Data packet analysis method and device based on eBPF and electronic equipment

Abstract

The invention discloses a data packet analysis method and device based on eBPF and electronic equipment. Relates to the field of cloud computing, and the method comprises the steps that a to-be-analyzed data packet captured by an eBPF kernel mode program from an operating system kernel is acquired based on an extended Berkley data packet filter eBPF user mode program, the eBPF user mode program is a program running in a user space of an operating system, and the eBPF kernel mode program is a program running in a kernel space of the operating system; determining a target analytic function; a target analytic function on a function calculation platform is called through the flow entry function, and the function calculation platform is a service system for operating the function according to needs; and based on the target analysis function, performing analysis processing on the to-be-analyzed data packet to obtain an analysis result of the to-be-analyzed data packet. According to the method and the device, the problem of limited processing capability of an eBPF flow analysis system on a single node in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and more specifically, to a method, device and electronic device for parsing data packets based on eBPF. Background Art

[0002] Business non-intrusive observation technology is one of the hot technologies in the field of observability technology. It refers to a method for detecting system status and behavior without changing or interfering with business system code and operations. Among them, eBPF-based business non-intrusive observation technology has attracted widespread attention in the industry because it has kernel-level data monitoring capabilities and can be applied to multiple fields such as system calls, network performance, application processes, file systems, etc., to achieve fine-grained and highly effective network monitoring. However, in order to ensure efficiency, the eBPF-based business non-intrusive observation capability usually parses traffic locally on the device where it is deployed. Therefore, it is limited by the performance and architecture of a single machine and lacks the ability to concurrently analyze large-scale traffic. Moreover, even if an additional remote server is deployed to parse the traffic, it is still difficult to ensure the efficiency of large-scale traffic parsing due to the fixed number of resources of the remote server.

[0003] With regard to the problem of limited processing capability of the eBPF traffic analysis system on a single node in related technologies, no effective solution has been proposed so far. Summary of the invention

[0004] The main purpose of the present application is to provide a data packet parsing method, device and electronic device based on eBPF to solve the problem of limited processing capacity of the eBPF traffic analysis system on a single node in the related art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a packet parsing method based on eBPF is provided. The method includes: based on the extended Berkeley packet filter eBPF user-state program, obtaining the data packet to be parsed captured by the eBPF kernel-state program from the operating system kernel, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; determining the target parsing function; calling the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system for running functions on demand; based on the target parsing function, parsing the data packet to be parsed to obtain the parsing result of the data packet to be parsed.

[0006] Optionally, the target parsing function includes: determining a target traffic type of the data packet to be parsed; and determining a target parsing function that matches the target traffic type from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types.

[0007] Optionally, before obtaining the data packet to be parsed captured by the kernel-state eBPF program from the operating system kernel based on the extended Berkeley packet filter eBPF user-state program, the method also includes: loading the kernel-state eBPF program into the operating system kernel; establishing an association relationship between the kernel-state eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-state eBPF program inserts and runs code when a predetermined kernel event or function call occurs.

[0008] Optionally, loading the kernel-state eBPF program into the operating system kernel includes: detecting whether the instructions included in the kernel-state eBPF program meet predetermined conditions; if the instructions included in the kernel-state eBPF program meet the predetermined conditions, loading the kernel-state eBPF program into the operating system kernel.

[0009] Optionally, before obtaining the data packet to be parsed captured by the kernel-state eBPF program from the operating system kernel based on the eBPF user-state program, the method also includes: obtaining the network data packet being processed by the operating system; detecting whether the network data packet is associated with the target mount point; when the network data packet is associated with the target mount point, calling the kernel-state eBPF program associated with the target mount point; and capturing the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-state eBPF program.

[0010] Optionally, based on the kernel-state eBPF program, the data packets to be parsed corresponding to the network data packets are captured from the operating system kernel, including: using the kernel-state eBPF program to capture the network data packets; using the kernel-state eBPF program to process the network data packets to obtain the data packets to be parsed.

[0011] Optionally, when there are N target parsing functions and the N target parsing functions are arranged according to a preset processing flow, the data packet to be parsed is parsed based on the target parsing function to obtain a parsing result of the data packet to be parsed, including: starting from the first target parsing function among the N target parsing functions, using the first N-1 parsing functions among the N target parsing functions to parse the data packet to be parsed in turn to obtain a parsing result, wherein N is an integer greater than or equal to 2; using the last target parsing function among the N target parsing functions to forward the parsing result to the target address for storage and / or display.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a packet parsing device based on eBPF is provided. The device includes: an acquisition module, which is used to acquire the data packet to be parsed captured by the eBPF kernel program from the operating system kernel based on the extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; a determination module, which is used to determine the target parsing function; a calling module, which is used to call the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and a parsing module, which is used to parse the data packet to be parsed based on the target parsing function to obtain the parsing result of the data packet to be parsed.

[0013] Optionally, the determination module includes: a first determination submodule, used to determine the target traffic type of the data packet to be parsed; and a second determination submodule, used to determine a target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0014] Optionally, the device also includes: a first loading submodule, used to load the kernel-state eBPF program into the operating system kernel; a first establishing submodule, used to establish an association relationship between the kernel-state eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-state eBPF program inserts and runs the code when a predetermined kernel event or function call occurs.

[0015] Optionally, the first loading sub-module also includes: a first detection sub-module, used to detect whether the instructions included in the kernel-state eBPF program meet predetermined conditions; and a second loading sub-module, used to load the kernel-state eBPF program into the operating system kernel when the instructions included in the kernel-state eBPF program meet predetermined conditions.

[0016] Optionally, the device also includes: a first acquisition sub-module, used to acquire the network data packet being processed by the operating system; a second detection sub-module, used to detect whether the network data packet is associated with the target mount point; a first calling sub-module, used to call the kernel-state eBPF program associated with the target mount point when the network data packet is associated with the target mount point; and a first capturing sub-module, used to capture the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-state eBPF program.

[0017] Optionally, the first capture submodule includes: a second capture submodule, used to capture network data packets using a kernel-state eBPF program; and a first processing submodule, used to process the network data packets using a kernel-state eBPF program to obtain data packets to be parsed.

[0018] Optionally, the parsing module includes: a first parsing submodule, used to start from the first target parsing function among N target parsing functions, and use the first N-1 parsing functions among the N target parsing functions to parse and process the data packet to be parsed in turn to obtain a parsing result, wherein N is an integer greater than or equal to 2; a first storage submodule, used to use the last target parsing function among the N target parsing functions to forward the parsing result to a target address for storage and / or display.

[0019] In an embodiment of the present application, a data packet to be parsed captured by an eBPF kernel-state program from an operating system kernel is obtained through an extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; a target parsing function is determined; the target parsing function on a function computing platform is called through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; based on the target parsing function, the data packet to be parsed is parsed and processed to obtain a parsing result of the data packet to be parsed, thereby achieving the purpose of real-time and efficient parsing of large-scale network traffic, thereby achieving the technical effect of improving the traffic parsing and analysis capability and scalability based on eBPF, and further solving the technical problem of being unable to realize concurrent analysis of large-scale traffic due to the limited processing capability of traditional eBPF traffic analysis systems on a single node. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 A hardware structure block diagram of a computer terminal for implementing a data packet parsing method based on eBPF is shown;

[0022] Figure 2 is a flowchart of a data packet parsing method based on eBPF provided according to an embodiment of the present application;

[0023] Figure 3 is a flowchart of an optional eBPF-based data packet parsing method according to an embodiment of the present application;

[0024] Figure 4 is a schematic diagram of a data packet parsing device based on eBPF provided according to an embodiment of the present application;

[0025] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0029] The extended Berkeley Packet Filter (eBPF) is a powerful kernel function extension mechanism that allows developers to safely run user-defined bytecode programs in the Linus (Linux) kernel.

[0030] An eBPF user-space program is an application running in the user space of the operating system. It is responsible for interacting with the eBPF kernel-space program, including loading kernel-space programs, configuring parameters, reading data or metadata captured by kernel-space programs, and performing advanced processing and analysis on these data.

[0031] eBPF kernel-space eBPF Program refers to a bytecode program running in the Linux kernel, which directly captures and preliminarily processes system calls, network data packets, etc., and shares data with user-space programs through Berkeley Packet Filter Maps (BPF Maps) to achieve low-latency, high-throughput data monitoring and control.

[0032] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0033] Example 1

[0034] According to an embodiment of the present application, a method embodiment of eBPF-based packet parsing is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a packet parsing method based on eBPF. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0036] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the eBPF-based packet parsing method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned eBPF-based packet parsing method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0039] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0040] Under the above operating environment, this application provides Figure 2 The eBPF-based packet parsing method shown. Figure 2 It is a flowchart of the eBPF-based data packet parsing method according to Example 1 of the present application.

[0041] Step S200, based on the extended Berkeley Packet Filter eBPF user-state program, obtaining the data packet to be parsed captured by the eBPF kernel-state program from the operating system kernel, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system;

[0042] Optionally, the eBPF kernel-mode program runs in the operating system kernel space and can directly capture and perform preliminary processing on network packets, such as filtering, modifying, or redirecting packets. The eBPF program runs in the kernel and can capture packets with very low latency. The eBPF kernel-mode program uses its unique instruction set and data structures (such as BPF Maps) to perform these operations, which can ensure the efficiency and security of data collection. The captured packets need to be passed to the user-mode program for further processing. Through the eBPF user-mode program, data transfer from kernel mode to user mode can be achieved. This can be done through BPFMaps or through the Linux performance monitoring mechanism Perf_events (Perf).

[0043] The operating system kernel may be a Linux system kernel, and the data counter, as part of the user-mode program, is responsible for reading data from BPF Maps. BPF Maps is a data structure in eBPF, used to share data between user mode and kernel mode, supporting multiple types of efficient data storage and access, and providing a mechanism for efficient sharing of data between kernel mode and user mode. Perf is a subsystem of the Linux kernel, used to provide access to and control of point and system hardware performance data.

[0044] It should be noted that eBPF kernel-mode programs run directly in kernel space and have access to kernel data and resources, but in order to prevent potential security risks such as buffer overflow or illegal memory access, the bytecode of kernel-mode programs undergoes strict verification checks before being loaded into the kernel. User-mode programs are responsible for writing, compiling, and loading these programs. They run in restricted user space and cannot directly access or modify kernel data, thus forming a secure isolation between user code and the kernel.

[0045] Optionally, the eBPF user-mode program also includes a function trigger module, which uses the collected data packets as events to trigger the traffic entry function on the function computing platform. This function can enhance the flexibility of eBPF technology, enabling it to be seamlessly integrated with the Serverless architecture to achieve high-concurrency processing of traffic parsing, where the Serverless architecture is a serverless architecture.

[0046] In an optional embodiment, before obtaining the data packet to be parsed captured by the kernel-state eBPF program from the operating system kernel based on the extended Berkeley packet filter eBPF user-state program, the method also includes: loading the kernel-state eBPF program into the operating system kernel; establishing an association relationship between the kernel-state eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-state eBPF program inserts and runs the code when a predetermined kernel event or function call occurs.

[0047] It should be noted that the target mount point, or Hook point, refers to a specific location in the Linux kernel where the eBPF program can be mounted or associated to execute when a specific event occurs. The Hook point can be an event of sending or receiving packets on a network interface, the entry and exit of a system call, or other key locations in the kernel. By associating the eBPF program with the Hook point, it is possible to monitor and process kernel data and events without modifying the kernel code.

[0048] Optionally, the kernel-mode eBPF program loading process is completed by the eBPF user-mode program calling specific eBPF tools, such as the BPF Compiler Collection (BCC) and the Berkeley packet filtering tool Bpftool. During the loading process, the kernel's built-in eBPF security verifier will perform static analysis on each instruction in the program to ensure its security and compliance and prevent potential malicious code from entering the kernel. Establishing an association relationship means connecting the kernel-mode eBPF program with the target mount point (such as a network port, kernel function entry and exit, etc.), so that the eBPF program can be automatically inserted and run when a predetermined kernel event or function call occurs. This can be achieved through tracepoints, kernel probe points (KProbes) or user-mode probe points (UProbes) technology, and is completed by calling the BPF program association (bpf_prog_attach), association kernel probe point (bpf_attach_kprobe) and other functions that come with the Linux system. After establishing the association, the kernel-mode eBPF program can efficiently access and process related network traffic when a specific event is triggered.

[0049] Among them, BCC is a collection of BPF compilers; Bpftool is a command-line tool for managing and debugging eBPF kernel-mode programs, supporting loading, unloading, and viewing eBPF kernel-mode programs and related information; Tracepoints is a technology that can insert monitoring points at predefined locations and events in Linux; KProbes is a Linux kernel dynamic plug-in mechanism that allows developers to dynamically insert Hook points into kernel functions for monitoring and debugging kernel behavior without recompiling the kernel, and corresponds to the UProbes mechanism in user mode; UProbes is a Linux dynamic plug-in mechanism that allows developers to insert Hook points at specified locations in user space programs. Corresponding to the KProbes mechanism in kernel mode.

[0050] It should be noted that kernel functions refer to functions defined and executed in the operating system kernel, which constitute the core functions of the kernel and are responsible for handling tasks that directly interact with hardware, managing system resources, and providing underlying services to user-mode applications. Kernel functions run in kernel space and have full access to system resources, including direct operation of physical memory, interrupt processing, device driver control, process scheduling, system call processing, etc.

[0051] In an optional embodiment, loading a kernel-state eBPF program into an operating system kernel includes: detecting whether instructions included in the kernel-state eBPF program meet predetermined conditions; if the instructions included in the kernel-state eBPF program meet the predetermined conditions, loading the kernel-state eBPF program into the operating system kernel.

[0052] Optionally, the detection process can be implemented by the eBPF security verifier that comes with the Linux kernel. Each instruction in the kernel-state eBPF program is checked to ensure that the instruction set meets the restrictions of eBPF and does not pose a threat to system security. The predetermined conditions may include, but are not limited to, restrictions on the number of instructions, disallowed instruction types, resource access permissions, etc., to prevent potential attacks or erroneous code from adversely affecting the operating system. The eBPF security verifier also checks whether the program follows the rules and conventions of the kernel to ensure that the normal operating process of the kernel is not violated during loading and execution, such as avoiding infinite loops, incorrect memory access, etc.

[0053] Through the above detection, it can be decided whether to load the eBPF program into the kernel. Only when the program meets all security and compliance conditions will the loading process continue, otherwise the program will be rejected to prevent potential problem codes from entering the kernel environment.

[0054] In an optional embodiment, before obtaining the data packet to be parsed captured by the kernel-state eBPF program from the operating system kernel based on the eBPF user-state program, the method also includes: obtaining the network data packet being processed by the operating system; detecting whether the network data packet is associated with the target mount point; when the network data packet is associated with the target mount point, calling the kernel-state eBPF program associated with the target mount point; and capturing the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-state eBPF program.

[0055] Optionally, by detecting whether the network packet being processed is associated with a preset target mount point, it can be ensured that only packets related to specific kernel events or function calls are captured by the kernel-mode eBPF program. This accuracy can avoid capturing unnecessary packets, reduce data processing overhead, and improve the overall efficiency of the system. The kernel-mode eBPF program is only called when the network packet matches the target mount point. The process of calling the eBPF program and capturing the packet is fully automated without human intervention, which not only simplifies the operation process, but also reduces errors and delays caused by manual configuration or operation, making traffic monitoring and processing more efficient and reliable.

[0056] In an optional embodiment, based on the kernel-state eBPF program, the data packets to be parsed corresponding to the network data packets are captured from the operating system kernel, including: using the kernel-state eBPF program to capture the network data packets; using the kernel-state eBPF program to process the network data packets to obtain the data packets to be parsed.

[0057] Optionally, the kernel-mode eBPF program can capture packets directly when they reach the operating system network stack, without the need for multiple data transfers and conversions by the user-space program, which can greatly improve capture efficiency and reduce packet processing latency. The kernel-mode eBPF program can perform real-time preprocessing on captured network packets, such as filtering, copying, and modifying, to reduce the load of subsequent user-mode parsing processes. It can not only filter out packets that need further parsing, but also add necessary metadata to these packets, such as the packet's timestamp, source IP address, etc., to provide richer information for subsequent traffic analysis.

[0058] Step S202, determining the target analytical function;

[0059] Optionally, in large-scale traffic monitoring, network data packets can cover a variety of protocols and formats. Determining the target parsing function can select the most suitable parsing function according to the type or characteristics of the data packet, which helps to accurately and efficiently parse different types of traffic. Different parsing requirements require different parsing logic. Determining the target parsing function can call the corresponding parsing function for specific needs to achieve customized parsing processing. By selecting the parsing function that best matches the traffic type, it is possible to avoid performance waste when using a general parsing function to process a specific type of traffic, thereby improving the efficiency and speed of parsing.

[0060] In an optional embodiment, determining a target parsing function includes: determining a target traffic type of a data packet to be parsed; and determining a target parsing function that matches the target traffic type from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types.

[0061] Optionally, through this embodiment, the traffic type of the data packet to be parsed can be intelligently determined, and the most appropriate parsing function can be selected according to the type. Different traffic types contain different data structures and protocols. Through intelligent selection, it can be ensured that the most suitable parsing logic is used to process the data packet, thereby improving the accuracy and efficiency of the parsing. The precise matching of traffic type and parsing function can avoid the waste of resources of general parsing functions. By selecting a parsing function that matches the target traffic type from multiple traffic parsing functions, the system can support traffic parsing of multiple protocols, providing a basis for building a comprehensive network monitoring and analysis system, which can cover everything from basic network layer protocols to advanced application layer protocols.

[0062] Step S204, calling the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system for running functions on demand;

[0063] Optionally, the traffic entry function acts as a bridge between the eBPF user-mode program and the function computing platform, and can quickly distribute the data packets to be parsed to multiple parsing function instances on the function computing platform according to the size and type of the traffic. It can process a large number of data packets at the same time without reducing the overall processing speed due to the bottleneck of a single parser. The on-demand operation of the function computing platform can dynamically adjust the number of instances of the parsing function according to the size of the real-time traffic. When the traffic increases, the running instances of the parsing function can be automatically increased, and vice versa, to ensure efficient use of resources and elastic expansion and contraction of the system. The traffic entry function can intelligently select the target parsing function on the function computing platform according to the protocol or type of the data packet, which can ensure that the data packet is processed by the most suitable parser and improve the accuracy and efficiency of the parsing.

[0064] Among them, the function computing platform is the Serverless function computing platform, which refers to a platform that can run function language images. Through this function computing platform, the parsing function can be run on demand.

[0065] It should be noted that the function computing platform is a serverless computing service based on event triggering and dynamic expansion. In this application, it serves as the hub for traffic parsing, responsible for receiving traffic data forwarded by eBPF user-mode programs, and distributing it to multiple parallel parsing functions to achieve high-concurrency processing and analysis of large-scale traffic. It allows users to upload functions, which are automatically called for processing when specific events occur, without the need for users to manage the operation and expansion of the underlying servers. This service model can automatically adjust resources based on actual load, and is particularly effective for processing high-concurrency, event-driven tasks.

[0066] Step S206, based on the target parsing function, the data packet to be parsed is parsed to obtain a parsing result of the data packet to be parsed.

[0067] Optionally, the target parsing function is selected based on the specific type of the data packet to be parsed, and can provide accurate parsing logic to conduct in-depth analysis of the header information, payload content, protocol features, etc. of the data packet. The ultimate goal of the parsing process is to generate parsing results, which may include but are not limited to metadata of the data packet (such as source IP, destination IP, timestamp, etc.), useful information after protocol decoding, and any possible anomalies or performance indicators. The parsing results can be used for subsequent data analysis, performance monitoring, security testing and other applications. The processing power of the target parsing function directly affects the accuracy and efficiency of the application.

[0068] The useful information after protocol decoding may refer to a Uniform Resource Locator (URL) requested by a HyperText Transfer Protocol (HTTP), a domain name queried by a Domain Name System (DNS), and the like.

[0069] In an optional embodiment, when there are N target parsing functions and the N target parsing functions are arranged according to a preset processing flow, the data packet to be parsed is parsed based on the target parsing function to obtain a parsing result of the data packet to be parsed, including: starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used to parse the data packet to be parsed in turn to obtain a parsing result, wherein N is an integer greater than or equal to 2; and the last target parsing function among the N target parsing functions is used to forward the parsing result to the target address for storage and / or display.

[0070] Optionally, N target parsing functions can be designed to perform a series of sequential processing steps, from preliminary traffic type identification to complex packet content analysis, and then to advanced network behavior detection. The phased processing approach allows for deeper and more complex parsing of packets. Each parsing function can focus on performing specific parsing tasks, such as protocol decoding, data statistics, security checks, etc. The design can be more modular, easy to maintain and expand. Through the preset processing flow, the data flow can be effectively managed to ensure that the data packets are passed to each parsing function in the correct order and logic, avoiding confusion in processing order or data loss.

[0071] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation of a data packet parsing method based on eBPF. Figure 3 1 is a flow chart of an optional eBPF-based packet parsing method according to an embodiment of the present application. The method includes:

[0072] Step S1, compile: The user state program or the user manually compiles the eBPF kernel state program into a bytecode program to be loaded and used later.

[0073] Step S2, load and associate the Hook point. The user-state program uses eBPF user-state tools such as BCC and Bpftool to load the kernel-state program or the kernel-state bytecode program compiled by the tool into the Linux kernel. During the loading process, the Linux kernel's built-in eBPF security verifier will perform static analysis on each instruction in the kernel-state program to ensure its compliance and security. After loading is completed, the user-state program needs to confirm the association between the kernel-state eBPF program and the mount Hook point. The Linux system predefines Hook points at important locations such as network ports and kernel function entrances and exits. User-state programs can obtain these Hook points through Tracepoints technology, or insert additional Hook points at specified locations in the system through KProbes and UProbes technology. After determining the Hook point to be associated, the user-state program can complete the association between the kernel-state program and the Hook point by calling the bpf_prog_attach, bpf_attach_kprobe and other functions that come with the Linux system.

[0074] Step S3, collect and transmit traffic. After completing the Hook point association, the Linux system will automatically run the eBPF kernel-state program when a data packet passes through the Hook point. After the kernel-state program runs, the BPF program instruction set can be used to access the header or payload data of the data packet. At this time, the eBPF kernel-state program can perform protocol judgment, copy, discard, modify, redirect, and total statistics on the traffic data, and can copy the filtered or processed data to the BPFMaps shared by the kernel state and the user state, which will be read regularly by the data statistics device of the user state program, or the data will be pushed directly to the perf_events data module of the user state program through the Linux performance monitoring mechanism Perf_events, and further processed by the user state program.

[0075] Step S4, traffic data replication: The data counter of the user-mode program and the perf_events data module will copy the data to the function trigger module.

[0076] Step S5: Traffic forwarding: When receiving data, the function trigger module of the user-mode program will immediately carry the traffic to trigger the traffic entry function of the function computing platform.

[0077] Step S6: Divert and process traffic according to traffic type. The entry function of the function computing platform will select different function workflows according to traffic of different protocols, and then immediately carry the traffic to trigger the first function of the workflow to perform full-process analysis of the traffic.

[0078] Step S7, forwarding the parsed data. After the traffic parsing is completed, the last function of the workflow will forward the parsed data to the address according to the preset or previous address passed by the previous function, and perform operations such as saving and displaying, thus completing the entire traffic processing.

[0079] Through the above steps, and with the help of the dynamic expansion capability of the Function Compute platform, the rate of traffic analysis can be guaranteed in the scenario of large-scale traffic analysis, and high-concurrency analysis can be achieved.

[0080] It should be noted that the packet parsing method based on eBPF provided in the embodiment of the present application obtains the packet to be parsed captured by the eBPF kernel-state program from the kernel of the operating system through the extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; determines the target parsing function; calls the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system for running functions on demand; based on the target parsing function, the packet to be parsed is parsed and processed to obtain the parsing result of the packet to be parsed, which solves the problem of limited processing capacity of the eBPF traffic analysis system on a single node in the related technology. And then achieves the purpose of real-time and efficient parsing of large-scale network traffic, thereby achieving the effect of improving the parsing analysis capability and scalability of traffic based on eBPF.

[0081] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0082] Example 2

[0083] The embodiment of the present application also provides a packet parsing device based on eBPF. It should be noted that the packet parsing device based on eBPF in the embodiment of the present application can be used to execute the packet parsing method based on eBPF provided in the embodiment of the present application. The following introduces the packet parsing device based on eBPF provided in the embodiment of the present application.

[0084] According to an embodiment of the present application, a device for implementing the above-mentioned eBPF-based packet parsing method is also provided, such as Figure 4 As shown, the device includes: an acquisition module 300, which is used to acquire the data packet to be parsed captured by the eBPF kernel-state program from the operating system kernel based on the extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; a determination module 302, connected to the acquisition module 300, used to determine the target parsing function; a calling module 304, connected to the determination module 302, used to call the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system that runs functions on demand; a parsing module 306, connected to the calling module 304, used to parse the data packet to be parsed based on the target parsing function to obtain the parsing result of the data packet to be parsed.

[0085] The packet parsing device based on eBPF provided in the embodiment of the present application is provided with an acquisition module 300, which is used to acquire the packet to be parsed captured by the eBPF kernel-state program from the kernel of the operating system based on the extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; a determination module 302, which is used to determine the target parsing function; a calling module 304, which is used to call the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system for running functions on demand; a parsing module 306, which is used to parse the packet to be parsed based on the target parsing function, and obtain the parsing result of the packet to be parsed, thereby solving the problem of limited processing capacity of the eBPF traffic analysis system on a single node in the related art. Thus, the purpose of real-time and efficient parsing of large-scale network traffic is achieved, thereby achieving the effect of improving the parsing analysis capability and scalability of traffic based on eBPF.

[0086] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, a determination module includes: a first determination submodule, used to determine a target traffic type of the packet to be parsed; and a second determination submodule, used to determine a target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0087] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, the device also includes: a first loading submodule, used to load the kernel-state eBPF program into the operating system kernel; a first establishing submodule, used to establish an association relationship between the kernel-state eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-state eBPF program inserts and runs the code when a predetermined kernel event or function call occurs.

[0088] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, the first loading sub-module also includes: a first detection sub-module, used to detect whether the instructions included in the kernel-state eBPF program meet predetermined conditions; a second loading sub-module, used to load the kernel-state eBPF program into the operating system kernel when the instructions included in the kernel-state eBPF program meet predetermined conditions.

[0089] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, the device also includes: a first acquisition sub-module, used to acquire the network data packet being processed by the operating system; a second detection sub-module, used to detect whether the network data packet is associated with the target mount point; a first calling sub-module, used to call the kernel-state eBPF program associated with the target mount point when the network data packet is associated with the target mount point; and a first capturing sub-module, used to capture the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-state eBPF program.

[0090] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, the first capture sub-module includes: a second capture sub-module, used to capture network data packets using a kernel-state eBPF program; and a first processing sub-module, used to process network data packets using a kernel-state eBPF program to obtain data packets to be parsed.

[0091] Optionally, in the eBPF-based packet parsing device provided in an embodiment of the present application, the parsing module includes: a first parsing submodule, used to start from the first target parsing function among N target parsing functions, and use the first N-1 parsing functions among the N target parsing functions to parse the data packet to be parsed in turn to obtain a parsing result, wherein N is an integer greater than or equal to 2; a first storage submodule, used to use the last target parsing function among the N target parsing functions to forward the parsing result to the target address for storage and / or display.

[0092] It should be noted that the acquisition module 300, the determination module 302, the calling module 304, and the parsing module 306 correspond to steps S200 to S206 in Example 1, and the examples and application scenarios implemented by the two modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be part of the device and can be run in the computer terminal 10 provided in Example 1.

[0093] Example 3

[0094] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 1002, memory 1004, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0095] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0096] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: based on the extended Berkeley Packet Filter eBPF user-state program, obtain the data packet to be parsed captured by the eBPF kernel-state program from the operating system kernel, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; determine the target parsing function; call the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system that runs functions on demand; based on the target parsing function, parse and process the data packet to be parsed to obtain the parsing result of the data packet to be parsed.

[0097] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the target traffic type of the data packet to be parsed; determine a target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0098] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: load the kernel-state eBPF program into the operating system kernel; establish an association relationship between the kernel-state eBPF program and the target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-state eBPF program inserts and runs the code when a predetermined kernel event or function call occurs.

[0099] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: detect whether the instructions included in the kernel-state eBPF program meet the predetermined conditions; if the instructions included in the kernel-state eBPF program meet the predetermined conditions, load the kernel-state eBPF program into the operating system kernel.

[0100] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the network data packet being processed by the operating system; detect whether the network data packet is associated with the target mount point; if the network data packet is associated with the target mount point, call the kernel-state eBPF program associated with the target mount point; based on the kernel-state eBPF program, capture the data packet to be parsed corresponding to the network data packet from the operating system kernel.

[0101] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: using the kernel state eBPF program to capture network data packets; using the kernel state eBPF program to process the network data packets to obtain data packets to be parsed.

[0102] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: starting from the first target parsing function among the N target parsing functions, use the first N-1 parsing functions among the N target parsing functions to parse and process the data packet to be parsed in turn to obtain a parsing result, where N is an integer greater than or equal to 2; use the last target parsing function among the N target parsing functions to forward the parsing result to the target address for storage and / or display.

[0103] By adopting the embodiment of the present application, a scheme for packet parsing based on eBPF is provided. Through the user-state program based on the extended Berkeley packet filter eBPF, the data packet to be parsed captured by the eBPF kernel-state program from the kernel of the operating system is obtained, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; the target parsing function is determined; the target parsing function on the function computing platform is called through the traffic entry function, wherein the function computing platform is a service system for running functions on demand; based on the target parsing function, the data packet to be parsed is parsed and processed to obtain the parsing result of the data packet to be parsed, thereby achieving the purpose of real-time and efficient parsing of large-scale network traffic, thereby achieving the technical effect of improving the parsing and analysis capability and scalability of traffic based on eBPF, and then solving the technical problem that the traditional eBPF traffic analysis system cannot realize concurrent analysis of large-scale traffic due to the limited processing capacity on a single node.

[0104] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 5The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations are shown.

[0105] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0106] Example 4

[0107] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the eBPF-based data packet parsing method provided in the first embodiment.

[0108] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0109] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the eBPF-based data packet parsing method.

[0110] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0111] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0113] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0115] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0116] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data packet parsing method based on eBPF, characterized in that: include: Based on the extended Berkeley Packet Filter eBPF user-state program, obtain the data packet to be parsed captured by the eBPF kernel-state program from the operating system kernel, wherein the eBPF user-state program is a program running in the user space of the operating system, and the eBPF kernel-state program is a program running in the kernel space of the operating system; Determine the target analytical function; Calling the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system for running functions on demand; Based on the target parsing function, the data packet to be parsed is parsed to obtain a parsing result of the data packet to be parsed.

2. The method according to claim 1, characterized in that The target parsing function comprises: Determine the target traffic type of the data packet to be parsed; The target parsing function matching the target traffic type is determined from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types.

3. The method according to claim 1, characterized in that Before the extended Berkeley packet filter eBPF user-mode program obtains the data packet to be parsed captured by the kernel-mode eBPF program from the operating system kernel, the method further includes: Loading the kernel-state eBPF program into the operating system kernel; An association relationship is established between the kernel-state eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is a location where the kernel-state eBPF program inserts and runs code when a predetermined kernel event or function call occurs.

4. The method according to claim 3, characterized in that The step of loading the kernel-state eBPF program into the operating system kernel includes: Detecting whether the instructions included in the kernel state eBPF program meet a predetermined condition; When the instructions included in the kernel-state eBPF program meet the predetermined condition, the kernel-state eBPF program is loaded into the operating system kernel.

5. The method according to claim 3, characterized in that: Before obtaining the data packet to be parsed captured by the kernel-mode eBPF program from the operating system kernel based on the eBPF user-mode program, the method further includes: Obtaining a network data packet being processed by the operating system; Detecting whether the network data packet is associated with the target mount point; In a case where the network data packet is associated with the target mount point, calling the kernel-mode eBPF program associated with the target mount point; Based on the kernel-state eBPF program, the data packet to be parsed corresponding to the network data packet is captured from the operating system kernel.

6. The method according to claim 5, characterized in that The method of capturing the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel state eBPF program includes: Using the kernel-mode eBPF program to capture the network data packet; The kernel-state eBPF program is used to process the network data packet to obtain the data packet to be parsed.

7. The method according to any one of claims 1 to 6, characterized in that: In the case where there are N target parsing functions and the N target parsing functions are arranged according to a preset processing flow, the parsing process is performed on the data packet to be parsed based on the target parsing function to obtain a parsing result of the data packet to be parsed, including: Starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used to parse the data packet to be parsed in sequence to obtain the parsing result, wherein N is an integer greater than or equal to 2; The last target parsing function among the N target parsing functions is used to forward the parsing result to a target address for storage and / or display.

8. A data packet parsing device based on eBPF, characterized in that: include: An acquisition module is used to acquire a data packet to be parsed captured by an eBPF kernel-state program from an operating system kernel based on an extended Berkeley packet filter eBPF user-state program, wherein the eBPF user-state program is a program running in a user space of an operating system, and the eBPF kernel-state program is a program running in a kernel space of an operating system; A determination module, used to determine a target analytical function; A calling module is used to call a target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system for running functions on demand; The parsing module is used to parse the data packet to be parsed based on the target parsing function to obtain the parsing result of the data packet to be parsed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the eBPF-based data packet parsing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

Images