Anomaly Detection Model for Process Resource Usage in Hybrid System based on eBPF and Isolation Forest

In the hybrid system, CPU-intensive processes, memory-intensive processes, and IO-intensive processes can consume a significant amount of system resources, potentially leading to system crashes in extreme cases. Therefore, it becomes crucial to detect anomalies in the resource usage of processes. This paper proposes a process resource usage anomaly detection model based on eBPF technology and the Isolation Forest algorithm. The model utilizes eBPF technology to extract process data, which provides finer granularity and greater accuracy compared to traditional tools. Subsequently, through comparative experiments, the important parameters of the Isolation Forest algorithm are adjusted to achieve the optimal precision and recall. Experimental results demonstrate that the anomaly detection model based on eBPF and Isolation Forest algorithm after parameter adjustment can more accurately and reliably detect anomalies in the resource usage of processes. This research has certain reference value in the field of anomaly detection of process resource usage in the hybrid system.