eBPF
A technology in the Linux kernel that allows developers to safely run sandboxed programs in kernel space without modifying kernel source code. It is widely used in cloud-native observability, networking, and security tooling.
Timeline (last 90 days)
Truly effective network isolation requires traffic interception at the kernel level (such as using eBPF for mandatory auditing of outbound traffic), rather than relying solely on application-layer configuration constraints.
NetWatch's process attribution is achieved by combining platform-level socket polling, PKTAP on macOS, and optional eBPF kprobes on Linux.
High-overhead probes may distort the true performance characteristics of the observed system, i.e., the observer effect
eBPF provides multiple map types, including hash map, LRU hash map, and per-CPU map
A team successfully reduced the CPU cost of eBPF by approximately 90% by introducing memoization technology
What is visible at the kernel layer consists of low-level signals such as system calls; mapping these back to the high-level decision semantics of agents requires additional correlation and interpretation work, presenting a semantic gap.
AgentSight is a project that leverages eBPF technology to provide observability capabilities for AI agents without modifying any application code.
Well-known projects such as Cilium, Falco, and Pixie are all built on eBPF.
eBPF primarily relies on relatively recent versions of the Linux kernel, and its applicability in environments such as Windows and macOS is limited.
For large model API calls that go over HTTPS, network-layer observation can see the connection being established but the content is encrypted, requiring other means to reconstruct the call details.
4 more timeline events
All Facts (15)
Caching frequently reused data in on-chip shared memory can reduce repeated reads from global memory.
70%UnverifiedTruly effective network isolation requires traffic interception at the kernel level (such as using eBPF for mandatory auditing of outbound traffic), rather than relying solely on application-layer configuration constraints.
50%UnverifiedNetWatch's process attribution is achieved by combining platform-level socket polling, PKTAP on macOS, and optional eBPF kprobes on Linux.
50%UnverifiedeBPF provides multiple map types, including hash map, LRU hash map, and per-CPU map
50%UnverifiedHigh-overhead probes may distort the true performance characteristics of the observed system, i.e., the observer effect
50%UnverifiedA team successfully reduced the CPU cost of eBPF by approximately 90% by introducing memoization technology
50%UnverifiedeBPF primarily relies on relatively recent versions of the Linux kernel, and its applicability in environments such as Windows and macOS is limited.
50%UnverifiedAgentSight is a project that leverages eBPF technology to provide observability capabilities for AI agents without modifying any application code.
50%UnverifiedWell-known projects such as Cilium, Falco, and Pixie are all built on eBPF.
50%UnverifiedWhat is visible at the kernel layer consists of low-level signals such as system calls; mapping these back to the high-level decision semantics of agents requires additional correlation and interpretation work, presenting a semantic gap.
50%UnverifiedFor large model API calls that go over HTTPS, network-layer observation can see the connection being established but the content is encrypted, requiring other means to reconstruct the call details.
50%UnverifiedeBPF offers excellent performance but is limited to Linux, while ESF is feature-complete but requires special authorization.
50%UnverifiedCommon solutions for process behavior monitoring on Linux include eBPF, the auditd audit subsystem, and the ptrace system call.
50%UnverifiedCilium is an eBPF-based cloud-native network security solution widely used for network policy enforcement in Kubernetes clusters.
50%UnverifiedeBPF允许开发者在不修改内核源码的前提下将自定义程序注入内核执行，加载时经内核验证器静态分析后被JIT编译为本机机器码执行，性能接近原生内核代码
50%