User-space Adaptive Bitrate (ABR) algorithms cannot see the transport layer signals that matter most, such as minimum RTT and instantaneous delivery rate, and they respond to network changes only after damage has already propagated to the playout buffer. We present eBandit, a framework that relocates both network monitoring and ABR algorithm selection into the Linux kernel using eBPF. A lightweight epsilon-greedy Multi-Armed Bandit (MAB) runs inside a sockops program, evaluating three ABR heuristics against a reward derived from live TCP metrics. On an adversarial synthetic trace eBandit achieves $416.3 \pm 4.9$ cumulative QoE, outperforming the best static heuristic by $7.2\%$. On 42 real-world sessions eBandit achieves a mean QoE per chunk of $1.241$, the highest across all policies, demonstrating that kernel-resident bandit learning transfers to heterogeneous mobile conditions.

翻译：用户态自适应码率（ABR）算法无法观测到最重要的传输层信号（如最小RTT和瞬时投递速率），且仅在损伤已传播至播放缓冲区后才响应网络变化。我们提出eBandit框架，该框架通过eBPF将网络监控与ABR算法选择功能迁入Linux内核。一个轻量级的epsilon-贪婪多臂赌博机（MAB）运行在sockops程序中，根据实时TCP指标产生的奖励值评估三种ABR启发式策略。在对抗性合成轨迹上，eBandit获得了$416.3 \pm 4.9$的累积QoE，比最优静态启发式策略提升$7.2\%$。在42个真实会话中，eBandit实现了每分块平均QoE 1.241，为所有策略最高，证明常驻内核的赌博机学习可迁移至异构移动环境。