Network index data acquisition method, device, equipment, medium and product

Abstract

The invention relates to the technical field of network communication, and provides a network index data acquisition method, device and equipment, a medium and a product. The method comprises the following steps: configuring an eBPF instruction set based on preset six-element information, wherein the six-element information comprises a client IP address, a client port, a server IP address, a server port, a domain name and a thread number; and filtering a received first network data packet based on the eBPF instruction set to obtain a second network data packet, and collecting a network index data set corresponding to the second network data packet, the second network data packet conforming to the six-element information. Based on the scheme of the invention, accurate and efficient network index data acquisition can be realized.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a method, apparatus, device, medium, and product for collecting network indicator data. Background Technology

[0002] In modern network architectures, distributed network systems improve access response speed and overall service quality by deploying services or content to multiple nodes close to users. However, in complex network environments and scenarios with massive business requests, the actual network performance of a system is often affected by a combination of underlying factors, leading to fluctuations in service quality. These performance fluctuations not only directly impact the end-user experience but also pose challenges to network performance optimization and fault localization. Collecting network metrics data provides a basis for in-depth analysis of system performance, locating the root cause of faults, and implementing effective optimization strategies. Therefore, how to accurately and efficiently collect network metrics data has become an urgent technical problem to be solved. Summary of the Invention

[0003] This application provides a method, apparatus, device, medium, and product for collecting network indicator data, in order to solve the technical problem of how to accurately and efficiently collect network indicator data.

[0004] In a first aspect, embodiments of this application provide a method for collecting network indicator data, including: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

[0005] In conjunction with the first aspect, in some possible implementations, the eBPF instruction set is configured based on a preset six-element information, including: Based on the preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing.

[0006] Combining the first aspect and the above implementation methods, in some possible implementation methods, based on preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing, including: Based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel is configured through dynamic tracing. Based on the six-element information, the eBPF instruction set corresponding to the network layer of the operating system kernel is configured through static tracing. Based on the hexagonal information, configure the eBPF instruction set corresponding to the transport layer of the operating system kernel through dynamic and static tracing; and / or, based on the hexagonal information, configure the eBPF instruction set corresponding to the application layer through user-mode tracing.

[0007] Combining the first aspect and the above implementation methods, in some possible implementation methods, the second network data packet is obtained by filtering from the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected, including: The network card is invoked to receive the first network data packet and then transmits the first network data packet to the operating system kernel; Based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and the second indicator data corresponding to the intermediate network data packets are collected. Based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected; or, based on the eBPF instruction set corresponding to the application layer, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected. Based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, determine the network indicator dataset corresponding to the second network data packet.

[0008] Combining the first aspect and the above implementation methods, in some possible implementation methods, intermediate network data packets are filtered from the first network data packets based on the eBPF instruction set corresponding to the network layer of the operating system kernel, including: Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, the first network data packet is parsed to obtain the corresponding communication quadruple information and thread number; Based on the communication quadruple information and thread number corresponding to the first network data packet, intermediate network data packets are obtained by filtering from the first network data packet; The intermediate network data packet is the first network data packet that conforms to the six-element information, namely the client IP address, client port, server IP address, server port, and thread number.

[0009] Combining the first aspect and the above implementation methods, in some possible implementation methods, based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, the second network data packet is obtained by filtering from the intermediate network data packets, including: When the intermediate network data packet is an unencrypted HTTP protocol data packet, the corresponding HTTP request data is obtained by parsing the intermediate network data packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel. The second network data packet is obtained by filtering from the intermediate network data packet based on the domain name contained in the HTTP request data corresponding to the intermediate network data packet; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0010] Combining the first aspect and the above implementation methods, in some possible implementation methods, based on the eBPF instruction set corresponding to the application layer, the second network data packet is obtained by filtering from the intermediate network data packets, including: When the intermediate network data packet is an HTTPS protocol data packet encrypted with SSL / TLS, the intermediate network data packet is tracked in the user-space SSL / TLS protocol parsing process based on the eBPF instruction set corresponding to the application layer to obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is obtained by filtering from the intermediate network data packets based on the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0011] In combination with the first aspect and the above implementation methods, in some possible implementation methods, after determining the network indicator dataset corresponding to the second network data packet based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, the method further includes: The network metric dataset corresponding to the second network data packet is transferred from the operating system kernel to the application layer through a circular buffer queue.

[0012] Combining the first aspect and the above implementation methods, in some possible implementation methods, the first indicator data corresponding to the second network data packet includes the network card's transmission and reception time; The second indicator data corresponding to the second network data packet includes at least one of TTL and data packet length; The third indicator data corresponding to the second network data packet includes at least one of the following: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows.

[0013] Combining the first aspect and the above implementation methods, in some possible implementation methods, after filtering the second network data packet from the received first network data packet based on the eBPF instruction set and collecting the network indicator dataset corresponding to the second network data packet, the method further includes: At the application layer, data cleaning and index aggregation are performed on the network index dataset corresponding to the second network data packet, and the index data is aggregated. Send the aggregated indicator data to the indicator analysis platform.

[0014] Secondly, embodiments of this application provide a network indicator data acquisition device, comprising: The configuration module is used to configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The acquisition module is used to filter the received first network data packet from the second network data packet based on the eBPF instruction set, and to collect the network indicator dataset corresponding to the second network data packet. The second network data packet conforms to six-element information.

[0015] Thirdly, embodiments of this application provide a network device, including a memory, a transceiver, and a processor; Memory is used to store computer programs; transceiver is used to send and receive data under the control of the processor; processor is used to read the computer programs from memory and perform the following operations: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

[0016] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the network indicator data acquisition method of the first aspect.

[0017] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, implements the steps of the network indicator data acquisition method of the first aspect.

[0018] The network indicator data acquisition method, apparatus, device, medium, and product provided in this application first configure an eBPF instruction set based on preset six-element information, including client IP address, client port, server IP address, server port, domain name, and thread number. Then, the received first network data packets are filtered using the configured eBPF instruction set to select second network data packets that match the six-element information. The second network data packets are then collected to obtain the corresponding network indicator dataset. By configuring the eBPF instruction set using the six-element information, the scope of network traffic collection is limited, avoiding the resource consumption associated with full data collection. Furthermore, filtering the first network data packets based on the eBPF instruction set to obtain the second network data packets and collecting their network indicator datasets ensures the relevance and accuracy of the collected data, achieving accurate and efficient network indicator data acquisition. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the network indicator data collection method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the interactive process for collecting CDN domain-level network metrics based on eBPF technology, provided in an embodiment of this application. Figure 3 This is a schematic diagram of the eBPF hierarchical configuration and network indicator collection process based on six-element information provided in the embodiments of this application; Figure 4 A schematic diagram illustrating the network layer structure and communication interaction process corresponding to the HTTP and HTTPS protocols provided in the embodiments of this application; Figure 5 A schematic diagram illustrating the configuration, kernel data collection, and indicator processing flow for network indicator collection provided in this application embodiment; Figure 6 This is a schematic diagram illustrating the client request, network indicator collection, and reporting process under HTTPS and HTTP protocols provided in the embodiments of this application. Figure 7 This is a schematic diagram of the network indicator data acquisition device provided in the embodiments of this application; Figure 8 This is a schematic diagram of the network device provided in the embodiments of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0022] Explanation of some terms used in the embodiments of this application: eBPF (extended Berkeley Packet Filter): A program instruction that runs in the operating system kernel space and is used to monitor and filter network packets.

[0023] HTTP (Hypertext Transfer Protocol): A non-encrypted network protocol used to transmit hypertext.

[0024] HTTPS (Hypertext Transfer Protocol Secure): An encrypted network protocol based on HTTP, using SSL / TLS for data encryption.

[0025] SSL (Secure Sockets Layer): A network protocol used to establish a secure connection between communicating parties.

[0026] TLS (Transport Layer Security): A successor to SSL, providing a more secure communication protocol.

[0027] CDN (Content Delivery Network): A network system that improves access speed and overall service quality by caching content on edge servers closer to users.

[0028] RTT (Round-Trip Time): A network metric that measures the time it takes for a data packet to travel from the sender to the receiver and back.

[0029] TTL (Time To Live): A field defined in the network layer protocol header that limits the maximum number of hops a data packet can be forwarded in the network.

[0030] In modern network architectures, distributed network systems improve access response speed and overall service quality by deploying services or content to multiple nodes close to users. However, in complex network environments and scenarios with massive business requests, the actual network performance of a system is often affected by a combination of underlying factors, leading to fluctuations in service quality. These performance fluctuations not only directly impact the end-user experience but also pose challenges to network performance optimization and fault location. Collecting network metric data can provide a basis for decision-making in in-depth analysis of system performance, locating the root cause of faults, and implementing effective optimization strategies.

[0031] Taking CDN as an example, CDN caches content on edge servers closer to users, allowing them to access the content they need from the nearest server, thereby improving access speed and success rate. Network performance metrics are key parameters for measuring CDN service quality. These include not only application-layer metrics, such as resource response output rate, but also kernel-layer metrics that affect these application-layer metrics. However, in scenarios with massive user requests and diverse business needs, accurately obtaining key kernel-layer metrics that affect business quality, such as packet ingress / egress time, minimum round-trip time due to congestion, average packet length, and number of zero windows, presents an extremely high challenge.

[0032] In some related technologies, a manual data collection approach is employed. This approach involves personnel logging into the faulty node and manually capturing kernel-level data related to the metrics using network connectivity tools or packet capture tools, then performing offline analysis and summarization. This process relies on long-term experience and numerous trial-and-error experiments to help resolve issues related to low metric quality.

[0033] In some related technologies, a full data collection approach is adopted. This approach uses specific collection tools to collect all kernel communication data and parameters. Due to the massive amount of data collected from full kernel data collection, it can usually only be temporarily activated during fixed periods of low business load. After multiple rounds of data collection, the data is then analyzed to help solve metric quality issues.

[0034] It is evident that the aforementioned technologies have shortcomings: For manual data collection solutions, the main drawbacks are: firstly, data collection and analysis lack timeliness and accuracy, requiring manual intervention, which is time-consuming and makes it difficult to capture precise data at the moment of a failure; secondly, it heavily relies on the professional knowledge and experience of the analysts; and finally, excessive online manual intervention threatens the stability of the production environment. For full-data collection solutions, the main drawbacks are: firstly, full-data collection consumes significant production system resources, exacerbating the deterioration of business indicators and threatening the stable operation of the production environment; secondly, this solution can only be activated temporarily, resulting in poor timeliness and potential inaccuracy of the collected data.

[0035] Therefore, how to accurately and efficiently collect network indicator data has become an urgent technical problem to be solved.

[0036] To address the aforementioned issues, the solution provided in this application primarily includes: First, configuring an eBPF instruction set based on preset six-element information, including client IP address, client port, server IP address, server port, domain name, and thread number; then, filtering the received first network data packets using the configured eBPF instruction set to select second network data packets that match the six-element information, and collecting data from these second network data packets to obtain the corresponding network indicator dataset; By configuring the eBPF instruction set using the six-element information, the scope of network traffic collection is limited, avoiding the resource consumption associated with full data collection; furthermore, filtering the first network data packets based on the eBPF instruction set to obtain the second network data packets and collecting their network indicator dataset ensures the relevance and accuracy of the collected data, achieving accurate and efficient network indicator data collection.

[0037] The following will provide a detailed description of the network indicator data collection method provided in the embodiments of this application.

[0038] Please see Figure 1 , Figure 1 This is a flowchart illustrating a method for collecting network indicator data, as provided in an embodiment of this application. Figure 1 As shown, the method in this application embodiment may include the following steps S101-S102.

[0039] S101 configures the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number.

[0040] Specifically, to achieve accurate filtering of specific business traffic within massive network traffic and avoid interference from irrelevant data and resource waste, the eBPF instruction set needs to be configured based on a preset six-element information set. This six-element information set includes the client IP address, client port, server IP address, server port, domain name, and thread number. The preset six-element information configuration refers to the process of setting a set of filtering parameters to uniquely identify target network communication based on monitoring requirements. The eBPF instruction set refers to a set of program instructions running in the operating system kernel space for monitoring and filtering network packets. The client IP address in the six-element information refers to the Internet Protocol address of the client device initiating the network request. The client port in the six-element information refers to the port number used by the client device initiating the network request for this communication. The server IP address in the six-element information refers to the Internet Protocol address of the server device providing network services. The server port in the six-element information refers to the port number used by the server device providing network services to listen for requests. The domain name in the six-element information refers to the identifier of the specific network resource requested by the user. The thread number in the six-element information refers to the number of the execution unit in the operating system that identifies the processing of specific network packets.

[0041] Regarding this step, in some possible implementations, configuration can be achieved by compiling the preset six-element information into the eBPF instruction set and loading the eBPF instruction set into a specified location. Alternatively, configuration can be achieved by storing the preset six-element information in a specified storage area accessible by the eBPF instruction set and loading the eBPF instruction set into the specified location.

[0042] It should be noted that the process of setting up the six-element information can be as follows: Operations personnel manually input or select the target client IP address, client port, server IP address, server port, domain name, and thread number in the configuration system according to monitoring needs, generating a configuration file. Alternatively, the process can be as follows: the relevant upper-level monitoring system automatically generates and distributes the six-element information based on real-time alarms or analysis results to achieve the desired configuration.

[0043] S102, based on the eBPF instruction set, filter the received first network data packet to obtain the second network data packet, and collect the network indicator dataset corresponding to the second network data packet. The second network data packet conforms to the six-element information.

[0044] Specifically, to obtain high-value network performance metrics related to specific services at the operating system kernel level, it is necessary to filter second network packets from the received first network packets based on the eBPF instruction set, and collect the network metric dataset corresponding to the second network packets. The second network packets conform to six-element information. Here, the first network packet refers to the raw network packet received by the network card without any filtering; filtering refers to the process of selecting network packets that meet specific conditions from the first network packet based on preset six-element information; the second network packet refers to the target network packet that conforms to the preset six-element information after filtering; the network metric dataset corresponding to the second network packet refers to a set of data associated with the second network packet used to measure its network performance; the second network packet conforming to the six-element information means that the client IP address, client port, server IP address, server port, domain name, and thread number processing the packet contained in the second network packet match the preset six-element information.

[0045] Regarding this step, some possible implementations involve using the eBPF instruction set to process the first network data packet at multiple network protocol processing stages within the operating system kernel. At each stage, filtering is performed based on six-element information to collect a dataset of network metrics corresponding to the second network data packet that matches the six-element information. Alternatively, specific processing points can be selected within the operating system kernel's network processing flow, and the eBPF instruction set can be used to centrally process the first network data packet to complete filtering and collect the dataset of network metrics corresponding to the second network data packet.

[0046] In some cases, after collecting the network metric dataset corresponding to the second network data packet, this dataset can be efficiently transferred from kernel space to user space applications via eBPF mapping mechanisms or event queues. In some cases, after collecting the network metric dataset corresponding to the second network data packet, preliminary aggregation or preprocessing can be performed on the dataset in kernel space before transmitting the processed results to the user, reducing data processing pressure in user space. In some cases, the network metric dataset corresponding to the second network data packet can also be sent to a relevant analysis platform. Besides these, the network metric dataset corresponding to the second network data packet may have various other applications, which are not limited in this embodiment.

[0047] In this embodiment, an eBPF instruction set is first configured based on a preset six-element information set, including the client IP address, client port, server IP address, server port, domain name, and thread number. Then, the received first network data packets are filtered using the configured eBPF instruction set to identify second network data packets that match the six-element information set. The second network data packets are then collected to obtain the corresponding network indicator dataset. By configuring the eBPF instruction set using the six-element information set, the scope of network traffic collection is limited, avoiding the resource consumption associated with full data collection. Furthermore, filtering the first network data packets based on the eBPF instruction set to obtain the second network data packets and collecting their network indicator dataset ensures the relevance and accuracy of the collected data, achieving accurate and efficient network indicator data collection.

[0048] In one embodiment, the above step "configure the eBPF instruction set based on preset six-element information" can be further refined and may include the following steps: Based on the preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing.

[0049] Specifically, considering that different levels of the operating system kernel (such as the data link layer, network layer, and transport layer) and the application layer in user space provide different types of observation points, and that each observation point is suitable for different tracking technologies, this embodiment proposes to combine at least one of dynamic tracking, static tracking, and user-space tracking to configure the eBPF instruction set in order to achieve flexible and comprehensive data acquisition capabilities across protocol stacks.

[0050] More specifically, to achieve accurate filtering of network packets and ensure that subsequently collected network metric data is correlated with specific service traffic, it is necessary to configure the eBPF instruction set based on a preset six-element information and through at least one of dynamic tracing, static tracing, and user-space tracing. The preset six-element information refers to a set of filtering parameters pre-defined according to monitoring requirements to uniquely identify target network communication. This set of filtering parameters includes the client IP address, client port, server IP address, server port, domain name, and thread number. Dynamic tracing refers to a technique that attaches trace points to dynamic kernel events or function addresses at runtime, such as using the kprobes mechanism to trace arbitrary kernel function calls. Static tracing refers to a technique that attaches trace points to predefined, stable trace points in the kernel source code, such as using the tracepoint mechanism to trace specific kernel events. User-space tracing refers to a technique that attaches trace points to specific functions or addresses in user-space applications, such as using the uprobes mechanism to trace user-space function calls.

[0051] Regarding this step, in some possible implementations, based on preset six-element information, the eBPF instruction set containing the six-element information filtering logic can be mounted to the dynamic function entry point of the data link layer or transport layer of the operating system kernel through dynamic tracking, thereby realizing the monitoring of specific network traffic.

[0052] In some possible implementations, based on preset six-element information, the eBPF instruction set containing the six-element information filtering logic can be mounted to a predefined static tracing point in the operating system kernel network layer, such as the tracing point of the IP packet processing function, through static tracing, so as to achieve preliminary screening of packets that conform to specific communication quadruple information.

[0053] In some possible implementations, based on the preset six-element information, the eBPF instruction set used to obtain domain name information can be mounted into the SSL / TLS protocol parsing function of the user-space application through user-space tracking. This allows the domain name to be obtained before encryption or after decryption, and the obtained domain name can be used as the domain name in the preset six-element information for subsequent filtering and judgment.

[0054] It is understandable that the above-mentioned dynamic tracing, static tracing, and user-space tracing methods can be combined or used in combination according to actual needs. For example, different eBPF instruction sets can be mounted in kernel space and user space at the same time to jointly complete the filtering and indicator collection of specific network packets.

[0055] In this embodiment, by employing one or more of dynamic tracing, static tracing, and user-space tracing, the eBPF instruction set can be flexibly deployed at different levels of the operating system. This allows filtering operations to be performed at multiple key nodes in the packet processing flow based on preset six-element information. This layered configuration, combining multiple tracing technologies, enables the system to implement precise filtering of packets from different protocols (such as HTTP and HTTPS) at the corresponding protocol processing level (such as the kernel transport layer or the user-space SSL resolution layer). This achieves accurate and efficient capture of target network traffic, thereby ensuring a strong correlation between subsequently collected network indicator data and specific service traffic.

[0056] In one embodiment, the above step "configure the eBPF instruction set based on preset six-element information and through at least one of dynamic tracking, static tracking, and user-space tracking" can be further refined and may include the following steps: Based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel is configured through dynamic tracing. Based on the six-element information, the eBPF instruction set corresponding to the network layer of the operating system kernel is configured through static tracing. Based on the hexagonal information, configure the eBPF instruction set corresponding to the transport layer of the operating system kernel through dynamic and static tracing; and / or, based on the hexagonal information, configure the eBPF instruction set corresponding to the application layer through user-mode tracing.

[0057] Specifically, considering the differences in data content and observable points processed by different network protocol layers of the operating system kernel, and the different tracking technologies such as dynamic tracking, static tracking, and user-space tracking each have their own applicable scenarios and performance characteristics, this embodiment proposes a layered configuration strategy. The aim is to deploy the eBPF instruction set, which contains preset six-element information filtering logic, to the corresponding layers of the operating system kernel and user space in a reasonable manner, thereby achieving accurate filtering of network data packets and efficient indicator collection.

[0058] First, based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel needs to be configured through dynamic tracking. Here, the operating system kernel refers to the core software that manages computer hardware resources, such as the Linux operating system kernel; the operating system kernel's data link layer refers to the protocol layer responsible for transmitting data frames between adjacent network nodes, such as Layer 2 in the Open Systems Interconnection (OSI) model; and the eBPF instruction set corresponding to the data link layer refers to the set of program instructions mounted on the data link layer used to collect relevant metrics at that layer, such as the instruction set used to obtain the time it takes for data packets to enter and exit the network interface card (NIC).

[0059] Regarding this step, in some possible implementations, based on the preset six-element information, the eBPF instruction set corresponding to the data link layer can be dynamically tracked and mounted to the function entry point in the operating system kernel that processes network card data packets. For example, it can be mounted to the receive and send functions of the network device driver through the kprobe mechanism. This allows the network card time for data packets that match the communication quadruple and thread number in the six-element information to be collected, and the network card time for receiving and sending data packets can be used as the first indicator data.

[0060] Furthermore, to perform preliminary filtering of data packets at the network layer, it is necessary to configure the eBPF instruction set corresponding to the network layer of the operating system kernel through static tracing based on the six-element information. Here, the network layer of the operating system kernel refers to the protocol layer responsible for handling packet addressing and routing in the network, such as Layer 3 in the Open Systems Interconnection (OSI) model; the eBPF instruction set corresponding to the network layer refers to the set of program instructions mounted on the network layer, used to parse the network layer protocol header and perform filtering operations, such as the instruction set used to parse the IP packet header to obtain the communication four-tuple information.

[0061] Regarding this step, in some possible implementations, based on the preset six-element information, the eBPF instruction set corresponding to the network layer can be attached to a predefined static tracing point in the operating system kernel that is related to IP packet processing, such as the tracing point of the IP fragmentation or reassembly function, through static tracing. This allows parsing the IP header of the first network packet, obtaining the communication quadruple information and thread number, and matching it with the preset six-element information. This filters out intermediate network packets from the first network packet that match the client IP address, client and server IP addresses, server port, and thread number. At the same time, the TTL and packet length corresponding to the intermediate network packet are collected as the second indicator data.

[0062] Furthermore, at least one of the following configuration steps can be performed based on actual needs.

[0063] One configuration step involves configuring the eBPF instruction set corresponding to the operating system kernel's transport layer based on the six-element information, using both dynamic and static tracing. This aims to parse domain name information from unencrypted protocol data packets to complete the final filtering. Here, the operating system kernel's transport layer refers to the protocol layer responsible for providing end-to-end communication services, such as the layer containing Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). The eBPF instruction set corresponding to the transport layer refers to the set of program instructions mounted on the transport layer, used to parse the transport layer protocol payload and perform filtering operations, such as the instruction set used to parse HTTP request headers to obtain domain name information.

[0064] Regarding this step, in some possible implementations, based on the preset six-element information, the eBPF instruction set corresponding to the transport layer can be mounted into the TCP protocol stack processing function of the operating system kernel through dynamic or static tracing to parse the transport layer payload of the intermediate network data packet. When it is determined that the data packet is an unencrypted HTTP protocol data packet, the domain name information is extracted from its HTTP request line or request header, and the extracted domain name information is matched with the domain name in the preset six-element information. This allows filtering out the second network data packet that matches the domain name from the intermediate network data packet, and at least one of the following is collected as the third indicator data: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows corresponding to the second network data packet.

[0065] Another configuration step involves configuring the eBPF instruction set corresponding to the application layer based on the six-element information and through user-space tracing. This aims to parse domain name information for encrypted protocol data packets to complete the final filtering. The application layer refers to the protocol layer that provides network services to user applications, such as the layer containing HTTP or SSL.

[0066] Regarding this step, in some possible implementations, based on the preset six-element information, the eBPF instruction set corresponding to the application layer can be mounted to the functions handling the SSL / TLS protocol in the user-space application through user-space tracking. For example, it can be mounted to the write or read functions of the SSL library through the uprobes mechanism. This allows the plaintext content of the data packet to be obtained before encryption or after decryption, and then the domain name information can be extracted from it. The extracted domain name information is then matched with the domain name in the preset six-element information, thereby filtering out the second network data packet that matches the domain name from the intermediate network data packet. At least one of the following is collected as the third indicator data: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows corresponding to the second network data packet.

[0067] In this embodiment, a multi-layered filtering and data collection system is constructed by configuring eBPF instruction sets with differentiated tracking technologies at the data link layer, network layer, transport layer, and application layer. This system can quickly filter irrelevant traffic based on communication quadtuple information in the early stages of packet processing, such as at the network layer, and perform precise filtering in subsequent critical layers, such as at the transport or application layer, combined with domain name information. This ensures targeted data collection while minimizing the impact on system performance, achieving efficient, accurate, and in-depth network indicator data collection for specific service traffic.

[0068] In one embodiment, the above step of "filtering the received first network data packet from the eBPF instruction set to obtain the second network data packet, and collecting the network indicator dataset corresponding to the second network data packet" can be further refined and may include the following steps: The network card is invoked to receive the first network data packet and then transmits the first network data packet to the operating system kernel; Based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and the second indicator data corresponding to the intermediate network data packets are collected. Based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected; or, based on the eBPF instruction set corresponding to the application layer, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected. Based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, determine the network indicator dataset corresponding to the second network data packet.

[0069] Specifically, network data packets are processed at different protocol levels in the operating system kernel, and the data packet parsing paths differ for different protocols (such as HTTP and secure HTTPS). This embodiment proposes a layered data filtering and indicator collection strategy that matches the protocol processing flow to achieve accurate capture and comprehensive indicator collection of target network data packets.

[0070] First, the network interface card (NIC) is used to receive the first network data packet and then transmit it to the operating system kernel. The NIC is the hardware interface connecting the computer to the network, responsible for receiving and sending network data frames. Regarding this step, in some possible implementations, the network driver in the operating system kernel can be used to convert the physical signal into a digital form of a first network data packet and pass it to the kernel protocol stack for further processing.

[0071] Furthermore, based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Here, the first indicator data corresponding to the first network data packet refers to the raw data related to the data packet transmission and reception time collected from the data link layer of the operating system kernel, which can characterize the precise time point when the data packet enters or leaves the network interface card.

[0072] Regarding this step, in some possible implementations, the eBPF instruction set containing the six-element information filtering logic can be mounted onto the network device driver transceiver function at the data link layer through dynamic tracing. When the first network data packet passes through this function, its receiving timestamp and sending timestamp are recorded, and the recorded network card transceiver time is used as the first indicator data.

[0073] Furthermore, based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and second indicator data corresponding to the intermediate network data packets is collected. The intermediate network data packets refer to network data packets that, after being filtered by the network layer, meet preset conditions for client IP address, client port, server IP address, server port, and thread number. The second indicator data corresponding to the intermediate network data packets refers to data related to the network layer protocol header collected from the network layer of the operating system kernel, which can characterize the basic attributes of the data packets during network transmission, such as time to live or data packet length.

[0074] Regarding this step, in some possible implementations, a static tracing approach can be used. The eBPF instruction set containing the six-element information filtering logic can be mounted onto the static tracing point of the network layer that processes IP packets. The IP header of the first network packet is parsed, the communication quadruple information and thread number are extracted, and matched with the preset six-element information. The first network packet that matches successfully is identified as an intermediate network packet. At the same time, the time to live value and packet length of the intermediate network packet are collected, and the collected time to live value and packet length are used as the second indicator data.

[0075] Furthermore, at least one of the following data collection steps can be performed: One of the acquisition steps is as follows: based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, filter the intermediate network data packets to obtain the second network data packets, and collect the third indicator data corresponding to the second network data packets.

[0076] Regarding this step, in some possible implementations, the eBPF instruction set containing the six-element information filtering logic can be mounted into the transport layer protocol processing function of the operating system kernel through dynamic or static tracing. The transport layer payload of the intermediate network data packet is parsed. When it is determined to be an unencrypted HTTP protocol data packet, the domain name information is extracted from its HTTP request. The extracted domain name information is matched with the domain name in the preset six-element information. The intermediate network data packet that matches successfully is determined as the second network data packet. At least one of the following is collected from the second network data packet: round-trip time, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows. The collected indicator data is used as the third indicator data.

[0077] Another acquisition step is to filter out the second network data packet from the intermediate network data packet based on the eBPF instruction set corresponding to the application layer, and then collect the third indicator data corresponding to the second network data packet.

[0078] Regarding this step, in some possible implementations, user-space tracing can be used to mount the eBPF instruction set containing domain name retrieval logic onto the user-space application's SSL / TLS processing function. Before or after data encryption, the plaintext content is obtained, and domain name information is extracted from it. The extracted domain name information is matched with the domain name in the preset six-element information. The intermediate network data packet that matches successfully is determined as the second network data packet, and at least one of the following is collected from the second network data packet: round-trip time, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows. The collected indicator data is used as the third indicator data.

[0079] It should be noted that the third indicator data corresponding to the second network data packet mentioned above refers to data collected from the transport layer of the operating system kernel or the user-space application layer that is related to the end-to-end communication performance and status. It can characterize the dynamic behavior of the data packet during transmission and the quality of network connection, such as round-trip time or congestion window size.

[0080] Finally, based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, the network indicator dataset corresponding to the second network data packet is determined.

[0081] Regarding this step, in some possible implementations, the first indicator data, the second indicator data, and the third indicator data can be associated and integrated to form a complete data set containing multiple levels of performance indicators, identified by the second network data packet, and this dataset can be integrated into the network indicator dataset corresponding to the second network data packet.

[0082] In this embodiment, a hierarchical filtering and collection mechanism is constructed at the data link layer, network layer, transport layer, and application layer to achieve step-by-step filtering of massive network traffic. This mechanism first performs preliminary filtering of the first network data packet based on communication quadruple information at the network layer of the operating system kernel, obtaining intermediate network data packets, effectively reducing the amount of data processed subsequently. Then, at the transport layer or application layer of the operating system kernel, the intermediate network data packets are subjected to secondary precise filtering based on domain name information, ultimately determining the second network data packet that meets the six-element information requirement. During this process, the first, second, and third indicator data collected at different levels are integrated into a network indicator dataset, thereby improving overall collection efficiency while ensuring the completeness and relevance of data collection.

[0083] In one embodiment, the step of "filtering intermediate network packets from the first network packets based on the eBPF instruction set corresponding to the network layer of the operating system kernel" can be further refined and may include the following steps: Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, the first network data packet is parsed to obtain the corresponding communication quadruple information and thread number; Based on the communication quadruple information and thread number corresponding to the first network data packet, intermediate network data packets are obtained by filtering from the first network data packet; The intermediate network data packet is the first network data packet that conforms to the six-element information, namely the client IP address, client port, server IP address, server port, and thread number.

[0084] Specifically, considering the need for a preliminary filtering mechanism in massive network traffic to reduce the data pressure in subsequent processing stages, this embodiment proposes a filtering scheme based on basic communication information at the network layer.

[0085] First, to identify data packets belonging to a specific communication session from raw network traffic, it is necessary to parse the first network data packet based on the eBPF instruction set corresponding to the network layer of the operating system kernel to obtain the corresponding communication quadruple information and thread number. Parsing refers to the process of analyzing the protocol header of the network data packet to extract key fields; the communication quadruple information corresponding to the first network data packet refers to the combination of source IP address, source port, destination IP address, and destination port that uniquely identify a network connection; the thread number corresponding to the first network data packet refers to the identifier of the kernel thread in the operating system that processes the first network data packet.

[0086] Regarding this step, in some possible implementations, static tracing can be used to attach the eBPF instruction set corresponding to the network layer to the function in the operating system kernel that processes network layer protocol packets. When the first network packet passes through this function, the eBPF instruction set is triggered, thereby parsing the network layer protocol header of the first network packet. The source IP address, source port, destination IP address, and destination port are extracted from the network layer protocol header, and this information is combined as the communication quadruple information corresponding to the first network packet. At the same time, the kernel context information currently processing the first network packet is obtained, the thread identifier processing the packet is extracted from it, and the thread identifier is used as the thread number corresponding to the first network packet.

[0087] Furthermore, intermediate network data packets are obtained by filtering from the first network data packet based on the communication quadruple information and thread number corresponding to the first network data packet.

[0088] Regarding this step, in some possible implementations, the communication quadruple information and thread number corresponding to the first network data packet can be matched with the client IP address, client port, server IP address, server port, and thread number in the preset six-element information; if the match is successful, the first network data packet is identified as an intermediate network data packet; if the match fails, the first network data packet is discarded and no further processing is performed.

[0089] The intermediate network data packet is a first network data packet that conforms to the six-element information: client IP address, client port, server IP address, server port, and thread number. Specifically, the source IP address of the intermediate network data packet is the same as the preset client IP address, the source port is the same as the preset client port, the destination IP address is the same as the preset server IP address, the destination port is the same as the preset server port, and the thread number processing the intermediate network data packet is the same as the preset thread number.

[0090] In this embodiment, by parsing the first network data packet using the eBPF instruction set at the network layer of the operating system kernel and filtering it based on the communication quadruple information and thread number, network data packets that do not meet the preset conditions can be excluded in the early processing stage. This process reduces the amount of data that needs to be deeply parsed at the transport or application layer, thereby reducing the computational overhead when performing precise filtering based on domain names and improving the efficiency of overall network indicator data collection.

[0091] In one embodiment, the step of "filtering the second network data packet from the intermediate network data packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel" can be further refined and may include the following steps: When the intermediate network data packet is an unencrypted HTTP protocol data packet, the corresponding HTTP request data is obtained by parsing the intermediate network data packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel. The second network data packet is obtained by filtering from the intermediate network data packet based on the domain name contained in the HTTP request data corresponding to the intermediate network data packet; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0092] Specifically, considering that the application layer payload of unencrypted HTTP protocol data packets is visible at the transport layer of the operating system kernel, while the payload of encrypted protocol data packets is not visible, this embodiment proposes a scheme for domain name resolution and filtering of unencrypted HTTP protocol data packets at the transport layer.

[0093] First, given that the intermediate network data packets are unencrypted HTTP protocol data packets, the corresponding HTTP request data needs to be parsed using the eBPF instruction set corresponding to the transport layer of the operating system kernel. Here, unencrypted HTTP protocol data packets refer to network data packets whose application layer protocol is Hypertext Transfer Protocol and which are not encrypted by Secure Sockets Layer (SSL) or transport layer security protocols; parsing refers to the process of examining the data packet content and extracting structured information according to a specific protocol format; the HTTP request data corresponding to the intermediate network data packets refers to information conforming to the Hypertext Transfer Protocol request format, specifically including the request line and request header.

[0094] Regarding this step, in some possible implementations, the eBPF instruction set corresponding to the transport layer of the operating system kernel can be mounted onto the data reception processing function of the Transmission Control Protocol stack through the kprobe or tracepoint mechanism. When the intermediate network data packet flows through the processing function, the eBPF instruction set is triggered to execute. The eBPF instruction set reads the payload content of the intermediate network data packet and parses it according to the format of the Hypertext Transfer Protocol to extract the request line and request header information. The extracted request line and request header information are used as the HTTP request data corresponding to the intermediate network data packet.

[0095] Furthermore, to complete the final filtering based on the business identifier after the initial screening, it is necessary to filter out the second network data packet from the intermediate network data packet according to the domain name contained in the HTTP request data corresponding to the intermediate network data packet. The domain name contained in the HTTP request data corresponding to the intermediate network data packet refers to the network resource identifier used to identify the target server in the Hypertext Transfer Protocol (HTTP) request header, specifically the value of the Host field.

[0096] Regarding this step, in some possible implementations, after obtaining the HTTP request data corresponding to the intermediate network data packet, the eBPF instruction set will further parse the request header part of the HTTP request data, extract the value of the Host field, and use this value as the domain name contained in the HTTP request data corresponding to the intermediate network data packet; then, the domain name is matched and compared with the domain name in the preset six-element information; if the match is successful, the intermediate network data packet is determined as the second network data packet; otherwise, the intermediate network data packet is discarded.

[0097] The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information. Specifically, the value of the Host field in the HTTP request data of the second network data packet is consistent with the domain name in the preset six-element information.

[0098] In this embodiment, by directly parsing unencrypted HTTP protocol data packets at the transport layer of the operating system kernel, deep detection and precise filtering of network traffic are achieved. This avoids the performance overhead of passing data packets to user space for parsing, improving the real-time performance and efficiency of data collection. Furthermore, since the parsing operation is completed in kernel space and filtering is performed directly based on the domain names contained in the HTTP request data corresponding to the intermediate network data packets, the immediacy of the filtering judgment is ensured. This guarantees a high degree of relevance between the final determined second network data packet and the target service, laying the foundation for the subsequent accurate collection of its corresponding network indicator dataset.

[0099] In one embodiment, the step "filtering the second network data packet from the intermediate network data packet based on the eBPF instruction set corresponding to the application layer" can be further refined and may include the following steps: When the intermediate network data packet is a secure HTTPS protocol data packet encrypted with SSL / TLS, the intermediate network data packet is tracked in the user-space SSL / TLS protocol parsing process based on the eBPF instruction set corresponding to the application layer to obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is obtained by filtering from the intermediate network data packets based on the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0100] Specifically, considering that the application layer payload of encrypted protocol data packets is invisible in the transport layer of the operating system kernel, making it impossible to directly parse domain name information in kernel mode, this embodiment proposes a scheme to obtain plaintext domain names in user mode by tracing the SSL / TLS protocol parsing process and filter them accordingly.

[0101] First, given that the intermediate network packets are secure HTTPS packets encrypted with SSL / TLS, it is necessary to trace these packets during the user-space SSL / TLS protocol parsing process, based on the corresponding eBPF instruction set at the application layer, to obtain either the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. Secure HTTPS packets encrypted with SSL / TLS refer to network packets whose application layer protocol is Secure Hypertext Transfer Protocol and whose payload is encrypted with SSL or TLS. The user-space SSL / TLS protocol parsing process refers to a series of processes executed by SSL / TLS library functions in the user-space application, involving the encryption or decryption of network data. Tracing refers to using a user-space tracing mechanism to attach the corresponding eBPF instruction set at the application layer to specific function call points within the user-space SSL / TLS protocol parsing process to monitor its input and output data behavior. Request data before SSL / TLS encryption refers to the raw request data conforming to HTTP format before the encryption operation performed by the SSL / TLS library in the user-space application. Response data after SSL / TLS decryption refers to the raw response data conforming to HTTP format after the decryption operation performed by the SSL / TLS library in the user-space application.

[0102] Regarding this step, in some possible implementations, the eBPF instruction set corresponding to the application layer can be mounted to the library function that handles SSL / TLS in the user-space application through user-space tracing, such as mounting it to the SSL write function or SSL read function. When the plaintext data corresponding to the intermediate network packet flows through the library function, the eBPF instruction set is triggered to execute. The eBPF instruction set reads the data buffer content processed by the library function and uses the read data buffer content as the request data before SSL / TLS encryption or the response data after SSL / TLS decryption.

[0103] Furthermore, in order to complete the final filtering of encrypted data packets based on business identifiers after the initial screening, it is necessary to filter out the second network data packets from the intermediate network data packets according to the domain names contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption.

[0104] Regarding this step, in some possible implementations, after obtaining the request data before SSL / TLS encryption or the response data after SSL / TLS decryption, the eBPF instruction set parses the data according to the HTTP format and extracts the value of the Host field in the request header. This value is used as the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. Subsequently, the domain name is compared with the domain name in the preset six-element information. If the match is successful, the intermediate network data packet is identified as the second network data packet; otherwise, the intermediate network data packet is discarded.

[0105] The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information. Specifically, the value of the Host field in the HTTP request data of the second network data packet is consistent with the domain name in the preset six-element information.

[0106] In this embodiment, by attaching the application-layer corresponding eBPF instruction set during the user-space SSL / TLS protocol parsing process, the request data before SSL / TLS encryption or the response data after decryption can be directly obtained, solving the technical problem of not being able to parse encrypted protocol data packets to obtain domain name information in kernel space. Furthermore, the intermediate network data packets are filtered based on the parsed domain name information, ensuring the relevance of the selected second network data packets to the target service. This scheme combines user-space tracking and kernel-space filtering to achieve the collection of indicator data for secure HTTPS protocol data packets encrypted with SSL / TLS, ensuring the completeness and accuracy of network indicator data collection.

[0107] In one embodiment, after the above step of "determining the network indicator dataset corresponding to the second network data packet based on the first indicator data, the second indicator data, and the third indicator data corresponding to the second network data packet", the following steps may also be included: The network metric dataset corresponding to the second network data packet is transferred from the operating system kernel to the application layer through a circular buffer queue.

[0108] Specifically, considering the performance overhead and efficiency issues of data transmission between the operating system kernel space and the application layer user space, especially in scenarios where network indicator datasets need to be transmitted frequently and in real time, related synchronous or blocking communication mechanisms may introduce significant performance bottlenecks and affect system stability. This embodiment proposes to transmit the network indicator dataset corresponding to the second network data packet from the operating system kernel to the application layer through a circular buffer queue.

[0109] Among them, the circular buffer queue refers to a first-in-first-out data structure that uses a contiguous block of storage space to access data, and is particularly suitable for scenarios where the speeds of producers and consumers are mismatched.

[0110] Regarding this step, in some possible implementations, in the operating system kernel, after the eBPF instruction set determines the network metric dataset corresponding to the second network packet, it writes the network metric dataset corresponding to the second network packet into a pre-created circular buffer queue by calling a preset kernel helper function; at the application layer, the user-space program maps the circular buffer queue to its own address space through memory mapping, and reads the network metric dataset corresponding to the second network packet from the circular buffer queue through event notification or polling mechanism.

[0111] In this embodiment, a circular buffer queue is used as the data transmission channel between the operating system kernel and the application layer, enabling efficient and asynchronous transmission of network metric datasets. This mechanism leverages the first-in, first-out (FIFO) characteristic of the circular buffer queue, allowing the eBPF instruction set to quickly write the network metric dataset while the application layer program can read it asynchronously, thus avoiding the performance overhead caused by frequent system calls or data copying. This design reduces the impact on production system business processing, ensuring low latency and high throughput data transmission even in scenarios with high network metric dataset generation rates, providing a reliable data foundation for real-time monitoring and analysis of network performance.

[0112] In one embodiment, the first indicator data corresponding to the second network data packet includes the network card's transmit and receive time; The second indicator data corresponding to the second network data packet includes at least one of TTL and data packet length; The third indicator data corresponding to the second network data packet includes at least one of the following: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows.

[0113] Specifically, considering that different network layers carry key information of different dimensions that affect the final service performance, it is difficult for indicators of a single layer to fully reflect the network status. This embodiment proposes a scheme to collect specific indicators from the data link layer, network layer and transport layer or application layer respectively to construct a multi-dimensional and refined network indicator dataset.

[0114] On the one hand, the first indicator data corresponding to the second network data packet includes the network interface card (NIC) transmission and reception time. The NIC transmission and reception time refers to an indicator that measures the time it takes for a network data packet to enter or leave the physical network interface.

[0115] The process of collecting the first indicator data corresponding to the second network data packet can be described as follows: In some possible implementations, the eBPF instruction set corresponding to the data link layer of the operating system kernel can be mounted at the key functions of the network device driver when the data packet enters and leaves the network device; when the second network data packet passes through these functions, the eBPF instruction set is triggered and a precise timestamp is recorded; the recorded entry time and exit time of the network card are combined as the first indicator data corresponding to the second network data packet.

[0116] On the other hand, the second indicator data corresponding to the second network data packet includes at least one of TTL and packet length. Here, TTL refers to a field defined in the network layer protocol header that limits the maximum number of hops a data packet can be forwarded in the network; packet length refers to a parameter characterizing the overall size of the network data packet.

[0117] The process of collecting the second indicator data corresponding to the second network data packet can be described as follows: In some possible implementations, the network layer protocol header of the second network data packet can be parsed based on the eBPF instruction set corresponding to the network layer of the operating system kernel; at least one of the Time to Live (TTL) value field and the total data packet length field can be extracted from the parsed protocol header; and at least one of the extracted TTL value and the total data packet length can be used as the second indicator data corresponding to the second network data packet.

[0118] On the other hand, the third indicator data corresponding to the second network data packet includes at least one of the following: RTT, congestion window size, communication status, retransmission count, number of weak ciphers, and number of zero windows. RTT refers to a metric measuring the time required for a data packet to travel from the sender to the receiver and back; congestion window size refers to a parameter maintained at the sender to control the amount of data transmitted based on network conditions; communication status refers to an identifier describing the current state of a transport layer connection, such as established or closing; retransmission count refers to a counter that counts the number of times data packets need to be retransmitted during data transmission due to lack of acknowledgment; number of weak ciphers refers to a statistical value of the number of connections using insecure or weak encryption algorithms detected during communication; and number of zero windows refers to a counter that counts the number of times the sender suspends data transmission due to the receiver announcing a zero receive window during communication.

[0119] The process of collecting the third indicator data corresponding to the second network data packet can be described as follows: In some possible implementations, it can be based on the eBPF instruction set corresponding to the transport layer of the operating system kernel or the eBPF instruction set corresponding to the application layer, and mounted in the state management function of the transmission control protocol stack or the function of user-space SSL / TLS; when the processing flow of the second network data packet triggers the eBPF instruction set, at least one of the following is extracted from the connection control structure associated with the data packet in the kernel: round-trip time, congestion window size, communication status, number of retransmissions, number of weak ciphers, and number of zero windows; at least one of the extracted round-trip time, congestion window size, communication status, number of retransmissions, number of weak ciphers, and number of zero windows is used as the third indicator data corresponding to the second network data packet.

[0120] In this embodiment, by collecting key indicators such as network interface card (NIC) transmission and reception time, TTL, packet length, RTT, and congestion window size in a layered manner, a complete network indicator dataset covering everything from the physical interface to the transmission logic is formed. This dataset organically integrates the first, second, and third indicator data corresponding to the second network packet, enabling network performance evaluation of specific service traffic that meets the six-element information requirement to no longer be limited to a single dimension. This multi-dimensional data association provides in-depth data support for accurately locating bottlenecks affecting network performance, such as physical link latency or transport layer congestion, thereby achieving refined network performance monitoring of specific service traffic.

[0121] In one embodiment, after the above steps of "filtering the received first network data packet from the eBPF instruction set to obtain the second network data packet, and collecting the network indicator dataset corresponding to the second network data packet", the following steps may also be included: At the application layer, data cleaning and index aggregation are performed on the network index dataset corresponding to the second network data packet, and the index data is aggregated. Send the aggregated indicator data to the indicator analysis platform.

[0122] Specifically, considering that the network indicator dataset corresponding to the second network data packet transmitted from the operating system kernel to the application layer may have problems such as incomplete data, inconsistent format, or outlier values, direct analysis will affect the accuracy and efficiency of the results. This embodiment proposes a scheme to preprocess and integrate the received network indicator dataset at the application layer.

[0123] Firstly, to improve data quality and provide a reliable foundation for subsequent analysis, it is necessary to perform data cleaning and index aggregation on the network index dataset corresponding to the second network data packet at the application layer. Data cleaning refers to the process of verifying and correcting the original data, aiming to improve data quality and provide a reliable data foundation for subsequent index aggregation. Index aggregation refers to the process of calculating and merging multiple cleaned network index datasets according to preset dimensions and rules, aiming to transform massive, fine-grained data into macroscopically representative statistical indicators. Aggregated index data refers to the summary data set generated after the index aggregation process, which reflects the network performance status under a specific dimension.

[0124] Regarding this step, in some possible implementations, the network indicator dataset corresponding to the second network data packet read from the circular buffer queue can be verified using preset data cleaning rules, removing illogical abnormal indicator data, such as data with negative round-trip latency. Subsequently, based on preset aggregation dimensions, such as domain name and time period, the cleaned network indicator dataset is grouped, and statistical values ​​of each indicator data within each group are calculated, such as average, maximum, and sum. The set of calculated statistical values ​​is then used as the aggregated indicator data. Alternatively, in some possible implementations, a streaming processing framework can be used to perform real-time data cleaning on the network indicator dataset corresponding to the received second network data packet, removing invalid data through state machines or filters. Simultaneously, a sliding time window mechanism can be used to dynamically aggregate indicators on the cleaned data, generating the aggregated indicator data for each time window ends.

[0125] Furthermore, to achieve centralized monitoring, in-depth analysis, and visualization of network performance, aggregated indicator data needs to be sent to an indicator analysis platform. This platform refers to a system used to receive, store, process, and display network performance indicator data, providing functions such as data querying, trend analysis, and anomaly alerts.

[0126] Regarding this step, in some possible implementations, the application layer program can proactively push the generated aggregated indicator data to a remote indicator analysis platform in a preset data format, such as JSON, via network protocols, such as HTTP or message queue protocols. Alternatively, in some possible implementations, the application layer program can store the aggregated indicator data in a local database or time-series database and provide a data query interface for the indicator analysis platform to periodically or on-demand retrieve the latest aggregated indicator data.

[0127] In this embodiment, the network indicator dataset corresponding to the second network data packet collected from the kernel layer is cleaned at the application layer to remove abnormal indicator data, ensuring the accuracy of subsequent analysis. Simultaneously, indicator aggregation integrates the massive network indicator dataset into aggregated indicator data based on domain name and time period, reducing data dimensionality and transmission volume. Sending the aggregated indicator data to the indicator analysis platform enables centralized monitoring and automated analysis of network performance indicators, providing data support for locating network performance bottlenecks and optimizing service quality.

[0128] In one embodiment, for a better understanding of the CDN domain-level network metric collection scheme based on eBPF technology in this application, please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the interactive process for collecting CDN domain-level network metrics based on eBPF technology, as provided in an embodiment of this application.

[0129] Specifically, Figure 2 The client shown is the device that initiated the network request; Figure 2 The edge node shown is a device used to perform network indicator collection operations in this application embodiment. The edge node includes an operating system kernel and an application layer. The operating system kernel is the carrier for deploying the eBPF instruction set corresponding to the preset six-element information in this application embodiment, and the application layer is the layer that performs data processing operations in this application embodiment. Figure 2 The indicator analysis platform shown is the platform used to receive and process network indicator data in this embodiment of the application. The specific interaction process is as follows: 1. The client sends the first network data packet to the edge node; 2. The operating system kernel of the edge node filters the first network data packet based on the pre-configured eBPF instruction set with six-element information, and at the same time collects the network indicator dataset corresponding to the filtered second network data packet. 3. Edge nodes transfer the network metric dataset from the operating system kernel to the application layer; 4. The application layer of the edge nodes performs data cleaning operations on the network metric dataset, and aggregates the cleaned data based on domain name and time to obtain aggregated metric data; 5. The application layer of the edge nodes reports the aggregated indicator data to the indicator analysis platform; 6. The indicator analysis platform analyzes and displays the received aggregated indicator data; 7. The edge node sends a response to the client.

[0130] In this embodiment, through Figure 2The interactive process shown enables the CDN domain name-level network metric collection scheme based on eBPF technology in this application embodiment: the eBPF instruction set deployed in the operating system kernel of the edge node completes the filtering of network data packets and the collection of network metric datasets, the application layer of the edge node completes the data cleaning and metric aggregation, and finally the metric analysis platform realizes the analysis and display of data, thereby achieving accurate and low-loss collection and processing of CDN domain name-level network metrics.

[0131] In one embodiment, for easier understanding of this application's content regarding configuring the eBPF instruction set based on preset six-element information and implementing hierarchical network packet filtering and network indicator data collection, please refer to [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of the eBPF hierarchical configuration and network indicator collection process based on six-element information provided in the embodiments of this application.

[0132] Specifically, Figure 3 The core elements displayed include the application layer, transport layer, network layer, data link layer, network interface card (NIC), ring buffer queue, configuration reading module, and indicator aggregation module, among which: 1. Network card: Figure 3 The network card shown is the hardware carrier for receiving the first network data packet. Its function is to perform the operation of "calling the network card to receive the first network data packet and transmitting the first network data packet to the operating system kernel". 2. Data Link Layer: This layer is part of the operating system kernel. Figure 3 The text indicates that the layer includes queue and data transmission / reception operations. In this embodiment, based on the preset six-element information, the corresponding eBPF instruction set is configured for this layer through dynamic tracking. Therefore, this layer is the configuration object of the dynamic tracking eBPF instruction set. In specific implementation, the data link layer uses the preset dynamic tracking eBPF instruction set to perform tracking and collection on the first network data packet transmitted from the network card to the operating system kernel, obtain the first indicator data (including network card transmission and reception time), and after completing the collection, transmit the first network data packet to the network layer. 3. Network Layer: This layer is part of the operating system kernel. Figure 3The text indicates that it includes fragmentation and IP header splitting operations. In this embodiment, based on the six-element information, the corresponding eBPF instruction set is configured for this layer through static tracking. Therefore, this layer is the configuration object of the static tracking eBPF instruction set. In specific implementation, the network layer performs fragmentation and IP header splitting parsing operations on the received first network data packet through the preset static tracking eBPF instruction set to obtain the corresponding communication quadruple information (client IP address, client port, server IP address, server port) and thread number. Then, the parsing result is matched with the preset six-element information to filter out intermediate network data packets that meet the above five information items. At the same time, the second indicator data (including at least TTL and data packet length) is collected. After processing, the intermediate network data packets are transmitted to the transport layer. 4. Transport Layer: This layer is part of the operating system kernel. Figure 3 The document shows that it includes operations such as establishing a connection, breaking a connection, splitting an IP address, reading, and writing. In this embodiment, based on the six-element information, a corresponding eBPF instruction set is configured for this layer through a combination of dynamic and static tracking. Therefore, this layer is the configuration object of the dynamic tracking combined with static tracking eBPF instruction set. In specific implementation, the transport layer parses the received intermediate network data packets through a preset dynamic tracking combined with static tracking eBPF instruction set: if the intermediate network data packet is an unencrypted HTTP protocol data packet, the HTTP request data is parsed and the domain name (the last item of the six-element information) is extracted, and the second network data packet that conforms to the complete six-element information is filtered out; at the same time, third indicator data (at least including RTT, congestion window size, communication status, retransmission count, and number of zero windows) is collected. 5. Application Layer: Figure 3 The document shows that it includes an application and an SSL module (including ssl_write and ssl_read operations). In this embodiment, based on the six-element information, the corresponding eBPF instruction set is configured for this layer through user-space tracking. Therefore, this layer is the configuration object of the user-space tracking eBPF instruction set. In specific implementation, if the intermediate network data packet transmitted by the transport layer is a secure HTTPS protocol data packet encrypted with SSL / TLS, the application layer uses the preset user-space tracking eBPF instruction set to track the ssl_write and ssl_read operations of the SSL module in the user-space SSL / TLS protocol parsing process, obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption, and extract the domain name (the last item of the six-element information). The data packet is then filtered to obtain a second network data packet that conforms to the complete six-element information. At the same time, third indicator data (at least including RTT, congestion window size, and number of weak ciphers) is collected. 6. Circular buffer queue: Figure 3This queue connects the operating system kernel (data link layer, network layer, transport layer) and the application layer. Its function is to serve as the transmission carrier for the step of "transmitting the network indicator dataset corresponding to the second network data packet from the operating system kernel to the application layer". In specific implementation, the first indicator data, the second indicator data, and the third indicator data collected by the data link layer, the network layer, and the transport layer are combined to form the network indicator dataset corresponding to the second network data packet. This dataset is transmitted to the application layer through a circular buffer queue. 7. Configure the reading module: Figure 3 This module is used to perform the "configuration read" operation. Its function is to call the preset six-element information to provide a basis for the configuration of each level of eBPF instruction set, and to ensure that the filtering and acquisition operations at each level are carried out around the six-element information. 8. Indicator Aggregation Module: Figure 3 This module is used to perform the operations of "summarizing data based on the key" and "summarizing and integrating data". Its function is to realize the process of "performing data cleaning and index aggregation on the network index dataset corresponding to the second network data packet at the application layer, and aggregating index data". In specific implementation, after the application layer receives the network index dataset transmitted by the circular buffer queue, it first performs data cleaning to remove invalid data, and then performs index aggregation based on the domain name and time as the key to obtain aggregated index data. Finally, the aggregated index data can be sent to the index analysis platform.

[0133] In this embodiment, Figure 3 The core process of the network indicator data acquisition method is fully presented: The configuration reading module calls six elements of information, configuring corresponding eBPF instruction sets for the operating system kernel's data link layer (dynamic tracking), network layer (static tracking), transport layer (dynamic tracking combined with static tracking), and application layer (user-space tracking); the network card receives the first network data packet and transmits it to the operating system kernel, where filtering and indicator acquisition operations are sequentially performed at each layer to obtain a second network data packet conforming to the six elements and the corresponding network indicator dataset; the dataset is transmitted to the application layer through a circular buffer queue, and aggregated indicator data is generated after data cleaning and indicator aggregation. This process strictly follows the limitations of the eBPF instruction set configuration method, layered filtering logic, indicator types, and data flow paths specified in this embodiment, achieving accurate and low-loss network indicator data acquisition.

[0134] In one embodiment, for a better understanding of the differences in network layer structure and communication process between HTTP and HTTPS protocols, as well as the adaptation methods of the network metric collection scheme of this application to the two protocols, please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram of the network layer structure and communication interaction process corresponding to the HTTP and HTTPS protocols provided in the embodiments of this application.

[0135] Specifically, Figure 4 It comprises two core parts: network layer structure and communication interaction process, among which: 1. Network hierarchical structure: Figure 4 The left side shows the network layer structure corresponding to HTTP, which includes the following layers in order: HTTP, transport (transport layer, TCP (transmission control protocol)), network (network layer, IP (Internet Protocol)), data link (data link layer), and physical (physical layer). This layer structure is the layer carrier for processing unencrypted network data packets in this application, corresponding to the scenario of resolving domain names based on the eBPF instruction set of the transport layer of the operating system kernel in this application.

[0136] Figure 4 The right side shows the network layer structure corresponding to secure HTTPS, which includes the following layers in order: HTTP, session (session layer, SSL (Secure Sockets Layer)), transport (transport layer, TCP (Transmission Control Protocol)), network (network layer, IP (Internet Protocol)), data link (data link layer), and physical (physical layer). The newly added session (session layer, SSL (Secure Sockets Layer)) layer is the core encryption processing layer that distinguishes the HTTPS protocol from the HTTP protocol. This layer structure is the carrier for processing encrypted network data packets in this application, corresponding to the scenario in this application where domain name tracing and resolution is based on the eBPF instruction set corresponding to the application layer.

[0137] 2. Communication and interaction process: Figure 4 The middle and right sides show the communication interaction flow corresponding to the HTTPS protocol. The execution steps of this flow are as follows: The initiator sends a SYN (synchronization) request to the receiver, and the receiver returns a SYN ACK (synchronization confirmation) response. The initiator sends an ACK (acknowledgment) message to the receiver, followed by a client hello request; The receiver returns a "server hello certificate" response to the initiator. The initiator executes the following operations in sequence: client key exchange, change cipher spec, and finish. The recipient performs the "change cipher spec" and "finish" operations. After completing the above encryption-related interactions, the initiator and the receiver will interact at the application level. This communication interaction process is the scenario carrier for collecting specific network indicator data (such as the number of weak passwords) under the HTTPS protocol in this application.

[0138] In this embodiment, Figure 4 The differences between HTTP and HTTPS protocols in network layer structure and communication interaction process are clearly presented. The network indicator data collection scheme of this application achieves accurate filtering of network data packets and collection of network indicator datasets under the two protocols by configuring the eBPF instruction set corresponding to the transport layer of the operating system kernel for HTTP protocol and the user-space tracking eBPF instruction set corresponding to the application layer for HTTPS protocol, thereby ensuring the adaptability and compatibility of the scheme under different protocol scenarios.

[0139] In one embodiment, for a better understanding of the entire process of network metric acquisition configuration, kernel data acquisition, and metric processing based on the eBPF instruction set in this application, please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a schematic diagram illustrating the configuration, kernel data collection, and indicator processing flow for network indicator collection provided in this embodiment of the application.

[0140] Specifically, Figure 5 This document demonstrates the entire process of network metric collection in this application, from configuration loading to metric reporting. The core modules and interaction logic involved are as follows: 1. Configuration and eBPF instruction set loading verification: Load Configuration: This module is the input module for the six elements of information (including client IP address, client port, server IP address, server port, domain name, and thread number) preset in this application. Its output is used for parameter configuration of subsequent modules. Metric observation point hooking: Based on the six-element information provided by the loading configuration, the observation points corresponding to the eBPF instruction set are associated, which is a prerequisite for the deployment of the eBPF instruction set in this application; bpf() syscall (bpf system call): This is the system call interface in this application for loading the eBPF instruction set into the operating system kernel; verifier: Verifies the legitimacy of the eBPF instruction set loaded via bpf() syscall, and is the guarantee module for the safe execution of the eBPF instruction set in the operating system kernel in this application; 2. Kernel layer data acquisition and processing: trace_point (corresponding to the tracepoint mechanism), kprobes, and fentry are all tracing technology types in eBPF technology. They are specific implementations of the tracing methods used to configure the eBPF instruction set in this application, and are used to trace the target process in the operating system kernel. Kernel data collection: Based on the above tracing technology, network data in the operating system kernel is collected, which corresponds to the operation of collecting network data packet related data in this application; Calculate and generate metrics (sk_buff): sk_buff is a network packet cache structure in the operating system kernel. This module calculates and generates network metric data based on this structure, which corresponds to the operation of collecting network metric dataset in this application. Key (keyword or key): clientip serverip clientport serverport: where clientip corresponds to the client IP address in the six elements information of this application, serverip corresponds to the server IP address, clientport corresponds to the client port, and serverport corresponds to the server port. This key is used to identify the core features of the network connection and is part of the six elements information in this application. Metric filtering (IP, domain name): Based on the IP (including client IP address and server IP address) and domain name in the six-element information, the calculated metrics are filtered to obtain valid metric data that conforms to the six-element information, which corresponds to the operation of filtering target data packets from network data packets in this application; 3. Data transmission and indicator processing: Circular queue: This is the carrier for transmitting network indicator data between the operating system kernel and the user layer in this application, used to transmit indicator data processed by the kernel layer to the user layer; Data acquisition: Receive indicator data transmitted via a circular queue and store it in the data storage module; 4. Indicator Aggregation and Reporting: Aggregated metrics: Based on the aggregation dimensions of "domain name" and "time" in this application, the stored metric data is aggregated to obtain aggregated metric data; Data reporting: Send the aggregated indicator data to the indicator analysis platform, which corresponds to the final output operation of the indicator data in this application.

[0141] In this embodiment, Figure 5This solution fully covers the core process of the network metric collection scheme in this application. By loading the six-element configuration input information, it completes the hooking, loading, and verification of the eBPF instruction set. With the help of eBPF tracing technologies such as trace_point, kprobes, and fentry, it realizes the collection, generation, and filtering of network data at the kernel layer. It completes the data transmission between the kernel layer and the user layer through a circular queue. Finally, it aggregates and reports the metrics by domain name and time, realizing accurate filtering, hierarchical collection, low-loss transmission, and targeted aggregation of network metric data.

[0142] In one embodiment, for easier understanding of the application scenarios of this application regarding the collection of network metrics from client requests under different protocols and the reporting of these metrics to the analysis platform, please refer to [link to relevant documentation]. Figure 6 , Figure 6 This is a schematic diagram illustrating the client request, network indicator collection, and reporting process under HTTPS and HTTP protocols provided in the embodiments of this application.

[0143] Specifically, Figure 6 The application process of the network metric collection scheme in this application is demonstrated in a real-world scenario. The core elements and logic involved are as follows: 1. Characteristics of protocol chain establishment time: Figure 6 The difference in connection time between HTTPS and HTTP is characterized by "longer connection time" and "shorter connection time". This corresponds to the scenario in this application where network indicators related to connection establishment are collected for different protocols. 2. Client request: Figure 6 The "Client" category includes APP-1 (Application 1), APP-2 (Application 2), APP-3 (Application 3), and APP-4 (Application 4). All of these applications serve as client vehicles for initiating network requests. APP-1 is the initiator of the HTTPS request, and its corresponding IP is 1.1.1.1. It sends a request for "domain name A". APP-2 is the initiator of the HTTP request, and its corresponding IP is 1.1.1.2. It sends a request for "domain name B". APP-3 is the initiator of the HTTPS request, and its corresponding IP is 2.2.2.1. It sends requests for "request domain B" and "request domain A". APP-4 is the initiator of the HTTP request, and its corresponding IP is 2.2.2.2; The IP addresses of the aforementioned clients (including 1.1.1.1, 1.1.1.2, 2.2.2.1, and 2.2.2.2) correspond to the client IP addresses in the six-element information of this application, and "request domain name A" and "request domain name B" correspond to the domain names in the six-element information of this application. 3. Edge node data acquisition operations: Figure 6 The "edge node" in this application is the device that performs network indicator collection operations. It performs the "collect data" operation, and the collected content includes IP (1.1.1.1) and domain name A, where IP (1.1.1.1) corresponds to the client IP address in the six-element information of this application, and domain name A corresponds to the domain name in the six-element information of this application. This "collect data" operation corresponds to the operation of filtering network data packets and collecting the corresponding network indicator dataset in this application based on the eBPF instruction set configured according to the preset six-element information. 4. Indicator Reporting and Analysis Platform: Figure 6 The “edge node” transmits the collected network indicator data to the “indicator analysis platform” through the “reporting indicator” operation. The “indicator analysis platform” is a specific implementation of the indicator analysis platform in this application. The "Indicator Analysis Platform" includes the following indicators: SSL handshake time, transport layer time, network time, and link time. These indicators are all specific indicator types in the network indicator dataset of this application. The platform also includes weak password ratio, sending window, and congestion window. The "weak password ratio" corresponds to the network indicator data collected under the HTTPS protocol in this application, while the "sending window" and "congestion window" correspond to the transport layer-related network indicator data in this application.

[0144] In this embodiment, Figure 6 The application fully demonstrates the practical application scenario of the network indicator collection scheme of this application: by connecting to different clients and requests under different protocols (HTTPS, HTTP) through edge nodes, network indicator collection operations are performed based on six-element information (client IP address, domain name), and the collected indicators are reported to the indicator analysis platform. This shows the applicability of the scheme in multi-client and multi-protocol scenarios, as well as the actual business value of indicator collection and reporting.

[0145] The following will combine Figure 7 The network indicator data acquisition device 800 provided in this application embodiment will be described in detail. The network indicator data acquisition device 800 and the network indicator data acquisition method described above can be referred to and correspond to each other. Specifically, the network indicator data acquisition device 800 may include a configuration module 810 and an acquisition module 820, as detailed below: Configuration module 810 is used to configure the eBPF instruction set based on preset six-element information, which includes client IP address, client port, server IP address, server port, domain name, and thread number. The acquisition module 820 is used to filter the second network data packet from the received first network data packet based on the eBPF instruction set, and to acquire the network indicator dataset corresponding to the second network data packet. The second network data packet conforms to six-element information.

[0146] Optionally, in some embodiments, the configuration module 810 can be used to: Based on the preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing.

[0147] Optionally, in some embodiments, the configuration module 810 can be used to: Based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel is configured through dynamic tracing. Based on the six-element information, the eBPF instruction set corresponding to the network layer of the operating system kernel is configured through static tracing. Based on the hexagonal information, configure the eBPF instruction set corresponding to the transport layer of the operating system kernel through dynamic and static tracing; and / or, based on the hexagonal information, configure the eBPF instruction set corresponding to the application layer through user-mode tracing.

[0148] Optionally, in some embodiments, the acquisition module 820 can be used for: The network card is invoked to receive the first network data packet and then transmits the first network data packet to the operating system kernel; Based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and the second indicator data corresponding to the intermediate network data packets are collected. Based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected; or, based on the eBPF instruction set corresponding to the application layer, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected. Based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, determine the network indicator dataset corresponding to the second network data packet.

[0149] Optionally, in some embodiments, the acquisition module 820 can be used for: Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, the first network data packet is parsed to obtain the corresponding communication quadruple information and thread number; Based on the communication quadruple information and thread number corresponding to the first network data packet, intermediate network data packets are obtained by filtering from the first network data packet; The intermediate network data packet is the first network data packet that conforms to the six-element information, namely the client IP address, client port, server IP address, server port, and thread number.

[0150] Optionally, in some embodiments, the acquisition module 820 can be used for: When the intermediate network data packet is an unencrypted HTTP protocol data packet, the corresponding HTTP request data is obtained by parsing the intermediate network data packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel. The second network data packet is obtained by filtering from the intermediate network data packet based on the domain name contained in the HTTP request data corresponding to the intermediate network data packet; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0151] Optionally, in some embodiments, the acquisition module 820 can be used for: When the intermediate network data packet is a secure HTTPS protocol data packet encrypted with SSL / TLS, the intermediate network data packet is tracked in the user-space SSL / TLS protocol parsing process based on the eBPF instruction set corresponding to the application layer to obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is obtained by filtering from the intermediate network data packets based on the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0152] Optionally, in some embodiments, the acquisition module 820 can be used for: The network metric dataset corresponding to the second network data packet is transferred from the operating system kernel to the application layer through a circular buffer queue.

[0153] Optionally, in some embodiments, the function of the acquisition module 820 can be further embodied as follows: The first indicator data corresponding to the second network data packet includes the network card's transmission and reception time; The second indicator data corresponding to the second network data packet includes at least one of TTL and data packet length; The third indicator data corresponding to the second network data packet includes at least one of the following: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows.

[0154] In addition, the network indicator data acquisition device 800 can be used for: At the application layer, data cleaning and index aggregation are performed on the network index dataset corresponding to the second network data packet, and the index data is aggregated. Send the aggregated indicator data to the indicator analysis platform.

[0155] For the effects achievable in this embodiment, please refer to the relevant embodiments of the above-mentioned network indicator data collection method, which will not be repeated here.

[0156] The network devices involved in the embodiments of this application may be base stations, edge caching servers in CDN systems, edge nodes, etc., and are not limited thereto. A base station may include multiple cells that provide services to terminals. Depending on the specific application, a base station may also be called an access point, or a device in the access network that communicates with wireless terminal devices through one or more sectors on the air interface, or other names.

[0157] Figure 8 This is a schematic diagram of the structure of a network device according to an embodiment of this application, with reference to... Figure 8 This application also provides a network device, which may include: a memory 1201, a transceiver 1202, and a processor 1203; The memory 1201 is used to store computer programs; the transceiver 1202 is used to send and receive data under the control of the processor 1203; the processor 1203 is used to read the computer programs in the memory 1201 and perform related operations.

[0158] Among them, Figure 8 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1203) and memory (memory 1201). The bus architecture may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1202 may be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1203 is responsible for managing the bus architecture and general processing, and the memory 1201 may store data used by the processor 1203 during operation.

[0159] In some possible implementations, processor 1203 is used to read the computer program in memory 1201 and perform the following operations: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

[0160] Optionally, the processor 1203 is also used to perform the following operations: Based on the preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing.

[0161] Optionally, the processor 1203 is also used to perform the following operations: Based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel is configured through dynamic tracing. Based on the six-element information, the eBPF instruction set corresponding to the network layer of the operating system kernel is configured through static tracing. Based on the hexagonal information, configure the eBPF instruction set corresponding to the transport layer of the operating system kernel through dynamic and static tracing; and / or, based on the hexagonal information, configure the eBPF instruction set corresponding to the application layer through user-mode tracing.

[0162] Optionally, the processor 1203 is also used to perform the following operations: The network card is invoked to receive the first network data packet and then transmits the first network data packet to the operating system kernel; Based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and the second indicator data corresponding to the intermediate network data packets are collected. Based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected; or, based on the eBPF instruction set corresponding to the application layer, the second network data packet is filtered from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected. Based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, determine the network indicator dataset corresponding to the second network data packet.

[0163] Optionally, the processor 1203 is also used to perform the following operations: Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, the first network data packet is parsed to obtain the corresponding communication quadruple information and thread number; Based on the communication quadruple information and thread number corresponding to the first network data packet, intermediate network data packets are obtained by filtering from the first network data packet; The intermediate network data packet is the first network data packet that conforms to the six-element information, namely the client IP address, client port, server IP address, server port, and thread number.

[0164] Optionally, the processor 1203 is also used to perform the following operations: When the intermediate network data packet is an unencrypted HTTP protocol data packet, the corresponding HTTP request data is obtained by parsing the intermediate network data packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel. The second network data packet is obtained by filtering from the intermediate network data packet based on the domain name contained in the HTTP request data corresponding to the intermediate network data packet; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0165] Optionally, the processor 1203 is also used to perform the following operations: When the intermediate network data packet is a secure HTTPS protocol data packet encrypted with SSL / TLS, the intermediate network data packet is tracked in the user-space SSL / TLS protocol parsing process based on the eBPF instruction set corresponding to the application layer to obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is obtained by filtering from the intermediate network data packets based on the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

[0166] Optionally, the processor 1203 is also used to perform the following operations: The network metric dataset corresponding to the second network data packet is transferred from the operating system kernel to the application layer through a circular buffer queue.

[0167] Optionally, the first indicator data corresponding to the second network data packet includes the network card's transmission and reception time; The second indicator data corresponding to the second network data packet includes at least one of TTL and data packet length; The third indicator data corresponding to the second network data packet includes at least one of the following: RTT, congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows.

[0168] Optionally, the processor 1203 is also used to perform the following operations: At the application layer, data cleaning and index aggregation are performed on the network index dataset corresponding to the second network data packet, and the index data is aggregated. Send the aggregated indicator data to the indicator analysis platform.

[0169] It should be noted that the network device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0170] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the network indicator data acquisition method provided in the above embodiments, such as including: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

[0171] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program. The computer program is used to cause a processor to execute the steps of the methods provided in the above embodiments, including, for example: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number. The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

[0172] Non-transitory computer-readable storage media can be any available medium or data storage device that can be accessed by a processor, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0173] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0174] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0175] All actions involving the acquisition of signal information or data in this application were carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for collecting network indicator data, characterized in that, include: Configure the extended Berkeley packet filter eBPF instruction set based on the preset six-element information, which includes the client's Internet Protocol IP address, client port, server's IP address, server port, domain name, and thread number; The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

2. The method according to claim 1, characterized in that, The configuration of the eBPF instruction set based on the preset six-element information includes: Based on the preset six-element information, the eBPF instruction set is configured through at least one of dynamic tracing, static tracing, and user-mode tracing.

3. The method according to claim 2, characterized in that, The configuration of the eBPF instruction set based on preset six-element information and through at least one of dynamic tracking, static tracking, and user-mode tracking includes: Based on the preset six-element information, the eBPF instruction set corresponding to the data link layer of the operating system kernel is configured through dynamic tracing. Based on the six-element information, the eBPF instruction set corresponding to the network layer of the operating system kernel is configured by static tracing. Based on the six-element information, the eBPF instruction set corresponding to the transport layer of the operating system kernel is configured through dynamic tracing and static tracing; and / or, based on the six-element information, the eBPF instruction set corresponding to the application layer is configured through user-mode tracing.

4. The method according to claim 1, characterized in that, The step of filtering the received first network data packet from the eBPF instruction set to obtain the second network data packet, and collecting the network indicator dataset corresponding to the second network data packet, includes: The network card is invoked to receive the first network data packet, and the first network data packet is transmitted to the operating system kernel; Based on the eBPF instruction set corresponding to the data link layer of the operating system kernel, the first indicator data corresponding to the first network data packet is collected. Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, intermediate network data packets are filtered from the first network data packets, and second indicator data corresponding to the intermediate network data packets are collected. Based on the eBPF instruction set corresponding to the transport layer of the operating system kernel, a second network data packet is obtained by filtering from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected; or, based on the eBPF instruction set corresponding to the application layer, a second network data packet is obtained by filtering from the intermediate network data packets, and the third indicator data corresponding to the second network data packet is collected. Based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, determine the network indicator dataset corresponding to the second network data packet.

5. The method according to claim 4, characterized in that, The eBPF instruction set based on the network layer corresponding to the operating system kernel filters intermediate network data packets from the first network data packets, including: Based on the eBPF instruction set corresponding to the network layer of the operating system kernel, the first network data packet is parsed to obtain the corresponding communication quadruple information and thread number; Based on the communication quadruple information and thread number corresponding to the first network data packet, intermediate network data packets are obtained by filtering from the first network data packet; The intermediate network data packet is a first network data packet that conforms to the six elements of the information: client IP address, client port, server IP address, server port, and thread number.

6. The method according to claim 4, characterized in that, The eBPF instruction set based on the transport layer corresponding to the operating system kernel filters the intermediate network data packets to obtain the second network data packets, including: When the intermediate network data packet is an unencrypted Hypertext Transfer Protocol (HTTP) protocol data packet, the intermediate network data packet is parsed based on the eBPF instruction set corresponding to the transport layer of the operating system kernel to obtain the corresponding HTTP request data. The second network data packet is obtained by filtering the intermediate network data packet based on the domain name contained in the HTTP request data corresponding to the intermediate network data packet; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

7. The method according to claim 4, characterized in that, The method of filtering the intermediate network data packets based on the eBPF instruction set corresponding to the application layer to obtain the second network data packet includes: When the intermediate network data packet is a Secure Hypertext Transfer Protocol (HTTPS) data packet encrypted with Secure Sockets Layer (SSL) / Transport Layer Security Protocol (TLS), the intermediate network data packet is tracked in the user-space SSL / TLS protocol parsing process based on the eBPF instruction set corresponding to the application layer to obtain the request data before SSL / TLS encryption or the response data after SSL / TLS decryption. The second network data packet is obtained by filtering from the intermediate network data packet based on the domain name contained in the request data before SSL / TLS encryption or the response data after SSL / TLS decryption; The second network data packet is an intermediate network data packet that conforms to the domain name in the six-element information.

8. The method according to claim 4, characterized in that, After determining the network indicator dataset corresponding to the second network data packet based on the first indicator data, second indicator data, and third indicator data corresponding to the second network data packet, the method further includes: The network metric dataset corresponding to the second network data packet is transferred from the operating system kernel to the application layer through a circular cache queue.

9. The method according to any one of claims 4 to 8, characterized in that, The first indicator data corresponding to the second network data packet includes the network card's transmission and reception time; The second indicator data corresponding to the second network data packet includes at least one of the Time to Live (TTL) value and the data packet length; The third indicator data corresponding to the second network data packet includes at least one of the following: round-trip time (RTT), congestion window size, communication status, number of retransmissions, number of weak passwords, and number of zero windows.

10. The method according to claim 1, characterized in that, After filtering the received first network data packet from the eBPF instruction set to obtain the second network data packet, and collecting the network indicator dataset corresponding to the second network data packet, the method further includes: At the application layer, data cleaning and index aggregation are performed on the network index dataset corresponding to the second network data packet to aggregate the index data. The aggregated indicator data is sent to the indicator analysis platform.

11. A network indicator data acquisition device, characterized in that, include: The configuration module is used to configure the eBPF instruction set based on preset six-element information, which includes client IP address, client port, server IP address, server port, domain name, and thread number. The acquisition module is used to filter the received first network data packet from the eBPF instruction set to obtain the second network data packet, and to acquire the network indicator dataset corresponding to the second network data packet, wherein the second network data packet conforms to the six-element information.

12. A network device, characterized in that, Includes memory, transceiver, and processor; A memory for storing computer programs; a transceiver for sending and receiving data under the control of the processor; and a processor for reading the computer programs from the memory and performing the following operations: Configure the eBPF instruction set based on the preset six-element information, which includes the client IP address, client port, server IP address, server port, domain name, and thread number; The second network data packet is obtained by filtering the received first network data packet based on the eBPF instruction set, and the network indicator dataset corresponding to the second network data packet is collected. The second network data packet conforms to the six-element information.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the network indicator data acquisition method as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the network indicator data acquisition method according to any one of claims 1 to 10.

Images