Data processing method and system

Abstract

The embodiment of the present specification provides a data processing method and system, the data processing method is applied to a data processing system, comprising: a client generates to be processed network data based on an eBPF program, uploads the to be processed network data to a server, wherein the to be processed network data is used to determine network monitoring data; the server obtains target business application data according to the to be processed network data, generates network monitoring data according to the to be processed network data and the target business application data, and saves the network monitoring data, wherein the network monitoring data is used to analyze network state information of the target business application. The method provided in the embodiment of the present specification collects network data through eBPF, extracts to be processed network data used to obtain network monitoring data in a data packet, and uploads the to be processed network data to the server, the server finds target business application data corresponding to the target business application according to the to be processed network data, and enriches relevant target business information for subsequent network state analysis.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to a data processing method. Background Technology

[0002] With the development and application of virtualization technology and microservice architecture, various resource components such as virtual machines, containers, and load balancers, as well as small and cohesive distributed microservice applications, have brought about more complex network transmission and application call relationships. In this scenario, in order to ensure and optimize the interaction between applications, operations and maintenance personnel need to understand the network connectivity and performance of each application. Topology discovery can automatically detect and obtain the connection relationships between various resource components and applications in the environment, while network monitoring can provide network traffic and other indicator data to help operations and maintenance personnel quickly locate network problems.

[0003] Typically, network packet capture tools collect information such as IP addresses, ports, and network traffic metrics, which can indicate the network status of a specific resource component. However, to observe network connectivity and performance at the application level, it is necessary to supplement and enhance the raw network data collected. For example, if an IP address is used by a container, the application data corresponding to that container needs to be added to the network data. How to supplement the network data with application data has become a pressing issue for technical personnel. Summary of the Invention

[0004] In view of the above, embodiments of this specification provide a data processing method. One or more embodiments of this specification also relate to a data processing system, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a data processing method is provided, applied to a data processing system, the data processing system including a client and a server, comprising:

[0006] The client generates network data to be processed based on the eBPF program and uploads the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data;

[0007] The server obtains the target business application data corresponding to the network data to be processed based on the network data to be processed, generates network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and saves the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

[0008] According to a second aspect of the embodiments of this specification, a

[0009] A data processing system includes a client and a server; among which,

[0010] The client is configured to generate network data to be processed based on an eBPF program and upload the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data;

[0011] The server is configured to obtain target business application data corresponding to the network data to be processed based on the network data to be processed, generate network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and save the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

[0012] According to a third aspect of the embodiments of this specification, a data processing method is provided, applied to a server, comprising:

[0013] Receive network data to be processed sent by the client;

[0014] Obtain the target business application data corresponding to the network data to be processed based on the network data to be processed;

[0015] Network monitoring data corresponding to the network data to be processed is generated based on the network data to be processed and the target business application data, wherein the network monitoring data is used to analyze the network status information of the target business application;

[0016] Save the network monitoring data.

[0017] According to a fourth aspect of the embodiments of this specification, a computing device is provided, comprising:

[0018] Memory and processor;

[0019] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the above-described data processing method.

[0020] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of the data processing method described above.

[0021] According to a sixth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described data processing method.

[0022] This specification provides a data processing method in one embodiment, applied to a data processing system. The data processing system includes a client and a server. The method includes: the client generating network data to be processed based on an eBPF program and uploading the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data; the server obtaining target business application data corresponding to the network data to be processed based on the network data to be processed, generating network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and saving the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

[0023] The method provided in this specification collects network data through an eBPF program running in kernel mode and processes data packets based on the eBPF program running in kernel mode, reducing multiple context switches during packet capture. Data packets are processed directly in kernel mode, extracting the network data to be processed for obtaining network monitoring data, and uploading it to the server. The server uses the network data to find the target business application data corresponding to the target business application and combines it with the network data to be processed to form network detection data, enriching the relevant target business information for subsequent network status analysis of the target business application. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating a data processing method provided in one embodiment of this specification;

[0025] Figure 2 This is a schematic diagram of the structure of a data processing method provided in one embodiment of this specification;

[0026] Figure 3 This is a flowchart illustrating the processing procedure of a data processing method provided in one embodiment of this specification.

[0027] Figure 4 This is a schematic diagram of the structure of a data processing system provided in one embodiment of this specification;

[0028] Figure 5 This is a flowchart illustrating a data processing method applied to a server, as provided in one embodiment of this specification.

[0029] Figure 6 This is a schematic diagram of the structure of a data processing device provided in one embodiment of this specification;

[0030] Figure 7 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0031] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0032] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0033] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0035] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0036] Classic deployment: Applications and services are deployed to traditional virtual machine or physical machine environments, and business operations are typically run as processes.

[0037] Cloud-native deployment: Application deployment and management based on Kubernetes, where services typically run in containers.

[0038] eBPF, short for Extended Berkeley Packet Filter, is a technology that allows sandboxed programs to run within the operating system kernel. It enables dynamic programming of the kernel to achieve efficient networking, observability, and security features.

[0039] Metadata: or metadata, provides information about other data, used to describe, manage, and statistically analyze other data. In cloud service scenarios, metadata typically includes information such as tenant information for resources like clusters.

[0040] With the development and application of virtualization technology and microservice architecture, various resource components such as virtual machines, containers, and load balancers, as well as small and cohesive distributed microservice applications, have brought about more complex network transmission and application call relationships. In this scenario, in order to ensure and optimize the interaction between applications, operations and maintenance personnel need to understand the network connections and performance of each application. Topology discovery can automatically detect and obtain the connection relationships between various resource components and applications in the environment, while network monitoring can provide indicator data such as network traffic to help operations and maintenance personnel quickly locate network problems.

[0041] In traditional network packet capture tools, data packets need to be copied multiple times before reaching the application. For example, the data packet first needs to be copied from the network card driver to the kernel buffer, and then from the kernel buffer to the user-space application buffer. During this process, the data packet undergoes multiple context switches, and some unnecessary information in the data packet is also copied, resulting in significant performance overhead.

[0042] During this process, the packet capture tool issues multiple capture commands, resulting in multiple context switches. Since the packet capture tool runs in user space, the multiple capture commands it issues throughout the network packet capture process will interrupt the system kernel multiple times, generating multiple system calls, which in turn will lead to multiple context switches, resulting in significant performance overhead.

[0043] Network packet capture tools can collect information such as IP addresses, ports, and network traffic metrics to indicate the network status of a resource component. However, to observe network connectivity and performance at the application level, it is necessary to supplement and enhance the raw network data. For example, by associating metadata such as which IP address is used by which container, or which container belongs to which application, application and other business information can be added to the network data.

[0044] The following problems exist in the solutions for business application network monitoring and topology discovery:

[0045] 1. When using traditional technical tools to collect network data, the data packets need to undergo multiple memory copies and context switches during the overall packet transfer process before reaching the application. During this process, some unnecessary information in the data packets will also be copied, which will result in significant performance overhead.

[0046] 2. Current network monitoring and topology discovery solutions can collect network connection quadruple (source IP, source port, destination IP, destination port) information, network traffic information, etc., and can display the collected network data as network monitoring data and connection topology for various resources. However, this processing solution lacks relevant business application information and cannot display network monitoring and topology relationships at the application level.

[0047] Based on this, a data processing method is provided in this specification. This specification also relates to a data processing system, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0048] See Figure 1 , Figure 1 A flowchart of a data processing method according to an embodiment of this specification is shown. The method is applied to a data processing system, which includes a client and a server. The method specifically includes the following steps.

[0049] Step 102: The client generates network data to be processed based on the eBPF program and uploads the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data.

[0050] Extended Berkeley Packet Filter (eBPF) is a virtual machine that runs within the Linux kernel. It evolved from Berkeley Packet Filter (BPF) and was initially used primarily for network packet filtering. However, with technological advancements, eBPF's functionality has expanded far beyond network packet filtering; it can now be used for observation and control tasks across many systems and networks.

[0051] In the embodiments provided in this specification, the client generates network data to be processed based on the eBPF program and uploads the network data to the server. Specifically, the network data to be processed refers to the network data subsequently used to determine network monitoring data and thus perform network analysis. In practical applications, the network data to be processed specifically refers to the statistical data information obtained after processing by the eBPF program; the network data to be processed is obtained after processing the original network data. Furthermore, the network data to be processed includes source IP, source port, destination IP, destination port, process ID, packet size, and other data obtained after processing the original network data.

[0052] In traditional network packet capture tools, data packets need to be copied multiple times before reaching the application. For example, the data packet first needs to be copied from the network card driver to the kernel buffer, and then from the kernel buffer to the user-space application buffer. This process of copying all data packets incurs significant performance overhead.

[0053] Based on this, the client generates network data to be processed using the eBPF program and uploads the network data to be processed to the server, including:

[0054] The client generates network data to be processed based on the eBPF program and saves the network data to be processed in a preset storage location;

[0055] The network data to be processed is read from the preset storage location and uploaded to the server.

[0056] The main feature of eBPF is its ability to run custom programs within the kernel without modifying the kernel source code or loading kernel modules. This means users can define custom programs to collect and process data within the kernel, enabling deep observation and control of the system. Furthermore, eBPF's virtual machines use a specially designed security sandbox to ensure that running programs do not harm the system.

[0057] eBPF programs are typically compiled and loaded into the kernel by user-space tools. They can be attached to many types of kernel objects, such as system calls, network interfaces, and task switching. When these events occur, the eBPF programs are executed, allowing them to read and modify data in the kernel and even alter system behavior.

[0058] Furthermore, based on the eBPF program, network data to be processed is generated, and the network data to be processed is saved in a preset storage location, including:

[0059] In kernel mode, the initial network data is obtained based on the eBPF program, and the initial network data is parsed to generate network data to be processed;

[0060] The network data to be processed is stored in a preset storage location in the kernel mode;

[0061] Accordingly, reading the network data to be processed from the preset storage location includes:

[0062] The user-space agent reads the network data to be processed from the preset storage location.

[0063] In an operating system, program execution typically occurs in two different modes: kernel space and user space, also known as kernel mode and user mode. Kernel mode and user mode are the two main runtime environments in an operating system.

[0064] User mode is the normal running mode of a program. Most user programs (such as text editors, browsers, database applications, etc.) run in user mode. In user mode, programs cannot directly access the operating system kernel, hardware, or the memory space of other programs. They can only request the kernel to perform some operations that require special privileges by initiating system calls, such as reading and writing files, sending network data, etc.

[0065] Kernel mode, also known as system mode, is where the operating system kernel runs. In this mode, the kernel can directly access hardware and memory, performing tasks such as memory management, interrupt handling, and system call processing. When a user-mode program initiates a system call, the system switches to kernel mode. After the kernel completes the requested service, it switches back to user mode. This mode-switching mechanism is designed to protect system security and stability. By restricting the behavior of user-mode programs, malicious or erroneous code can be prevented from damaging the operating system kernel or other programs. When a program needs to perform operations with special privileges, it switches to kernel mode via a system call, allowing the kernel to complete the operation and ensuring the normal operation and security of the system.

[0066] Programs running in kernel mode and user mode have the following differences:

[0067] Permissions: Programs running in kernel mode have higher privileges. They can directly access hardware and kernel data structures, while user-space programs need to request services from the kernel through system calls. This means that programs running in kernel mode can do more things, but it also means greater risks, because a wrong operation may damage the entire operating system.

[0068] Performance: Programs running in kernel mode are generally faster than programs running in user mode because they can directly access hardware and kernel data structures without the overhead of system calls, which is very important for tasks that require high performance.

[0069] Security: User-mode programs run in a restricted environment and cannot directly access hardware or affect other programs, which provides a certain level of security for the operating system. Kernel-mode programs, on the other hand, need to be more careful because incorrect operations may cause the operating system to crash.

[0070] Therefore, when choosing between running programs in kernel mode or user mode, a trade-off must be made based on specific needs and risks. eBPF programs provide a secure mechanism for running custom programs in kernel mode, allowing users to enjoy the high performance of kernel mode without worrying about operating system security issues.

[0071] The eBPF program consists of two parts: kernel mode and user mode. The user-mode eBPF program loads the kernel-mode eBPF into the kernel, while the kernel-mode eBPF program generates network data to be processed based on network packets. The kernel-mode eBPF program acquires the initial network data during the network system call process. This initial network data includes kernel structures such as `sk_buff` and `socket`. The kernel-mode eBPF program can directly capture data packets within the kernel, reducing context switching operations and saving computational resources compared to packet capture tools running in user mode, thus reducing performance overhead.

[0072] Network data to be processed is obtained from initial network data. This network data is used to determine network monitoring data. In the method provided in the embodiments of this specification, relevant business application information is added, enriching network monitoring and topology relationships from the perspective of application information. Therefore, the network data to be processed needs to include information that can directly locate the corresponding business process.

[0073] In cloud-native scenarios, one container typically corresponds to one application. Therefore, based on the target IP in the network connection quadruple (source IP, source port, target IP, target port) reported by the collection agent, the corresponding target application can be located. Thus, the network data to be processed in cloud-native scenarios must at least include the target IP for subsequent location of the target application and acquisition of application information.

[0074] For classic deployment scenarios, directly applying cloud-native methods will result in the inability to locate the target application. In cloud-native scenarios, containers can be matched by IP address to find the corresponding application. However, in classic deployment scenarios, applications typically run as processes, and multiple applications on the host machine often communicate using the same IP address. In this case, IP information alone is insufficient to pinpoint the specific application. Therefore, the network data to be processed in classic deployment scenarios must at least include the process ID. The target application can then be located using the process ID to obtain application information.

[0075] Based on this, after obtaining the initial network data, the eBPF program can parse the initial network data to obtain the network data to be processed. For example, in the event of a network system call, network packet data will be input into the kernel protocol stack. The eBPF program can obtain the network packet data in the kernel protocol stack and parse the network data to be processed from it. Then, the network data to be processed is saved to a specified location and then transmitted to user space, reducing the amount of data during transmission and further reducing performance overhead.

[0076] In practical applications, at least the source IP, source port, destination IP, destination port, process ID, and packet size need to be obtained from network packet data to generate the network data to be processed. Specifically, this can be achieved by parsing network packet data to obtain the four-tuple information of source IP, source port, destination IP, and destination port carried in the network packet data. The operating system kernel also stores a port-process mapping table, which maintains the correspondence between port numbers and process IDs. Through this port-process mapping table, the process ID corresponding to the target port can be retrieved.

[0077] eBPF also supports a kernel data structure called "Maps," which can be used to store and share data. In the methods described in this specification, the default storage location specifically refers to eBPF Maps. eBPF programs can read and modify data in Maps, and user-space programs can also read and modify this data. This enables efficient data exchange between user-space programs and kernel-space eBPF programs. eBPF is a powerful tool that can be used to implement various system and network observation and control tasks.

[0078] In practical applications, the eBPF program acquires the network data to be processed for subsequent network analysis and saves the network data to be processed in a preset storage location (eBPF Maps).

[0079] Specifically, in kernel mode, initial network data is obtained based on the eBPF program, including:

[0080] In kernel mode, based on eBPF programs, initial network data is obtained through hook technology.

[0081] In practical applications, eBPF programs obtain initial network data based on hooking techniques. Hooking is a programming term that typically refers to altering or extending the behavior of an operating system, software component, or system by modifying, adding, or intercepting function calls, messages, or events. In some cases, it can also refer to low-level access to hardware devices. When one program (the target program) is running, another program (the hooking program) can set a hook to intercept certain function calls, messages, or events of the target program. When the hooked function is called, or the specified message or event occurs, control is transferred to the hooking program. The hooking program can choose to modify the parameters of these calls, messages, or events, prevent them, or add additional behavior without affecting the target program. Common applications of hooking techniques include debugging and reverse engineering, creating macros, automating tasks, and adding new functions or features.

[0082] The method described in this specification involves setting a hook point in the kernel protocol stack so that the eBPF program can obtain network packet data written to the kernel protocol stack using hooking technology. The kernel protocol stack is the target program mentioned above. In practical applications, network system calls may involve cross-host system calls or local system calls. When a network system call occurs, corresponding network packet data is written to the kernel protocol stack. The hooking program sets a hook point in the kernel protocol stack, and the eBPF program, through this hook point, can obtain the network packet data if it exists in the kernel protocol stack. It then parses the network packet data to obtain the network data to be processed carried within it. The network data to be processed is generated according to a preset data storage format and stored in the eBPF Maps in kernel mode.

[0083] In one specific implementation provided in this specification, using a cloud-native scenario as an example, if a business application needs to call POD1, then the network packet data related to POD1 will be added to the kernel protocol stack. The HOOK program obtains data information such as the source IP, source port, destination IP, destination port, and packet size from the network packet data from the kernel protocol stack, thereby generating network data to be processed.

[0084] In another specific implementation provided in this specification, a classic deployment scenario is used as an example for explanation. When an application needs to call process a, the network packet data related to this service call is added to the kernel protocol stack. The HOOK program obtains data information such as source IP, source port, destination IP, and destination port from the network packet data from the kernel protocol stack. Then, based on the destination port, it determines the process ID corresponding to the destination port through the port-process mapping table. Based on the source IP, source port, destination IP, destination port, process ID, and other information, it generates network data to be processed.

[0085] In practical applications, the preset storage location is located in kernel mode. The network data to be processed needs to be retrieved from the preset storage location in kernel mode. Furthermore, an agent program runs in user mode. The agent program running in user mode reads the network data to be processed from eBPF Maps.

[0086] In cloud-native scenarios, an Agent is typically a lightweight process or service deployed on each node. It is responsible for collecting and reporting information about that node, such as hardware status, system performance metrics, and application logs. This information is used to monitor and manage the entire cloud environment. The Agent's main tasks include data collection, event response, and command execution. Data collection refers to the Agent periodically collecting various information from the node, such as CPU usage, memory usage, disk I / O, and network traffic, and sending this data to the central monitoring system. Event response means that when certain specific events occur on the node (such as resource exhaustion or service crashes), the Agent immediately reports to the central monitoring system. Command execution means that the Agent can also receive instructions from the central monitoring system and execute them on the node. These commands may include restarting services, updating applications, and making configuration changes.

[0087] Agent programs typically start automatically when a node starts and run in the background, having minimal impact on system performance. Agents are crucial for maintaining the health and stability of cloud-native environments. For example, in Kubernetes, an agent program like Kubelet runs on each node, responsible for communicating with the Master node, receiving instructions, and managing Pods on the node.

[0088] The method provided in this specification draws on the Agent program used in cloud-native scenarios, deploying the Agent program on the terminal. Specifically, the Agent program is deployed in user space, reading the network data to be processed from a preset storage location (eBPF Maps) and sending the network data to be processed to the server.

[0089] Step 104: The server obtains the target business application data corresponding to the network data to be processed based on the network data to be processed, generates network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and saves the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

[0090] After receiving the network data to be processed sent by the client, the server obtains the target business application data corresponding to the network data to be processed.

[0091] Specifically, target business application data refers to application data related to the target business application, such as the corresponding metric information, upstream and downstream business nodes, etc. In one or more embodiments provided in this specification, target business application data specifically refers to application data related to the target application used for network topology analysis.

[0092] Specifically, obtaining the target service application data corresponding to the network data to be processed based on the network data to be processed includes:

[0093] Determine the target service application corresponding to the network data to be processed;

[0094] Collect the target business application data corresponding to the target business application.

[0095] In practical applications, the user-space Agent program on the client consumes network data to be processed from eBPF Maps and sends it to the server. The server runs a gateway service, which retrieves the corresponding target business application data based on the network data to be processed.

[0096] In a cloud-native environment, the primary role of a gateway is to provide an entry point for managing network traffic entering and leaving the Kubernetes cluster. Gateways simplify and streamline the interaction between internal services and the management of external traffic. The main functions of a cloud-native gateway include routing, load balancing, security, rate limiting, and protocol conversion. Routing refers to the gateway's ability to route external requests to appropriate internal services based on predefined rules, such as URL paths or request header information. Load balancing allows the gateway to distribute requests across multiple service instances, improving system availability and performance. Security provides measures such as authentication and authorization to prevent unauthorized access.

[0097] In practical applications, Kubernetes Ingress is a common cloud-native gateway. Envoy and Istio also offer more complex and powerful gateway functionalities. These gateways can be used with other cloud-native technologies such as service mesh to provide a complete and consistent network management solution. In the specific implementations provided in this specification, the gateway is not only applied in cloud-native scenarios but also in classic deployment scenarios. Through the gateway, network data to be processed can be received, and the corresponding target business application data can be obtained by supplementing the gateway with this data.

[0098] Specifically, the network data to be processed includes application identification information, and the target service application corresponding to the network data to be processed is determined accordingly, including:

[0099] Extract the application identification information from the network data to be processed;

[0100] The target business application is determined based on the application identification information.

[0101] In practical applications, after receiving network data to be processed, the gateway extracts the application identification information stored in the network data. Specifically, the application identification information refers to the identification information that can locate the target business application. Once the application identification information is determined, the target business application can be located based on this information, thereby obtaining the target business application data corresponding to the target business application.

[0102] In one specific embodiment provided in this specification, extracting application identification information from the network data to be processed includes:

[0103] Extract the process identifier or container identifier from the network data to be processed.

[0104] In practical applications, in cloud-native scenarios, the network data to be processed includes container identifiers (container IPs); in classic deployment scenarios, the network data to be processed includes process identifiers (process IDs). The corresponding target business application can be located through either the container IP or the process ID.

[0105] In cloud-native scenarios, due to containerization technology, the network partitioning, virtual network interface cards, and other network conditions are relatively complex. However, cloud-native is a microservice application, and each container usually only has one application running. Therefore, in cloud-native scenarios, the correspondence between the target IP address and the application in the network data to be processed is clearer, and the target business application can be located based on the container identifier.

[0106] In classic deployment scenarios, multiple applications may run on a single host machine. If the target IP address in the network data to be processed is used alone, it is not possible to accurately locate the corresponding target business application. Therefore, in classic deployment scenarios, the network data to be processed includes PID data. The target business application corresponding to the network data to be processed can be accurately located through this PID data.

[0107] In one specific embodiment provided in this specification, collecting target business application data corresponding to the target business application includes:

[0108] Based on the application identifier information, query the target business application data corresponding to the target business application in the business application metadata database.

[0109] In cloud-native scenarios, the operating system kernel resides in each individual virtual machine or container. The virtual machine or container runs on the host machine and provides its own operating system environment through certain isolation mechanisms. Each virtual machine or container contains a complete user space environment, including process space, file system, etc., but the virtual machine has its own kernel, while the container shares the host machine's kernel.

[0110] In this setup, pooled resources (such as CPU, memory, storage, and network) are managed by the operating system kernel and provided to virtual machines or containers running within them through virtualization technology. This allows resources to be flexibly allocated and scheduled among virtual machines or containers. For example, Kubernetes is a common cloud-native scenario consisting of a set of interconnected nodes, each running an operating system kernel. Kubernetes uses a scheduler to schedule Pods (groups of containers containing one or more containers) to run on different nodes. In this process, the resources of each node are pooled and managed by the operating system kernel.

[0111] Taking a cloud-native scenario as an example, using Kubernetes as a container orchestration tool, each Pod and Node has its own IP address. A Pod (container group) is the smallest deployment unit in Kubernetes and can contain one or more containers. In Kubernetes, each Pod is assigned an IP address, and all containers within a Pod share this IP address and network namespace. A Node is a worker node in Kubernetes, which can be a physical machine or a virtual machine. Each Node also has its own IP address, which is used by other components in the Kubernetes cluster to communicate with it. This design allows Pods to communicate over the network like physical hosts, greatly simplifying network management and facilitating the implementation of advanced network functions such as service discovery and load balancing.

[0112] In the gateway, the target business application is located based on the application identification information in the network data to be processed. Specifically, this can be based on the process identifier or container identifier. In cloud-native scenarios, resources such as Pods or Nodes can be located through container IPs, and the corresponding target business application can be found based on the application tags of the resources. In classic scenarios, processes can be matched through the host machine's IP and process ID, and the corresponding target business application can be found based on the application matching rules of the process.

[0113] Once the target business application is identified, its corresponding data can be retrieved from the business application metadata database. This allows for the use of application-level network monitoring data in subsequent network monitoring processes, enriching the dimensions of the network monitoring data and enhancing the richness of the network topology.

[0114] After obtaining the network data to be processed and the target business application data, the network data to be processed and the target business application data are merged to generate network monitoring data corresponding to the network protection device to be processed. Specifically, the network monitoring data refers to the application data associated with the target business application, which is used for subsequent business network analysis based on the actual needs of the business side.

[0115] In practical applications, the network data to be processed includes information such as source IP, source port, destination IP, destination port, process ID, and packet size. The target service application data may include the target service application identifier, target service application traffic information, target service application network parameter information, the corresponding reference service application identifier, reference service application identifier traffic information, reference service application network parameter information, and so on. The network data to be processed and the target service application data are then concatenated and merged to generate network traffic monitoring data.

[0116] After obtaining the network monitoring data, it can be saved for subsequent network monitoring. The network monitoring data is used to analyze the network status information of the target business application.

[0117] In one specific embodiment provided in this specification, storing the network monitoring data includes:

[0118] The network monitoring data is saved to a non-relational database.

[0119] In practical applications, network monitoring data is acquired in real time. To facilitate subsequent data analysis, this data can be stored in a database. Since network monitoring data includes business information related to the target business process, it is non-relational data, making a non-relational database suitable for storage. Compared to relational databases, non-relational databases are more flexible and suitable for handling large amounts of distributed data and high concurrency access. In practice, non-relational databases can include Elasticsearch (ES), MongoDB, Redis, Memcache, etc. Preferably, the non-relational database is Elasticsearch (ES) data storage service. ES is a document-oriented database, meaning it eliminates the need for row and column table field constraints. ES stores the entire structured data or document; however, it does more than just store data. This allows each piece of data in the document to be identified and retrieved.

[0120] In one specific embodiment provided in this specification, it further includes:

[0121] Receive network analysis requests for the target service application;

[0122] Obtain at least one network monitoring data corresponding to the target business application;

[0123] Network status information for the target business application is generated based on network monitoring data.

[0124] After saving the network monitoring data to a non-relational database, in subsequent processing, network analysis requests sent by the front-end business side can be received. These network analysis requests can be business application network topology, traffic monitoring for target business applications, etc. In the implementation methods provided in this specification, the specific form of the network analysis request is not limited, and the actual application shall prevail.

[0125] Upon receiving a network analysis request for a target business application, at least one network monitoring data corresponding to the target business application can be obtained. Specifically, at least one network monitoring data corresponding to the target business application can be queried from a non-relational database, and network status information corresponding to the target business application can be generated based on each network monitoring data.

[0126] In one specific embodiment provided in this specification, taking a network analysis request as an example of a network topology request for a target business application, network monitoring data corresponding to the target business application is obtained from a non-relational database, and network topology information for the target business application is generated through analysis and processing of the network monitoring data.

[0127] In another specific embodiment provided in this specification, taking the analysis of the traffic of a target business application within a certain time interval as an example, network monitoring data of the target business application within that time interval is obtained from the ES database, and the network traffic of the target business application within that time interval is generated through analysis and processing of the network monitoring data.

[0128] In one specific embodiment provided in this specification, it further includes:

[0129] The network status information is visualized.

[0130] In practical applications, after analyzing and generating network status information, appropriate visualization methods can be selected to display the network status information. These methods can include bar charts, network diagrams, topology diagrams, line graphs, etc. The method provided in this manual is not limited to any particular visualization method; the actual application shall prevail. The visualization can be generated on the server and then sent to the front end; alternatively, the server can send the network status information to the front end for visualization. The implementation method provided in this manual is not limited in this regard.

[0131] The data processing method provided in this specification includes generating network data to be processed based on an eBPF program in kernel mode and storing the network data to be processed in a preset storage location, wherein the network data to be processed is used to determine network monitoring data; reading the network data to be processed from the preset storage location in user mode and obtaining target service application data corresponding to the network data to be processed based on the network data to be processed; generating network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target service application data; and storing the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target service application.

[0132] The method provided in this specification uses eBPF technology to collect network data, processes data packets directly in kernel mode, extracts the network data to be processed for obtaining network monitoring data from the data packets, and uploads it to the server. The server finds the target business application data corresponding to the target business application based on the network data to be processed, and combines it with the network data to be processed to form network detection data, enriching the relevant target business information for subsequent network status analysis of the target business application. By adding application-level network monitoring data, the dimensions of network monitoring data are enriched, and the richness of the network topology is improved.

[0133] Secondly, in the process of collecting network data through eBPF technology, data packets are processed directly in kernel mode, extracting the network data to be processed for obtaining network monitoring data from the data packets, and performing subsequent processing on the network data to be processed, which greatly reduces the amount of data copied in traditional collection and improves processing efficiency.

[0134] Furthermore, the method for locating target business references using application identification information is applicable to both cloud-native and classic deployment scenarios. In cloud-native scenarios, resources such as Pods or Nodes can be matched by IP address, and the corresponding target business application can be found based on the application tag of the resource. In classic deployment scenarios, processes can be matched by host IP address and process ID, and the corresponding target business reference can be located based on the process. The method provided in this manual can be applied to both cloud-native and classic deployment scenarios, making it more universally applicable.

[0135] The following is in conjunction with the appendix Figure 2 and attached Figure 3 Taking the application of the data processing method provided in this specification to network topology as an example, the data processing method will be further explained. Figure 2 A schematic diagram of the structure of a data processing method provided in one embodiment of this specification is shown, such as... Figure 2 As shown, an eBPF program is deployed in the kernel mode of the terminal. The eBPF program hooks to the kernel protocol stack, captures network packet data from the kernel protocol stack, and then obtains statistical data such as source IP, source port, destination IP, destination port, process ID, and packet size based on the network packet data. These are combined into network data to be processed and added to eBPF Maps.

[0136] The Agent program is deployed in the user space of the terminal. The Agent program consumes the network data to be processed from the eBPF Maps in the kernel space and reports the network data to be processed to the gateway service of the server.

[0137] In the server's gateway service, based on the application identifier information in the network data to be processed, the target business application data corresponding to the target business application is retrieved from the server's metadata database. The collected target business application data and the network data to be processed are then merged to generate network monitoring data, which is then saved to the server's Elasticsearch data storage service.

[0138] The front end requests the network topology of the business application from the server. The server queries the Elasticsearch data storage service, calculates the directed graph of the network topology of the business application based on the network monitoring data stored in the ES data storage service, and generates the corresponding network topology graph, which is then fed back to the front end for display.

[0139] Figure 3 A flowchart illustrating the processing procedure of a data processing method according to an embodiment of this specification is shown, specifically including the following steps.

[0140] Step 302: The client obtains initial network data in kernel mode based on the eBPF program.

[0141] Step 304: The client's eBPF program parses the initial network data, generates network data to be processed, and saves the network data to be processed in eBPF Maps.

[0142] Step 306: The client reads the network data to be processed from the eBPF Maps based on the user-space agent program, and reports the network data to be processed to the server's gateway service.

[0143] Step 308: Extract the application identification information from the network data to be processed in the gateway service of the server, and determine the target business application based on the application identification information.

[0144] Step 310: The server queries the target business application data corresponding to the target business application in the business application metadata database based on the application identification information.

[0145] Step 312: The server merges the target business application data and the network data to be processed to generate network monitoring data.

[0146] Step 314: The server saves the network monitoring data to the Elasticsearch data storage service.

[0147] Step 316: The server receives the network topology request for the business application sent by the front end.

[0148] Step 318: The server obtains at least one network monitoring data corresponding to the target business application from the Elasticsearch data storage service, and generates the network status information of the target business application based on each network monitoring data.

[0149] Step 320: The server feeds back the network status information to the front end so that the network status information can be visualized on the front end.

[0150] The methods provided in the embodiments of this specification

[0151] Network data is collected using eBPF technology, and data packets are processed directly in kernel mode. The network data to be processed, used for network monitoring, is extracted from the packets and uploaded to the server. The server then uses this network data to locate the target application's data and combines it with the network data to form network detection data. This enriches the relevant target application information for subsequent network status analysis of the target application. By adding application-level network monitoring data, the dimensions of the network monitoring data are enriched, enhancing the richness of the network topology.

[0152] Secondly, in the process of collecting network data through eBPF technology, data packets are processed directly in kernel mode, extracting the network data to be processed for obtaining network monitoring data from the data packets, and performing subsequent processing on the network data to be processed, which greatly reduces the amount of data copied in traditional collection and improves processing efficiency.

[0153] Furthermore, the method for locating target business references using application identification information is applicable to both cloud-native and classic deployment scenarios. In cloud-native scenarios, resources such as Pods or Nodes can be matched by IP address, and the corresponding target business application can be found based on the application tag of the resource. In classic deployment scenarios, processes can be matched by host IP address and process ID, and the corresponding target business reference can be located based on the process. The method provided in this manual can be applied to both cloud-native and classic deployment scenarios, making it more universally applicable.

[0154] Corresponding to the above method embodiments, this specification also provides data processing system embodiments. Figure 4 A schematic diagram of the structure of a data processing system according to one embodiment of this specification is shown. Figure 4 As shown, the system includes a client 402 and a server 404:

[0155] The client 402 is configured to generate network data to be processed based on the eBPF program and upload the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data;

[0156] The server 404 is configured to obtain target business application data corresponding to the network data to be processed based on the network data to be processed, generate network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and save the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

[0157] Optionally, the client 402 is further configured as follows:

[0158] The network data to be processed is generated based on the eBPF program and saved in a preset storage location;

[0159] The network data to be processed is read from the preset storage location and uploaded to the server.

[0160] Optionally, the client 402 is further configured as follows:

[0161] In kernel mode, the initial network data is obtained based on the eBPF program, and the initial network data is parsed to generate network data to be processed;

[0162] The network data to be processed is stored in a preset storage location in the kernel mode;

[0163] The user-space agent reads the network data to be processed from the preset storage location.

[0164] Optionally, the client 402 is further configured as follows:

[0165] In kernel mode, based on eBPF programs, initial network data is obtained through hook technology.

[0166] Optionally, the server 404 is further configured as follows:

[0167] Determine the target service application corresponding to the network data to be processed;

[0168] Collect the target business application data corresponding to the target business application.

[0169] Optionally, the network data to be processed includes application identification information;

[0170] The server 404 is further configured as follows:

[0171] Extract the application identification information from the network data to be processed;

[0172] The target business application is determined based on the application identification information.

[0173] Optionally, the server 404 is further configured as follows:

[0174] Extract the process identifier or container identifier from the network data to be processed.

[0175] Optionally, the server 404 is further configured as follows:

[0176] Based on the application identifier information, query the target business application data corresponding to the target business application in the business application metadata database.

[0177] Optionally, the server 404 is further configured as follows:

[0178] The network monitoring data is saved to a non-relational database.

[0179] Optionally, the server 404 is also configured as follows:

[0180] Receive network analysis requests for the target service application;

[0181] Obtain at least one network monitoring data corresponding to the target business application;

[0182] Network status information for the target business application is generated based on network monitoring data.

[0183] Optionally, the server 404 is also configured as follows:

[0184] The network status information is visualized.

[0185] The data processing system provided in this specification uses eBPF technology to collect network data, processes data packets directly in kernel mode, extracts the network data to be processed for obtaining network monitoring data from the data packets, and uploads it to the server. The server uses the network data to find the target business application data corresponding to the target business application and combines it with the network data to form network detection data, enriching the relevant target business information for subsequent network status analysis of the target business application. By adding application-level network monitoring data, the dimensions of network monitoring data are enriched, and the richness of the network topology is improved.

[0186] Secondly, in the process of collecting network data through eBPF technology, data packets are processed directly in kernel mode, extracting the network data to be processed for obtaining network monitoring data from the data packets, and performing subsequent processing on the network data to be processed, which greatly reduces the amount of data copied in traditional collection and improves processing efficiency.

[0187] Furthermore, the method for locating target business references using application identification information is applicable to both cloud-native and classic deployment scenarios. In cloud-native scenarios, resources such as Pods or Nodes can be matched by IP address, and the corresponding target business application can be found based on the application tag of the resource. In classic deployment scenarios, processes can be matched by host IP address and process ID, and the corresponding target business reference can be located based on the process. The method provided in this manual can be applied to both cloud-native and classic deployment scenarios, making it more universally applicable.

[0188] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the data processing system is basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the data processing method embodiments.

[0189] Figure 5 This specification illustrates a data processing method provided by an embodiment of the present invention. The method is applied to a server and specifically includes the following steps:

[0190] Step 502: Receive network data to be processed sent by the client.

[0191] Step 504: Obtain the target business application data corresponding to the network data to be processed based on the network data to be processed.

[0192] Step 506: Generate network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target service application data, wherein the network monitoring data is used to analyze the network status information of the target service application.

[0193] Step 508: Save the network monitoring data.

[0194] This specification provides a data processing method in one embodiment, applied to a server. The server receives network data to be processed sent by the client, obtains the corresponding target business application data based on the network data to be processed, and merges the target business application data and the network data to be processed to generate network detection data, thereby enriching the relevant target business information for subsequent network status analysis of the target business application.

[0195] Corresponding to the above method embodiments, this specification also provides data processing system embodiments. Figure 6 A schematic diagram of the structure of a data processing apparatus according to one embodiment of this specification is shown. Figure 6 As shown, the device includes:

[0196] The receiving module 602 is configured to receive network data to be processed sent by the client;

[0197] The acquisition module 604 is configured to acquire target service application data corresponding to the network data to be processed based on the network data to be processed.

[0198] The generation module 606 is configured to generate network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target service application data, wherein the network monitoring data is used to analyze the network status information of the target service application;

[0199] The storage module 608 is configured to store the network monitoring data.

[0200] This specification provides a data processing apparatus in one embodiment, applied to a server. The server receives network data to be processed sent by a client, obtains the corresponding target business application data based on the network data to be processed, and merges the target business application data and the network data to be processed to generate network detection data, thereby enriching the relevant target business information for subsequent network status analysis of the target business application.

[0201] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the data processing apparatus is basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the data processing method embodiments.

[0202] Figure 7 A structural block diagram of a computing device 700 according to one embodiment of this specification is shown. The components of the computing device 700 include, but are not limited to, a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and a database 750 is used to store data.

[0203] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 740 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, or a Near Field Communication (NFC) interface.

[0204] In one embodiment of this specification, the above-described components of the computing device 700 and Figure 7 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 7 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0205] The computing device 700 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 700 can also be a mobile or stationary server.

[0206] The processor 720 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described data processing method.

[0207] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the computing device embodiments are basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the data processing method embodiments.

[0208] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described data processing method.

[0209] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the computer-readable storage medium embodiments are basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the data processing method embodiments.

[0210] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described data processing method.

[0211] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the computer program embodiments are basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the data processing method embodiments.

[0212] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0213] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0214] It should be noted that the above description describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments of this specification.

[0215] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0216] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A data processing method applied to a data processing system, the data processing system comprising a client and a server, comprising: The client generates network data to be processed based on the eBPF program and uploads the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data; The server obtains the target business application data corresponding to the network data to be processed based on the network data to be processed, generates network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and saves the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

2. The method as described in claim 1, wherein the client generates network data to be processed based on an eBPF program and uploads the network data to be processed to the server, comprising: The client generates network data to be processed based on the eBPF program and saves the network data to be processed in a preset storage location; The network data to be processed is read from the preset storage location and uploaded to the server.

3. The method as described in claim 2, wherein generating network data to be processed based on an eBPF program and saving the network data to be processed in a preset storage location includes: In kernel mode, the initial network data is obtained based on the eBPF program, and the initial network data is parsed to generate network data to be processed; The network data to be processed is stored in a preset storage location in the kernel mode; Accordingly, reading the network data to be processed from the preset storage location includes: The user-space agent reads the network data to be processed from the preset storage location.

4. The method as described in claim 3, wherein initial network data is obtained in kernel mode based on an eBPF program, comprising: In kernel mode, based on eBPF programs, initial network data is obtained through hook technology.

5. The method as described in claim 1, wherein obtaining the target service application data corresponding to the network data to be processed based on the network data to be processed includes: Determine the target service application corresponding to the network data to be processed; Collect the target business application data corresponding to the target business application.

6. The method as described in claim 5, wherein the network data to be processed includes application identification information; Determining the target service application corresponding to the network data to be processed includes: Extract the application identification information from the network data to be processed; The target business application is determined based on the application identification information.

7. The method as described in claim 6, wherein extracting application identification information from the network data to be processed includes: Extract the process identifier or container identifier from the network data to be processed.

8. The method as described in claim 6, wherein collecting target business application data corresponding to the target business application includes: Based on the application identifier information, query the target business application data corresponding to the target business application in the business application metadata database.

9. The method as described in claim 1, wherein saving the network monitoring data includes: The network monitoring data is saved to a non-relational database.

10. The method of claim 1, further comprising: Receive network analysis requests for the target service application; Obtain at least one network monitoring data corresponding to the target business application; Network status information for the target business application is generated based on network monitoring data.

11. The method of claim 10, further comprising: The network status information is visualized.

12. A data processing system, comprising a client and a server; wherein, The client is configured to generate network data to be processed based on an eBPF program and upload the network data to be processed to the server, wherein the network data to be processed is used to determine network monitoring data; The server is configured to obtain target business application data corresponding to the network data to be processed based on the network data to be processed, generate network monitoring data corresponding to the network data to be processed based on the network data to be processed and the target business application data, and save the network monitoring data, wherein the network monitoring data is used to analyze the network status information of the target business application.

13. The system of claim 12, wherein the client is further configured to: The network data to be processed is generated based on the eBPF program and saved in a preset storage location; The network data to be processed is read from the preset storage location and uploaded to the server.

14. The system of claim 13, wherein the client is further configured to: In kernel mode, the initial network data is obtained based on the eBPF program, and the initial network data is parsed to generate network data to be processed; The network data to be processed is stored in a preset storage location in the kernel mode; The user-space agent reads the network data to be processed from the preset storage location.

15. The system of claim 14, wherein the client is further configured to: In kernel mode, based on eBPF programs, initial network data is obtained through hook technology.

16. The system of claim 12, wherein the server is further configured to: Determine the target service application corresponding to the network data to be processed; Collect the target business application data corresponding to the target business application.

17. The system of claim 16, wherein the network data to be processed includes application identification information; The server is further configured as follows: Extract the application identification information from the network data to be processed; The target business application is determined based on the application identification information.

18. The system of claim 17, wherein the server is further configured to: Extract the process identifier or container identifier from the network data to be processed.

19. The system of claim 17, wherein the server is further configured to: Based on the application identifier information, query the target business application data corresponding to the target business application in the business application metadata database.

20. The system of claim 12, wherein the server is further configured to: The network monitoring data is saved to a non-relational database.

21. The system of claim 12, wherein the server is further configured to: Receive network analysis requests for the target service application; Obtain at least one network monitoring data corresponding to the target business application; Network status information for the target business application is generated based on network monitoring data.

22. The system of claim 21, wherein the server is further configured to: The network status information is visualized.

23. A data processing method, applied to a server, comprising: Receive network data to be processed sent by the client; Obtain the target business application data corresponding to the network data to be processed based on the network data to be processed; Network monitoring data corresponding to the network data to be processed is generated based on the network data to be processed and the target business application data, wherein the network monitoring data is used to analyze the network status information of the target business application; Save the network monitoring data.

24. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the method of claim 23.

25. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the method of claim 23.

Images