Bridging Observability and Security: A Graph-Based Arbitration and Adaptive Sensing Approach via eBPF

With the evolution of cloud-native microservice architectures traditional sidecar-based monitoring patterns and fragmented security tools have introduced significant resource overhead and management complexity. Current research indicates that the sidecar pattern induces notable network latency in distributed tracing while hybrid deployments of multiple kernel-level security tools often lead to policy execution conflicts and performance bottlenecks. Furthermore native probing mechanisms in current container orchestration platforms lack precise awareness of internal application states and malware detection methods based on simple system call counting struggle to identify highly concealed advanced persistent threats. To address these limitations this paper proposes an adaptive and unified framework for full-stack observability and security driven by extended Berkeley Packet Filter technology. This framework innovatively constructs a kernel-level closed loop for monitoring analysis and response. First a multi-modal data fusion adaptive sensing mechanism is proposed to unify the collection of application-layer network flows and system call sequences within the kernel space. This approach eliminates the need for sidecars while providing context-rich feature data for anomaly detection models. Second a state-aware dynamic hook orchestration algorithm is designed. Operating in a low-load monitoring mode by default this algorithm automatically escalates hook depth to the Linux Security Module layer for active blocking or granular forensics upon detecting service anomalies or behavioral drift effectively solving the performance dilemma of continuous high-load monitoring. Finally a graph-theory-driven unified policy arbitration engine is constructed to pre-calculate and resolve logical conflicts between security defense policies and operational scheduling policies prior to bytecode loading. Experimental results demonstrate that the proposed framework integrates full-stack observability and real-time security defense within a single agent significantly reducing end-to-end latency for anomaly detection and response while drastically lowering CPU overhead effectively defending against complex supply chain attacks and resource exhaustion attacks while maintaining a low false-positive rate.