基于eBPF的云环境下payload进程检测方法

针对目前云环境下攻击载荷（Payload）所体现出的新特征以及目前检测方法性能损耗较高的问题，提出了一种利用eBPF技术在内核态检测反向连接类Payload进程从而定位被入侵容器的方法。该方法在内核态对服务端TCP连接进行监控，通过筛选TCP标志位定位疑似反向连接类Payload进程所在容器，并对该容器进程组后续访问文件行为进行追踪以控制损害。实验证明，该方法可以有效检出并定位被入侵容器，且其性能消耗极低，多线程性能Unixbench分数损耗仅为0.53%。

payload process detection method based on eBPF in cloud environment

Aiming at the new features of Payloads in the cloud environment and the high performance loss of current detection methods, this paper proposed a method using eBPF technology to detect reverse connected Payloads in the kernel state to locate the invaded container. This method monitored the TCP connection of the server in the kernel state, located the container of the suspected reverse connection class Payload process by filtering the TCP flag bit, and tracked the subsequent file access behavior of the container process group to control the damage. Experiments show that this method can effectively detect and locate the intruded container, and its performance consumption is extremely low. The multi-threaded performance Unixbench score loss is only 0.53%.