System State Clustering using eBPF data
summary
Proposes using eBPF-generated maps as a live feature store and feeding those time-windowed counts into clustering models that label system states as normal or anomalous. Shows plumbing: eBPF programs write to maps/ring buffers, userspace pulls them into a datastore, clustering flags shifts and a time-series layer detects ramping anomalies. Demonstrates a concrete action: XDP drop/redirect via map for malicious IPs, with integration hooks like Cilium and Sysdig and the core idea eBPF maps as feature store.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:17Agenda overview
- 1:38What is eBPF
- 6:09Introduction to clustering with machine learning
- 8:14eBPF data + clustering
- 9:16XDP network filtering
- 11:22eBPF SRE tools
- 13:04Cilium observability
- 14:28Pixie monitoring
- 16:10eBPF SRE use cases
- 18:15XDP traffic filtering
- 21:07Closing & Q&A
related talks
32mExploring the Power of eBPF for System Observability
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs
47mInto the Heart of the eBPF Hive!
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
43meBPF Superpowers for SRE
42mCommunity Driven Breakout Session: eBPF and Auto-Instrumentation- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools