eBandit: Kernel-Driven Reinforcement Learning for Adaptive Video Streaming
Moving video streaming intelligence into the Linux kernel cuts buffering delays — but results so far come from a small real-world test.
The Thesis
When you stream video, your phone or laptop constantly decides whether to request higher or lower quality — a process called Adaptive Bitrate (ABR) selection. Today that logic runs in user-space software, which can only see coarse network hints and always reacts too late when conditions change. eBandit pushes both the decision-making and the network monitoring directly into the Linux kernel using a technology called eBPF (extended Berkeley Packet Filter), a safe way to run small programs inside the OS without modifying kernel source code. This gives the system access to raw TCP signals — like the minimum round-trip time and real-time delivery rate — that user-space code simply cannot see. The catch: validation rests on 42 real-world sessions and one synthetic adversarial trace, so the generalization story is still early.
Catalyst
eBPF matured enough in recent Linux kernels (5.x and above) to support low-overhead socket operations programs (sockops), making it practical to run tiny learning algorithms inside the kernel without destabilizing the OS. Simultaneously, streaming quality-of-experience (QoE) research has produced standardized reward metrics, giving kernel-resident algorithms a clear objective function to optimize against. Those two pieces — a stable eBPF runtime and a well-defined reward signal — were not reliably available together until recently.
What's New
Prior ABR systems like Pensieve (a deep reinforcement learning approach) and BOLA (a buffer-occupancy heuristic) run entirely in user-space players such as browsers or mobile apps. Those systems receive network state only indirectly — through buffer levels or bandwidth estimates — and incur round-trip latency before any adaptation occurs. eBandit replaces that indirect loop with a lightweight epsilon-greedy Multi-Armed Bandit (MAB) — an algorithm that tries different options and gradually shifts toward whichever works best — running inside the kernel itself, where it can read live TCP metrics before data ever reaches the application layer.
The Counter
Forty-two real-world sessions is a thin dataset on which to claim the 'highest QoE across all policies' in heterogeneous mobile conditions. The 7.2% improvement over the best static heuristic on a single synthetic adversarial trace is plausible but easy to manufacture by tuning the trace to favor the proposed method. The paper compares against heuristic baselines (rule-based algorithms), not against the strongest learned systems like Pensieve or Comyco, so it is unclear whether kernel residency actually beats state-of-the-art user-space RL or just beats simpler rules. Deploying eBPF programs in production environments — especially at CDN scale or on locked-down mobile operating systems like iOS — faces serious security review, vendor approval, and kernel version dependency hurdles that the paper does not address. Finally, the epsilon-greedy bandit is a deliberately simple learning algorithm; it may not adapt quickly enough under rapid, sustained network degradation compared to model-based approaches.
Longs
- AKAM (Akamai) — CDN operator whose edge servers run Linux and could deploy kernel-resident ABR
- CSCO (Cisco) — network hardware maker with stakes in video delivery optimization
- ROKU — streaming platform that controls client software and could benefit from lower-layer QoE gains
- NFLX (Netflix) — vertically integrated streamer that ships its own client stacks and invests in ABR research
- IGV (iShares Expanded Tech-Software ETF) — broad software exposure including streaming infrastructure
Shorts
- User-space ABR library vendors (e.g., dash.js, Shaka Player maintainers) — their optimization layer becomes redundant if kernel-resident logic proves superior
- Deep-RL ABR startups — heavy models like Pensieve are harder to port to kernel space, weakening a key differentiator if lightweight bandit methods match their performance
Enablers (Picks & Shovels)
- Linux kernel eBPF subsystem (open-source, kernel.org) — the runtime that makes kernel-resident programs safe and possible
- libbpf (GitHub: libbpf/libbpf) — the user-space library for loading and interacting with eBPF programs
- DASH / HLS streaming standards — the ABR protocol frameworks eBandit's heuristics plug into
- Mahimahi network emulator — the synthetic trace tool used for adversarial testing in this paper
Private Watchlist
- Fastly — edge cloud with programmable infrastructure relevant to kernel-level delivery optimization
- Conviva — streaming analytics company focused on QoE measurement
- Mux — video infrastructure startup with deep ABR and metrics tooling
Resources
The Paper
User-space Adaptive Bitrate (ABR) algorithms cannot see the transport layer signals that matter most, such as minimum RTT and instantaneous delivery rate, and they respond to network changes only after damage has already propagated to the playout buffer. We present eBandit, a framework that relocates both network monitoring and ABR algorithm selection into the Linux kernel using eBPF. A lightweight epsilon-greedy Multi-Armed Bandit (MAB) runs inside a sockops program, evaluating three ABR heuristics against a reward derived from live TCP metrics. On an adversarial synthetic trace eBandit achieves $416.3 \pm 4.9$ cumulative QoE, outperforming the best static heuristic by $7.2\%$. On 42 real-world sessions eBandit achieves a mean QoE per chunk of $1.241$, the highest across all policies, demonstrating that kernel-resident bandit learning transfers to heterogeneous mobile conditions.