57 results about "Berkeley Packet Filter" patented technology

Techniques for mobile network information sharing via extended Berkeley Packet Filter (eBPF) for zero trust security are disclosed. In some embodiments, a system / process / computer program product for mobile network information sharing via eBPF for zero trust security includes monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications; extracting meta information associated with the session using the agent executed on a network element in the core mobile network; sending the extracted meta information to a security platform located outside of the core mobile network; and enforcing a security policy on the session at the security platform based on the extracted meta information to apply granular-based security in the core mobile network based on a security policy.

The invention provides a server-free dynamic management and control method based on an extended Burkley packet filter, and the method comprises the steps: mounting an eBPF program to a kernel cgroup subsystem, monitoring a function instance creation / destruction event in real time, extracting metadata, dynamically generating a fine-grained network strategy, compiling the fine-grained network strategy into an eBPF byte code, and injecting the eBPF byte code into a Map format strategy table, realizing data packet level allowing / discarding control by using a flow control hook; and when the instance is destroyed, the strategy table rule is automatically cleared through a cgroprease event. Through kernel-level dynamic management and control, precise security protection, zero-trust micro-isolation and kernel layer malicious behavior interception of the function instance in the full life cycle are realized, and the security efficiency and the resource utilization rate of the cloud native environment are remarkably improved.

The invention discloses a network communication dynamic encryption method, an encryption and decryption system, equipment, a medium and a product, and relates to the technical field of communication. The method comprises the steps that a dynamic factor is obtained through a Berkley packet filter function, a key is generated based on the dynamic factor, the key generated based on the dynamic factor has high randomness and unpredictability, and the problem that a fixed key is adopted in a traditional encryption mode, and consequently the key is prone to being cracked can be solved; moreover, by using the execution environment of the Berkley packet filter function in the kernel mode, the risk that the key is stolen in the transmission and storage process is reduced, the influence on the network communication performance is small, and the network communication encryption efficiency and the network communication security are improved. Moreover, the information of network communication is used as the basis of key generation, additional key distribution and storage management processes are not needed, complex key exchange and certificate management mechanisms are not needed, the key management process is simplified, and the operation and maintenance cost of the system is reduced.

The invention discloses an AI infrastructure performance detection method and device and a storage medium, and belongs to the technical field of data processing. The method comprises the steps that according to chip information of container nodes, dynamic instrumentation is conducted on a kernel layer and a calculation layer by expanding a Burkley packet filter, first performance indexes of the kernel layer and the calculation layer are collected, a hardware management library function is called, second performance indexes of a chip hardware layer are collected, and on the basis of a control group mechanism, the kernel layer and the calculation layer are subjected to dynamic instrumentation; and obtaining meta-information of the business process group in the container node, constructing an association relationship between the first performance index and the business process group and between the second performance index and the business process group through association marking according to the meta-information, and performing association analysis on the first performance index and the second performance index based on the association relationship to obtain a performance detection result of the business process group. According to the method, the performance parameters are collected through a non-intrusive scheme, the performance indexes of different service processes are determined through a service association mode, and the accuracy of AI performance problem positioning is improved.

Systems and methods for testing sandboxed in-kernel programs are provided. A method of testing a program includes: obtaining a Berkeley Packet Filter (BPF) program to test; obtaining a test to run on the BPF program; performing the test on the BPF program for a plurality of Linux kernels and reporting a result of performing the test on the BPF program for a plurality of Linux kernels. This enables a generic testing solution for black box testing of BPF programs. The embodiments can integrate with existing testing suites and frameworks and can integrate into CI / CD pipelines. Some embodiments allow testing using any kernel from user space. Host kernel testing of BPF programs is enabled by a developer using the developer's own workstation and version of the Linux kernel. Guest kernel testing of BPF programs is enabled using specific kernel versions by providing the framework a specification of the target kernel environment.

Automation solutions for event logging and debugging on KUBERNETES are disclosed. A system for event logging and debugging on a distributed application cluster includes a user interface and at least one processor for executing instructions. The instructions, when executed, instruct the at least one processor to provide an edge module configured to deploy a Berkeley Packet Filter (BPF) probe and a BPF program in a computing environment. The BPF probe is triggered based on an event associated with a distributed application running in a user space of the computing environment. Data associated with the event is collected in a kernel space of the computing environment via the BPF program and transferred from the BPF program to the edge module. A query request associated with the collected data is sent to the edge module. A response corresponding to the collected data is received at the user interface.

The invention discloses a self-adaptive process scheduling method and system based on real-time state perception, and the method comprises the steps: firstly carrying out the low-overhead real-time monitoring of a system operation state through an extended Berkley data packet filter technology, and collecting multi-dimensional original data; secondly, identifying a current system load mode by using a pre-trained gradient boosting decision tree model, and performing stable prediction on a load mode of a next decision period in combination with a historical window mechanism based on time weighted voting so as to smooth instantaneous fluctuation; then, querying a'load mode-target scheduler 'mapping table which is constructed offline in advance according to a prediction result to determine a target scheduling strategy; and finally, dynamically and safely switching to a target scheduling strategy through the extensible scheduler class framework, and realizing self-adaptive adjustment of system scheduling. According to the method, macroscopic strategy selection and microcosmic scheduling decision are decoupled, high real-time inference overhead is avoided, safety and stability of the system are guaranteed by utilizing a kernel native mechanism, and the system operation efficiency under diversified loads is remarkably improved while low performance overhead, high safety and easy deployment are kept.

Automation solutions for event logging and debugging on KUBERNETES are disclosed. A method for navigating data associated with a distributed application cluster includes providing an edge module configured to deploy a Berkeley Packet Filter (BPF) probe and a corresponding BPF program in a computing environment. The BPF probe is triggered based on an event associated with a distributed application running in a user space of the computing environment, the distributed application being one entity of a plurality of entities on the distributed application cluster. Data associated with the event is collected in a kernel space of the computing environment via the BPF program. At least one relationship is identified between the distributed application and at least one entity of the plurality of entities based on the collected data. At least one recommended data set based on the at least one identified relationship is provided via a user interface.

A hypercall method and apparatus for a kernel-mode program of an enhanced Berkeley packet filter are disclosed. The method is applied to a virtual machine monitor, comprises: acquiring, in response to a virtualization page fault triggered by the kernel-mode program, a memory address where the virtualization page fault is triggered; determining whether the memory address of the virtualization page fault is consistent with a memory address corresponding to a page fault key in a mapping table; reading, from the mapping table, a page fault value mapped by the page fault key if the memory address of the virtualization page fault is consistent with the memory address corresponding to the page fault key, wherein the page fault value comprises a function type of a hypercall written by the kernel-mode program; and executing, based on the function type indicated by the page fault value, the hypercall of the function type.

Examples are described for inferring results based on application data using code segments executing within an application with a machine learning (ML) model. Code segments may be dynamically loaded into an application during execution. The controller verifies that the code segment meets security requirements for execution within the application based on an extended Berkelike Packet Filter (eBPF) bytecode of the code segment. A computing device executing an application loads the validated code segment into a library of the application. The application executes the validated code segment to apply the application data to the machine learning model to infer a result. The ML machine learning model may be implemented by eBPF code of a code segment, or the code segment may include a call to the machine learning model, the type of which is supported by a controller of the application, and a mapping of serialized representations for the machine learning model. The computing device may reconstruct an ML model based on the serialized representation.

The invention discloses an electricity consumption information acquisition terminal transaction semantic monitoring and causal delimiting method, which comprises the following steps: acquiring an application protocol data unit by utilizing an eBPF probe, generating a cross-layer unique transaction fingerprint based on extracted sessions, objects, businesses and calling identifiers, and generating a transaction event record by utilizing a pairing state machine; constructing a transaction observation window containing front and back extensions by taking a transaction observation timestamp as a reference, and screening and aggregating kernel events associated with the transaction fingerprint to obtain a transaction evidence set; and constructing a directed evidence graph based on the set, and calculating the confidence coefficient of each root cause category by using a scoring rule and an index normalization algorithm. According to the invention, non-intrusive deep observation of power acquisition business affairs is realized, and the automation level and fault diagnosis precision of power terminal operation and maintenance are improved.

Technologies for programming flexible accelerated network pipelines include a comping device with a network controller. The computing device loads a program binary file that includes a packet processing program and a requested hint section. The binary file may be an executable and linkable format (ELF) file with an extended Berkeley packet filter (eBPF) program. The computing device determines a hardware configuration for the network controller based on the requested offload hints and programs the network controller. The network controller processes network packets with the requested offloads, such as packet classification, hashing, checksums, traffic shaping, or other offloads. The network controller returns results of the offloads as hints in metadata. The packet processing program performs actions based on the metadata, such as forwarding, dropping, packet modification, or other actions. The computing device may compile an eBPF source file to generate the binary file. Other embodiments are described and claimed.

The application discloses a data collection method, system, device and storage medium, wherein the method comprises the following steps: in response to a data collection instruction of a network to be monitored, reading collection configuration information stored in a mapping of a control type of an extended Berkeley packet filter (eBPF) based on identification information of the network to be monitored; wherein the collection configuration information comprises collection index information of the network to be monitored; and acquiring first target data corresponding to the collection index information in the network to be monitored.

A computing environment determines, by an initialization process, a monitor instance identifier of an instance of an application, wherein the initialization process initializes monitoring of the instance of the application. The computing environment generates, by the initialization process, a system call argument based on a pseudo-randomly generated identifier. The computing environment makes, by the initialization process, a system call comprising the system call argument. The computing environment determines, by a kernel-space Berkeley packet filter (BPF), to monitor the instance of the application based on the system call. The computing environment extracts, by the kernel-space BPF, the pseudo-randomly generated identifier from the system call argument to obtain the monitor instance identifier. The computing environment stores, in a watch list, the monitor instance identifier and the pseudo-randomly generated identifier. The computing environment obtains instrumentation data using the monitor instance identifier and the pseudo-randomly generated identifier.

The application provides an eBPF-based non-intrusive intelligent agent behavior collection method, device, medium and program product. The method comprises the following steps: loading an extended Berkeley packet filter-based collection probe in an operating system kernel of a target computing node; collecting system call behaviors, network communication behaviors and process execution behaviors in an intelligent agent running process to obtain original behavior event data; transmitting the original behavior event data from the operating system kernel to a user state asynchronously through a data transmission mechanism between the kernel state and the user state; filtering, processing, protocol reorganizing and metadata enriching the original behavior event data in the user state to obtain structured behavior event data; performing metering processing on resource consumption of the intelligent agent in a model calling stage to obtain resource consumption indexes; and forming a full-link behavior event data stream based on the structured behavior event data and the resource consumption indexes. The application has the advantages of non-intrusiveness and low overhead, and improves the observability of the system.

This application discloses a packet parsing method, apparatus, and electronic device based on eBPF. Relating to the field of cloud computing, the method includes: acquiring packets to be parsed captured from the operating system kernel by an eBPF kernel-mode program based on an extended Berkeley packet filter (eBPF) user-space program, wherein the eBPF user-space program is a program running in the user space of the operating system, and the eBPF kernel-mode program is a program running in the kernel space of the operating system; determining a target parsing function; calling the target parsing function on a function computing platform through a traffic entry function, wherein the function computing platform is a service system that runs functions on demand; and parsing the packets to be parsed based on the target parsing function to obtain the parsing result of the packets. This application solves the problem of limited processing capacity of eBPF traffic analysis systems on a single node in related technologies.

The present application discloses a block storage cache method, device, equipment and storage medium, which relates to the field of data processing technology and is applied to a server, including: when using a block storage cache system to process input and output requests, monitoring the real-time performance data of the block storage cache system through a user-mode program built based on an extended Berkeley packet filter; the block storage cache system is a system containing configuration parameters pre-built based on a machine learning algorithm; the parameters characterizing the processing order of the input and output requests are calculated according to the real-time performance data to obtain the parameter value; based on the parameter value, the configuration parameters of the block storage cache system are adjusted through a file system interface to process the input and output requests using the adjusted block storage cache system. In this way, in the process of the block storage cache system processing input and output requests, the present application can dynamically adjust the relevant configuration parameters according to the real-time performance data, which can meet the needs of multiple business scenarios.

An apparatus for dynamic control of a network, the apparatus includes a processor, and a storage medium recording one or more programs configured to be executable by the processor. The one or more programs include instructions for executing collecting network monitoring information, determining, based on the network monitoring information, whether a network abnormality condition is satisfied, and loading, based on a result of the determination, an extended Berkeley packet filter (eBPF) program controlling a network environment.

The application provides a unified platform full-stack observability method, which comprises the following steps: collecting log, index and link tracking data by using an application performance monitoring agent, an extended Berkeley packet filter agent and an index collection agent respectively; storing and distributing the log, index and link tracking data; and performing data correlation processing by using request tracking identification and timestamps to obtain a unified storage and cross-data correlation raw data set, and performing format standardization and full-stack tracking integration processing to obtain standardized time series index and full-stack link tracking data respectively. The application can achieve the following effects: all observability data can be observed on the same platform by collecting the data into the same set of observation systems and correlating the observation data by using specific fields; the same set of user interfaces can be used, so that it is not necessary to switch between multiple system pages; and the problem of data silos is solved, and a user-friendly observability platform is created.

An eBPF module (e.g. an extended Berkeley Packet Filter) receives untracked new traffic from a client and, in response, adds 713 an entry to a ConnTrack map corresponding to the new traffic. The eBPF

Examples are described for providing fine-grained real-time preemption of small code based on runtime thresholds. The controller inserts a checkpoint into an extended Berkley packet filter (eBPF) bytecode of the third-party small code prior to verifying the third-party small code. The device executes the code group at the hook point of the application. The inserted checkpoint determines the runtime of the small code. In response to the run-time exceeding the threshold, the device terminates the code group. The application may be a virtualized radio access network (vRAN) network function, and the small code may control the vRAN function or derive network metrics. The application may be executed in a container management system that modifies a container for the application to install code including a function associated with a hook point of the application to the container; detecting an annotation identifying a container of the code group; and symbologically linking the code to the hook point.

The embodiment of the invention provides a file protection method, device and system, equipment, a storage medium and a program product, and relates to the technical field of computing security. The file protection method comprises the following steps: in response to an access request of a user process to a file in a kernel space, loading a file access strategy based on an extended Berkley data packet filter eBPF, performing security check on the access request based on the file access strategy, and releasing or intercepting the access request according to a security check result; wherein the file access strategy is that the security service module of the user space receives the file access strategy from the server side and sends the file access strategy to the file security module, and the file security module stores the file access strategy in the kernel space in advance based on the eBPF. The technical scheme provided by the embodiment of the invention is relatively high in universality and security for various kernel versions.

The application relates to the field of load balancing, and provides a load balancing method and device for service traffic, electronic equipment and a storage medium. The method is applied to a load balancer cluster constructed based on an extended Berkeley packet filter, and comprises the following steps: in the case of first receiving current service traffic, determining a server for processing the current service traffic based on a consistent hashing algorithm; in the case of non-first receiving current service traffic, determining the server for processing the current service traffic based on local data of a first load balancer; or, determining the server for processing the current service traffic based on a data packet received by the first load balancer. The application constructs the load balancer cluster based on the extended Berkeley packet filter, the load balancer cluster allocates servers for service traffic through the consistent hashing algorithm and local data or a data packet with an identifier, realizes consistency of the service traffic, and improves load balancing efficiency.

The present application provides a file observation method, electronic device, chip and program product. In this method, at the creation point of the index node inode of the target file, the file path information is pre-recorded in the extended Berkeley Packet Filter Map information BPF map. When the target file needs to be observed, the corresponding path information can be obtained from the BPF map using the identification information of the target file, so that the file can be observed according to the path information, providing important data support for system tuning.

The application relates to the technical field of network security, in particular to an IPv6 fragmentation bypass threat detection method and system based on eBPF and XDP, which sets a data packet observation point at a network driver layer, the data packet observation point is used for mounting an extended Berkeley packet filter (eBPF) program on a data packet processing path by using a fast data path (XDP) technology; for a data packet received on the network driver layer, the data packet observation point calls the eBPF program on an XDP network hook, the eBPF program is used for identifying and filtering a data packet with potential threats by using a feature matching strategy, the feature matching strategy is used for extracting key features of the data packet, matching the extracted key features of the data packet with target threat features, and judging whether an upper layer header of the data packet is complete; the application realizes efficient detection of specific threats by combining the dynamic programmability of the eBPF and the high-performance data packet processing capability of the XDP, meets the task requirements of an IPv6 network security threat high-performance solution, and has a smaller influence on system stability even under serious threats.

The embodiment of the invention provides a method for obtaining operation information and related equipment. The invention provides an efficient scheme for obtaining the operation information of the application program. The method includes: when a stream conversion method in a performance analysis application is triggered, an extended Berkeley packet filter (eBPF) virtual machine (VM) running in a kernel space obtains thread data, the first thread data comprises N table entries, each table entry in the N table entries corresponds to one method in the performance analysis application, and the first thread data comprises a first thread data and a second thread data, each table entry in the N table entries corresponds to one method in the performance analysis application, and each table entry in the N table entries corresponds to one method in the performance analysis application. The N table items comprise a first table item, and the first table item corresponds to the triggered stream conversion method; the eBPF VM determines a target method according to the thread data, and the target method is called by the triggered stream conversion method; the eBPF VM performs performance analysis on the performance analysis application program to obtain a stack tracking result, the stack tracking result comprises a plurality of table entries, the table entries are in one-to-one correspondence with a plurality of methods, the table entries comprise a second table entry, and the second table entry corresponds to the target method; a collector running in a user space obtains the thread data and the stack tracking result from the eBPF VM; and the collector determines operation information of the performance analysis application program according to the thread data and the stack tracking result. According to the technical scheme, the eBPF VM can perform performance analysis on the performance analysis application program in the kernel space. In addition to the performance analysis application, the eBPF VM may obtain thread data and stack tracking results for other applications. No code is injected into the performance analysis application and / or the user space of the performance analysis application so that no damage is caused by code injection.

The invention relates to a priority-based data processing method and device, equipment and a storage medium, and the method comprises the steps: obtaining an eBPF program, and loading the eBPF program; obtaining priority configuration information, wherein the priority configuration information is used for indicating the priority of the service data; after input / output (IO) operation on any business data is received, an eBPF program is triggered, and the eBPF program determines the execution sequence of the corresponding IO operation based on the priority of the business data; and executing the IO operation according to the execution sequence. Therefore, the priority of the business data is identified by utilizing the eBPF program, the execution sequence of the IO operations corresponding to the different business data is sequenced based on the priority of the business data, the IO operations of the business data with higher priority can be executed preferentially, and the IO operations of the business data with lower priority can be executed later. The key data can be preferentially submitted to the storage medium only by setting the key data to be high in priority, so that the timeliness and read-write performance of the key data are improved.

The application relates to the technical field of communication, and provides a flight vehicle path planning method, device and equipment based on communication optimization and a medium. On the one hand, a Berkeley packet filter is used to assist in collecting mobile communication data of a monitoring area, and a nanosecond timestamp label can be realized, so that the time delay measurement precision is improved. On the other hand, during the flight, a mobile communication service quality three-dimensional heat map of the monitoring area is generated based on a height attenuation factor and the mobile communication data, the mobile communication service quality of a three-dimensional space can be accurately predicted, and accurate real-time obstacle avoidance decision basis is provided for subsequent flight vehicle path planning. On the other hand, the generation cost of each candidate path is calculated, the candidate path with the lowest generation cost is selected as a target path, and the target flight vehicle is controlled to fly to a flight end point according to the target path. More accurate three-dimensional path planning can be realized by introducing the path generation cost, so that the success rate of the flight vehicle quickly and safely reaching the end point is higher.

According to the present specification, a method for inspecting a high-speed network packet payload by a terminal includes: a step of receiving L7 (Layer 7) policy related to containers from a user; a step of extracting string patterns to be inspected for each of the containers on the basis of the L7 policy through a pattern compiler; a step of creating a deterministic finite automaton (DFA) on the basis of the extracted string patterns through the pattern complier; and a step of converting a state transition table of the deterministic finite automaton into a match-action table through the pattern compiler and storing the match-action table in an eBPF (extended Berkeley Packet Filter) map for a payload inspection engine.

The present application relates to a cloud storage processing method, apparatus, computer equipment, computer-readable storage medium and computer program product, and relates to the field of cloud storage technology. The present application can reduce cloud disk access latency and improve cloud disk storage access performance. The method includes: determining the block storage engine node where the cloud disk server is located; the block storage engine node starts a node optimizer; binding a business scheduling unit to the block storage engine node, and sending the address of the block storage engine node to a redirector; according to a login request of a cloud disk client mounted by the business scheduling unit, providing an address to the cloud disk client through the redirector for login, so that the business scheduling unit can log in to the block storage engine node to perform input and output operations of the cloud disk business; wherein the node optimizer is used to start the kernel service of the extended Berkeley packet filter at the block storage engine node, and forward the input and output requests of the input and output operations at the kernel level.