An eBPF-based intelligent deep packet inspection system and method

Abstract

This specification discloses an intelligent deep packet inspection system and method based on eBPF. A packet acquisition and distribution module is configured to mount a first eBPF program with a fast data path type at the system network interface card driver layer to filter packets. A deep packet inspection engine is configured to mount a second eBPF program with a flow control layer type on the inbound and outbound hooks of the system flow control layer to receive non-malicious packets that have been allowed by the packet acquisition and distribution module and converted into a socket buffer structure, read the protocol header fields and payload of the non-malicious packets, and perform the deep packet inspection process. A data sharing and transmission module includes a per-CPU hash mapping table and a ring buffer. A user-space management and control module interacts with the second eBPF program through a user-space library. The embodiments in this specification ensure high performance, low latency, and zero-interruption hot updates while improving the accuracy of intelligent deep packet inspection.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to an intelligent deep packet inspection system and method based on eBPF. Background Technology

[0002] With the widespread adoption of cloud computing, containerization, and microservice architectures, the scale and complexity of network traffic have increased dramatically, leading to increasingly diverse and covert cybersecurity threats. Deep Packet Inspection (DPI) technology, a core tool in cybersecurity, can parse the application-layer payload of data packets, enabling functions such as protocol identification, traffic classification, intrusion detection, and content auditing. It has broad application needs in carrier networks, enterprise security gateways, and cloud-native environments. However, existing DPI solutions have several shortcomings. For example, while user-space bypass solutions based on DPDK offer extremely high throughput, completely bypassing the kernel prevents integration with kernel network modules, compromising security boundaries. Furthermore, they require dedicated CPU cores, resulting in high deployment costs and difficulty in balancing high performance and flexibility. Traditional kernel-module-based DPI solutions execute code directly in kernel space, leading to system crashes and poor stability if errors occur. Kernel upgrades also necessitate recompilation and maintenance, resulting in extremely high operational costs. Traditional software DPI solutions based on mechanisms like libpcap and AF_PACKET require completely copying data packets to user space for detection, incurring significant kernel / user-space context switching overhead and high CPU resource consumption, failing to meet the real-time detection requirements of high-traffic scenarios. Additionally, updates to existing DPI systems' detection rule base or programs typically require restarting the detection service or reloading kernel modules, creating detection blind spots and impacting security continuity. Traditional DPI devices are often deployed in series or as bypass hardware, unable to detect east-west micro-traffic between Kubernetes Pods and lacking the ability to detect traffic at the container network namespace level. Therefore, how to provide an intelligent deep packet inspection system that combines high performance, security and stability, dynamic programmability and native support for cloud-native scenarios has become a core technical problem that urgently needs to be solved. Summary of the Invention

[0003] This specification provides an intelligent deep packet inspection system and method based on eBPF, the technical solution of which is as follows:

[0004] This specification provides an intelligent deep packet inspection system based on eBPF, comprising: a packet acquisition and distribution module configured to mount a first eBPF program with a fast data path type on the system network interface card driver layer, executing the first eBPF program before packets entering the system are converted into socket buffer structures; the first eBPF program is used to filter packets, including: discarding malicious packets corresponding to packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious packets to be sent to the kernel protocol stack; and a deep packet inspection engine configured to mount a second eBPF program with a flow control layer type on the inbound and outbound hooks of the system flow control layer, the second eBPF program being used to receive packets that have been allowed by the packet acquisition and distribution module and converted into socket buffer structures. The system reads the protocol header fields and payload of non-malicious data packets to perform deep packet inspection and generate inspection results. A data sharing and transmission module includes at least one per-CPU hash mapping table configured to store flow state information and flow tables maintained by the deep packet inspection engine to eliminate lock contention during multi-core processing. It also includes at least one circular buffer configured to asynchronously report the inspection results generated by the deep packet inspection engine to the user-space management and control module. The user-space management and control module runs in user space and interacts with the second eBPF program through a user-space library. It is configured to dynamically update the detection rules of the second eBPF program. The module reads the flow state information stored in the per-CPU hash mapping table and performs statistical aggregation. It receives alarm information from the circular buffer and links with external security systems. It outputs traffic statistics logs.

[0005] On the other hand, embodiments of this specification also provide an intelligent deep packet inspection method based on eBPF, including the following steps:

[0006] After the data packet arrives at the network card, it is intercepted by the first eBPF program mounted on the system network card driver layer and filtered, including: dropping malicious data packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious data packets to be sent into the kernel protocol stack.

[0007] Non-malicious data packets enter the kernel network protocol stack, triggering the second eBPF program mounted on the inbound hook and outbound hook of the system flow control layer. The second eBPF program receives the non-malicious data that has been converted into a socket buffer structure, reads the protocol header field and payload of the non-malicious data packets, performs the deep detection process, and generates detection results.

[0008] The second eBPF program writes the detection results into a circular buffer and asynchronously reports them to the user-mode management and control module; when a high-risk rule is hit, it triggers TC_ACT_SHOT blocking or TC_ACT_REDIRECT redirection.

[0009] The user-mode management and control module reads the detection results from the circular buffer, performs statistical aggregation, alarm linkage, and log retention, and dynamically issues updated detection rules to the second eBPF program through the eBPF mapping table.

[0010] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0011] This embodiment of the specification mounts a first eBPF program with a fast data path type at the system network card driver layer. The first eBPF program executes before the data packet is converted into a socket buffer structure, and is at the very front of the entire system network stack, enabling nanosecond-level first-layer fast classification of data packets entering the system. Furthermore, the deep packet inspection engine of this embodiment of the specification mounts a second eBPF program with a flow control layer type on the inbound hooks and outbound hooks of the system flow control layer. The second eBPF program can directly read the protocol header fields and payload of the data packet, and perform deep inspection processes such as protocol parsing, feature matching, and flow behavior statistics. This embodiment of the specification achieves a two-layer collaboration between high-speed coarse filtering and deep fine inspection, which not only ensures the ability to quickly intercept malicious traffic, but also reduces the processing load for subsequent deep inspection, significantly improving the overall performance and anti-attack capability of the detection system. The two-layer collaboration ensures both high-speed filtering capability and detection accuracy.

[0012] Moreover, the deep detection process in the embodiments of this specification is completed directly in kernel mode, without the need to copy data packets from kernel mode to user mode. This eliminates the memory copying and context switching overhead caused by frequent switching between kernel and user mode in traditional DPI schemes, reducing CPU utilization and detection latency.

[0013] Moreover, the eBPF programs in the embodiments of this specification can be directly mounted on the virtual Ethernet device of the container without modifying the container network plugin. They are compatible with cloud-native container network environments such as Kubernetes and can achieve deep packet inspection of east-west traffic between Pods. This not only solves the technical problems of high overhead, high risk, difficult operation and maintenance, incompatibility with container networks, and inability to perceive container network namespace-level traffic in traditional DPI solutions.

[0014] Furthermore, the data sharing and transmission module in this embodiment uses a per-CPU hash mapping table to store the flow state information. Each CPU core has an independent copy of the data, and each core does not need to lock when accessing it, thus avoiding lock contention during multi-core processing and achieving linear expansion of multi-core processing capabilities. A circular buffer is used to asynchronously report the detection results to user space, reducing memory lock contention and significantly improving throughput compared to the traditional perf buffer.

[0015] Furthermore, the user-space management and control module in this embodiment can read the flow state information stored in the hash mapping table of each CPU and perform statistical aggregation, read the detection results from the circular buffer, and dynamically update the detection rules, forming a closed-loop feedback mechanism of detection, analysis, update, and re-detection, thereby achieving real-time optimization of the detection strategy. In addition, the user-space management and control module can also interact with the second eBPF program in the kernel space through the user-space library, supporting the dynamic compilation and distribution of detection rules. This allows for the expansion of detection capabilities without modifying the kernel code, significantly reducing the system's operation, maintenance, and iteration costs. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the layered architecture of the intelligent deep packet inspection system based on eBPF provided in this manual.

[0018] Figure 2 This is a flowchart illustrating the intelligent deep packet inspection method based on eBPF provided in this manual. Detailed Implementation

[0019] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings.

[0020] The terms "first," "second," etc., in the description, claims, and accompanying drawings are used to distinguish different objects and not to describe a particular order. Furthermore, the term "comprising" and any variations thereof are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0021] Please see Figure 1 , Figure 1This is a schematic diagram of the layered architecture of an intelligent deep packet inspection system based on eBPF provided in an embodiment of the present invention. In this embodiment, the intelligent deep packet inspection system based on eBPF may include a hardware layer, kernel mode, and user mode. The hardware layer may include a network interface layer, serving as the data packet entry point; the kernel mode may include a Fast Data Path Hook (XDP Hook) layer, a kernel network protocol stack layer, a Traffic Control Hook (TCHook) layer, a deep packet inspection engine (corresponding to the eBPF DPI engine), and an eBPF Maps data sharing layer; the user mode may include a user-mode management and control module. Specifically, the XDP Hook layer may include a data packet acquisition and distribution module, the TCHook layer may include a deep packet inspection engine, and the eBPF Maps data sharing layer may include a data sharing and transmission module.

[0022] This embodiment can run on operating systems that support eBPF, including but not limited to Linux. As eBPF technology expands to platforms such as Windows, this embodiment can also be adapted to those platforms. The eBPF (Extended Berkeley Packet Filter) in this embodiment is a system kernel virtual machine technology, which allows for the secure execution of user-defined sandboxed programs in kernel mode.

[0023] In some embodiments, the packet acquisition and distribution module is configured to mount a first eBPF program with a fast data path type on the system network card driver layer. The first eBPF program is executed before the packets entering the system are converted into a socket buffer structure. The first eBPF program is used to filter packets, including: performing a drop operation (XDP_DROP) on malicious packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious packets (XDP_PASS) to be sent into the kernel protocol stack (corresponding to the kernel network protocol stack layer).

[0024] In some embodiments, the packet acquisition and distribution module performs a discarding operation on packets that hit the blacklist or malicious packets that are determined to be attack packets. This includes: performing a discarding operation on malicious packets that are determined to be attack packets, which includes: determining the source IP address of any packet based on the rate counter in the eBPF mapping table; determining the SYN packet rate by calculating the number of SYN packets sent by the source IP address per unit time; when the SYN packet rate exceeds the rate threshold, determining any packet as a malicious packet corresponding to an attack packet and discarding the malicious packet; querying a preset blacklist mapping table; when any packet hits the source IP address or port in the blacklist, determining any packet as a malicious packet corresponding to a packet that hits the blacklist and discarding the malicious packet.

[0025] In this embodiment, the attack packets may include DDoS attack packets, such as abnormal SYN packets in a SYN Flood, which can be used to determine whether the speed is exceeded by the rate counter in the eBPF mapping table.

[0026] In this embodiment, the first eBPF program executes before the data packet is converted into a socket buffer structure, placing it at the very front of the entire system's (e.g., Linux) network stack to perform initial, rapid filtering of incoming data packets. Malicious data packets are dropped within nanoseconds, without consuming subsequent kernel resources. Non-malicious data packets are allowed to pass through, and deep detection is performed by the subsequent TC Hook layer.

[0027] In this embodiment, the kernel network protocol stack layer is located between the XDP Hook layer and the TC Hook layer. It receives non-malicious data packets allowed by the XDP Hook layer, allocates a standard socket buffer structure (sk_buff structure) for these packets, performs checksum verification, fragmentation and reassembly, and triggers deep inspection of the non-malicious data packets via the second eBPF program in the TC Hook layer. The kernel network protocol stack layer ensures a smooth transition from fast filtering to deep inspection of data packets. For traffic that does not require deep inspection or is allowed after inspection, the kernel protocol stack continues to handle subsequent routing and delivery, ensuring that normal network communication is not affected.

[0028] In some embodiments, the deep packet inspection engine is configured to attach a second eBPF program of the flow control layer type to the inbound hook and outbound hook of the system flow control layer. The second eBPF program is used to receive non-malicious data packets that have been allowed by the data packet acquisition and diversion module and have been converted into a socket buffer structure, read the protocol header field and payload of the non-malicious data packets, perform the deep inspection process, and generate inspection results.

[0029] In some embodiments, the deep packet inspection engine includes at least protocol parsing, feature matching, flow behavior statistics, and encrypted traffic identification.

[0030] In this embodiment, protocol parsing includes parsing the Ethernet frame header, IP header, transport layer protocol header, and application layer payload of non-malicious data packets layer by layer from the data link layer to the application layer, and reading the protocol header fields and payload through kernel-mode functions.

[0031] This embodiment can parse Ethernet frame headers, IP headers, TCP headers, UDP headers, etc., layer by layer, down to the application layer payload (HTTP, DNS, TLS, etc.); it can directly read the protocol header fields and payload in kernel space using the kernel-mode function bpf_skb_load_bytes(), without having to copy them to user space.

[0032] In this embodiment, feature matching includes: performing multi-pattern string matching in kernel mode based on the protocol feature library stored in the eBPF mapping table to determine the application layer protocol type; the multi-pattern string matching uses the AC automaton algorithm, and the matching logic of the AC automaton algorithm is compiled into eBPF bytecode and executed in kernel mode; the application layer protocol type can include at least HTTP, P2P, and VoIP application layer protocols. Protocol header fields can include Ethernet frame header, IP header, TCP header, UDP header, etc. The Ethernet frame header corresponding fields can include at least source MAC address, destination MAC address, virtual LAN tag, Ethernet type, etc.; the IP header can include at least source IP address, destination IP address, protocol type, TTL, etc.; the TCP header can include at least source port, destination port, packet sequence number, acknowledgment number, flow control window size, etc.; the UDP header can include source port, destination port, UDP datagram length, error detection checksum, etc.; the payload is the application layer data after removing all protocol headers, and different payloads correspond to different application layer protocol types.

[0033] This embodiment can perform multi-mode string matching in kernel mode based on the protocol feature library stored in the eBPF mapping table (such as compiling the feature matching logic implemented by the AC automaton algorithm into eBPF bytecode) to identify application layer protocols such as HTTP, P2P, and VoIP.

[0034] In this embodiment, the flow behavior statistics include: grouping non-malicious data packets by data flow, and maintaining the flow state information of each data flow in kernel space through a per-CPU hash mapping table. The flow state information includes at least the number of packets, the number of bytes, the packet interval time, and the direction ratio. The abnormal behavior corresponding to the flow state information is detected based on the sliding window algorithm. The abnormal behavior includes at least port scanning and slow attack.

[0035] This embodiment can utilize a per-CPU hash map to maintain the state of each stream (number of packets, number of bytes, packet interval, direction ratio, etc.) in kernel space, and detect abnormal behavior (such as port scanning, slow attacks, etc.) through a sliding window algorithm.

[0036] In this embodiment, encrypted traffic identification includes: identifying transport layer security traffic corresponding to non-malicious data packets by detecting transport layer port numbers or handshake message types; extracting metadata from the handshake messages of the identified transport layer security traffic, the metadata including at least a server name indication field, application layer protocol negotiation extension, and JA3 fingerprint; and matching the metadata with the fingerprint database stored in the eBPF mapping table to identify the application type of the encrypted traffic.

[0037] In this embodiment, for TLS traffic, metadata such as the SNI field, ALPN extension, and JA3 fingerprint can be extracted from the ClientHello. This data is then matched against a fingerprint database stored in the eBPF mapping table to achieve encrypted application identification without decryption. The ClientHello can be the first handshake message sent by the client to the server in the TLS (Transport Layer Security) protocol, used to initiate an encrypted connection request.

[0038] In some embodiments, the data sharing and transmission module includes at least one per-CPU hash mapping table configured to store the flow state information and flow table maintained by the deep packet inspection engine to eliminate lock contention during multi-core processing; it also includes at least one circular buffer configured to asynchronously report the detection results generated by the deep packet inspection engine to the user-mode management and control module.

[0039] In this embodiment, while the detection results are written to the circular buffer and asynchronously reported to the user space, when the detection results match a high-risk rule, the TC_ACT_SHOT action is triggered to block the corresponding data packet; or the TC_ACT_REDIRECT action is returned to redirect the corresponding data packet to a specified network device. High-risk rules can be detection rules marked as high-threat in the detection rule base, used to identify network traffic with serious security risks.

[0040] In some embodiments, the user-space management and control module runs in user space, interacts with the second eBPF program through the user-space library, and is configured to dynamically update the detection rules of the second eBPF program; read the flow state information stored in the per-CPU hash mapping table and perform statistical aggregation; receive alarm information from the ring buffer and link with the external security system; and output traffic statistics logs.

[0041] In some embodiments, the user-mode management and control module dynamically updates the detection rules of the second eBPF program, including: compiling human-readable detection rules into eBPF bytecode and updating the second eBPF program without interrupting the detection service; receiving alarm information from the ring buffer and linking with external security systems, including: reading detection results from the ring buffer and determining the alarm level of the detection results; when the alarm level exceeds a preset level threshold, sending the detection results to an external intrusion detection system or a security information and event management system; and outputting traffic statistics logs, including: outputting traffic statistics logs in NetFlow format or IPFIX format.

[0042] In this embodiment, the user-space management and control module can interact with the eBPF program (first eBPF program and / or second eBPF program) in kernel space through the user-space library (libbpf library). For example, it can perform dynamic rule compilation, compiling human-readable detection rules into eBPF bytecode; it can perform atomic hot-sell distribution, using bpf_link replacement to achieve atomic replacement of eBPF programs without stopping the detection service, i.e., updating the program without interrupting the detection service; it can perform read and write operations and statistical aggregation on the eBPF mapping table, including: distributing detection rules to the second eBPF program, reading the flow state information stored in the per-CPU hash mapping table and performing statistical aggregation; it can determine the alarm level of the detection results and link with external intrusion detection systems or security information and event management systems; and it can perform traffic statistics visualization, outputting traffic statistics logs in NetFlow or IPFIX format.

[0043] In this embodiment, the eBPF mapping table can be a key-value storage structure created in the kernel, accessible to both kernel-mode eBPF programs (the first eBPF program and / or the second eBPF program) and user-mode programs. Through the eBPF mapping table, the user-mode management and control module can send configuration information such as detection rules, blacklists, and various thresholds to the kernel-mode. The kernel-mode eBPF programs can write data such as flow state information and detection results into the mapping table for user-mode reading, thereby achieving efficient data sharing between the kernel and user modes.

[0044] In some embodiments, the eBPF-based intelligent deep packet inspection system may further include an adaptive sampling and degradation module, which is configured to: determine the number of data packets arriving at the network interface card per unit time; when the number of data packets exceeds a preset threshold, switch the detection mode from full detection to sampling detection; and dynamically distribute the sampling rate of the sampling detection to the second eBPF program through the eBPF mapping table.

[0045] In this embodiment, when a traffic burst exceeds a preset threshold, the system automatically switches to a sampling detection mode, such as switching from full detection to 1:N sampling, to protect the system from overload. Simultaneously, it maintains alarm accuracy through flow-level statistical inference. The sampling rate is dynamically distributed via the eBPF mapping table, taking effect in real time without requiring a restart.

[0046] In some embodiments, please refer to Figure 2 , Figure 2 This is a flowchart illustrating the intelligent deep packet inspection method based on eBPF provided in this embodiment of the invention. The executing entity of the intelligent deep packet inspection method based on eBPF can be the intelligent deep packet inspection system based on eBPF provided in this embodiment of the invention. The process of the system performing intelligent deep packet inspection based on eBPF includes:

[0047] 200. After the data packet arrives at the network card, it is intercepted by the first eBPF program mounted on the system network card driver layer and the data packet is filtered, including: dropping malicious data packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious data packets to be sent into the kernel protocol stack.

[0048] 210. Non-malicious data packets enter the kernel network protocol stack, triggering the second eBPF program mounted on the inbound hook and outbound hook of the system flow control layer. The second eBPF program receives the non-malicious data that has been converted into a socket buffer structure, reads the protocol header field and payload of the non-malicious data packets, and performs a deep detection process to generate detection results.

[0049] 220. The second eBPF program writes the detection results into the circular buffer and asynchronously reports them to the user-mode management and control module; when a high-risk rule is hit, it triggers TC_ACT_SHOT blocking or TC_ACT_REDIRECT redirection.

[0050] 230. The user-mode management and control module reads the detection results from the circular buffer, performs statistical aggregation, alarm linkage and log retention, and dynamically sends updated detection rules to the second eBPF program through the eBPF mapping table.

[0051] In some embodiments, the second eBPF program is further configured to: perform correlation analysis with at least one third eBPF program; the third eBPF program is an eBPF program mounted at a user-space function entry point; the user-space function entry point includes an SSL library function of the application process, the third eBPF program is mounted at the SSL library function of the application process, and is configured to capture plaintext content before data encryption or after data decryption, and pass the plaintext content to the second eBPF program; the second eBPF program performs correlation analysis between the plaintext content and metadata extracted from the TLS traffic.

[0052] This embodiment enables application-layer content detection of encrypted traffic such as HTTPS and QUIC without deploying a TLS man-in-the-middle proxy, avoiding the complexity of certificate management and the performance overhead and security risks introduced by man-in-the-middle proxies. By combining TLS metadata (such as JA3 fingerprints, SNI, ALPN, etc.) from the TC Hook layer for multi-dimensional cross-validation, the detection coverage and accuracy of encrypted traffic are significantly improved.

[0053] In some embodiments, the user-space management and control module further includes a machine learning inference engine; a second eBPF program configured to acquire statistical feature vectors for each data stream and write the statistical feature vectors into a circular buffer; the user-space management and control module reads the statistical feature vectors from the circular buffer, classifies the statistical feature vectors through the machine learning inference engine, generates inference results, and sends the inference results to the second eBPF program through an eBPF mapping table; the second eBPF program performs at least one of the following operations on subsequent data packets: blocking, allowing, rate limiting, or marking, based on the inference results.

[0054] For scenarios where pure feature matching schemes cannot identify unknown encrypted traffic without obvious protocol signatures (such as new malware C2 communication, covert tunnels, etc.), this embodiment can use a machine learning classification method based on behavioral features to identify traffic through statistical behavioral patterns, covering zero-day protocols and obfuscated traffic, significantly improving the detection rate of new threats.

[0055] In some embodiments, the second eBPF program includes multiple eBPF subroutines linked by a tail call mechanism; the tail call mechanism is implemented based on a tail call mapping table, which stores the program identifiers of each eBPF subroutine; the multiple eBPF subroutines are chained together through the tail call mapping table, and each eBPF subroutine is compiled and hot-updated independently.

[0056] In some embodiments, the multiple eBPF subroutines include at least two of the following: network layer and transport layer parsing subroutines, application protocol identification subroutines, threat signature matching subroutines, flow statistics subroutines, and policy execution subroutines.

[0057] This embodiment can break through the constraint of the upper limit of the number of instructions in a single eBPF program, and support the implementation of complex detection logic; the detection modules are decoupled from each other, and a single module can be flexibly combined or replaced according to task requirements without affecting the operation of other modules, which greatly reduces the system operation and maintenance and iteration costs.

[0058] This embodiment of the specification mounts a first eBPF program with a fast data path type at the system network card driver layer. The first eBPF program executes before the data packet is converted into a socket buffer structure, and is at the very front of the entire system network stack, enabling nanosecond-level first-layer fast classification of data packets entering the system. Furthermore, the deep packet inspection engine of this embodiment of the specification mounts a second eBPF program with a flow control layer type on the inbound hooks and outbound hooks of the system flow control layer. The second eBPF program can directly read the protocol header fields and payload of the data packet, and perform deep inspection processes such as protocol parsing, feature matching, and flow behavior statistics. This embodiment of the specification achieves a two-layer collaboration between high-speed coarse filtering and deep fine inspection, which not only ensures the ability to quickly intercept malicious traffic, but also reduces the processing load for subsequent deep inspection, significantly improving the overall performance and anti-attack capability of the detection system.

[0059] Moreover, the deep detection process in the embodiments of this specification is completed directly in kernel mode, without the need to copy data packets from kernel mode to user mode. This eliminates the memory copying and context switching overhead caused by frequent switching between kernel and user mode in traditional DPI schemes, reducing CPU utilization and detection latency.

[0060] Moreover, the eBPF programs in the embodiments of this specification can be directly mounted on the virtual Ethernet device of the container without modifying the container network plugin. They are compatible with cloud-native container network environments such as Kubernetes and can achieve deep packet inspection of east-west traffic between Pods. This not only solves the technical problems of high overhead, high risk, difficult operation and maintenance, incompatibility with container networks, and inability to perceive container network namespace-level traffic in traditional DPI solutions.

[0061] Furthermore, the data sharing and transmission module in this embodiment uses a per-CPU hash mapping table to store the flow state information. Each CPU core has an independent copy of the data, and each core does not need to lock when accessing it, thus avoiding lock contention during multi-core processing and achieving linear expansion of multi-core processing capabilities. A circular buffer is used to asynchronously report the detection results to user space, reducing memory lock contention and significantly improving throughput compared to the traditional perf buffer.

[0062] Furthermore, the user-space management and control module in this embodiment can read the flow state information stored in the hash mapping table of each CPU and perform statistical aggregation, read the detection results from the circular buffer, and dynamically update the detection rules, forming a closed-loop feedback mechanism of detection, analysis, update, and re-detection, thereby achieving real-time optimization of the detection strategy. In addition, the user-space management and control module can also interact with the second eBPF program in the kernel space through the user-space library, supporting the dynamic compilation and distribution of detection rules. This allows for the expansion of detection capabilities without modifying the kernel code, significantly reducing the system's operation, maintenance, and iteration costs.

[0063] The eBPF program in this embodiment can undergo static security verification by the kernel verifier during loading, ensuring no out-of-bounds access and no infinite loops, fundamentally eliminating the risk of kernel crashes. This embodiment also enables zero-interruption hot updates; utilizing the eBPF program's atomic replacement mechanism, updates to detection rules and logic do not require service interruption, eliminating detection blind spots in traditional solutions. Furthermore, this embodiment employs a two-layer collaborative detection system: the XDP Hook layer handles nanosecond-level coarse screening (e.g., DDoS defense), while the TC Hook layer handles microsecond-level fine-grained deep detection. This division of labor ensures both high-speed filtering and detection accuracy, complementing each other. Moreover, the eBPF program can be directly mounted on container veth devices without modifying container network plugins, adapting to cloud-native container network environments such as Kubernetes, and enabling deep packet inspection of east-west traffic at the Pod level.

[0064] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0065] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this specification is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0066] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0067] The above embodiments are merely preferred embodiments described in this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. An intelligent deep packet inspection system based on eBPF, characterized in that, include: The packet acquisition and distribution module is configured to mount a first eBPF program with a fast data path type on the system network card driver layer. The first eBPF program is executed before the packets entering the system are converted into a socket buffer structure. The first eBPF program is used to filter the packets, including: dropping malicious packets corresponding to packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious packets to be sent into the kernel protocol stack. The deep packet inspection engine is configured to mount a second eBPF program of the flow control layer type on the inbound hook and outbound hook of the system flow control layer. The second eBPF program is used to receive non-malicious data packets that have been released by the data packet acquisition and diversion module and have been converted into a socket buffer structure, read the protocol header field and payload of the non-malicious data packets, perform the deep inspection process, and generate inspection results. The data sharing and transmission module includes at least one per-CPU hash mapping table, configured to store the flow state information and flow table maintained by the deep packet inspection engine to eliminate lock contention during multi-core processing; it also includes at least one circular buffer, configured to asynchronously report the detection results generated by the deep packet inspection engine to the user-mode management and control module. The user-space management and control module runs in user space and interacts with the second eBPF program through the user-space library. It is configured to dynamically update the detection rules of the second eBPF program; read the flow state information stored in the per-CPU hash mapping table and perform statistical aggregation; receive alarm information from the ring buffer and link with the external security system; and output traffic statistics logs.

2. The system according to claim 1, characterized in that, It also includes an adaptive sampling and degradation module, which is configured to: determine the number of data packets arriving at the network card per unit time; when the number of data packets exceeds a preset threshold, switch the detection mode from full detection to sampling detection; the sampling rate of the sampling detection is dynamically distributed to the second eBPF program through the eBPF mapping table.

3. The system according to claim 1, characterized in that, In the packet acquisition and distribution module, malicious packets that match the blacklist or are identified as attack packets are discarded, including: The process of discarding malicious data packets corresponding to the attack message includes: determining the source IP address of any data packet based on the rate counter in the eBPF mapping table; determining the SYN packet rate by calculating the number of SYN packets sent by the source IP address per unit time; and when the SYN packet rate exceeds the rate threshold, determining the arbitrary data packet as a malicious data packet corresponding to the attack message and discarding the malicious data packet. The system queries a preset blacklist mapping table. When any data packet hits the source IP address or port of the blacklist, the arbitrary data packet is identified as a malicious data packet corresponding to the message that hit the blacklist, and the malicious data packet is discarded.

4. The system according to claim 1, characterized in that, In the deep packet inspection engine, the deep inspection process includes at least protocol parsing, feature matching, flow behavior statistics, and encrypted traffic identification; The protocol parsing includes parsing the Ethernet frame header, IP header, transport layer protocol header, and application layer payload of the non-malicious data packet layer by layer from the data link layer to the application layer, and reading the protocol header fields and payload through kernel-mode functions; The feature matching includes: performing multi-pattern string matching in kernel mode based on the protocol feature library stored in the eBPF mapping table to determine the application layer protocol type; the multi-pattern string matching adopts the AC automaton algorithm, and the matching logic of the AC automaton algorithm is compiled into eBPF bytecode and executed in kernel mode; the application layer protocol type includes at least HTTP, P2P, and VoIP application layer protocols. The flow behavior statistics include: grouping the non-malicious data packets by data flow, and maintaining the flow status information of each data flow in kernel space through a per-CPU hash mapping table. The flow status information includes at least the number of packets, the number of bytes, the packet interval time, and the direction ratio. The abnormal behavior corresponding to the flow status information is detected based on a sliding window algorithm. The abnormal behavior includes at least port scanning and slow attack. The encrypted traffic identification includes: identifying the transport layer security traffic corresponding to the non-malicious data packet by detecting the transport layer port number or handshake message type; extracting metadata from the handshake message of the identified transport layer security traffic, wherein the metadata includes at least a server name indication field, application layer protocol negotiation extension, and JA3 fingerprint; and matching the metadata with the fingerprint database stored in the eBPF mapping table to identify the application type of the encrypted traffic.

5. The system according to claim 1, characterized in that, In the user-mode management and control module The dynamic updating of the detection rules of the second eBPF program includes: compiling human-readable detection rules into eBPF bytecode and updating the second eBPF program without interrupting the detection service; The step of receiving alarm information from the circular buffer and linking with an external security system includes: reading detection results from the circular buffer and determining the alarm level of the detection results; when the alarm level exceeds a preset level threshold, sending the detection results to an external intrusion detection system or a security information and event management system. The output traffic statistics log includes traffic statistics logs in NetFlow format or IPFIX format.

6. The system according to claim 1 or 2, characterized in that, The system performs an intelligent deep packet inspection process based on eBPF, including: After the data packet arrives at the network card, it is intercepted by the first eBPF program mounted on the system network card driver layer and filtered, including: dropping malicious data packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious data packets to be sent into the kernel protocol stack. The non-malicious data packet enters the kernel network protocol stack, triggering the second eBPF program mounted on the inbound hook and outbound hook of the system flow control layer. The second eBPF program receives the non-malicious data that has been converted into a socket buffer structure, reads the protocol header field and payload of the non-malicious data packet, performs a deep detection process, and generates a detection result. The second eBPF program writes the detection result into a circular buffer and asynchronously reports it to the user-mode management and control module; The user-mode management and control module reads the detection results from the circular buffer, performs statistical aggregation, alarm linkage and log retention, and dynamically issues updated detection rules to the second eBPF program through the eBPF mapping table.

7. The system according to claim 1, characterized in that, The second eBPF procedure is also used for: Perform association analysis with at least one third eBPF program; the third eBPF program is an eBPF program mounted at the user-mode function entry point; The user-space function entry point includes the SSL library function of the application process. The third eBPF program is mounted at the SSL library function of the application process and is used to capture plaintext content before data encryption or after data decryption, and pass the plaintext content to the second eBPF program. The second eBPF program performs correlation analysis on the plaintext content and the metadata extracted from the TLS traffic.

8. The system according to claim 1, characterized in that, The user-mode management and control module also includes a machine learning inference engine; The second eBPF program is configured to obtain the statistical feature vector of each data stream and write the statistical feature vector into the circular buffer; The user-state management and control module reads the statistical feature vector from the circular buffer, classifies the statistical feature vector through the machine learning inference engine, generates inference results, and sends the inference results to the second eBPF program through the eBPF mapping table; The second eBPF program performs at least one of the following operations on subsequent data packets based on the inference result: blocking, allowing, rate limiting, or marking.

9. The system according to claim 1, characterized in that, The second eBPF program includes multiple eBPF subroutines linked through a tail call mechanism; the tail call mechanism is implemented based on a tail call mapping table, which stores the program identifiers of each eBPF subroutine; the multiple eBPF subroutines are chained together through the tail call mapping table, and each eBPF subroutine is compiled and hot-updated independently. The multiple eBPF subroutines include at least two of the following: network layer and transport layer parsing subroutines, application protocol identification subroutines, threat signature matching subroutines, flow statistics subroutines, and policy execution subroutines.

10. A smart deep packet inspection method based on eBPF, characterized in that, Including the following steps: After the data packet arrives at the network card, it is intercepted by the first eBPF program mounted on the system network card driver layer and filtered, including: dropping malicious data packets that hit the blacklist or are determined to be attack packets, and allowing non-malicious data packets to be sent into the kernel protocol stack. Non-malicious data packets enter the kernel network protocol stack, triggering the second eBPF program mounted on the inbound hook and outbound hook of the system flow control layer. The second eBPF program receives the non-malicious data that has been converted into a socket buffer structure, reads the protocol header field and payload of the non-malicious data packets, performs the deep detection process, and generates detection results. The second eBPF program writes the detection results into a circular buffer and asynchronously reports them to the user-mode management and control module; when a high-risk rule is hit, it triggers TC_ACT_SHOT blocking or TC_ACT_REDIRECT redirection. The user-mode management and control module reads the detection results from the circular buffer, performs statistical aggregation, alarm linkage, and log retention, and dynamically issues updated detection rules to the second eBPF program through the eBPF mapping table.

Images