隨著物聯網(Internet Of Things, IoT)裝置的普及，大量的裝置要能即時管理，勢必需要對於各裝置能集中監控，因此在過去誕生了像 SNMP 的監控協定可用於管理，一直到現在都還是屬於穩定的商用監控協定之一，然而近年來邊緣運算(Edge computing)概念的興起，從過去資料中心集中運算到如今只要具有一定數量的物聯網裝置都能形成一定規模的分散式運算架構，大幅度的改善了在利用網路服務時的延遲與可用性，SNMP 協定在現今架構下雖然還是具有廣泛低門檻的優點，但是經過整理後發現會有對於 OS kernel 層面的監控細節較無法取得、取得監控資訊的手段與過程耗費過多資源、主從溝通過程過於複雜的三個缺點，因此本研究將提出基於 eBPF 的監控解決方案，針對上述缺失進行改善與評估，預期能夠降低在進行監控時所耗費的系統資源，對於物聯網在進行監控時能有更好的解決方案。

With the wide spread of the Internet of Things (IoT) technologies, real-time distributed observability and management mechanisms for a large number of connected things are critical. SNMP has been the de facto standard of distributed observability in traditional networked environments. While SNMP was proven reliable and effective, it suffers from various issues in IoT environments. As the kernel-level information is important for ensuring the reliability of IoT devices, obtaining this type of information via SNMP takes too many system resources, whereas system resources are valuable in resource-constrained IoT devices. What is more, SNMP forces a client-server communication model, namely, polling instead of callback, to lead to a significant waste of networking resources. This thesis proposes an eBPF-based solution to deal with the issues mentioned above. Specifically, based on eBPF, this research proposes a reference architecture and system design to realize comprehensive monitoring of an IoT system in an efficient way. Experiments show that the approach is able to reduce the system resources consumed in monitoring and provide better performance for the Internet of Things observability.

[1] Ericson, "Cellular networks for massive IoT," p. 2. [Online]. Available: https://www.ericsson.com/assets/local/publications/white-papers/wp_iot.pdf
[2] I. C. Education. "Observability." https://www.ibm.com/cloud/learn/observability (accessed.
[3] R. S. Carl Lebsack, "SNMP is dead," p. 5. [Online]. Available: https://research.google/pubs/pub47773/
[4] "Net-SNMP." http://www.net-snmp.org/ (accessed.
[5] "Windows Management Instrumentation." https://docs.microsoft.com/zh-tw/windows/win32/wmisdk/about-wmi (accessed.
[6] "Common Information Model." https://www.dmtf.org/standards/cim (accessed.
[7] S. McCanne and V. Jacobson, "The BSD Packet Filter: A New Architecture for User-level Packet Capture," in USENIX winter, 1993, vol. 46.
[8] "Extending extended BPF." https://lwn.net/Articles/603983/ (accessed.
[9] "ftrace - Function Tracer." https://www.kernel.org/doc/Documentation/trace/ftrace.txt (accessed.
[10] "Kernel Probes (Kprobes)." https://docs.kernel.org/trace/kprobes.html (accessed.
[11] M. Bertrone, S. Miano, F. Risso, and M. Tumolo, "Accelerating Linux Security with eBPF iptables," presented at the Proceedings of the ACM SIGCOMM 2018 Conference on Posters and Demos, Budapest, Hungary, 2018. [Online]. Available: https://doi.org/10.1145/3234200.3234228.
[12] S. Tesliuk, "Monitoring network traffic and detecting attacks using eBPF," 2021.
[13] G. Fournier, "Monitoring and protecting SSH sessions with eBPF."
[14] C. Cassagnes, L. Trestioreanu, C. Joly, and R. State, "The rise of eBPF for non-intrusive performance monitoring," in NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium, 20-24 April 2020 2020, pp. 1-7, doi: 10.1109/NOMS47738.2020.9110434.
[15] C. Liu, Z. Cai, B. Wang, Z. Tang, and J. Liu, "A protocol-independent container network observability analysis system based on eBPF," in 2020 IEEE 26th International Conference on Parallel and Distributed Systems (ICPADS), 2-4 Dec. 2020 2020, pp. 697-702, doi: 10.1109/ICPADS51040.2020.00099.
[16] T. Shiraishi, M. Noro, R. Kondo, Y. Takano, and N. Oguchi, "Real-time monitoring system for container networks in the era of microservices," in 2020 21st Asia-Pacific Network Operations and Management Symposium (APNOMS), 2020: IEEE, pp. 161-166.