing information; Step S2: Based on the obtained container information, a corresponding eBPF program is created for each container with network functions, and the kernel eBPF program captures the container traffic data; Step S3: passing the network data packet information captured by the kernel eBPF program from the kernel space to the user space; Step S4: The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules input by the user, converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring.

3. The method for monitoring host-side lightweight container traffic based on eBPF according to claim 2 is characterized in that: In step S1: Perform container detection and metadata collection, use the Docker tool set to collect information about containers that are running and have network functions on the current host, and perform container lifecycle detection based on the Docker events mechanism to dynamically maintain existing information; The method for detecting container information is that after the system is started, the docker client development library is used to communicate with the dockerd daemon on the host to obtain the container information on the current host, filter out the running container information with network functions, and obtain the information of each container according to the container identification ID, including the container name, network mode, network to which it belongs, and veth pair virtual network device information, and use these containers as the list of containers to be monitored in the initial state; during the operation of the system, there is an independent listening coroutine, which obtains a pipeline for storing container event information through the docker events mechanism, and filters out event information that will affect the container network environment on the current host from the pipeline, and dynamically changes the list of containers to be monitored according to the information, and sends signals to other modules to trigger the execution of subsequent steps.

4. The method for monitoring host-side lightweight container traffic based on eBPF according to claim 2 is characterized in that: In step S2: Based on the obtained container information, a corresponding eBPF program is created for each container with network functions and compiled to generate BPF bytecode, which is then loaded into the kernel and connected to the hook point of the network stack of the container virtual network device. The method for the kernel eBPF program to capture container traffic data is to generate xdp and tc type eBPF programs and connect them to the kernel network stack of the container virtual network device; the xdp type eBPF program acts on the bottom layer of the network stack. When the device driver processes the traffic data packet, the traffic data packet will pass through the hook point where xdp acts, and thus be captured by the xdp type eBPF program; after passing through the bottom layer of the network stack, the traffic data packet goes up layer by layer, undergoes more processing, and is captured by the tc type eBPF program at the third layer of the network stack.

5. The method for monitoring host-side lightweight container traffic based on eBPF according to claim 2, characterized in that: In step S3: Through the map object mechanism provided by eBPF technology, the network packet information captured by the kernel eBPF program is passed from kernel space to user space; After the kernel eBPF program obtains the traffic data, it passes it to the user space through the LRU_HASH and ARRAY type map objects provided by eBPF. The user interaction module in the user space accesses the file descriptor of the map object to obtain the monitoring data, and then formats the monitoring data and displays it on the command line interface.

6. The method for monitoring host-side lightweight container traffic based on eBPF according to claim 2, characterized in that: In step S4: The user space displays the network traffic monitoring information at the container granularity, and accepts the traffic control rules entered by the user. It then converts the rules into the execution logic of the corresponding eBPF program in the kernel and updates the eBPF program to achieve further traffic monitoring. The implementation method of user-defined rules is to change the eBPF program related to a specific container in the kernel and modify the return value of the hook function. When the user enters the rule, the rule needs to meet the preset format, which is parsed by the user interaction module and triggers the update behavior of the eBPF program management module. The eBPF program management module then generates, loads, unloads and updates the kernel eBPF program according to the rule content, completes the implementation of the custom rules, and intervenes in the traffic interaction behavior of a specific container.

Images