Low-overhead file operation log collection method

Abstract

The invention relates to a low-overhead file operation log collection method. The method comprises the following steps: 1) collecting file operation log information in a kernel by adopting a kernel probe; 2) setting a shared memory for writing information acquired by the kernel probe in a kernel space, and reading the information acquired by the kernel probe from the shared memory by a user space;and 3) reducing the log quantity through a deduplication algorithm, and reducing the log collection overhead. Compared with the prior art, the method has the advantages that file operation information is collected by selecting a kernel probe technology with low overhead, information in the kernel is transmitted to a user layer in a memory sharing mode, and then the log quantity and the system overhead are reduced through an online deduplication algorithm.

Description

technical field [0001] The invention relates to the field of data protection, in particular to a method for collecting file operation logs with low overhead. Background technique [0002] With the rapid development of the Internet, social media, cloud computing, Internet of Things, mobile short video, e-commerce and other fields, the amount of data generated globally every year is growing explosively. The era of big data has arrived, and data has become the most important digital asset in the world. The development of technology has brought great convenience to people's life, such as mobile payment, face recognition, intelligent voice, unmanned supermarket and so on. But at the same time, it also brings people the risk of data leakage. All kinds of data breaches emerge in an endless stream. People's demand for data protection is also increasing. At this stage, 80% of data is stored in files. Recording file operation logs is one of the important measures for data protecti...

AI Technical Summary

Problems solved by technology

[0005] (3) Due to the existence of a large number of redundant logs and logs generated by temporary files in the file operation log, the system log volume is too large and the disk IO overhead is large

Although this method can reduce system overhead, it cannot record all file operations of all users. When a file that has not been logged is leaked, it is impossible to trace the source through the file operation log, find the leaker, and the leaking method

Images