The extended Berkeley Packet Filter (eBPF) has emerged as a powerful and safe in-kernel execution technology, widely adopted in domains such as system observability, security auditing, and high-performance networking. However, due to its stringent verifier constraints and steep learning curve, automatically generating compliant eBPF programs remains a substantial challenge. This paper presents a novel framework RACE for eBPF program synthesis that combines Retrieval-Augmented Generation (RAG) with Chain-of-Thought (CoT) reasoning. The framework leverages a high-quality code knowledge base and structured multi-stage prompts to guide large language models (LLMs) in generating eBPF programs from natural language descriptions. It also incorporates both syntactic validation through the native eBPF verifier to ensure correctness and reliability. Experiments conducted on three representative LLMs—GPT-4o Mini, Gemini 2.0 Flash, and Qwen-Plus—demonstrate significant improvements across both BCC and BPFtrace programming paradigms. Notably, the framework achieves up to 93.3% task-level success rate on complex BCC tasks while significantly reducing false positive rates, showcasing strong generalizability, effectiveness, and practical deployment potential.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

RACE: Towards Automatic eBPF Program Synthesis via Retrieval-Augmented Generation and Chain-of-Thought Reasoning

  • Chaojun Huang,
  • Hao Han,
  • Yulong Tian

摘要

The extended Berkeley Packet Filter (eBPF) has emerged as a powerful and safe in-kernel execution technology, widely adopted in domains such as system observability, security auditing, and high-performance networking. However, due to its stringent verifier constraints and steep learning curve, automatically generating compliant eBPF programs remains a substantial challenge. This paper presents a novel framework RACE for eBPF program synthesis that combines Retrieval-Augmented Generation (RAG) with Chain-of-Thought (CoT) reasoning. The framework leverages a high-quality code knowledge base and structured multi-stage prompts to guide large language models (LLMs) in generating eBPF programs from natural language descriptions. It also incorporates both syntactic validation through the native eBPF verifier to ensure correctness and reliability. Experiments conducted on three representative LLMs—GPT-4o Mini, Gemini 2.0 Flash, and Qwen-Plus—demonstrate significant improvements across both BCC and BPFtrace programming paradigms. Notably, the framework achieves up to 93.3% task-level success rate on complex BCC tasks while significantly reducing false positive rates, showcasing strong generalizability, effectiveness, and practical deployment potential.