Seungsoo Lee

Rahul Arvind Jadhav

Jaehyun Nam

A computer-implemented system, computer-implemented method, and computer program product for facilitating in-kernel instrumentation of kernel-level processes are envisaged. The system, method, and computer program product implement the in-kernel instrumentation independent of the user space and without sharing any kernel-level processes-related information with the user space. A plurality of predetermined, customized eBPF maps are created and used to store information directed to kernel-level processes, including process ID, process namespace ID, process context, process parameters, and pointers directed to kernel-executable instrumentation-related directives. The information directed to kernel-level processes and kernel-executable instrumentation directives, both stored within the kernel space in a plurality of interlinked eBPF maps, are compared with one another, and subsequent to a successful comparison, the kernel-level processes are instrumented within the kernel space and entirely within the kernel-level, without any reliance on the user-level for performing such a comparison, and without having to facilitate context-switches between the user-level and kernel-level.

Growing community of inventors

Dong-Gu, South Korea

Seungsoo Lee