Linux Network Situation Prediction Model Based on eBPF and LSTM

Abstract

Aiming at the problem that the existing network security technology cannot accurately predict the network situation, using the low-overhead non-intrusive fine-grained data collection technology of the kernel under Linux, a prediction method based on eBPF and LSTM is proposed. This method uses eBPF technology to extract Linux system network data, which is more accurate than traditional data collection methods and has finer data granularity. Then, the extracted data set is trained through the LSTM model, and the subsequent network situation is predicted through simulation. The results of the prediction method are tested, and the results show that eBPF and LSTM can accurately reflect the overall trend of network security and improve the prediction accuracy of the network security situation. Compared with similar methods, the prediction method in this paper is more accurate in network security situation prediction. Rate and real-time, which can efficiently predict the network security situation in real-time.