Ebpf-based packet parsing method and device, and electronic equipment

Abstract

This application discloses a packet parsing method, apparatus, and electronic device based on eBPF. Relating to the field of cloud computing, the method includes: acquiring packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley packet filter (eBPF) user-space program, wherein the eBPF user-space program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system; determining a target parsing function; calling the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and parsing the packets to be parsed based on the target parsing function to obtain the parsing result of the packets. This application solves the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a packet parsing method, apparatus, and electronic device based on eBPF. Background Technology

[0002] Non-intrusive business observation technology is a hot topic in the field of observability technology. It refers to a method for detecting system status and behavior without changing or interfering with the code and operation of business systems. Among them, non-intrusive business observation technology based on eBPF has attracted widespread attention in the industry because it has kernel-level data monitoring capabilities and can be applied to multiple fields such as system calls, network performance, application processes, and file systems, achieving fine-grained and highly timely network monitoring. However, to ensure efficiency, non-intrusive business observation capabilities based on eBPF usually perform traffic parsing locally on the deployed device. Therefore, limited by the performance and architecture of a single machine, this mode lacks the ability to perform large-scale concurrent traffic analysis. Moreover, even if additional remote servers are deployed to parse traffic, the fixed number of resources on remote servers makes it difficult to guarantee the parsing efficiency of large-scale traffic.

[0003] There is currently no effective solution to the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a packet parsing method, apparatus, and electronic device based on eBPF, so as to solve the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a packet parsing method based on eBPF is provided. The method includes: acquiring packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley packet filter (eBPF) user-mode program, wherein the eBPF user-mode program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system; determining a target parsing function; calling the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and parsing the packets to be parsed based on the target parsing function to obtain the parsing result of the packets to be parsed.

[0006] Optionally, the target parsing function includes: determining the target traffic type of the data packet to be parsed; and determining a target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0007] Optionally, before the user-space program of the extended Berkeley packet filter eBPF obtains the packets to be parsed captured by the kernel-space eBPF program from the operating system kernel, the method further includes: loading the kernel-space eBPF program into the operating system kernel; establishing an association between the kernel-space eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-space eBPF program inserts and runs code at a predetermined kernel event or function call.

[0008] Optionally, loading the kernel-mode eBPF program into the operating system kernel includes: detecting whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; and loading the kernel-mode eBPF program into the operating system kernel if the instructions included in the kernel-mode eBPF program meet the predetermined conditions.

[0009] Optionally, before obtaining the data packet to be parsed captured from the operating system kernel by the kernel-mode eBPF program based on the eBPF user-mode program, the method further includes: obtaining the network data packet being processed by the operating system; detecting whether the network data packet is associated with the target mount point; if the network data packet is associated with the target mount point, calling the kernel-mode eBPF program associated with the target mount point; and capturing the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-mode eBPF program.

[0010] Optionally, based on a kernel-mode eBPF program, the system captures the network data packets corresponding to the data packets to be parsed from the operating system kernel, including: capturing network data packets using a kernel-mode eBPF program; and processing the network data packets using a kernel-mode eBPF program to obtain the data packets to be parsed.

[0011] Optionally, when there are N target parsing functions arranged according to a preset processing flow, the data packet to be parsed is parsed based on the target parsing functions to obtain the parsing result, including: starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used to parse the data packet to be parsed in sequence to obtain the parsing result, where N is an integer greater than or equal to 2; the parsing result is forwarded to the target address using the last target parsing function among the N target parsing functions for storage and / or display.

[0012] To achieve the above objectives, according to another aspect of this application, an eBPF-based packet parsing apparatus is provided. The apparatus includes: an acquisition module for acquiring packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley packet filter eBPF user-mode program, wherein the eBPF user-mode program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system; a determination module for determining a target parsing function; a calling module for calling the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and a parsing module for parsing the packets to be parsed based on the target parsing function to obtain the parsing result of the packets to be parsed.

[0013] Optionally, the determining module includes: a first determining submodule, used to determine the target traffic type of the data packet to be parsed; and a second determining submodule, used to determine a target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0014] Optionally, the apparatus further includes: a first loading submodule for loading a kernel-mode eBPF program into the operating system kernel; and a first establishment submodule for establishing an association between the kernel-mode eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-mode eBPF program inserts and runs code at a predetermined kernel event or function call.

[0015] Optionally, the first loading submodule further includes: a first detection submodule, used to detect whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; and a second loading submodule, used to load the kernel-mode eBPF program into the operating system kernel if the instructions included in the kernel-mode eBPF program meet predetermined conditions.

[0016] Optionally, the device further includes: a first acquisition submodule for acquiring network data packets being processed by the operating system; a second detection submodule for detecting whether the network data packets are associated with a target mount point; a first invocation submodule for invoking a kernel-mode eBPF program associated with the target mount point when the network data packets are associated with the target mount point; and a first capture submodule for capturing the data packets to be parsed corresponding to the network data packets from the operating system kernel based on the kernel-mode eBPF program.

[0017] Optionally, the first capture submodule includes: a second capture submodule, used to capture network packets using a kernel-mode eBPF program; and a first processing submodule, used to process the network packets using a kernel-mode eBPF program to obtain packets to be parsed.

[0018] Optionally, the parsing module includes: a first parsing submodule, used to parse the data packet to be parsed sequentially using the first N-1 parsing functions among the N target parsing functions, starting from the first target parsing function, to obtain the parsing result, where N is an integer greater than or equal to 2; and a first storage submodule, used to forward the parsing result to the target address using the last target parsing function among the N target parsing functions for storage and / or display.

[0019] In this embodiment, the eBPF user-space program, based on the extended Berkeley Packet Filter (eBPF), acquires the data packets to be parsed captured by the eBPF kernel-space program from the operating system kernel. The eBPF user-space program runs in the user space of the operating system, and the eBPF kernel-space program runs in the kernel space of the operating system. A target parsing function is determined. This target parsing function is then called through a traffic entry function on a function computing platform, which is a service system that runs functions on demand. Based on the target parsing function, the data packets to be parsed are processed to obtain the parsing results. This achieves the goal of real-time and efficient parsing of large-scale network traffic, thereby improving the technical effect of enhancing the traffic parsing and analysis capabilities and scalability based on eBPF. Furthermore, it solves the technical problem that traditional eBPF traffic analysis systems cannot achieve large-scale concurrent traffic analysis due to the limited processing capacity on a single node. Attached Figure Description

[0020] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 A hardware block diagram of a computer terminal for implementing an eBPF-based packet parsing method is shown.

[0022] Figure 2 This is a flowchart of a packet parsing method based on eBPF provided according to an embodiment of this application;

[0023] Figure 3 This is a flowchart of an optional eBPF-based packet parsing method according to an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of a packet parsing device based on eBPF provided according to an embodiment of this application;

[0025] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0029] The extended Berkeley Packet Filter (eBPF) is a powerful kernel feature extension mechanism that allows developers to securely run user-defined bytecode programs within the Linus (Linux) kernel.

[0030] A user-space eBPF program is an application that runs in the user space of the operating system. It is responsible for interacting with the eBPF kernel-space program, including loading the kernel-space program, configuring parameters, reading data or metadata captured by the kernel-space program, and performing advanced processing and analysis on this data.

[0031] Kernel-space eBPF programs are bytecode programs that run in the Linux kernel. They directly and efficiently capture and perform preliminary processing of system calls and network packets. Through Berkeley Packet Filter Maps (BPF Maps), they share data with user-space programs to achieve low-latency, high-throughput data monitoring and control.

[0032] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0033] Example 1

[0034] According to an embodiment of this application, a method embodiment for packet parsing based on eBPF is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an eBPF-based packet parsing method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0036] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the eBPF-based packet parsing method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned eBPF-based packet parsing method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0039] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0040] Under the aforementioned operating environment, this application provides the following: Figure 2 The packet parsing method based on eBPF is shown. Figure 2 This is a flowchart of a packet parsing method based on eBPF according to Embodiment 1 of this application.

[0041] Step S200: Based on the extended Berkeley Packet Filter (eBPF) user-space program, obtain the data packets to be parsed captured by the eBPF kernel-space program from the operating system kernel. Here, the eBPF user-space program is a program running in the user space of the operating system, and the eBPF kernel-space program is a program running in the kernel space of the operating system.

[0042] Optionally, eBPF kernel-mode programs run in the operating system kernel space, allowing direct capture and preliminary processing of network packets, such as filtering, modifying, or redirecting packets. Running within the kernel, eBPF programs can capture packets with very low latency. Utilizing its unique instruction set and data structures (such as BPF Maps), the eBPF kernel-mode program performs these operations, ensuring efficient and secure data acquisition. Captured packets need to be passed to user-mode programs for further processing. Data transfer from kernel to user mode can be achieved through eBPF user-mode programs. This can be accomplished using BPF Maps or the Linux performance monitoring mechanism Perf_events (Perf).

[0043] The operating system kernel can be a Linux kernel. The data statistics unit, as part of a user-space program, is responsible for reading data from BPF Maps. BPF Maps are data structures in eBPF used to share data between user space and kernel space, supporting efficient data storage and access for various types of data, and providing a mechanism for efficient data sharing between kernel space and user space. Perf is a subsystem of the Linux kernel used to provide access to and control over point and system hardware performance data.

[0044] It's important to note that eBPF kernel-mode programs run directly in kernel space and have access to kernel data and resources. However, to prevent potential security risks such as buffer overflows or illegal memory access, the bytecode of kernel-mode programs undergoes rigorous verification checks before being loaded into the kernel. User-mode programs are responsible for writing, compiling, and loading these programs. They run in a restricted user space and cannot directly access or modify kernel data, thus creating a security isolation between user code and the kernel.

[0045] Optionally, the eBPF user-space program also includes a function triggering module, which uses the collected data packets as event-triggered functions to trigger traffic entry functions on the computing platform. This feature enhances the flexibility of eBPF technology, enabling seamless integration with serverless architectures to achieve high-concurrency traffic parsing. Serverless architecture, in this context, refers to a serverless architecture.

[0046] In an optional embodiment, before the kernel-mode eBPF user-mode program acquires the data packets to be parsed captured from the operating system kernel by the extended Berkeley packet filter eBPF user-mode program, the method further includes: loading the kernel-mode eBPF program into the operating system kernel; establishing an association between the kernel-mode eBPF program and a target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-mode eBPF program inserts and runs code at a predetermined kernel event or function call.

[0047] It's important to note that a target mount point, or hook point, refers to a specific location within the Linux kernel. eBPF programs can be mounted or associated with these locations to execute when a specific event occurs. Hook points can be events related to the sending and receiving of network packets, entry and exit points of system calls, or other critical locations within the kernel. By associating eBPF programs with hook points, it's possible to monitor and process kernel data and events without modifying the kernel code.

[0048] Optionally, the kernel-mode eBPF program loading process is accomplished by the eBPF user-mode program calling specific eBPF tools, such as the BPF Compiler Collection (BCC) and the Berkeley packet filtering tool Bpftool. During loading, the kernel's built-in eBPF security verifier performs static analysis on each instruction in the program to ensure its security and compliance, preventing potential malicious code from entering the kernel. Establishing an association refers to connecting the kernel-mode eBPF program with the target mount point (such as a network port, kernel function entry / exit point, etc.). When a predetermined kernel event or function call occurs, the eBPF program can automatically insert and run. This can be achieved through tracepoints, kernel probes (KProbes), or user-mode probes (UProbes), by calling functions such as `bpf_prog_attach` and `bpf_attach_kprobe`, which are built into the Linux system. After the association is established, the kernel-mode eBPF program can efficiently access and process relevant network traffic when specific events are triggered.

[0049] Among them, BCC is a collection of BPF compilers; Bpftool is a command-line tool for managing and debugging eBPF kernel-mode programs, supporting loading, unloading, and viewing eBPF kernel-mode programs and related information; Tracepoints are a technique that allows the insertion of monitoring points at predefined locations and events in Linux; KProbes is a Linux kernel dynamic instrumentation mechanism that allows developers to dynamically insert hook points into kernel functions for monitoring and debugging kernel behavior without recompiling the kernel; the corresponding mechanism in user space is UProbes; UProbes is a Linux dynamic instrumentation mechanism that allows developers to insert hook points at specified locations in user-space programs. The corresponding mechanism in kernel space is KProbes.

[0050] It's important to note that kernel functions are functions defined and executed within the operating system kernel. They constitute the core functionality of the kernel, handling tasks that directly interact with hardware, managing system resources, and providing low-level services to user-space applications. Kernel functions run in kernel space and have full access to system resources, including direct manipulation of physical memory, interrupt handling, device driver control, process scheduling, and system call handling.

[0051] In one optional embodiment, loading a kernel-mode eBPF program into the operating system kernel includes: detecting whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; and loading the kernel-mode eBPF program into the operating system kernel if the instructions included in the kernel-mode eBPF program meet the predetermined conditions.

[0052] Optionally, the detection process can be implemented using the eBPF security verifier built into the Linux kernel. It examines every instruction in the kernel-mode eBPF program to ensure that the instruction set meets eBPF restrictions and does not pose a threat to system security. These predefined conditions may include, but are not limited to, restrictions on the number of instructions, prohibited instruction types, and resource access permissions, to prevent potential attacks or erroneous code from adversely affecting the operating system. The eBPF security verifier also checks whether the program follows kernel rules and conventions, ensuring that it does not violate the normal kernel operation flow during loading and execution, such as avoiding infinite loops and incorrect memory accesses.

[0053] The above-described detection methods determine whether to load the eBPF program into the kernel. The loading process will only continue if the program meets all security and compliance conditions; otherwise, the program will be rejected to prevent potentially problematic code from entering the kernel environment.

[0054] In an optional embodiment, before obtaining the data packet to be parsed captured by the kernel-mode eBPF program from the operating system kernel based on the eBPF user-mode program, the method further includes: obtaining the network data packet being processed by the operating system; detecting whether the network data packet is associated with a target mount point; if the network data packet is associated with a target mount point, invoking the kernel-mode eBPF program associated with the target mount point; and capturing the data packet to be parsed corresponding to the network data packet from the operating system kernel based on the kernel-mode eBPF program.

[0055] Optionally, by detecting whether the network packets being processed are associated with a preset target mount point, it can be ensured that only packets related to specific kernel events or function calls are captured by the kernel-mode eBPF program. This precision avoids capturing unnecessary packets, reduces data processing overhead, and improves overall system efficiency. The kernel-mode eBPF program is only invoked when a network packet matches a target mount point. The invocation of the eBPF program and the packet capture process are fully automated, requiring no human intervention. This not only simplifies the operation process but also reduces errors and delays caused by manual configuration or operation, making traffic monitoring and processing more efficient and reliable.

[0056] In one optional embodiment, the process of capturing network data packets corresponding to network data packets from the operating system kernel based on a kernel-mode eBPF program includes: capturing network data packets using a kernel-mode eBPF program; and processing the network data packets using a kernel-mode eBPF program to obtain the data packets to be parsed.

[0057] Optionally, kernel-mode eBPF programs can capture packets directly upon arrival at the operating system's network stack, eliminating the need for multiple data transfers and transformations by user-space programs. This significantly improves capture efficiency and reduces packet processing latency. Kernel-mode eBPF programs can perform real-time preprocessing on captured network packets, such as filtering, copying, and modifying them, reducing the load on subsequent user-space parsing. They can not only filter out packets requiring further parsing but also add necessary metadata, such as timestamps and source IP addresses, providing richer information for subsequent traffic analysis.

[0058] Step S202: Determine the target analytical function;

[0059] Optionally, in large-scale traffic monitoring, network packets can cover various protocols and formats. Determining the target parsing function allows for the selection of the most suitable function based on the packet type or characteristics, facilitating accurate and efficient parsing of different types of traffic. Different parsing requirements necessitate different parsing logic; identifying the target parsing function enables the invocation of the appropriate function for specific needs, achieving customized parsing processing. By selecting the parsing function that best matches the traffic type, performance waste when using general-purpose parsing functions to handle specific types of traffic can be avoided, improving parsing efficiency and speed.

[0060] In one optional embodiment, determining the target parsing function includes: determining the target traffic type of the data packet to be parsed; and determining a target parsing function that matches the target traffic type from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types.

[0061] Optionally, this embodiment can intelligently determine the traffic type of the data packet to be parsed and select the most suitable parsing function based on the type. Different traffic types contain different data structures and protocols. Intelligent selection ensures that the most applicable parsing logic is used to process the data packet, improving the accuracy and efficiency of parsing. Precise matching between traffic type and parsing function avoids the waste of resources by using generic parsing functions. By selecting a parsing function that matches the target traffic type from multiple traffic parsing functions, the system can support traffic parsing for multiple protocols, providing a foundation for building a comprehensive network monitoring and analysis system that can cover everything from basic network layer protocols to advanced application layer protocols.

[0062] Step S204: Call the target parsing function on the function computing platform through the traffic entry function, wherein the function computing platform is a service system for running functions on demand;

[0063] Optionally, the traffic ingress function, acting as a bridge between eBPF user-space programs and the Function Compute platform, can quickly distribute packets to be parsed to multiple parsing function instances on the Function Compute platform based on the size and type of traffic. It can handle large numbers of packets simultaneously without slowing down the overall processing speed due to bottlenecks in a single parser. The Function Compute platform's on-demand operation dynamically adjusts the number of parsing function instances based on real-time traffic volume. When traffic increases, the number of running parsing function instances automatically increases, and vice versa, ensuring efficient resource utilization and elastic system scaling. The traffic ingress function can intelligently select the target parsing function on the Function Compute platform based on the packet's protocol or type, ensuring that packets are processed by the most suitable parser, improving parsing accuracy and efficiency.

[0064] Among them, the function computing platform, also known as the serverless function computing platform, refers to a platform that can run function language images. Through this function computing platform, parsed functions can be run on demand.

[0065] It should be noted that the Function Compute platform is a serverless computing service based on event triggering and dynamic scaling. In this application, it serves as the central hub for traffic parsing, responsible for receiving traffic data forwarded by eBPF user-space programs. By distributing this data to multiple parallel parsing functions, it achieves high-concurrency processing and analysis of large-scale traffic. It allows users to upload functions, which are automatically invoked for processing when specific events occur, without requiring users to manage the operation and expansion of the underlying servers. This service model can automatically adjust resources according to the actual load, making it particularly effective for handling high-concurrency, event-driven tasks.

[0066] Step S206: Based on the target parsing function, the data packet to be parsed is parsed to obtain the parsing result of the data packet to be parsed.

[0067] Optionally, the target parsing function is selected based on the specific type of the data packet to be parsed. It provides precise parsing logic, performing in-depth analysis of the packet's header information, payload content, protocol characteristics, etc. The ultimate goal of the parsing process is to generate a parsing result, which may include, but is not limited to, the packet's metadata (such as source IP, destination IP, timestamp, etc.), useful information after protocol decoding, and any possible anomalies or performance indicators. The parsing result can be used for subsequent data analysis, performance monitoring, security detection, and other applications. The processing capability of the target parsing function directly affects the accuracy and efficiency of the application.

[0068] Among them, the useful information after protocol decoding may refer to the Uniform Resource Locator (URL) requested by the Hypertext Transfer Protocol (HTTP), the domain name queried by the Domain Name System (DNS), etc.

[0069] In one optional embodiment, when there are N target parsing functions arranged according to a preset processing flow, the data packet to be parsed is parsed based on the target parsing functions to obtain the parsing result of the data packet to be parsed, including: starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used to parse the data packet to be parsed in sequence to obtain the parsing result, where N is an integer greater than or equal to 2; the parsing result is forwarded to the target address using the last target parsing function among the N target parsing functions for storage and / or display.

[0070] Optionally, the N target parsing functions can be designed to perform a series of sequential processing steps, from initial traffic type identification to complex packet content analysis, and then to advanced network behavior detection. This phased processing approach allows for deeper and more complex packet parsing. Each parsing function can focus on performing specific parsing tasks, such as protocol decoding, data statistics, and security checks. The design can be more modular, easy to maintain, and extensible. Pre-defined processing flows can effectively manage data flow, ensuring that packets are delivered to each parsing function in the correct order and logic, avoiding processing disorder or data loss.

[0071] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation method for an eBPF-based packet parsing method. Figure 3 This is a flowchart of an optional eBPF-based packet parsing method according to an embodiment of this application. The method includes:

[0072] Step S1, Compilation. The user-space program or the user manually compiles the eBPF kernel-space program into bytecode for later loading and use.

[0073] Step S2: Load and associate Hook points. User-space programs use eBPF user-space tools such as BCC and Bpftool to load kernel-space programs or kernel-space bytecode programs compiled by these tools into the Linux kernel. During loading, the Linux kernel's built-in eBPF security verifier performs static analysis on each instruction in the kernel-space program to ensure its compliance and security. After loading, the user-space program needs to confirm the association between the kernel-space eBPF program and the mounted Hook point. The Linux system predefines Hook points at important locations such as network ports and kernel function entry / exit points. User-space programs can obtain these Hook points using Tracepoints technology, or insert additional Hook points at specified locations in the system using KProbes and UPloe technologies. After determining the Hook point to be associated, the user-space program can complete the association between the kernel-space program and the Hook point by calling Linux system-provided functions such as bpf_prog_attach and bpf_attach_kprobe.

[0074] Step S3: Collect and transmit traffic. After completing the Hook point association, the Linux system will automatically run the eBPF kernel-mode program when a data packet passes through the Hook point. After the kernel-mode program runs, it can access the header or payload data of the data packet using the BPF program instruction set. At this time, the eBPF kernel-mode program can perform operations such as protocol judgment, copying, discarding, modifying, redirecting, and total count on the traffic data. It can also copy the filtered or processed data to the BPFMaps shared by the kernel and user spaces, which is read periodically by the data statistics unit of the user-space program, or directly push the data to the perf_events data module of the user-space program through the Linux performance monitoring mechanism Perf_events for further processing by the user-space program.

[0075] Step S4, Traffic Data Copying. The user-space program's data statistics unit and perf_events data module will copy the data to the function triggering module.

[0076] Step S5, traffic forwarding. Upon receiving data, the user-space program's function triggering module immediately carries the traffic triggering function from the computing platform's traffic entry function.

[0077] Step S6: Traffic is processed based on its type. The entry function of the Function Compute platform selects different function workflows based on the traffic of different protocols, and then immediately triggers the first function of that workflow with the traffic to perform full-process analysis of the traffic.

[0078] Step S7: Forward the parsed data. After traffic parsing is complete, the last function in the workflow will forward the parsed data to the address specified by the preset address or the address passed from the previous function, and perform operations such as saving and displaying. This completes all traffic processing.

[0079] By following the steps above and leveraging the dynamic scaling capabilities of the Function Compute platform, we can ensure the speed of traffic parsing even in large-scale traffic analysis scenarios, thus achieving high-concurrency parsing.

[0080] It should be noted that the packet parsing method based on eBPF provided in this application embodiment obtains the packets to be parsed captured by the operating system kernel by the eBPF kernel-mode program through the extended Berkeley packet filter eBPF user-space program. The eBPF user-space program runs in the user space of the operating system, and the eBPF kernel-mode program runs in the kernel space of the operating system. A target parsing function is determined; the target parsing function is called on the function computing platform through the traffic entry function. The function computing platform is a service system that runs functions on demand. Based on the target parsing function, the packets to be parsed are processed to obtain the parsing result. This solves the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies. This achieves the goal of real-time and efficient parsing of large-scale network traffic, thereby improving the traffic parsing and analysis capabilities and scalability based on eBPF.

[0081] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0082] Example 2

[0083] This application also provides an eBPF-based packet parsing apparatus. It should be noted that the eBPF-based packet parsing apparatus of this application can be used to execute the eBPF-based packet parsing method provided in this application. The following describes the eBPF-based packet parsing apparatus provided in this application.

[0084] According to embodiments of this application, an apparatus for implementing the above-described eBPF-based packet parsing method is also provided, such as... Figure 4 As shown, the device includes: an acquisition module 300, used to acquire data packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley Packet Filter (eBPF) user-mode program, wherein the eBPF user-mode program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system; a determination module 302, connected to the acquisition module 300, used to determine a target parsing function; a calling module 304, connected to the determination module 302, used to call the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and a parsing module 306, connected to the calling module 304, used to parse the data packets to be parsed based on the target parsing function to obtain the parsing result of the data packets to be parsed.

[0085] The eBPF-based packet parsing device provided in this application embodiment includes an acquisition module 300, which acquires packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley packet filter eBPF user-mode program. The eBPF user-mode program runs in the user space of the operating system, and the eBPF kernel-mode program runs in the kernel space of the operating system. A determination module 302 determines the target parsing function. A calling module 304 calls the target parsing function on a function computing platform through a traffic entry function. The function computing platform is a service system that runs functions on demand. A parsing module 306 parses the packets to be parsed based on the target parsing function to obtain the parsing result. This solves the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies. It achieves real-time and efficient parsing of large-scale network traffic, thereby improving the traffic parsing and analysis capabilities and scalability based on eBPF.

[0086] Optionally, in the eBPF-based packet parsing apparatus provided in this application embodiment, the determining module includes: a first determining submodule, used to determine the target traffic type of the packet to be parsed; and a second determining submodule, used to determine a target parsing function that matches the target traffic type from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types.

[0087] Optionally, in the eBPF-based packet parsing apparatus provided in this application embodiment, the apparatus further includes: a first loading submodule, used to load the kernel-mode eBPF program into the operating system kernel; and a first establishment submodule, used to establish the association between the kernel-mode eBPF program and the target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-mode eBPF program inserts and runs code when a predetermined kernel event or function call occurs.

[0088] Optionally, in the eBPF-based packet parsing apparatus provided in this application embodiment, the first loading submodule further includes: a first detection submodule, used to detect whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; and a second loading submodule, used to load the kernel-mode eBPF program into the operating system kernel when the instructions included in the kernel-mode eBPF program meet predetermined conditions.

[0089] Optionally, in the eBPF-based packet parsing apparatus provided in this application embodiment, the apparatus further includes: a first acquisition submodule, used to acquire network packets being processed by the operating system; a second detection submodule, used to detect whether the network packets are associated with a target mount point; a first invocation submodule, used to invoke a kernel-mode eBPF program associated with the target mount point when the network packets are associated with the target mount point; and a first capture submodule, used to capture the packet to be parsed corresponding to the network packets from the operating system kernel based on the kernel-mode eBPF program.

[0090] Optionally, in the eBPF-based packet parsing apparatus provided in this application embodiment, the first capture submodule includes: a second capture submodule, used to capture network packets using a kernel-mode eBPF program; and a first processing submodule, used to process the network packets using a kernel-mode eBPF program to obtain the packet to be parsed.

[0091] Optionally, in the eBPF-based packet parsing device provided in this application embodiment, the parsing module includes: a first parsing submodule, configured to start from the first target parsing function among N target parsing functions, and sequentially use the first N-1 parsing functions among the N target parsing functions to parse the packet to be parsed, to obtain the parsing result, where N is an integer greater than or equal to 2; and a first storage submodule, configured to use the last target parsing function among the N target parsing functions to forward the parsing result to the target address for storage and / or display.

[0092] It should be noted that the acquisition module 300, determination module 302, calling module 304, and parsing module 306 mentioned above correspond to steps S200 to S206 in Embodiment 1. The instances and application scenarios implemented by the two modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0093] Example 3

[0094] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 1002, memory 1004, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0095] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0096] The processor can access information and applications stored in memory via a transmission device to perform the following steps: Based on the extended Berkeley Packet Filter (eBPF) user-space program, acquire the data packets to be parsed captured from the operating system kernel by the eBPF kernel-space program, where the eBPF user-space program runs in the operating system's user space and the eBPF kernel-space program runs in the operating system's kernel space; determine the target parsing function; call the target parsing function on the function computing platform through the traffic entry function, where the function computing platform is a service system that runs functions on demand; and based on the target parsing function, parse the data packets to be parsed to obtain the parsing result.

[0097] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the target traffic type of the data packet to be parsed; determine the target parsing function that matches the target traffic type from multiple traffic parsing functions, wherein the multiple traffic parsing functions correspond to different traffic types.

[0098] The processor can also access information and applications stored in memory via a transfer device to perform the following steps: loading the kernel-mode eBPF program into the operating system kernel; establishing an association between the kernel-mode eBPF program and the target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-mode eBPF program inserts and runs code at a predetermined kernel event or function call.

[0099] The processor can also call information and applications stored in memory via a transfer device to perform the following steps: detect whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; if the instructions included in the kernel-mode eBPF program meet predetermined conditions, load the kernel-mode eBPF program into the operating system kernel.

[0100] The processor can also access information and applications stored in memory via the transmission device to perform the following steps: acquiring network packets being processed by the operating system; detecting whether the network packets are associated with a target mount point; if the network packets are associated with a target mount point, invoking the kernel-mode eBPF program associated with the target mount point; and capturing the data packets to be parsed corresponding to the network packets from the operating system kernel based on the kernel-mode eBPF program.

[0101] The processor can also call information and applications stored in memory through the transmission device to perform the following steps: capture network packets using a kernel-mode eBPF program; process the network packets using a kernel-mode eBPF program to obtain the data packets to be parsed.

[0102] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used to parse the data packet to be parsed in sequence to obtain the parsing result, where N is an integer greater than or equal to 2; the parsing result is forwarded to the target address using the last target parsing function among the N target parsing functions for storage and / or display.

[0103] This application provides a packet parsing scheme based on eBPF. By using an eBPF user-space program based on an extended Berkeley packet filter, the system obtains the packets to be parsed captured from the operating system kernel by an eBPF kernel-space program. The eBPF user-space program runs in the user space of the operating system, and the eBPF kernel-space program runs in the kernel space of the operating system. A target parsing function is determined. This target parsing function is called through a traffic entry function on a function computing platform, which is a service system that runs functions on demand. Based on the target parsing function, the packets to be parsed are processed to obtain the parsing results. This achieves real-time and efficient parsing of large-scale network traffic, thereby improving the technical effect of enhancing the traffic parsing and analysis capabilities and scalability based on eBPF. Furthermore, it solves the technical problem that traditional eBPF traffic analysis systems cannot achieve large-scale concurrent traffic analysis due to the limited processing capacity on a single node.

[0104] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0105] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0106] Example 4

[0107] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the eBPF-based packet parsing method provided in Embodiment 1.

[0108] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0109] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform the steps of an eBPF-based packet parsing method.

[0110] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0115] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0116] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A packet parsing method based on eBPF, characterized in that, include: Based on the extended Berkeley Packet Filter (eBPF) user-space program, the data packets to be parsed captured by the eBPF kernel-space program from the operating system kernel are obtained. The eBPF user-space program is a program running in the user space of the operating system, and the eBPF kernel-space program is a program running in the kernel space of the operating system. Determining the target parsing function includes: determining the target traffic type of the data packet to be parsed; and determining the target parsing function that matches the target traffic type from a plurality of traffic parsing functions, wherein the plurality of traffic parsing functions correspond to different traffic types. The target parsing function is invoked through the traffic entry function on the function computing platform, wherein the function computing platform is a service system that runs functions on demand; Based on the target parsing function, the data packet to be parsed is parsed to obtain the parsing result of the data packet to be parsed.

2. The method according to claim 1, characterized in that, Before the extended Berkeley Packet Filter (eBPF) user-space program obtains the packets to be parsed captured by the kernel-space eBPF program from the operating system kernel, the method further includes: Load the kernel-mode eBPF program into the operating system kernel; Establish the association between the kernel-mode eBPF program and the target mount point included in the operating system kernel, wherein the target mount point is the location where the kernel-mode eBPF program inserts and runs code when a predetermined kernel event or function call occurs.

3. The method according to claim 2, characterized in that, Loading the kernel-mode eBPF program into the operating system kernel includes: Detect whether the instructions included in the kernel-mode eBPF program meet predetermined conditions; If the instructions included in the kernel-mode eBPF program meet the predetermined conditions, the kernel-mode eBPF program is loaded into the operating system kernel.

4. The method according to claim 2, characterized in that, Before the eBPF user-space program obtains the data packets to be parsed captured by the kernel-space eBPF program from the operating system kernel, the method further includes: Obtain the network data packets being processed by the operating system; Detect whether the network data packet is associated with the target mount point; When the network data packet is associated with the target mount point, the kernel-mode eBPF program associated with the target mount point is invoked; Based on the kernel-mode eBPF program, the network data packet corresponding to the data packet to be parsed is captured from the operating system kernel.

5. The method according to claim 4, characterized in that, The process of capturing the network data packet corresponding to the data packet to be parsed from the operating system kernel based on the kernel-mode eBPF program includes: The network packets are captured using the kernel-mode eBPF program; The network data packets are processed using the kernel-mode eBPF program to obtain the data packets to be parsed.

6. The method according to any one of claims 1 to 5, characterized in that, When there are N target parsing functions, and these N target parsing functions are arranged according to a preset processing flow, the step of parsing the data packet to be parsed based on the target parsing functions to obtain the parsing result of the data packet to be parsed includes: Starting from the first target parsing function among the N target parsing functions, the first N-1 parsing functions among the N target parsing functions are used sequentially to parse the data packet to be parsed, and the parsing result is obtained, where N is an integer greater than or equal to 2; The parsing result is forwarded to the target address using the last of the N target parsing functions for storage and / or display.

7. A packet parsing device based on eBPF, characterized in that, include: The acquisition module is used to acquire packets to be parsed captured from the operating system kernel by the eBPF kernel-mode program based on the extended Berkeley Packet Filter (eBPF) user-mode program. The eBPF user-mode program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system. A determination module is used to determine a target parsing function, including: determining the target traffic type of the data packet to be parsed; and determining, from a plurality of traffic parsing functions, the target parsing function that matches the target traffic type, wherein the plurality of traffic parsing functions correspond to different traffic types; The calling module is used to call the target parsing function on the function computing platform through the traffic entry function. The function computing platform is a service system that runs functions on demand. The parsing module is used to parse the data packet to be parsed based on the target parsing function, and obtain the parsing result of the data packet to be parsed.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the packet parsing method based on any one of claims 1 to 6.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 6.

Images