Seven-layer protocol data extraction method, system, device and medium based on eBPF

Abstract

The application discloses an eBPF-based seven-layer protocol data extraction method, system, device and medium, and belongs to the technical field of data extraction. The technical problem to be solved by the application is how to avoid the influence of cold start on high availability and low-delay services, and to complete data content collection of a seven-layer application layer protocol under the lowest resource requirement and the fastest speed, so as to provide data basis for subsequent cold start and routing. The technical scheme adopted is that the method is based on the eBPF technology to realize connection forgery and application layer data collection of a specific HTTP service at the user level. The TCP connection and the application layer request are intercepted and hijacked, the cold start or the routing configuration of the back-end service is triggered, and the real connection is completed when the user program retries, so that the influence of the cold start on the high availability and the low-delay services is solved.

Description

Technical Field

[0001] This invention relates to the field of data extraction technology, specifically to a seven-layer protocol data extraction method, system, device, and medium based on eBPF. Background Technology

[0002] The current Linux kernel network stack adopts a layered processing model, responsible for processing network packets from the physical layer to the application layer. It mainly includes the driver layer, protocol stack layer, Netfilter framework, and socket interface core components. Driver layer: The network card writes packets to kernel memory (sk_buff structure) via DMA, triggering soft interrupts (such as NAPI) for packet reception scheduling. Protocol stack layer: Processes the link layer (MAC), network layer (IP), and transport layer (TCP / UDP) sequentially, executing routing, fragmentation, congestion control, and other logic. Netfilter framework: Provides hooks such as PREROUTING, FORWARD, and POSTROUTING, supporting firewall (iptables / nftables), NAT, and other functions. Socket interface: Ultimately delivers data to user-space applications (such as HTTP services) or forwards it to other network devices.

[0003] However, Linux has the following problems: ① It is a performance bottleneck in high-performance networks, as data packets need to be processed layer by layer through the network stack, resulting in high latency (microseconds) and low throughput (especially in high-speed network scenarios); ② Poor scalability: the protocol stack logic is fixed in the kernel, and modifications require recompilation, while new features depend on kernel version upgrades; ③ Difficult to observe: network status (such as packet loss and queue backlog) is difficult to track in real time, and debugging is highly complex.

[0004] eBPF (Extended Berkeley Packet Filter) is a revolutionary kernel technology that allows sandboxed programs to run securely within the kernel, dynamically extending kernel functionality without modifying the kernel source code or loading kernel modules. Initially used for efficient packet filtering (such as tcpdump), it has now expanded to multiple areas including networking, security, observability, performance tuning, and hardware acceleration. The eBPF agent ensures secure execution through a JIT compiler and rigorous verifier, preventing kernel crashes or resource abuse. eBPF technology currently covers various scenarios such as network acceleration, security auditing, and performance analysis (such as the BCC toolchain). However, current issues include: ① Limited instruction count, lack of support for dynamic loops, and reliance on Helper functions to access kernel data. ABI differences between different kernel versions may lead to compatibility issues, requiring CO-RE (Compile Once-Run Everywhere) technology to resolve; ② Familiarity with kernel mechanisms and the eBPF toolchain (such as libbpf and BCC) is required, and debugging tools are not yet fully developed; ③ Development frameworks (such as BCC / libbpf) and release standards are not yet unified.

[0005] Native is an open-source project that uses Kubernetes as its underlying framework to provide a platform for deploying, running, and managing serverless applications. Its main functions include: Serving: Managing the deployment, scaling, autoscaling, version control, and traffic management of serverless applications. Eventing: Managing event-driven serverless applications, including event sourcing, event routing, event filtering, and event transformation. Build: Building and packaging images of serverless applications, supporting multiple build tools and languages.

[0006] Knative automatically adjusts the number of application instances based on request load. When there are no requests, it can shrink to zero to save resources, but it increases the overall complexity of the system, including component configuration, integration, and maintenance.

[0007] Therefore, how to avoid the impact of cold starts on high availability and low latency services, and complete the data content collection of the 7-layer application layer protocol with the lowest resource requirements and the fastest speed, so as to provide data basis for subsequent cold starts and routing, is a technical problem that urgently needs to be solved. Summary of the Invention

[0008] The technical objective of this invention is to provide a method, system, device, and medium for extracting data from the seven-layer application layer protocol based on eBPF, in order to address the problem of how to avoid the impact of cold starts on high availability and low latency services, and to complete the data content collection of the seven-layer application layer protocol with the lowest resource requirements and the fastest speed, so as to provide data basis for subsequent cold starts and routing.

[0009] The technical objective of this invention is achieved as follows: a layer 7 protocol data extraction method based on eBPF. This method uses eBPF technology to achieve connection forgery and application layer data collection at the user level for a specific HTTP service (e.g., example.com). By intercepting and hijacking TCP connections and application layer requests, it triggers cold start or routing configuration of backend services and completes the real connection when the user program retryes, thus resolving the impact of cold start on high availability and low latency services. Specifically, as follows:

[0010] Real-time interception: The eBPF agent intercepts data packets targeting the IP address of the example.com service address, forces the return value of sys_connect() to be changed to a successful connection, and records the forged connection;

[0011] Application layer parsing: After waiting for the user program to send an HTTP request, the eBPF agent intercepts the HTTP information sent by the user by intercepting the system call sys_enter_sendto(), and intercepts the application layer information in it. It then parses the application layer information to obtain the application layer data, including the HTTP header information.

[0012] Forced shutdown: After collecting application layer information, directly call sys_enter_close to actively close the socket, simulate TCP RST, and trigger the user program's reconnection logic;

[0013] Backend cold start: The eBPF agent controls the cold start of the backend service based on the identified application layer information and completes the routing configuration at the same time, so that the user program can correctly complete the service connection after retries.

[0014] Automatic recovery: When the user program retryes, the real service is ready, enabling normal TCP and HTTP connections.

[0015] As a preferred option, the eBPF agent includes the following hook points:

[0016] kprobe / sys_connect: intercepts connect, specifically: captures the target IP, checks whether the dst_address corresponding to the IP corresponds to example.com, parses the corresponding structure and writes it into the map, and forces a return of 0 through bpf_override_return;

[0017] kprobe / sys_setsockopt: Modifies socket parameters during the connection phase;

[0018] tracepoint / net:net_dev_xdp or sockfilter: captures and parses L3 / L4 packets to extract HTTP data;

[0019] `kprobe / sys_sendto|sys_sendmsg|sys_write`: Closes the socket and triggers RST when sending at the application layer;

[0020] kprobe / sys_close: Works with active closing to ensure rapid resource release.

[0021] Preferably, the map of the eBPF agent includes a perf map and a hash map;

[0022] Among them, perf map is used to return the capture results to the user-space program;

[0023] Hash maps are used to transfer domain names that need to be managed between user space and kernel space.

[0024] As a preferred option, the eBPF agent's map includes two data types: map_connections and map_http_meta;

[0025] Among them, map_connections: key=(pid,fd), value={dst_ip, timestamp, fake=true};

[0026] map_http_meta: key=(pid,fd), value={http_headers...}.

[0027] As a preferred option, the implementation logic of the eBPF agent is as follows:

[0028] When the target IP is intercepted in sys_connect, it is written to map_connections, and a fake return value is created;

[0029] When HTTP packets are intercepted in sendto / send, check if they exist in map_connections:

[0030] If so, parse the HTTP header information and write it to map_http_meta;

[0031] Trigger a user-space notification perf_event and mark the corresponding connection as pending closure;

[0032] At the appropriate time, call bpf_probe_write_user or guide the user-space call close to simulate a TCP RST.

[0033] As a preferred option, the user-space ebpf Controller is as follows:

[0034] Event consumption: Listen for eBPF events using libbpf and obtain connection information (e.g., pid, fd, http_headers) from the perf map;

[0035] Backend notification: Based on the HTTP Host, URI, and Header information, call the backend autoscaler interface via gRPC or HTTP;

[0036] State management: Maintain the lifecycle of each connection to ensure that the same request is only notified once;

[0037] Logs and monitoring: Record trigger time, request metadata, and backend startup time.

[0038] Ideally, the backend autoscaler should be configured as follows:

[0039] Cold start: Calling the API of a container orchestration platform (such as Kubernetes) to create or scale up or down a Pod or Service;

[0040] Health check: Returns success only after ensuring the new instance is ready;

[0041] Callback notification: Once the service is ready, return a completion signal to the eBPF Controller.

[0042] A Layer 7 protocol data extraction system based on eBPF, which implements the aforementioned Layer 7 protocol data extraction method based on eBPF; the system includes:

[0043] The eBPF agent is used to initiate a sys_connect call to the target IP (example.com), fake a successful connection, capture the HTTP requests sent by the user program, parse the HTTP header information, actively close the socket after collecting the application layer information, simulate TCP RST, trigger the user program's reconnection logic, and based on the parsed HTTP header information, notify the backend to start the corresponding service instance or update the route. When the user program retryes, the real service is ready, realizing a normal TCP and HTTP connection.

[0044] The user-space eBPF Controller is used to listen for eBPF events through libbpf, obtain connection information from the perf map, and call the backend autoscaler interface via gRPC or HTTP based on the HTTP Host, URI and Header information to maintain the lifecycle of each connection, ensuring that the same request is only notified once, and thus recording the trigger time, request metadata and backend startup time.

[0045] The backend autoscaler is used to call the API of the container orchestration platform (such as Kubernetes) to create or scale up or down Pods or Services, and returns success only after ensuring that the new instance is ready through health checks. Once the service is ready, it returns a completion signal to the eBPFController.

[0046] An electronic device includes: a memory and at least one processor;

[0047] The memory contains computer programs;

[0048] The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the eBPF-based seven-layer protocol data extraction method as described above.

[0049] A computer-readable storage medium storing a computer program that can be executed by a processor to implement the eBPF-based seven-layer protocol data extraction method described above.

[0050] The eBPF-based seven-layer protocol data extraction method, system, device, and medium of the present invention have the following advantages:

[0051] (i) The user program of this invention establishes an HTTP connection to example.com. After completing the TCP connection, i.e. after the sysconnect returns a success, the user program sends an HTTP request. If the user program encounters a TCP reset error, it retryes the TCP connection. If the user program retryes successfully, the HTTP connection is completed. It can forge the connection and obtain application layer data at a lower cost. It can be used for control plane management applications based on the 7-layer protocol data, such as Knative.

[0052] (ii) The purpose of this invention is to complete the data content collection of the 7-layer application layer protocol with the lowest resource requirements and the fastest speed, so as to provide data basis for subsequent cold start and routing;

[0053] (iii) This invention can collect data at the kernel level and perform operations such as cold start and routing configuration based on the collected information, while ensuring that user programs can still work normally.

[0054] (iv) This invention can complete the functions of knatice at the kernel level, thereby reducing the resource investment required to achieve the same purpose and saving costs;

[0055] (v) This invention uses kernel coding technology, such as eBPF technology, to control multiple system calls and kernel functions in the kernel, thereby forging normal connections and allowing user programs to send application layer protocol requests normally, thus completing the data capture process.

[0056] (vi) When the client program builds a connection, the present invention forges a normally established connection, thereby allowing the client to continue sending data. Specifically, the method can be to directly force a correct return when the client uses the sys_connect() call.

[0057] (vii) When a user sends a normal application layer request, the present invention directly intercepts and processes the application layer data. Specifically, the method is to intercept socket data and obtain application layer data in the send or send_to call.

[0058] (viii) After obtaining application layer data, the present invention closes the current connection and feeds back an appropriate error code, thereby enabling the user program to maintain retry behavior. The specific method is to directly call sys_enter_close to close the socket. Attached Figure Description

[0059] The invention will be further described below with reference to the accompanying drawings.

[0060] Appendix Figure 1 This is a schematic diagram of the structure of a seven-layer protocol data extraction system based on eBPF. Detailed Implementation

[0061] The following detailed description of the eBPF-based seven-layer protocol data extraction method, system, device, and medium of the present invention is provided with reference to the accompanying drawings and specific embodiments.

[0062] Example 1:

[0063] This embodiment provides a layer 7 protocol data extraction method based on eBPF. This method uses eBPF technology to achieve connection forgery and application-layer data collection at the user level for a specific HTTP service (e.g., example.com). By intercepting and hijacking TCP connections and application-layer requests, it triggers cold starts or routing configurations in backend services, and completes a real connection when the user program retryes, thus mitigating the impact of cold starts on high availability and low-latency services. Details are as follows:

[0064] S1. Real-time interception: The eBPF agent intercepts data packets targeting the IP address of the example.com service address, forces the return value of sys_connect() to be changed to a successful connection, and records the forged connection.

[0065] S2, Application Layer Parsing: After waiting for the user program to send an HTTP request, the eBPF agent intercepts the HTTP information sent by the user by intercepting the system call sys_enter_sendto(), and intercepts the application layer information in it. It then parses the application layer information to obtain the application layer data, including the HTTP header information.

[0066] S3, Force Close: After collecting application layer information, directly call sys_enter_close to actively close the socket, simulate TCP RST, and trigger the user program's reconnection logic;

[0067] S4. Backend Cold Start: The eBPF agent controls the cold start of the backend service based on the identified application layer information and completes the routing configuration, so that the user program can correctly complete the service connection after retries.

[0068] S5. Automatic recovery: When the user program retryes, the real service is ready, and normal TCP and HTTP connections are established.

[0069] The eBPF agent in this embodiment includes the following hook points:

[0070] kprobe / sys_connect: intercepts connect, specifically: captures the target IP, checks whether the dst_address corresponding to the IP corresponds to example.com, parses the corresponding structure and writes it into the map, and forces a return of 0 through bpf_override_return;

[0071] kprobe / sys_setsockopt: Modifies socket parameters during the connection phase;

[0072] tracepoint / net:net_dev_xdp or sockfilter: captures and parses L3 / L4 packets to extract HTTP data;

[0073] `kprobe / sys_sendto|sys_sendmsg|sys_write`: Closes the socket and triggers RST when sending at the application layer;

[0074] kprobe / sys_close: Works with active closing to ensure rapid resource release.

[0075] In this embodiment, the eBPF agent's map includes a perf map and a hash map;

[0076] Among them, perf map is used to return the capture results to the user-space program;

[0077] Hash maps are used to transfer domain names that need to be managed between user space and kernel space.

[0078] In this embodiment, the eBPF agent's map includes two data types: map_connections and map_http_meta;

[0079] Among them, map_connections: key=(pid,fd), value={dst_ip, timestamp, fake=true};

[0080] map_http_meta: key=(pid,fd), value={http_headers...}.

[0081] The implementation logic of the eBPF agent in this embodiment is as follows:

[0082] ① Intercept the target IP in sys_connect, write it to map_connections, and forge the return value;

[0083] ② When HTTP packets are intercepted in sendto / send, check if they exist in map_connections:

[0084] If so, parse the HTTP header information and write it to map_http_meta;

[0085] ③ Trigger the user-space notification perf_event and mark the corresponding connection as pending closure;

[0086] ④ Call bpf_probe_write_user or guide the user-space call close at the appropriate time to simulate TCPRST.

[0087] The user-space ebpf Controller in this embodiment is as follows:

[0088] ① Event consumption: Listen for eBPF events using libbpf and obtain connection information (e.g., pid, fd, http_headers) from the perf map;

[0089] ② Backend notification: Based on the HTTP Host, URI and Header information, call the backend autoscaler interface via gRPC or HTTP;

[0090] ③ State management: Maintain the lifecycle of each connection to ensure that the same request is only notified once;

[0091] ④ Logs and monitoring: Record trigger time, request metadata, and backend startup time.

[0092] The backend autoscaler in this embodiment is as follows:

[0093] ① Cold start: Call the API of a container orchestration platform (such as Kubernetes) to create or scale up or down a Pod or Service;

[0094] ② Health check: Ensure the new instance is ready before returning success;

[0095] ③ Callback notification: Once the service is ready, return a completion signal to the eBPF Controller.

[0096] Example 2:

[0097] As attached Figure 1 As shown, this embodiment provides a Layer 7 protocol data extraction system based on eBPF. This system is used to implement the Layer 7 protocol data extraction method based on eBPF as described in Embodiment 1. The system includes:

[0098] The eBPF agent is used to initiate a sys_connect call to the target IP (example.com), fake a successful connection, capture the HTTP requests sent by the user program, parse the HTTP header information, actively close the socket after collecting the application layer information, simulate TCP RST, trigger the user program's reconnection logic, and based on the parsed HTTP header information, notify the backend to start the corresponding service instance or update the route. When the user program retryes, the real service is ready, realizing a normal TCP and HTTP connection.

[0099] The user-space eBPF Controller is used to listen for eBPF events through libbpf, obtain connection information from the perf map, and call the backend autoscaler interface via gRPC or HTTP based on the HTTP Host, URI and Header information to maintain the lifecycle of each connection, ensuring that the same request is only notified once, and thus recording the trigger time, request metadata and backend startup time.

[0100] The backend autoscaler is used to call the API of the container orchestration platform (such as Kubernetes) to create or scale up or down Pods or Services, and returns success only after ensuring that the new instance is ready through health checks. Once the service is ready, it returns a completion signal to the eBPFController.

[0101] The eBPF agent in this embodiment includes the following hook points:

[0102] kprobe / sys_connect: intercepts connect, specifically: captures the target IP, checks whether the dst_address corresponding to the IP corresponds to example.com, parses the corresponding structure and writes it into the map, and forces a return of 0 through bpf_override_return;

[0103] kprobe / sys_setsockopt: Modifies socket parameters during the connection phase;

[0104] tracepoint / net:net_dev_xdp or sockfilter: captures and parses L3 / L4 packets to extract HTTP data;

[0105] `kprobe / sys_sendto|sys_sendmsg|sys_write`: Closes the socket and triggers RST when sending at the application layer;

[0106] kprobe / sys_close: Works with active closing to ensure rapid resource release.

[0107] In this embodiment, the eBPF agent's map includes a perf map and a hash map;

[0108] Among them, perf map is used to return the capture results to the user-space program;

[0109] Hash maps are used to transfer domain names that need to be managed between user space and kernel space.

[0110] In this embodiment, the eBPF agent's map includes two data types: map_connections and map_http_meta;

[0111] Among them, map_connections: key=(pid,fd), value={dst_ip, timestamp, fake=true};

[0112] map_http_meta: key=(pid,fd), value={http_headers...}.

[0113] The implementation logic of the eBPF agent in this embodiment is as follows:

[0114] ① Intercept the target IP in sys_connect, write it to map_connections, and forge the return value;

[0115] ② When HTTP packets are intercepted in sendto / send, check if they exist in map_connections:

[0116] If so, parse the HTTP header information and write it to map_http_meta;

[0117] ③ Trigger the user-space notification perf_event and mark the corresponding connection as pending closure;

[0118] ④ Call bpf_probe_write_user or guide the user-space call close at the appropriate time to simulate TCPRST.

[0119] Example 3:

[0120] This embodiment also provides an electronic device, including: a memory and a processor;

[0121] The memory stores the instructions executed by the computer.

[0122] The processor executes computer execution instructions stored in the memory, causing the processor to perform the eBPF-based seven-layer protocol data extraction method in any embodiment of the present invention.

[0123] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can be a microprocessor or any conventional processor.

[0124] Memory is used to store computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, at least one application program required for a function, etc.; the data storage area can store data created based on the use of the terminal, etc. In addition, memory can also include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart memory cards (SMC), secure digital cards (SD cards), flash memory cards, at least one disk storage device, flash memory devices, or other volatile solid-state storage devices.

[0125] Example 4:

[0126] This embodiment also provides a computer-readable storage medium storing multiple instructions, which are loaded by a processor to cause the processor to execute the eBPF-based seven-layer protocol data extraction method according to any embodiment of the present invention. Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0127] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0128] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RYM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0129] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0130] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for extracting data from a seven-layer protocol based on eBPF, characterized in that, This method, based on eBPF technology, enables connection forgery and application-layer data collection at the user level for specific HTTP services. By intercepting and hijacking TCP connections and application-layer requests, it triggers cold starts or routing configurations in backend services and establishes a real connection during user program retry, thus mitigating the impact of cold starts on high availability and low-latency services. Details are as follows: Real-time interception: The eBPF agent intercepts data packets targeting the IP address of the example.com service address, forces the return value of sys_connect() to be changed to a successful connection, and records the forged connection; Application layer parsing: After waiting for the user program to send an HTTP request, the eBPF agent intercepts the HTTP information sent by the user by intercepting the system call sys_enter_sendto(), and intercepts the application layer information in it. It then parses the application layer information to obtain the application layer data, including the HTTP header information. Forced shutdown: After collecting application layer information, directly call sys_enter_close to actively close the socket, simulate TCP RST, and trigger the user program's reconnection logic; Backend cold start: The eBPF agent controls the cold start of the backend service based on the identified application layer information and completes the routing configuration at the same time, so that the user program can correctly complete the service connection after retries. Automatic recovery: When the user program retryes, the real service is ready, enabling normal TCP and HTTP connections.

2. The method for extracting seven-layer protocol data based on eBPF according to claim 1, characterized in that, The eBPF agent includes the following hook points: kprobe / sys_connect: intercepts connect, specifically: captures the target IP, checks whether the dst_address corresponding to the IP corresponds to example.com, parses the corresponding structure and writes it into the map, and forces a return of 0 through bpf_override_return; kprobe / sys_setsockopt: Modifies socket parameters during the connection phase; tracepoint / net:net_dev_xdp or sockfilter: captures and parses L3 / L4 packets to extract HTTP data; `kprobe / sys_sendto|sys_sendmsg|sys_write`: Closes the socket and triggers RST when sending at the application layer; kprobe / sys_close: Works with active closing to ensure rapid resource release.

3. The method for extracting seven-layer protocol data based on eBPF according to claim 1, characterized in that, The eBPF agent's map includes a perf map and a hash map; Among them, perf map is used to return the capture results to the user-space program; Hash maps are used to transfer domain names that need to be managed between user space and kernel space.

4. The method for extracting seven-layer protocol data based on eBPF according to claim 1, characterized in that, The eBPF agent's map includes two data types: map_connections and map_http_meta; Among them, map_connections: key=(pid,fd), value={dst_ip, timestamp, fake=true}; map_http_meta: key=(pid,fd), value={http_headers...}.

5. The method for extracting seven-layer protocol data based on eBPF according to claim 1, characterized in that, The specific implementation logic of the eBPF agent is as follows: When the target IP is intercepted in sys_connect, it is written to map_connections, and a fake return value is created; When HTTP packets are intercepted in sendto / send, check if they exist in map_connections: If so, parse the HTTP header information and write it to map_http_meta; Trigger a user-space notification perf_event and mark the corresponding connection as pending closure; At the appropriate time, call bpf_probe_write_user or guide the user-space call close to simulate a TCP RST.

6. The method for extracting seven-layer protocol data based on eBPF according to claim 1, characterized in that, The user-space ebpfController is as follows: Event consumption: Listen for eBPF events using libbpf and obtain connection information from the perf map; Backend notification: Based on the HTTP Host, URI, and Header information, call the backend autoscaler interface via gRPC or HTTP; State management: Maintain the lifecycle of each connection to ensure that the same request is only notified once; Logs and monitoring: Record trigger time, request metadata, and backend startup time.

7. The method for extracting seven-layer protocol data based on eBPF according to any one of claims 1-6, characterized in that, The backend autoscaler is as follows: Cold start: Call the container orchestration platform API to create or scale up or down a Pod or Service; Health check: Returns success only after ensuring the new instance is ready; Callback notification: Once the service is ready, return a completion signal to the eBPF Controller.

8. A seven-layer protocol data extraction system based on eBPF, characterized in that, This system is used to implement the eBPF-based seven-layer protocol data extraction method as described in any one of claims 1 to 7; the system includes: The eBPF agent is used to initiate a sys_connect call to the target IP, fake a successful connection, capture the HTTP requests sent by the user program, parse the HTTP header information, actively close the socket after collecting the application layer information, simulate TCPRST, trigger the user program's reconnection logic, and based on the parsed HTTP header information, notify the backend to start the corresponding service instance or update the route. When the user program retryes, the real service is ready, realizing a normal TCP and HTTP connection. The user-space eBPF Controller is used to listen for eBPF events through libbpf, obtain connection information from the perf map, and call the backend autoscaler interface via gRPC or HTTP based on the HTTP Host, URI and Header information to maintain the lifecycle of each connection, ensuring that the same request is only notified once, and thus recording the trigger time, request metadata and backend startup time. The backend autoscaler is used to call the container orchestration platform API to create or scale up or down Pods or Services, and returns success only after ensuring that the new instance is ready through health checks. Once the service is ready, it returns a completion signal to the eBPF Controller.

9. An electronic device, characterized in that, include: Memory and at least one processor; The memory contains computer programs; The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the eBPF-based seven-layer protocol data extraction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that can be executed by a processor to implement the eBPF-based seven-layer protocol data extraction method as described in any one of claims 1 to 7.

Images