Unified multi-version kernel service network traffic acquisition method and system based on high-performance non-invasive technology

Abstract

The invention discloses a unified multi-version kernel service network traffic acquisition method and system based on a high-performance non-intrusive technology, and belongs to the technical field of computers. The method comprises the following steps: collecting traffic according to a kernel type of an operating system; and analyzing the collected flow data. Through the scheme of the invention, efficient collection of network traffic in various kernel versions and operation environments can be realized, and technical obstacles caused by kernel version differences do not need to be worried about. No matter a high-performance server, a device with a low-version Linux kernel or a container or a cloud environment with limited authority, seamless flow capture and analysis can be realized by using the system provided by the invention. Meanwhile, the protocol analysis and flow topology function helps the user to quickly understand the network condition and output a unified flow index, thereby greatly improving the efficiency of network operation, maintenance and analysis.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a unified multi-version kernel service network traffic acquisition method and system based on high-performance non-intrusive technology. Background Art

[0002] With the development of network technology, the monitoring and analysis of network traffic has become the key to ensuring network security, optimizing network performance and managing traffic. Traffic acquisition can provide real-time data analysis to help operators identify abnormal traffic, optimize bandwidth usage, and improve user experience. Multi-version kernels allow multiple kernel versions to run on the same machine, which is very useful in testing, development, and troubleshooting. However, this also brings complexity to traffic acquisition. Due to the implementation differences of different kernel versions, existing traffic monitoring tools often face challenges in compatibility, performance, and accuracy. Non-intrusive technology refers to obtaining network traffic data without interfering with the normal operation of the system.

[0003] like Figures 1-2 As shown in Figure 1, traditional methods of collecting traffic information include using tools such as tcpdump and Wireshark, which capture traffic by listening to data packets on a network interface. These tools interact directly with a network interface (such as an Ethernet or wireless interface) and can monitor the data flow through the interface in real time. They use the API provided by the operating system (such as libpcap) to access network data.

[0004] Non-intrusive traffic acquisition is a more flexible and efficient network monitoring solution that can capture and analyze network traffic in real time. For example, eBPF technology monitors and captures data packets in real time by dynamically loading programs in kernel space. The flexibility of eBPF enables traffic analysis without interfering with the normal operation of the system.

[0005] In existing scenarios, actual applications still face challenges in compatibility, performance, security, and data integrity. These defects limit their widespread application and stability. For example, tools such as tcpdump and Wireshark capture traffic by listening to data packets on the network interface. They are suitable for a single kernel version, but in a multi-version kernel environment, they may face compatibility issues and performance issues, which will affect the performance of the host machine.

[0006] Kernel version compatibility: Different kernel versions may have different APIs and features, causing traffic acquisition tools to not work properly on some kernel versions. For example, the behavior or return values ​​of some system calls may change, which requires tools to be frequently updated to adapt to different environments. As the kernel is updated, some functions may be deprecated or replaced, which means that traffic acquisition tools that rely on these functions will become unreliable, increasing maintenance costs.

[0007] Security and permission management: Non-intrusive traffic acquisition usually requires higher system permissions, such as root permissions. This requirement may cause security risks, especially in multi-user systems, where unauthorized users may use high permissions to perform malicious activities. During traffic monitoring, the capture and storage of sensitive data may lead to data leakage. Failure to properly handle and encrypt this data will increase security risks.

[0008] Unified data format: Due to different kernel versions and different traffic monitoring tools, the final output data format is synchronized, cannot be managed and output in a unified manner, and the data availability is low. Summary of the invention

[0009] The object of the present invention is to provide an efficient unified multi-version kernel service network traffic acquisition method and system based on high-performance non-intrusive technology.

[0010] In order to solve the above technical problems, the present invention provides a unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology, comprising the following steps:

[0011] Traffic collection is performed based on the kernel type of the operating system;

[0012] Analyze the collected traffic data.

[0013] Preferably, traffic collection is performed according to the kernel type of the operating system, specifically including the following steps:

[0014] For operating systems with higher-version kernels, traffic collection is implemented based on eBPF technology.

[0015] For operating systems with lower-version kernels, traffic is collected through kernel modules.

[0016] For operating systems with unsupported or unprivileged kernels, traffic is collected in user mode based on the libpcap library.

[0017] Preferably, for an operating system whose kernel type is a high-version kernel, traffic collection is implemented based on eBPF technology, specifically including the following steps:

[0018] Through the tracepoint mechanism of the eBPF program, the network message data of the system call is obtained in the entry mount function of the Read and Write system calls and saved in the eBPF map;

[0019] Write the network message data in the eBPF map into shared memory;

[0020] When the number of network message data in the shared memory reaches the input parameter threshold, the user state process is awakened through the export mounting function of the Read and Write system calls to read and process the network request;

[0021] The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

[0022] Preferably, for an operating system whose kernel type is a low-version kernel, traffic collection is performed through a kernel module, specifically including the following steps:

[0023] The kernel module registers the traffic capture hook when it is initialized and mounts it into the network packet processing path;

[0024] The kernel module uses the traffic capture hook to obtain network packet data, encapsulates it into a custom data structure and writes it into shared memory;

[0025] When the network message data in the shared memory reaches the input parameter threshold, the user state process is awakened through the file descriptor eventfd to read and process the network request;

[0026] The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

[0027] Preferably, for an operating system whose kernel type is an unsupported or unauthorized kernel, traffic collection is performed based on the user state of the libpcap library, specifically comprising the following steps:

[0028] Set up filtering mechanisms;

[0029] Dynamically adjust the capture buffer size to adapt to different traffic loads;

[0030] Set the non-blocking mode and use multi-threading to capture the number of network message data in parallel on a high-performance server;

[0031] A user state buffer pool is set up for storing the number of captured network message data, the data packets are stored in the user state buffer pool, and batch processed.

[0032] Preferably, a filtering mechanism is provided;

[0033] Traffic filtering is performed through BPF optimization strategy, filtering traffic in user mode.

[0034] Preferably, each thread independently creates a pcap session and is bound to a different CPU core.

[0035] Preferably, dynamically adjusting the size of the capture buffer to adapt to different traffic loads specifically includes the following steps:

[0036] In high-traffic scenarios, increase the buffer size to avoid buffer overflow;

[0037] In low-traffic scenarios, shrinking the buffer reduces memory usage.

[0038] Preferably, the collected traffic data is analyzed;

[0039] Analyze network message data;

[0040] Use the TCP quadruple, pid, and fd information of the network message data to confirm whether the same request is initiated and related messages are received;

[0041] Parsing network message data includes protocol header and protocol content; the protocol header includes protocol code, message type, command code, command version and codec;

[0042] Parse the message content of the network message data, confirm the network protocol type through the fast failure mechanism, implement the message content parsing through the custom implementation of the Hessian2 deserialization parser, and implement the network protocol parsing by obtaining the requested URL related information.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] Through the solution of the present invention, efficient collection of network traffic can be achieved in various kernel versions and operating environments, without worrying about the technical barriers caused by kernel version differences. Whether it is a high-performance server, a device with a low-version Linux kernel, or a container or cloud environment with limited permissions, the system of the present invention can be used to achieve seamless traffic capture and analysis. At the same time, the protocol parsing and traffic topology functions help users quickly understand the network status, output unified traffic indicators, and greatly improve the efficiency of network operation and maintenance and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0046] Figure 1 It is a schematic diagram of the background technology architecture;

[0047] Figure 2 It is a schematic diagram of data flow of background technology;

[0048] Figure 3 This is a schematic diagram of data flow in the present invention. DETAILED DESCRIPTION

[0049] Many specific details are set forth in the following description to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present invention, so the present invention is not limited to the specific implementation disclosed below.

[0050] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0051] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0052] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0053] The present invention provides a unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology, comprising the following steps:

[0054] Traffic collection is performed based on the kernel type of the operating system;

[0055] Analyze the collected traffic data.

[0056] Preferably, traffic collection is performed according to the kernel type of the operating system, specifically including the following steps:

[0057] For operating systems with higher-version kernels, traffic collection is implemented based on eBPF technology.

[0058] For operating systems with lower-version kernels, traffic is collected through kernel modules.

[0059] For operating systems with unsupported or unprivileged kernels, traffic is collected in user mode based on the libpcap library.

[0060] Preferably, for an operating system whose kernel type is a high-version kernel, traffic collection is implemented based on eBPF technology, specifically including the following steps:

[0061] Through the tracepoint mechanism of the eBPF program, the network message data of the system call is obtained in the entry mount function of the Read and Write system calls and saved in the eBPF map;

[0062] Write the network message data in the eBPF map into shared memory;

[0063] When the number of network message data in the shared memory reaches the input parameter threshold, the user state process is awakened through the export mounting function of the Read and Write system calls to read and process the network request;

[0064] The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

[0065] Preferably, for an operating system whose kernel type is a low-version kernel, traffic collection is performed through a kernel module, specifically including the following steps:

[0066] The kernel module registers the traffic capture hook when it is initialized and mounts it into the network packet processing path;

[0067] The kernel module uses the traffic capture hook to obtain network packet data, encapsulates it into a custom data structure and writes it into shared memory;

[0068] When the network message data in the shared memory reaches the input parameter threshold, the user state process is woken up to read and process the network request;

[0069] The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

[0070] Preferably, for an operating system whose kernel type is an unsupported or unauthorized kernel, traffic collection is performed based on the user state of the libpcap library, specifically comprising the following steps:

[0071] Set up filtering mechanisms;

[0072] Dynamically adjust the capture buffer size to adapt to different traffic loads;

[0073] Set the non-blocking mode and use multi-threading to capture the number of network message data in parallel on a high-performance server;

[0074] A user state buffer pool is set up for storing the number of captured network message data, the data packets are stored in the user state buffer pool, and batch processed.

[0075] Preferably, a filtering mechanism is provided;

[0076] Traffic filtering is performed through BPF optimization strategy, filtering traffic in user mode.

[0077] Preferably, each thread independently creates a pcap session and is bound to a different CPU core.

[0078] Preferably, dynamically adjusting the size of the capture buffer to adapt to different traffic loads specifically includes the following steps:

[0079] In high-traffic scenarios, increase the buffer size to avoid buffer overflow;

[0080] In low-traffic scenarios, shrinking the buffer reduces memory usage.

[0081] Preferably, the collected traffic data is analyzed;

[0082] Analyze network message data;

[0083] Use the TCP quadruple, pid, and fd information of the network message data to confirm whether the same request is initiated and related messages are received;

[0084] Parsing network message data includes protocol header and protocol content; the protocol header includes protocol code, message type, command code, command version and codec;

[0085] Parse the message content of the network message data, confirm the network protocol type through the fast failure mechanism, implement the message content parsing through the custom implementation of the Hessian2 deserialization parser, and implement the network protocol parsing by obtaining the requested URL related information.

[0086] In order to better illustrate the technical effect of the present invention, the present invention provides the following specific embodiments to illustrate the above technical process:

[0087] Embodiment 1: A unified multi-version kernel service network traffic acquisition method and system based on high-performance non-intrusive technology:

[0088] Existing traffic monitoring solutions have problems with kernel version compatibility, security and permission management, and data format unification. The present invention designs a mechanism that can support efficient packet capture using eBPF / kernel modules in kernel space, and can also acquire traffic through user space tools such as libpcap. This design ensures that the appropriate traffic capture method can be flexibly selected in different scenarios and requirements to achieve optimal performance and resource utilization. A unified output information format is achieved. This allows traffic data from different sources to be processed and analyzed in a consistent manner, reducing the complexity of subsequent data analysis and improving data availability. Compatible with multiple hardware architectures and kernel versions to ensure that network traffic monitoring can be effectively performed regardless of whether it is a physical server, virtual machine or cloud environment.

[0089] The present invention can classify operating systems and kernel types into three categories, and provide corresponding traffic collection solutions for each type:

[0090] 1. Unsupported or unprivileged kernel: Use user-mode tools, agents, or third-party services to collect traffic. Windows: Non-Linux systems use different kernel architectures; Restricted environments: Such as containers (Docker), virtual machines, and some embedded devices, which may not have permission to load kernel modules or perform privileged operations; Old or streamlined Linux distributions: May lack necessary kernel functions or permissions.

[0091] 2. Custom kernel module (below 4.10): Use the kernel module mechanism for traffic collection. The kernel module mechanism is available, but does not support eBPF.

[0092] 3. eBPF-supported kernels (4.10 and above): Take full advantage of the power of eBPF, combined with ring buffers and shared memory, to achieve efficient traffic collection and analysis. eBPF is fully functional and allows efficient interaction between user mode and kernel mode.

[0093] The present invention provides a unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology, which specifically includes the following steps:

[0094] 1. Implement the Ebpf traffic collection solution

[0095] For high-version kernels, especially Linux systems that support eBPF, the present invention uses a traffic collection method based on eBPF technology. eBPF technology has the advantages of high efficiency, flexibility and non-intrusion, and can dynamically load traffic capture programs into the kernel without recompiling the kernel or installing additional drivers. Specifically, by mounting on the kernel's network stack, kindling uses eBPF to collect traffic at different stages when network packets arrive at the protocol stack, capturing detailed information on inbound and outbound traffic. At the same time, combined with XDP (eXpress Data Path), the performance of traffic collection can be further improved, especially in high-traffic environments. The specific process of obtaining traffic in the present invention is as follows:

[0096] (1) Through the tracepoint mechanism of the eBPF program, the input parameters of the system call (i.e., network message) are obtained in the entry mount function of the Read and Write system calls and saved in the eBPF map.

[0097] (2) In the exit mount function of the Read and Write system calls, the traffic information is written from the eBPF map to the traffic ring buffer (user-mode and kernel-mode shared memory, RingBuffer)

[0098] (3) When the number of network messages in the buffer reaches the threshold, the Read and Write system exit mount functions will wake up the user-mode process to read and process the network request;

[0099] (4) The user process reads the data in the shared memory, implements network protocol analysis, and finally realizes the standardized output of network indicators.

[0100] 2. Custom kernel module traffic collection solution

[0101] For low-version kernels, the present invention uses the traditional kernel module method to collect traffic. Although this method is more "invasive" than eBPF, it is the only efficient solution that can be executed in kernel state in low-version kernels. By writing a customized kernel module, the traffic capture function can be implemented, and the captured traffic data can be sent to the user state for processing and analysis.

[0102] (1) When the kernel module is initialized, it registers the traffic capture hook TRACEPOINT_PROBE and mounts it into the network packet processing path;

[0103] (2) TRACEPOINT_PROBE is used in the kernel to monitor the events of network devices sending data packets, encapsulate them into a custom data structure and write them into the traffic ring buffer (user-mode and kernel-mode shared memory);

[0104] (3) When the number of network messages in the buffer reaches the threshold, the user-mode process is awakened through the file descriptor eventfd to read and process the network request;

[0105] Waking up the user-mode process through the file descriptor eventfd is used as an event notification mechanism. When a certain condition is met (such as the number of network messages in the ring buffer reaches a threshold), the kernel can write a value to eventfd, which triggers the epoll_wait or read call that the user-mode process is waiting for. Specifically, the following steps are included:

[0106] 3.1. Create eventfd: Create an eventfd in the user state process.

[0107] 3.2. Passing filedescriptor to kernel module

[0108] Pass the file descriptor of eventfd to the kernel module through ioctl. Define a unique ioctl command number. You can use the _IOWR macro to define the command number, ensure that the command number is unique and indicate the parameter type and direction, then open the device file and communicate with the kernel module, call ioctl to pass the file descriptor to the kernel module.

[0109] 3.3. Trigger eventfd in the kernel.

[0110] When the number of network messages in the ring buffer reaches the threshold, the kernel module calls eventfd_signal to write a value to eventfd. For example: eventfd_signal(event_fd,1).

[0111] 3.4. User-mode process waits for events.

[0112] The user-mode process uses epoll or directly reads to wait for event notifications from eventfd.

[0113] 3.5. After the user-state process receives the event notification using epoll, it will wake up the user-state process, read and process the network request.

[0114] (4) The user process reads the data in the shared memory, implements network protocol analysis, and finally realizes the standardized output of network indicators.

[0115] 3. Traffic collection solutions that do not support or have no permission kernel

[0116] In some cases, the target operating system may not support the loading of kernel modules, or the operating environment may not have sufficient permissions to perform kernel-mode operations (such as restricted permissions in a cloud environment or container). In response to this, the present invention provides a user-mode traffic collection solution based on the libpcap library. libpcap is a user-mode traffic capture library that is suitable for various platforms. It can be used to obtain network data packets directly in user space without modifying the kernel. The present invention provides an optimization solution based on the libpcap library that can efficiently collect traffic data in user mode and ensure stability and high performance in complex network environments.

[0117] (1) Efficient filtering mechanism: Adopts a refined BPF (Berkeley Packet Filter) optimization strategy to filter unnecessary traffic in user mode and reduce the pressure of data packet processing.

[0118] (2) Adaptive buffer management: By dynamically adjusting the buffer size, the capture efficiency can be improved and packet loss can be reduced in environments with large traffic fluctuations. Use pcap_set_buffer_size() to dynamically adjust the capture buffer size to adapt to different traffic loads. For high-traffic scenarios, increasing the buffer size can effectively avoid buffer overflow and thus reduce the risk of packet loss; in low-traffic scenarios, the buffer size can be appropriately reduced to reduce memory usage.

[0119] (3) Asynchronous and multi-threaded capture mode: The non-blocking mode is combined with the multi-threaded capture method to improve the real-time performance and throughput of data processing. The non-blocking mode is set by pcap_setnonblock() so that traffic collection will not be blocked due to waiting for data. At the same time, on high-performance servers, multi-threaded parallel capture of data packets is used. Each thread independently creates a pcap session and is bound to a different CPU core, thereby improving the capture speed and parallel processing capabilities.

[0120] (4) User-mode cache pool optimization: Implement a cache pool in user mode to reduce frequent memory allocation and release operations and reduce system load. Design a user-mode cache pool dedicated to storing captured data packets, store the data packets in the cache pool, and process them in batches. Avoid frequent memory allocation and release operations, reduce the overhead of malloc and free calls, thereby reducing system overhead and improving overall throughput.

[0121] 4. Traffic protocol analysis solution

[0122] On the basis of traffic collection, the present invention also includes a protocol parsing system that can automatically identify and parse a variety of common network protocols (such as TCP, HTTP, DNS, MySQL, Redis, Kafka, SofaBolt, etc.). DataReceiver receives data, and by parsing the protocol header information, the system can build a traffic topology map to display the communication between network nodes, including source IP, destination IP, port information, data packet size, etc., so as to help users intuitively understand the direction of network traffic and load distribution.

[0123] The following is an example of SofaBolt protocol analysis:

[0124] (1) Obtain network message data collected by eBPF / custom kernel module / user-mode network card for analysis.

[0125] (2) Through the TCP four-tuple, pid, and fd information, it can be confirmed that it is a group of related messages initiated and received for the same request.

[0126] (3) The parsed message generally consists of two parts: the data message protocol header and the protocol content. The sofabolt protocol header content includes the protocol code, message type, command code, command version, and codec. The protocol parsing fast failure strategy is implemented through the protocol header. If it does not meet the protocol header standard, the next protocol parser is used.

[0127] (4) Parse the content of the sofabolt message. The network protocol type can be further confirmed through the fast failure mechanism. The sofabolt message serialization mechanism is Hessian2. The message content is parsed by customizing the Hessian2 deserialization parser. The sofabolt network protocol is parsed by obtaining the requested URL and other related information. The data is encapsulated and passed to the next analyzer.

[0128] The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology in this embodiment has the following characteristics:

[0129] 1) Creatively realize multi-kernel version adaptation, and optimize compatibility and performance, and adapt different kernel versions of common operating systems in advance. By dynamically loading the eBPF program and verifying its functionality, it is ensured that the system can run efficiently in the high-version kernel. The program interfaces with the kernel through the kernel header file to ensure compatibility with the target kernel version. After successfully injecting the eBPF program and confirming its validity, the system will switch to the eBPF mode for traffic capture. In the case where the kernel does not support eBPF or fails to load, the present invention performs traffic collection through a custom kernel module (.ko file). The kernel module is loaded through the insmod command and loaded and verified. After the kernel module is compiled, it will be adapted to the target kernel through the kernel header file to ensure compatibility with the current kernel version. If loading is successful, traffic collection will be performed through kernel mode. If both kernel modes (eBPF or custom kernel module) cannot be loaded, or in a permission-restricted environment such as a container, the program will fall back to using libpcap for traffic capture.

[0130] 2) Realize efficient traffic collection. Through eBPF and XDP technology, the present invention realizes efficient and almost non-intrusive traffic collection in high-version kernels. At the same time, by optimizing the kernel modules in low-version kernels, performance loss is minimized as much as possible.

[0131] 3) Realize protocol analysis and traffic topology. The system has its own protocol analysis function, which can automatically identify and analyze various network protocols, generate traffic topology diagrams and provide detailed traffic indicators, providing strong support for network management and monitoring.

[0132] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules, modules or units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units, modules or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0133] The units may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0134] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0135] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above-mentioned functions defined in the method of the present invention are executed. It should be noted that the above-mentioned computer-readable medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of an electrical, magnetic, optical, electromagnetic, infrared segment, or semiconductor, or any combination of the above.

[0136] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0137] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology, characterized in that: The following steps are involved: Traffic collection is performed based on the kernel type of the operating system; Analyze the collected traffic data.

2. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 1 is characterized in that: Traffic collection is performed based on the kernel type of the operating system, including the following steps: For operating systems with higher-version kernels, traffic collection is implemented based on eBPF technology. For operating systems with lower-version kernels, traffic is collected through kernel modules. For operating systems with unsupported or unprivileged kernels, traffic is collected in user mode based on the libpcap library.

3. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 2 is characterized in that: For operating systems with higher-version kernels, traffic collection is implemented based on eBPF technology, which includes the following steps: Through the tracepoint mechanism of the eBPF program, the network message data of the system call is obtained in the entry mount function of the Read and Write system calls and saved in the eBPF map; Write the network message data in the eBPF map into shared memory; When the number of network message data in the shared memory reaches the input parameter threshold, the user state process is awakened through the export mount function of the Read and Write system calls to read and process the network request; The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

4. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 2 is characterized in that: For operating systems with lower-version kernels, traffic collection is performed through kernel modules, which specifically includes the following steps: The kernel module registers the traffic capture hook when it is initialized and mounts it into the network packet processing path; The kernel module uses the traffic capture hook to obtain network packet data, encapsulates it into a custom data structure and writes it into shared memory; When the network message data in the shared memory reaches the input parameter threshold, the user state process is awakened through the file descriptor eventfd to read and process the network request; The user-mode process reads the network message data in the shared memory, performs network protocol analysis, and then realizes the normalized output of network indicators.

5. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 2 is characterized in that: For operating systems with unsupported or unauthorized kernels, traffic collection is performed in user mode based on the libpcap library, specifically including the following steps: Set up filtering mechanisms; Dynamically adjust the capture buffer size to adapt to different traffic loads; Set the non-blocking mode and use multi-threading to capture the number of network message data in parallel on a high-performance server; A user state buffer pool is set up for storing the number of captured network message data, the data packets are stored in the user state buffer pool, and batch processed.

6. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 5 is characterized in that: Set up filtering mechanisms; Traffic filtering is performed through BPF optimization strategy, filtering traffic in user mode.

7. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 6 is characterized in that: Each thread creates a pcap session independently and is bound to a different CPU core.

8. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 7 is characterized in that: Dynamically adjust the capture buffer size to accommodate different traffic loads. This includes the following steps: In high-traffic scenarios, increase the buffer size to avoid buffer overflow; In low-traffic scenarios, reducing the buffer size reduces memory usage.

9. The unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology according to claim 1 is characterized in that: Analyze the collected traffic data; Analyze network message data; Use the TCP quadruple, pid, and fd information of the network message data to confirm whether the same request is initiated and related messages are received; Parsing network message data includes protocol header and protocol content; the protocol header includes protocol code, message type, command code, command version and codec; Parse the message content of the network message data, confirm the network protocol type through the fast failure mechanism, implement the message content parsing through the custom implementation of the Hessian2 deserialization parser, and implement the network protocol parsing by obtaining the requested URL related information.

10. A unified multi-version kernel service network traffic acquisition system based on high-performance non-intrusive technology, used to implement the unified multi-version kernel service network traffic acquisition method based on high-performance non-intrusive technology as described in any one of claims 1-9, characterized in that: include: A collection module is used to collect traffic according to the kernel type of the operating system; The parsing module is used to parse the collected traffic data.

Images