Traffic analysis method, device and electronic equipment for cloud-native environment

Abstract

The application provides a cloud native environment traffic analysis method and device and electronic equipment, and relates to the technical field of cloud computing, wherein the method comprises the following steps: collecting at least one traffic data packet of a target collection object in a cloud native environment through an eBPF traffic collection module; calling an eBPF traffic filtering module through the eBPF traffic collection module, and sending at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module; matching each first traffic data packet with a first preset filtering rule through the eBPF traffic filtering module to obtain a first matching result; the first preset filtering rule is used for filtering a preset traffic data packet set by a user; and analyzing a second traffic data packet representing a matching failure in the first matching result. The application realizes the collection and analysis of traffic data packets, and improves the flexibility of traffic collection and analysis.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, and in particular to a traffic analysis method and device for a cloud native environment and an electronic device. BACKGROUND

[0002] The cloud native environment has the characteristics of a large scale and dynamic changes of collection objects (pods) and large east-west traffic. Therefore, how to efficiently collect and analyze the traffic of the collection objects becomes a challenge.

[0003] In the related art, the traffic data packets of the collection objects in the cloud native environment are usually collected and analyzed based on a traffic control tool tc set in the kernel.

[0004] However, in the above related art, the analysis of the traffic data packets is only based on the capabilities provided by the kernel natively, which reduces the flexibility of traffic collection and analysis. SUMMARY

[0005] The present application provides a traffic analysis method and device for a cloud native environment and an electronic device to solve the defect that the flexibility of traffic collection and analysis is reduced in the prior art.

[0006] The present application provides a traffic analysis method for a cloud native environment, applied to an electronic device, wherein an eBPF traffic collection module and an eBPF traffic filtering module are loaded in the kernel of the electronic device, the eBPF traffic collection module is attached in a traffic control tool, the traffic control tool acts on a virtual network interface of the kernel, and the virtual network interface is connected with a network namespace of a target collection object; the method comprises:

[0007] collecting at least one traffic data packet of the target collection object in the cloud native environment through the eBPF traffic collection module;

[0008] calling the eBPF traffic filtering module by the eBPF traffic collection module, and sending at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module;

[0009] matching each first traffic data packet with a first preset filtering rule through the eBPF traffic filtering module to obtain a first matching result; the first preset filtering rule is used to filter a preset traffic data packet set by a user;

[0010] analyzing a second traffic data packet representing a matching failure in the first matching result.

[0011] According to the traffic analysis method for a cloud native environment provided by the present application, an eBPF traffic control module and a threat detection module are also loaded in the kernel.

[0012] The analysis on the second traffic data packet representing a matching failure in the first matching result comprises:

[0013] The eBPF traffic filtering module tail-calls the eBPF traffic control module, and sends the second traffic data packet to the threat detection module through the eBPF traffic control module;

[0014] The threat detection module performs threat analysis on the second traffic data packet to obtain a threat analysis result.

[0015] According to the cloud native environment traffic analysis method provided by the application, the method further comprises:

[0016] In the case that the threat analysis result represents that the second traffic data packet includes threat traffic, an alarm log corresponding to the second traffic data packet is generated;

[0017] The threat detection module sends the alarm log to a cloud native proxy module, and the alarm log is used to instruct the cloud native proxy module to enrich the alarm log, and then send the enriched alarm log to a cloud security posture management platform through a cloud native control module.

[0018] According to the cloud native environment traffic analysis method provided by the application, the second traffic data packet is sent to the threat detection module through the eBPF traffic control module, comprising:

[0019] In the case that the traffic limiting identifier is a first identifier, the second traffic data packet is sent to the threat detection module through the eBPF traffic control module; the first identifier is used to represent that the current traffic bandwidth is not reduced.

[0020] According to the cloud native environment traffic analysis method provided by the application, the method further comprises:

[0021] The eBPF traffic control module acquires the size of each second traffic data packet in the statistical list based on a preset period, and determines the current traffic bandwidth based on the size of each second traffic data packet currently acquired and the size of each second traffic data packet acquired last time;

[0022] In the case that the eBPF traffic control module determines that the current traffic bandwidth is greater than a preset traffic data packet bandwidth, the traffic limiting identifier is set to a second identifier, and the second identifier is used to represent that the current traffic bandwidth is reduced.

[0023] According to the cloud native environment traffic analysis method provided by the application, the method further comprises:

[0024] The eBPF traffic collection module generates a traffic log corresponding to the first traffic data packet;

[0025] The eBPF traffic collection module sends the traffic log to a cloud native proxy module, and the traffic log is used to instruct the cloud native proxy module to send the enriched traffic log to a cloud security posture management platform through a cloud native control module after enriching the traffic log.

[0026] According to the cloud native environment traffic analysis method provided by the application, the method further comprises:

[0027] The eBPF traffic collection module matches each traffic data packet with a second preset filtering rule to obtain a second matching result; the second preset filtering rule is used to filter illegal traffic data packets;

[0028] The traffic data packet representing a matching failure in the second matching result is determined as the first traffic data packet.

[0029] According to the cloud native environment traffic analysis method provided by the application, the method further comprises:

[0030] The initial filtering program of the preset format is compiled to obtain a cBPF instruction set;

[0031] The cBPF instruction set is converted into an eBPF instruction set;

[0032] The eBPF traffic collection module is created based on the eBPF instruction set.

[0033] The application also provides a cloud native environment traffic analysis device, comprising:

[0034] The acquisition unit is configured to acquire at least one traffic data packet of a target acquisition object in a cloud native environment;

[0035] The calling unit is configured to call an eBPF traffic filtering module and send at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module;

[0036] The first matching unit is configured to match each first traffic data packet with a first preset filtering rule to obtain a first matching result; the first preset filtering rule is used to filter a preset traffic data packet set by a user;

[0037] The analysis unit is configured to analyze a second traffic data packet representing a matching failure in the first matching result.

[0038] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the traffic analysis method of the cloud-native environment according to any one of the above when executing the program.

[0039] The application further provides a non-transitory computer-readable storage medium, which stores a computer program, and the computer program implements the traffic analysis method of the cloud-native environment according to any one of the above when executed by a processor.

[0040] The application further provides a computer program product, which includes a computer program, and the computer program implements the traffic analysis method of the cloud-native environment according to any one of the above when executed by a processor.

[0041] The application provides a traffic analysis method, device and electronic device of a cloud-native environment, wherein the eBPF traffic collection module and the eBPF traffic filtering module are loaded in the kernel of the electronic device, at least one traffic data packet of a target collection object in the cloud-native environment is collected through the eBPF traffic collection module, and the eBPF traffic filtering module is tail called, at least one first traffic data packet in the at least one traffic data packet is sent to the eBPF traffic filtering module, each first traffic data packet is matched with a first preset filtering rule through the eBPF traffic filtering module, a first matching result is obtained, and a second traffic data packet representing a matching failure in the first matching result is analyzed. It can be known that the eBPF traffic collection module and the eBPF traffic filtering module configured in the kernel are used to realize the collection and analysis of traffic data packets, on one hand, the eBPF has programmability, so the eBPF traffic collection module and the eBPF traffic filtering module can be loaded in the kernel at any time, and on the other hand, the eBPF traffic collection module and the eBPF traffic filtering module are both eBPF programs, so the communication between the eBPF traffic collection module and the eBPF traffic filtering module can be realized through tail calling, thereby improving the flexibility of traffic collection and analysis. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0043] Figure 1 is one of the flowcharts of the traffic analysis method of the cloud-native environment provided by the embodiments of the application;

[0044] Figure 2Figure 2 is a flowchart of a traffic analysis method of a cloud-native environment according to an embodiment of the present application;

[0045] Figure 3 Figure 3 is a flowchart of a traffic analysis method of a cloud-native environment according to an embodiment of the present application;

[0046] Figure 4 Figure 4 is a structural diagram of a traffic analysis system of a cloud-native environment according to an embodiment of the present application;

[0047] Figure 5 Figure 5 is a structural diagram of an eBPF module according to an embodiment of the present application;

[0048] Figure 6 Figure 6 is a structural diagram of a traffic analysis device of a cloud-native environment according to an embodiment of the present application;

[0049] Figure 7 Figure 7 is a structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described below in connection with the drawings in the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative work fall within the scope of protection of the present application.

[0051] Traditionally, the kernel is an ideal place to implement observability, security and network functions. When users expect certain functions, but the current kernel does not have these functions, they either upgrade the kernel (relying on the capabilities provided by the kernel natively) or develop kernel modules to extend the functions of the kernel. The emergence of the revolutionary technology of Extended Berkeley Packet Filter (eBPF) has changed this rule. eBPF provides a new option that allows application developers to dynamically extend the functions of the kernel at runtime through eBPF programs without changing the kernel source code or loading kernel modules. At the same time, with the help of the Just-in-time compilation (JIT) and verification engine of the kernel, the efficiency and security of the eBPF program can be guaranteed.

[0052] In the Linux kernel, the hook points for processing network traffic are mainly xdp and tc, so there are two types of eBPF related to processing network traffic: xdp and tc. Among them, xdp occurs at the earliest stage of packet processing, that is, when the network driver receives the packet, unfortunately, xdp can only process ingress traffic, which is not suitable for traffic collection. Compared with xdp, when the traffic reaches tc, the sk_buff has been built, and there is a richer context, and most importantly, tc can process traffic in the ingress (traffic direction from the outside) and egress (traffic direction sent to the outside) directions in the network data path, so the present application uses eBPF programs attached to the traffic control tool tc to collect and analyze traffic packets in the cloud native environment.

[0053] The cloud native environment traffic analysis method of the present application will be described below in combination with Figures 1-5 The cloud native environment traffic analysis method of the present application will be described below in combination with

[0054] Figure 1 is one of the flowcharts of the cloud native environment traffic analysis method provided by the embodiments of the present application, applied to an electronic device, the kernel of the electronic device loads an eBPF traffic collection module and an eBPF traffic filtering module, the eBPF traffic collection module is attached to a traffic control tool, the traffic control tool acts on a virtual network interface of the kernel, and the virtual network interface is connected to a network namespace of a target collection object; as Figure 1 The cloud native environment traffic analysis method comprises the following steps:

[0055] Step 101, collecting at least one traffic packet of the target collection object in the cloud native environment through the eBPF traffic collection module.

[0056] Among them, the target collection object can be a Pod, and the eBPF traffic collection module can be represented by entrypoint, in actual application, the eBPF traffic collection module entrypoint is intercepted at the ingress interface and the egress interface of the virtual network interface veth, so as to collect the traffic packets entering from the outside and the traffic packets sent to the outside.

[0057] For example, since the eBPF traffic collection module is attached to the traffic control tool tc, the traffic control tool tc acts on the virtual network interface (Virtual Ethernet, veth) of the kernel, and the veth is connected to the network namespace (Namespace) of the target collection object, so the eBPF traffic collection module can be used to collect the traffic packets in the target collection object Pod.

[0058] Step 102, the eBPF traffic collection module tail calls the eBPF traffic filtering module, and sends at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module.

[0059] Wherein, the eBPF traffic filtering module can be represented as filter.

[0060] For example, when the eBPF traffic collection module collects traffic data packets in the target collection object Pod, the eBPF traffic filtering module is tail called to send at least one first traffic data packet in all collected traffic data packets to the tail called eBPF traffic filtering module.

[0061] Step 103, the eBPF traffic filtering module matches each first traffic data packet with a first preset filtering rule to obtain a first matching result; the first preset filtering rule is used to filter preset traffic data packets set by a user.

[0062] For example, when the eBPF traffic filtering module receives each first traffic data packet, each first traffic data packet is matched with the first preset filtering rule. When the matching is successful, it indicates that the corresponding first traffic data packet is a preset traffic data packet that needs to be filtered out by the user, and TC_ACT_OK is returned to block the normal execution flow of the eBPF traffic filtering module; when the matching fails, it indicates that the corresponding first traffic data is not a preset traffic data packet that needs to be filtered out by the user, that is, it is a traffic data packet that can pass, thereby obtaining the first matching result for all first traffic data packets. For example, the user only cares about the traffic of the protocol stack above layer 3, and filters out the traffic below layer 3 of the protocol stack; or global filtering, for example, there are a large number of audio and video services in the current cluster, and the traffic related to the audio and video services can be globally filtered.

[0063] Step 104, analyzing the second traffic data packet representing a matching failure in the first matching result.

[0064] For example, the first matching result includes the matching result of each first traffic data packet with the first preset filtering rule, each first traffic data packet corresponding to a matching failure is determined as a second traffic data packet, and the second traffic data packet is filtered for illegal data packets and analyzed for threats.

[0065] The cloud native environment traffic analysis method provided by the application has an eBPF traffic collection module and an eBPF traffic filtering module loaded in the kernel of an electronic device, at least one traffic data packet of a target collection object in the cloud native environment is collected by the eBPF traffic collection module, and the eBPF traffic filtering module is tail called, at least one first traffic data packet in the at least one traffic data packet is sent to the eBPF traffic filtering module, each first traffic data packet is matched with a first preset filtering rule by the eBPF traffic filtering module, a first matching result is obtained, and a second traffic data packet representing a matching failure in the first matching result is analyzed. It can be known that the eBPF traffic collection module and the eBPF traffic filtering module configured in the kernel are used to realize collection and analysis of traffic data packets, on the one hand, the eBPF traffic collection module and the eBPF traffic filtering module can be loaded in the kernel at any time due to the programmability of the eBPF, and on the other hand, the eBPF traffic collection module and the eBPF traffic filtering module can communicate with each other through tail calling because they are both eBPF programs, thereby improving the flexibility of traffic collection and analysis.

[0066] In an embodiment, the kernel further loads an eBPF traffic control module and a threat detection module; Figure 2 Figure 2 is a flowchart of a cloud native environment traffic analysis method provided by an embodiment of the application, as shown in Figure 2 The step 104 of analyzing the second traffic data packet representing a matching failure in the first matching result can be implemented by the following steps:

[0067] The step 1041 tail calls the eBPF traffic control module by the eBPF traffic filtering module, and sends the second traffic data packet to the threat detection module by the eBPF traffic control module.

[0068] The eBPF traffic control module can be represented by redirect, the threat detection module can be modified based on an open source suricata, the threat detection module is deployed in the same way as KSPM-magnet, and is deployed in the form of a daemonset.

[0069] For example, when the eBPF traffic filtering module obtains each second traffic data packet, the eBPF traffic control module is tail called to send each second traffic data packet to the eBPF traffic control module, and the eBPF traffic control module sends each received second traffic data packet to the threat detection module.

[0070] The step 1042 performs threat analysis on the second traffic data packet by the threat detection module to obtain a threat analysis result.

[0071] For example, the threat detection module extracts key features from each second traffic data packet upon receiving each second traffic data packet. The key features can include source IP address, destination IP address, port number, protocol type, packet size, transmission speed, etc. The extracted key features are matched with each threat information in the threat intelligence library. If a match is found, it is determined that the second traffic data packet includes threat traffic. If no match is found, it is determined that the second traffic data packet does not include threat traffic. Thus, a threat analysis result is obtained.

[0072] In this embodiment, the eBPF traffic filtering module calls the eBPF traffic control module by tail recursion to send each second traffic data packet to the eBPF traffic control module. The eBPF traffic control module forwards each second traffic data packet to the threat detection module for threat analysis. Through the flexible interaction among the eBPF traffic filtering module, the eBPF traffic control module, and the threat detection module, threat analysis of the second traffic data packet is achieved.

[0073] In an embodiment, after step 1042, the traffic analysis method of the cloud-native environment further includes the following steps:

[0074] In the case where the threat analysis result indicates that the second traffic data packet includes threat traffic, an alarm log corresponding to the second traffic data packet is generated. The threat detection module sends the alarm log to the cloud-native proxy module. The alarm log is used to instruct the cloud-native proxy module to enrich the alarm log. The cloud-native control module sends the enriched alarm log to the cloud security posture management platform.

[0075] For example, when the threat analysis result indicates that the second traffic data packet includes threat traffic, it is indicated that the second traffic data packet is unsafe, and an alarm log corresponding to the second traffic data packet is generated based on the content included in the second traffic data packet. The alarm log corresponding to the second traffic data packet is sent to the cloud native proxy module KSPM-agent. When the cloud native proxy module KSPM-agent receives the alarm log corresponding to the second traffic data packet, the alarm log is first enriched to obtain a first enriched alarm log, and then the first enriched alarm log is sent to the cloud native control module KSPM-controller. When the cloud native control module KSPM-controller receives the first enriched alarm log, the first enriched alarm log is cached according to the cluster-scoped of the cloud native control module KSPM-controller, and the first enriched alarm log is second enriched to obtain a second enriched alarm log. Finally, the second enriched alarm log is sent to the cloud security posture management platform CSPM platform. The second enriched alarm log corresponding to the second traffic data packet is managed by the cloud security posture management platform CSPM platform, so as to facilitate subsequent tracing of the second traffic data packet based on the second enriched alarm log. The first enrichment includes at least one of the following: adding the identifier of the container generating the second traffic data packet, the identifier of the corresponding collection object Pod, the network namespace Namespace of the collection object Pod, and the identifier of the cluster node to which the collection object Pod belongs. The second enrichment includes at least one of the following: service, external, and workload. The service refers to the relevant information of the service, for example, the name, version, and calling condition of the service, and the relevant information of the service helps to understand the state and behavior of the service when the alarm log is generated. The external refers to the interaction information with external systems or resources, for example, the calling of external API or the access of external database, which helps to track the interaction between the system and other external components. The workload refers to the running service instance or task. The additional workload information can include container identifier, instance number, resource usage, etc., which helps to understand the system load when the alarm log is generated.

[0076] In the embodiment, when the threat analysis result indicates that the second traffic data packet includes threat traffic, the alarm log corresponding to the second traffic data packet is generated. The alarm log is sent to the cloud native proxy module by the threat detection module. The alarm log is used to instruct the cloud native proxy module to enrich the alarm log, and then the cloud native control module sends the enriched alarm log to the cloud security posture management platform. The enriched alarm log corresponding to the second traffic data packet is managed by the cloud security posture management platform, so as to facilitate subsequent tracing of the second traffic data packet based on the enriched alarm log.

[0077] In an embodiment, the sending of the second traffic data packet to the threat detection module through the eBPF traffic control module in step 1041 above can be implemented in the following manner:

[0078] In the case where the traffic limiting identifier is the first identifier, the second traffic data packet is sent to the threat detection module through the eBPF traffic control module; the first identifier is used to represent that the current traffic bandwidth is not reduced.

[0079] For example, when the eBPF traffic control module receives the second traffic data packet, the size of the second traffic data packet is stored in the statistics list Metrics Map, and the current number of the second traffic data packet in the statistics list Metrics Map is updated, i.e., the current number is increased by one. At the same time, the traffic limiting identifier in the Config Map is obtained. When the traffic limiting identifier is the first identifier representing that the current traffic bandwidth is not reduced, it is indicated that the traffic bandwidth does not need to be reduced at this time, and the data structure sk_buff of each second traffic data packet is directly copied. The copied second traffic data packets are sent to the threat detection module through the eBPF traffic control module, and TC_ACK_OK is returned, indicating that the processing path of the second traffic data packet will not be changed.

[0080] In an embodiment, the traffic analysis method of the cloud native environment further includes the following steps:

[0081] The eBPF traffic control module obtains the size of each second traffic data packet in the statistics list based on a preset period, and determines the current traffic bandwidth based on the size of each second traffic data packet currently obtained and the size of each second traffic data packet obtained last time. The eBPF traffic control module sets the traffic limiting identifier to a second identifier in the case where the current traffic bandwidth is greater than a preset traffic data packet bandwidth, and the second identifier is used to represent that the current traffic bandwidth is reduced.

[0082] The preset period can be set based on demand, and the present application does not limit this.

[0083] For example, the eBPF traffic control module obtains the size of each second traffic data packet in the statistical list based on a preset period, and obtains a difference value between a sum of the sizes of all second traffic data packets currently obtained and a sum of the sizes of all second traffic data packets last obtained, divides the difference value by the preset period to obtain a current traffic bandwidth, compares the current traffic bandwidth with a preset traffic bandwidth, and when it is determined that the current traffic bandwidth is greater than the preset traffic bandwidth, it is indicated that the current network load is large, and at this time, a traffic limiting identifier in a Config Map is set to a second identifier representing reducing the current traffic bandwidth, so as to reduce the current traffic bandwidth to a target traffic bandwidth, and the target traffic bandwidth is less than or equal to the preset traffic bandwidth, for example, the current traffic bandwidth is reduced to 100 bps, so that the global traffic control at the node level is realized.

[0084] In an embodiment, Figure 3 is a flowchart of a third traffic analysis method of a cloud-native environment provided by an embodiment of the application, as shown in the above step 101, the traffic analysis method of the cloud-native environment further includes the following steps: Figure 3

[0085] Step 105, generating a traffic log corresponding to the first traffic data packet by the eBPF traffic collection module.

[0086] Step 106, sending the traffic log to the cloud-native proxy module by the eBPF traffic collection module, and the traffic log is used to instruct the cloud-native proxy module to send the enriched traffic log to the cloud security posture management platform through the cloud-native control module after enriching the traffic log.

[0087] ​For example, when the eBPF traffic collection module filters the first traffic data packet, it reports a traffic event. The traffic event is used to generate a corresponding traffic log, that is, a traffic log corresponding to the first traffic data packet is generated based on the content of the first traffic data packet, and the traffic log corresponding to the first traffic data packet is sent to the cloud native agent module KSPM-agent. When the cloud native agent module KSPM-agent receives the traffic log corresponding to the first traffic data packet, it performs third enrichment on the traffic log to obtain a first enriched traffic log, and then sends the first enriched traffic log to the cloud native control module KSPM-controller. When the cloud native control module KSPM-controller receives the first enriched traffic log, it caches the first enriched traffic log according to its cluster-scoped cache, and performs fourth enrichment on the first enriched traffic log to obtain a second enriched traffic log, and finally sends the second enriched traffic log to the cloud security posture management platform CSPM platform. The cloud security posture management platform CSPM platform manages the second enriched traffic log corresponding to the first traffic data packet, which facilitates subsequent tracing of the corresponding first traffic data packet based on the second enriched traffic log. The third enrichment includes at least one of the following: adding the identifier of the container generating the first traffic data packet, the identifier of the corresponding collection object Pod, the network namespace Namespace of the collection object Pod, and the identifier of the cluster node to which the collection object Pod belongs, etc. The fourth enrichment includes at least one of the following: service1, external1 and workload1. Service1 refers to the relevant information of the service, for example, the name, version and calling situation of the service, etc. The relevant information of the service helps to understand the state and behavior of the service when the traffic log is generated. External1 refers to the interaction information with external systems or resources, for example, the calling of external API or the access of external database, etc., which helps to track the interaction between the system and other external components. Workload1 refers to the running service instance or task. The additional workload information can include container identifier, instance quantity, resource usage, etc., which helps to understand the system load when the traffic log is generated.

[0088] In this embodiment, the traffic log corresponding to the first traffic data packet is generated, and the traffic log is sent to the cloud native agent module through the eBPF traffic collection module. The traffic log is used to instruct the cloud native agent module to enrich the traffic log after enrichment, and then send the enriched traffic log to the cloud security posture management platform through the cloud native control module. The cloud security posture management platform manages the enriched traffic log corresponding to the first traffic data packet, which facilitates subsequent tracing of the corresponding first traffic data packet based on the enriched traffic log.

[0089] In an embodiment, after step 101, the traffic analysis method of the cloud-native environment further includes the following steps:

[0090] The eBPF traffic collection module matches each of the traffic data packets with the second preset filtering rule to obtain a second matching result; and determines the traffic data packets representing a matching failure in the second matching result as the first traffic data packets.

[0091] The second preset filtering rule is used to filter illegal traffic data packets.

[0092] For example, when the eBPF traffic collection module collects each traffic data packet, it matches each traffic data packet with the second preset filtering rule. When the matching is successful, it means that the corresponding traffic data packet is an illegal traffic data packet that needs to be filtered out by the user. When the matching fails, it means that the corresponding traffic data is not an illegal traffic data packet that needs to be filtered out by the user, i.e., it is a preliminary legal traffic data packet. Thus, a second matching result for all traffic data packets is obtained, and the traffic data packets representing a matching failure in the second matching result are determined as the first traffic data packets.

[0093] In an embodiment, the traffic analysis method of the cloud-native environment further includes the following steps:

[0094] The initial filtering program in the preset format is compiled to obtain a cBPF instruction set; the cBPF instruction set is converted into an eBPF instruction set; and the eBPF traffic collection module is created based on the eBPF instruction set.

[0095] The preset format can be a human-readable tcpdump format.

[0096] It should be noted that, whether it is cBPF or eBPF, it is essentially a set of instructions, but eBPF can operate more registers and the instruction set is more abundant, so eBPF is used in the present application.

[0097] For example, the initial filtering program in the human-readable tcpdump format is compiled to obtain a cBPF instruction set, the cBPF instruction set is converted into an eBPF instruction set by means of an instruction conversion module (cbpfc), an eBPF program is created based on the eBPF instruction set, the created eBPF program is determined as the eBPF traffic collection module, and Prog Map is updated. In Prog Map, the index corresponding to the eBPF traffic collection module filter is increased, for example, index 0 in Prog Map represents the eBPF traffic collection module filter, and index 1 represents the eBPF traffic control module redirect.

[0098] It should be noted that the process of converting the cBPF instruction set into the eBPF instruction set by means of the instruction conversion module (cbpfc) is carried out in the KSPM-agent.

[0099] In the embodiment, the initial filtering procedure of the preset format is compiled to obtain a cBPF instruction set, the cBPF instruction set is converted into an eBPF instruction set, and finally an eBPF traffic collection module is created based on the eBPF instruction set, so that the automatic creation of the eBPF traffic collection module is realized, the traffic data packets are collected based on the created eBPF traffic collection module, and the flexibility of collection is improved.

[0100] Figure 4 is a structural schematic diagram of a traffic analysis system of a cloud native environment provided by the embodiment of the application, as Figure 4 shown, the traffic analysis system of the cloud native environment includes a cloud security posture management platform, a control plane and a data plane.

[0101] The cloud security posture management platform CSPM platform is used to store traffic logs and threat logs, is a unified observable platform for cloud native assets and threat events, and can issue traffic collection strategies and the like.

[0102] The control plane includes a cloud native control module KSPM-controller and part of a cloud native agent module KSPM-agent, the KSPM-controller listens to a policy configuration request from the cloud security posture management platform, maintains the life cycle of a CRD object, for example, the CRD object is a SnifferGroup and a SnifferPolicy, the SnifferGroup represents a Pod set, the SnifferPolicy is a kind of security policy or rule, and the SnifferPolicy issues the policy of the collector by updating a Pod annotation (annotation). The KSPM-agent maintains the life cycle of the collector. For the application, the collector is an eBPF program attached to a traffic control tool tc, that is, an eBPF traffic collection module. The KSPM-controller is deployed in a deployment manner, and the KSPM-agent is deployed in a daemonset manner, and respectively provides controller capabilities in k8s cluster scope and node scope.

[0103] The data plane includes another part of the cloud-native agent module KSPM-agent, a threat detection module and an eBPF module loaded in the kernel, wherein the KSPM-agent and the eBPF module communicate through eBPF maps, which is a data structure allowing eBPF modules to share data between kernel space and user space. One k8s node can contain multiple collector Pods, that is, one k8s node has multiple collector Pods, so the KSPM-agent can have the ability to manage multiple collectors.

[0104] The KSPM-agent listens to the changes of the collector Pods through the listening module list-watch kube-apiserver, and the SnifferManager of the KSPM-agent obtains the collector parameters from the Pod annotation, for example, the collector parameters include the traffic collection rate, etc., and creates a collector based on the collector parameters, the process of creating the collector is to load the eBPF program, that is, to load the eBPF traffic collection module, and to attach the eBPF traffic collection module to the traffic control tool tc, Figure 4 The pubsub in the above formula refers to the abbreviation of the Publish-Subscribe mode, which is a message passing mode.

[0105] Figure 5 is a structural diagram of the eBPF module provided by the embodiment of the application, as Figure 5 shown, the BPF module includes multiple eBPF programs, which are an eBPF traffic collection module entrypoint, an eBPF traffic filtering module filter and an eBPF traffic control module redirect. Since the eBPF traffic collection module entrypoint, the eBPF traffic filtering module filter and the eBPF traffic control module redirect have the same context, the communication between the three eBPF programs can be realized through tail call. Among them, the eBPF traffic filtering module filter and the eBPF traffic control module redirect can be indexed by a Prog Map, for example, index 0 in the Prog Map represents the eBPF traffic collection module filter, and index 1 represents the eBPF traffic control module redirect. The eBPF traffic filtering module filter and the eBPF traffic control module redirect are not directly attached to the traffic control tool tc, in addition, as Figure 4 and Figure 5 shown, the eBPF maps include a Prog Map, a Metrics Map and a Config Map.

[0106] The present application has the flexibility and scalability of user mode programs, and the efficiency and stability of kernel mode programs by introducing eBPF, and eBPF is a non-invasive technology that can be well implemented in a cloud-native environment. The present application uses eBPF tail call and eBPF map, and under the cooperation of user mode programs and kernel mode programs, complex business requirements can be flexibly implemented, such as using mature eBPF packet filtering mechanisms to implement traffic packet filtering, and global traffic control at the node level, without invasiveness, and can be well implemented in a cloud-native environment.

[0107] It should be noted that in actual application, multiple eBPF traffic collection modules, eBPF traffic filtering modules corresponding to each eBPF traffic collection module, and eBPF traffic control modules can be loaded in the kernel of the electronic device, each eBPF traffic collection module is attached to the traffic control tool, the traffic control tool acts on multiple virtual network interfaces of the kernel, and each virtual network interface is connected to a corresponding network namespace of the collection object; that is, the eBPF traffic collection module, the eBPF traffic filtering module, the eBPF traffic control module, the virtual network interface, and the collection object correspond one-to-one, and the collection and analysis of the traffic data packets of the corresponding collection object can be implemented through the eBPF traffic collection module, the eBPF traffic filtering module corresponding to the eBPF traffic collection module, and the eBPF traffic control module, and the present application does not limit this.

[0108] The cloud-native environment traffic analysis device provided by the present application will be described below, and the cloud-native environment traffic analysis device described below can be correspondingly referred to the cloud-native environment traffic analysis method described above.

[0109] Figure 6 is a structural schematic diagram of the cloud-native environment traffic analysis device provided by the embodiment of the present application, as Figure 6 shown, the cloud-native environment traffic analysis device 600 includes a collection unit 601, a calling unit 602, a first matching unit 603, and an analysis unit 604; wherein:

[0110] The collection unit 601 is configured to collect at least one traffic data packet of a target collection object in a cloud-native environment.

[0111] The calling unit 602 is configured to tail call an eBPF traffic filtering module and send at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module.

[0112] The first matching unit 603 is configured to match each of the first traffic data packets with a first preset filtering rule to obtain a first matching result, and the first preset filtering rule is used for filtering a preset traffic data packet set by a user.

[0113] The analysis unit 604 is configured to analyze a second traffic data packet representing a matching failure in the first matching result.

[0114] The traffic analysis device of the cloud native environment provided by the application has an eBPF traffic collection module and an eBPF traffic filtering module loaded in the kernel of the electronic device, at least one traffic data packet of a target collection object in the cloud native environment is collected by the eBPF traffic collection module, and the eBPF traffic filtering module is tail called, at least one first traffic data packet in the at least one traffic data packet is sent to the eBPF traffic filtering module, each first traffic data packet is matched with a first preset filtering rule by the eBPF traffic filtering module, a first matching result is obtained, and a second traffic data packet representing a matching failure in the first matching result is analyzed. It can be seen that the eBPF traffic collection module and the eBPF traffic filtering module configured in the kernel are used to realize the collection and analysis of traffic data packets. On the one hand, the eBPF has programmability, so the eBPF traffic collection module and the eBPF traffic filtering module can be loaded in the kernel at any time. On the other hand, the eBPF traffic collection module and the eBPF traffic filtering module are both eBPF programs, so the communication between the eBPF traffic collection module and the eBPF traffic filtering module can be realized by tail calling, thereby improving the flexibility of traffic collection and analysis.

[0115] Based on any of the above embodiments, the analysis unit 604 is specifically configured to:

[0116] The eBPF traffic control module is tail called, and the second traffic data packet is sent to a threat detection module through the eBPF traffic control module;

[0117] The threat detection module is used for threat analysis on the second traffic data packet to obtain a threat analysis result.

[0118] Based on any of the above embodiments, the traffic analysis device 600 of the cloud native environment further comprises:

[0119] The first generation unit is configured to generate an alarm log corresponding to the second traffic data packet in the case where the threat analysis result represents that the second traffic data packet includes threat traffic.

[0120] The first sending unit is configured to send the alarm log to a cloud-native proxy module, and the alarm log is used to instruct the cloud-native proxy module to send the enriched alarm log to a cloud security posture management platform through a cloud-native control module after enriching the alarm log.

[0121] Based on any of the above embodiments, the analysis unit 604 is further specifically configured to:

[0122] In a case where the flow rate limiting identifier is the first identifier, the second flow data packet is sent to a threat detection module through the eBPF flow control module; the first identifier is used to represent that the current flow bandwidth is not reduced.

[0123] Based on any of the above embodiments, the flow analysis device 600 of the cloud-native environment further includes:

[0124] The first determination unit is configured to obtain the size of each second flow data packet in the statistical list based on a preset period, and determine the current flow bandwidth based on the size of each second flow data packet currently obtained and the size of each second flow data packet last obtained.

[0125] The setting unit is configured to set the flow rate limiting identifier as a second identifier in a case where the current flow bandwidth is greater than the preset flow data packet bandwidth; the second identifier is used to represent that the current flow bandwidth is reduced.

[0126] Based on any of the above embodiments, the flow analysis device 600 of the cloud-native environment further includes:

[0127] The second generation unit is configured to generate a flow log corresponding to the first flow data packet.

[0128] The second sending unit is configured to send the flow log to a cloud-native proxy module; the flow log is used to instruct the cloud-native proxy module to send the enriched flow log to a cloud security posture management platform through a cloud-native control module after enriching the flow log.

[0129] Based on any of the above embodiments, the flow analysis device 600 of the cloud-native environment further includes:

[0130] The second matching unit is configured to match each flow data packet with a second preset filtering rule to obtain a second matching result; the second preset filtering rule is used to filter illegal flow data packets.

[0131] The second determination unit is configured to determine the flow data packet representing a matching failure in the second matching result as the first flow data packet.

[0132] Based on any of the above embodiments, the flow analysis device 600 of the cloud-native environment further includes:

[0133] a compiling unit, configured to compile an initial filter program in a preset format to obtain a cBPF instruction set;

[0134] a converting unit, configured to convert the cBPF instruction set into an eBPF instruction set;

[0135] a creating unit, configured to create the eBPF traffic collection module based on the eBPF instruction set.

[0136] Figure 7 is the entity structure schematic diagram of the electronic device provided by the embodiment of the present application, as Figure 7 shown, the electronic device can include: processor 710, communications interface (Communications Interface) 720, memory 730 and communication bus 740, wherein, processor 710, communications interface 720, memory 730 pass through communication bus 740 complete mutual communication.Processor 710 can call the logic instruction in memory 730, to execute the traffic analysis method of cloud native environment, the method includes: through eBPF traffic collection module, at least one traffic data packet of target collection object in cloud native environment is collected;

[0137] through the eBPF traffic collection module tail call eBPF traffic filtering module, and at least one first traffic data packet in the at least one traffic data packet is sent to the eBPF traffic filtering module;

[0138] through the eBPF traffic filtering module, each first traffic data packet is matched with first preset filter rule, and first matching result is obtained;The first preset filter rule is used to filter the preset traffic data packet set by user;

[0139] the second traffic data packet representing matching failure in the first matching result is analyzed.

[0140] Further, the logic instructions in the memory 730 described above can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or parts of the present application that essentially contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0141] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to perform the traffic analysis method of the cloud native environment provided by the above-mentioned methods, the method comprising: collecting at least one traffic data packet of a target collection object in a cloud native environment by an eBPF traffic collection module;

[0142] Tail-calling an eBPF traffic filtering module by the eBPF traffic collection module, and sending at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module;

[0143] Matching each of the first traffic data packets with a first preset filtering rule by the eBPF traffic filtering module to obtain a first matching result; the first preset filtering rule is used to filter a preset traffic data packet set by a user;

[0144] Analyzing a second traffic data packet representing a matching failure in the first matching result.

[0145] In yet another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, the computer program is executed by a processor to implement the traffic analysis method of the cloud native environment provided by the above-mentioned methods, the method comprising: collecting at least one traffic data packet of a target collection object in a cloud native environment by an eBPF traffic collection module;

[0146] Tail-calling an eBPF traffic filtering module by the eBPF traffic collection module, and sending at least one first traffic data packet in the at least one traffic data packet to the eBPF traffic filtering module;

[0147] Each of the first traffic data packets is matched with a first preset filtering rule by the eBPF traffic filtering module, to obtain a first matching result; the first preset filtering rule is used to filter a preset traffic data packet set by a user;

[0148] The second traffic data packet representing a matching failure in the first matching result is analyzed.

[0149] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0150] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0151] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A traffic analysis method for a cloud-native environment, characterized in that, An electronic device is used whereby an eBPF traffic acquisition module and an eBPF traffic filtering module are loaded into its kernel. The eBPF traffic acquisition module is attached to a traffic control tool (tc), which operates on the kernel's virtual network interface (veth). The eBPF traffic acquisition module is loaded onto the ingress and egress interfaces of the veth virtual network interface to acquire incoming and outgoing traffic data packets. The traffic control tool (tc) processes traffic in the ingress and egress directions of the network data path. The veth virtual network interface is connected to the network namespace of the target acquisition object. The method includes: The eBPF traffic acquisition module collects at least one traffic data packet of the target object in the cloud-native environment. The eBPF traffic acquisition module calls the eBPF traffic filtering module and sends at least one first traffic data packet from the at least one traffic data packet to the eBPF traffic filtering module. The eBPF traffic filtering module matches each of the first traffic data packets with a first preset filtering rule to obtain a first matching result; the first preset filtering rule is used to filter preset traffic data packets set by the user. The second traffic data packet representing the failed match in the first matching result is analyzed.

2. The traffic analysis method for cloud-native environments according to claim 1, characterized in that, The kernel also includes an eBPF traffic control module and a threat detection module. The analysis of the second traffic data packet representing the failed match in the first matching result includes: The eBPF traffic filtering module calls the eBPF traffic control module, and sends the second traffic data packet to the threat detection module through the eBPF traffic control module. The threat detection module performs threat analysis on the second traffic data packet to obtain the threat analysis results.

3. The traffic analysis method for cloud-native environments according to claim 2, characterized in that, The method further includes: If the threat analysis results indicate that the second traffic data packet contains threat traffic, an alarm log corresponding to the second traffic data packet is generated. The threat detection module sends the alarm logs to the cloud-native agent module. The alarm logs are used to instruct the cloud-native agent module to enrich the alarm logs, and then the cloud-native control module sends the enriched alarm logs to the cloud security posture management platform.

4. The traffic analysis method for cloud-native environments according to claim 2, characterized in that, The step of sending the second traffic data packet to the threat detection module through the eBPF traffic control module includes: When the traffic rate limiting identifier is the first identifier, the second traffic data packet is sent to the threat detection module through the eBPF traffic control module; the first identifier is used to indicate that the current traffic bandwidth is not reduced.

5. The traffic analysis method for cloud-native environments according to claim 2, characterized in that, The method further includes: The eBPF flow control module obtains the size of each second traffic data packet in the statistics list based on a preset period, and determines the current traffic bandwidth based on the size of each second traffic data packet obtained now and the size of each second traffic data packet obtained last time. When the eBPF traffic control module determines that the current traffic bandwidth is greater than the preset traffic data packet bandwidth, it sets the traffic rate limiting flag to a second flag, which is used to indicate that the current traffic bandwidth is reduced.

6. The traffic analysis method for cloud-native environments according to claim 1, characterized in that, The method further includes: The eBPF traffic acquisition module generates a traffic log corresponding to the first traffic data packet. The eBPF traffic acquisition module sends the traffic logs to the cloud-native agent module. The traffic logs are used to instruct the cloud-native agent module to enrich the traffic logs and then send the enriched traffic logs to the cloud security posture management platform through the cloud-native control module.

7. The traffic analysis method for cloud-native environments according to any one of claims 1-6, characterized in that, The method further includes: The eBPF traffic acquisition module matches each traffic data packet with a second preset filtering rule to obtain a second matching result; the second preset filtering rule is used to filter illegal traffic data packets. The traffic data packets that indicate a failed match in the second matching result are identified as the first traffic data packets.

8. The traffic analysis method for cloud-native environments according to any one of claims 1-6, characterized in that, The method further includes: The initial filtering program with the preset format is compiled to obtain the cBPF instruction set; Convert the cBPF instruction set to the eBPF instruction set; The eBPF traffic acquisition module is created based on the eBPF instruction set.

9. A traffic analysis device for a cloud-native environment, characterized in that, The traffic analysis method applied to the cloud-native environment according to any one of claims 1-8, the apparatus comprising: The acquisition unit is used to acquire at least one traffic data packet of the target acquisition object in a cloud-native environment; The calling unit is used to call the eBPF traffic filtering module and send at least one first traffic data packet from the at least one traffic data packet to the eBPF traffic filtering module. The first matching unit is used to match each of the first traffic data packets with the first preset filtering rules to obtain the first matching result; the first preset filtering rules are used to filter preset traffic data packets set by the user. The analysis unit is used to analyze the second traffic data packets that represent the failed match in the first matching result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the traffic analysis method for a cloud-native environment as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the traffic analysis method for a cloud-native environment as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the traffic analysis method for a cloud-native environment as described in any one of claims 1 to 8.

Images