Blog Details

Introduction & Industry Dynamics

In modern enterprise infrastructures, eBPF (extended Berkeley Packet Filter) technology has rapidly become a standard architectural component due to its capability for kernel-level observability and security policy enforcement. However, eBPF programs handling high-frequency system calls can create significant CPU loads, especially in frequently repeated operations like file access. This situation creates a critical performance bottleneck for security agents requiring real-time policy enforcement. The biggest challenge in the industry is how to optimize the speed of security policy enforcement without negatively impacting kernel performance. In this context, memoization, a simple but effective software engineering technique, offers an unexpected performance leap in the eBPF world.

Recently, we designed our eBPF security agent to be fast from the ground up; however, our profiling revealed that the most expensive part is not the policy enforcement (allow/deny) logic, but the process of determining which policy applies to a specific file open. Our path-based policies utilize an LSM (Linux Security Modules) hook that triggers on file open events. In this process, we reconstruct the path, walk up the parent dentries, and check whether the file or any ancestor directory has a matching policy. While this approach works, we end up repeating much of the work for files we have already seen (for example, database operations that repeatedly access the same file paths). This repetition exponentially increases inefficiency, especially in systems with heavy I/O loads like Postgres.

Technical & Architectural Deep Dive

As a solution, we developed a mechanism to cache which policy applies for each inode. This simple change reduced our kernel CPU cost by approximately 90%. In the cache design, creating a lightweight and safe structure was critical. Initially, we considered using dentries; however, dentries are pointers, and pointers cannot be stored directly in eBPF maps. While it is possible to store dentry content in a struct and use it as a key, this struct would be quite heavy. Therefore, we transitioned to an inode-based cache strategy. Our cache key consists of three fields: mount namespace ID, mount ID, and inode number. Caching only the inode number is not sufficient because inode numbers are unique to a specific mount tree and can overlap in different mount trees. The mount ID helps us identify which mounted tree we observed the file through, and the mount namespace ID prevents cached entries from different namespaces from mixing.

The cache value consists of two parts: an access_index and a cache state. We store our policies as bitmasks for space efficiency, and the access_index represents the bit position of the path policy. This structure is designed to work on an LRU (Least Recently Used) hash map. The new flow is as follows: First, we build the cache key. Then, we look up this key in the LRU hash map. If there is a hit, we enforce the file open directly based on this cached data. This allows us to completely skip the expensive dentry walk and policy matching process when the same file or files in the same subtree are opened again. This optimization provides dramatic speed improvements, especially in workloads with repetitive patterns such as database accesses.

Strategic Comparison & Impact Analysis

The performance comparison before and after memoization clearly reveals the cost of the 'slow path' in eBPF architecture. In the cacheless scenario, the entire path hierarchy is scanned for every file open, and policy checks are performed at each level. This is an O(n) complexity operation, where n depends on the depth of the file path. In the cached scenario, the operation drops to O(1) complexity after the first access, because the key lookup operation is completed in constant time. This difference means a massive cumulative CPU savings in systems performing thousands of file open operations per second. The following table summarizes the technical differences between the two approaches:

The impact of this optimization is not just a technical improvement but also a strategic advantage in terms of enterprise scalability. The capacity of security agents to provide maximum protection without slowing down the workload increases. This is a factor that directly affects costs, especially in scenarios where resources need to be used efficiently in the cloud environment. The 90% CPU savings allow running more virtual machines or containers on the same hardware, which significantly reduces the total cost of ownership (TCO).

InsightTech Engineering Perspective & Risk Governance

At InsightTech, our goal is to maintain the balance between performance and security at the highest level when designing eBPF-based security solutions. The implementation of the memoization technique is a critical engineering decision that establishes this balance. However, using a cache also brings certain risks: cache inconsistency and memory leaks. The use of LRU hash maps is one of the best practices to limit memory usage; however, correctly creating cache keys is vital to prevent false cache hits. In particular, correctly capturing the mount namespace and mount ID prevents files from different isolation layers from mixing. This is mandatory to maintain security integrity in multi-tenant cloud environments.

From a risk management perspective, the cache invalidation strategy must also be handled carefully. The reuse of inode numbers or changes in mount structures in file systems can cause old cache entries to become invalid. Therefore, the lifecycle of cache entries must be synchronized with kernel events. The InsightTech engineering team is developing automatic monitoring mechanisms to track such dynamic situations and ensure cache consistency. Additionally, making the cache size (max_entries) dynamically adjustable according to system resources helps ensure optimal performance in infrastructures of different scales. This proactive approach minimizes potential performance fluctuations and security vulnerabilities.

Conclusion & Strategic Roadmap

In eBPF performance optimization, memoization demonstrates the power of the correct application of fundamental software engineering principles rather than complex algorithms. The CPU savings of up to 90% are concrete evidence of how effective this technique can be in enterprise infrastructures. In the future, as the eBPF ecosystem grows, we expect similar optimization techniques to become standard in more security and observability tools. As InsightTech, we will continue to integrate such proven techniques into our platforms and provide our customers with more efficient, faster, and secure solutions.

Our strategic roadmap aims for eBPF agents to become active components that not only enforce security policies but also increase infrastructure performance. Techniques like memoization are the cornerstones of this vision. Infrastructure engineers should identify similar repetitive workloads in their own eBPF projects, evaluate inode-based cache mechanisms, and measure potential performance gains. This approach is a sustainable engineering practice that increases both cost efficiency and system reliability.