Working set size estimation (WSS) is of great significance to improve the efficiency of program executing and memory arrangement in modern operating systems. Previous work proposed several methods to estimate WSS, including self-balloning, Zballoning and so on. However, these methods which are based on virtual machine usually cause a large overhead. Thus, using those methods to estimate WSS is impractical. In this paper, we propose a novel framework to efficiently estimate WSS with eBPF (extended Berkeley Packet Filter), a cutting-edge technology which monitors and filters data by being attached to the kernel. With an eBPF program pinned into the kernel, we get the times of page fault and other information of memory allocation. Moreover, we collect WSS via vanilla tool to train a predictive model to complete estimation work with LightGBM, a useful tool which performs well on generating decision trees over continuous value. The experimental results illustrate that our framework can estimate WSS precisely with 98.5\% reduction in overhead compared to traditional methods.

翻译：工作集大小估计（WSS）对于提升现代操作系统中程序执行效率与内存管理具有重要意义。已有研究提出了多种WSS估计方法，包括自膨胀法（self-ballooning）、Z膨胀法（Z-ballooning）等。然而，这些基于虚拟机的方法通常会产生巨大开销，导致其在实际场景中难以应用。本文提出了一种基于eBPF（扩展伯克利数据包过滤器）框架的高效WSS估计方案。eBPF作为尖端技术，通过挂载至内核实现数据监控与过滤。通过将eBPF程序固定于内核，我们能够获取缺页次数及内存分配等其他信息。此外，我们利用原生工具采集WSS数据，训练基于LightGBM（一种在连续值决策树生成中表现优异的工具）的预测模型完成估计任务。实验结果表明，相较传统方法，本框架可在保持WSS估计精度的同时，将系统开销降低98.5%。