Process tracking method and device, equipment and storage medium

Abstract

The invention relates to the technical field of processes, and discloses a process tracking method, device and equipment and a storage medium, the method comprises the following steps: responding to any process of an application program to enter a system call, triggering a first tracking point, and obtaining a system call number; based on the first tracking point and the system call number, collecting first information that the process enters system call; in response to the process exiting the system call, triggering a second tracking point; based on the second tracking point, collecting second information that the process quits the system call; a process of the application is tracked based on the first information and the second information. By comparing the information before and after the system calling, the change before and after the system calling can be accurately detected, the comprehensive tracking of the system calling process of the process is realized, the safety of the system is enhanced, and meanwhile, when the system is abnormal or has a safety problem, the reason of the problem can be quickly positioned through the records, so that the safety of the system is improved. And troubleshooting and repairing are facilitated.

Description

Technical Field

[0001] The present invention relates to the field of process technology, and in particular to a process tracking method, device, equipment and storage medium. Background Art

[0002] System calls are the main way for processes to interact with the operating system kernel. By tracking the process of a process making a system call, the changes before and after the system call can be clearly identified to ensure the security of the operating system. Taking process capabilities as an example, in the Linux capability system, system permissions are allocated into multiple different capability sets, such as inherited capabilities (Inheritable set), permitted capabilities (Permitted set), effective capabilities (Effective set), bound capabilities (Bounding set) and ambient capabilities (Ambient set). Each capability set controls the permissions of the process in different situations. These capabilities may change before and after the process makes a system call, causing it to be able to perform operations that should not be allowed, thereby causing security issues. Therefore, how to track the process of a process making a system call to improve the security of the system is a problem that needs to be solved. Summary of the invention

[0003] In view of this, the present invention provides a process tracking method, device, equipment and storage medium to solve the problem that it is impossible to clearly identify the changes caused by a process before and after a system call, thereby affecting system security.

[0004] In a first aspect, the present invention provides a process tracking method, the method comprising:

[0005] In response to any process of the application program entering a system call, a first tracking point is triggered, and a system call number is obtained, where the system call number is used to distinguish the type of the system call;

[0006] Based on the first tracking point and the system call number, first information of the process entering the system call is collected, the first information including the application layer stack, the passed parameters and the process capabilities at the time of entry;

[0007] In response to the process exiting the system call, triggering a second tracking point;

[0008] Based on the second tracking point, collecting second information of the process exiting the system call, the second information including the system call return value and the process capability at the exit time;

[0009] Based on the first information and the second information, a progress of the application is tracked.

[0010] The process tracking method provided by the embodiment of the present invention triggers a first tracking point to collect first information when any process of the application enters a system call, and triggers a second tracking point to collect second information when the process exits the system call. By comparing the information before and after the system call, the changes before and after the system call can be accurately detected, thereby achieving comprehensive tracking of the process of the system call and enhancing the security of the system. At the same time, when the system has an abnormality or security problem, the cause of the problem can be quickly located through these records, which is convenient for troubleshooting and repair.

[0011] In an optional implementation, after collecting first information of a process entering a system call based on the first tracking point and the system call number, the method further includes:

[0012] Determine whether the key-value pair with the process ID of the process as the key exists in the kernel layer hash table;

[0013] When the key-value pair with the process identifier of the process as the key does not exist in the kernel layer hash table, a key-value pair of the process is created in the kernel layer hash table, and the first information is stored in the key-value pair.

[0014] The process tracking method provided by an embodiment of the present invention determines whether a key-value pair of the process is stored in a kernel layer hash table based on the process identifier of the process, thereby creating a process without a key-value pair, and storing the first information in the hash table in the form of a key-value pair, making the data more structured and organized, while supporting dynamic management.

[0015] In an optional implementation, after determining whether a key-value pair with a process identifier of the process as a key exists in the kernel layer hash table, the method further includes:

[0016] When a key-value pair using the process identifier of the process as a key exists in the kernel layer hash table, the key-value pair of the process is updated, and the first information is stored in the key-value pair.

[0017] The process tracking method provided by the embodiment of the present invention realizes timely storage of data, optimizes resource management, and supports dynamic management by updating the key-value pair corresponding to the process based on the first information when the kernel layer hash table already has the key-value pair.

[0018] In an optional implementation, after collecting first information of a process entering a system call based on the first tracking point and the system call number, the method further includes:

[0019] The tracking storage information is sent to the user layer, where the tracking storage information is used to instruct the user layer to store the first information in the user layer hash table.

[0020] The process tracking method provided by the embodiment of the present invention sends tracking storage information to the user layer, so that the user layer can store the first information in the user layer hash table, so that the system call information of the related process can be quickly found from the user layer hash table, helping to quickly locate the problem.

[0021] In an optional embodiment, the method further includes:

[0022] In response to the process ending, triggering a third tracking point;

[0023] Based on the third tracking point, clearing information is sent to the user layer, where the clearing information is used to instruct the user layer to clear the key-value pair with the process identifier of the process as the key from the user layer hash table.

[0024] The process tracking method provided by the embodiment of the present invention triggers the third tracking point when the process ends to send a clearing message to the user layer, thereby clearing the key-value pairs corresponding to the process from the user layer hash table, releasing occupied memory resources, avoiding resource waste, ensuring that data that is no longer used is cleared in a timely manner, preventing memory leaks, and maintaining efficient operation of the system.

[0025] In an optional implementation, tracking the process of the application based on the first information and the second information includes:

[0026] Determine a change in the process's capabilities based on the process capabilities at the entry time in the first information and the process capabilities at the exit time in the second information;

[0027] Determine a function call status of the process based on the application layer stack in the first information;

[0028] Based on the passed parameters in the first information and the system call return value in the second information, the system call status of the process is determined.

[0029] The process tracking method provided by the embodiment of the present invention can accurately monitor the changes in the capabilities of the process before and after the system call by comparing the process capabilities at the entry time and the exit time, which is helpful to timely discover and prevent the abuse of permissions. By analyzing the application layer stack, the function call status of the process during the system call can be understood in detail, thereby improving the performance and stability of the program. By analyzing the passed parameters and the system call return value, the system call behavior of the process can be fully understood, which helps to detect potential security vulnerabilities and performance bottlenecks. By comprehensively tracking the capability changes, function calls and system calls of the process, the security of the system is significantly improved.

[0030] In an optional implementation, after determining the change in the capabilities of the process based on the process capabilities at the entry time in the first information and the process capabilities at the exit time in the second information, the method further includes:

[0031] When the capabilities of the process change, the function when the capabilities of the process change is determined based on the application layer stack in the first information and the system call return value in the second information.

[0032] The process tracking method provided in the embodiment of the present invention can accurately locate which specific function causes the change in process capabilities by analyzing the application layer stack and system call return values, which helps to quickly identify and repair problems in permission management, achieve real-time tracking and response, and reduce potential security risks.

[0033] In a second aspect, the present invention provides a process tracking device, the device comprising:

[0034] A first trigger module is used to trigger a first tracking point in response to any process of the application entering a system call, and obtain a system call number, where the system call number is used to distinguish the type of the system call;

[0035] A first collecting module, used for collecting first information of a process entering a system call based on a first tracking point and a system call number, the first information including an application layer stack, a transfer parameter and a process capability at an entry time;

[0036] A second trigger module, configured to trigger a second tracking point in response to a process exiting a system call;

[0037] A second collection module, used for collecting second information of the process exiting the system call based on the second tracking point, the second information including the system call return value and the process capability at the exit time;

[0038] The tracking module is used to track the process of the application based on the first information and the second information.

[0039] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the process tracking method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the process tracking method of the first aspect or any corresponding embodiment thereof.

[0041] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the process tracking method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a flowchart of a process tracking method according to an embodiment of the present invention;

[0044] Figure 2 is a flowchart of another process tracking method according to an embodiment of the present invention;

[0045] Figure 3 is a structural block diagram of a process tracking device according to an embodiment of the present invention;

[0046] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0048] System calls are the main way for processes to interact with the operating system kernel. By tracking the process of making system calls, the changes before and after the system calls can be clearly identified to ensure the security of the operating system. The process tracking method provided in the embodiment of the present invention triggers a first tracking point to collect first information when any process of the application enters a system call, and triggers a second tracking point to collect second information when the process exits the system call. By comparing the information before and after the system call, the changes before and after the system call can be accurately detected, and the process of making system calls by the process can be fully tracked, thereby enhancing the security of the system. At the same time, when the system has an abnormality or security problem, the cause of the problem can be quickly located through these records, which is convenient for troubleshooting and repair.

[0049] According to an embodiment of the present invention, a process tracking method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0050] In this embodiment, a process tracking method is provided, which can be used in an operating system. Figure 1 is a flow chart of a process tracking method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0051] Step S101, in response to any process of the application entering the system call, trigger the first tracking point, obtain the system call number, and the system call number is used to distinguish the type of system call. Specifically, the first tracking point is the entry point for all applications to execute any system call. Almost all versions of Linux systems support this function, and the first tracking point is a static tracking point. The API (Application Programming Interface) is stable and does not change easily, the performance loss is extremely small, and the impact on business performance is also extremely small. An application may be composed of multiple processes, especially in distributed or concurrent processing scenarios, each process can execute system calls independently. When any process enters any system call, the first tracking point is triggered, and the system call number, that is, the number of the current system call, is obtained. The system call number is a unique identifier used to distinguish different types of system calls, such as file operations, network communications, etc.

[0052] Step S102, based on the first tracking point and the system call number, collect the first information of the process entering the system call, the first information includes the application layer stack, the passed parameters and the process capabilities at the time of entry. Specifically, after the first tracking point is triggered, the processing function of the tracking point is registered. The processing function defines which operations the kernel layer of the operating system should perform when the first tracking point is activated. In the embodiment of the present invention, information is collected by calling the processing function to obtain the first information. Assume that the process executes an open system call, the open system call is used to open a file, and the parameters passed by the system call can be the file name and the opening mode (read-only, read-write, create, etc.). The application layer stack refers to all function call paths from the entry point to the open system call during the execution of the process, and each function call will leave a record in the stack. The following code is part of the application layer stack code and is only an example.

[0053] 0x00007ffff7aecab0 in open64()from / lib64 / libc.so.6

[0054] 0x00005555554023c3 in main()

[0055] The kernel layer of the operating system can capture the call stack 0x00007ffff7aecab0 and the call stack 0x00005555554023c3 in the application layer stack. The call relationship can be obtained through analysis, that is, the open64 function is executed from the main function to enter the open system call. More specifically, the analysis process can be performed in the user layer of the operating system. The user layer obtains the analysis result through analysis and passes it to the kernel layer.

[0056] When collecting the process capabilities at the time of entry, struct task_struct is the core structure used to describe the process in the Linux system kernel, and real_cred is a member of the structure. Since the first tracking point points to the real_cred member of the structtask_struct structure of the current process, the real_cred in the kernel can be obtained through the first tracking point. The real_cred member is the process capabilities when the process enters the open system call.

[0057] Step S103, in response to the process exiting the system call, triggering the second tracking point. Specifically, the tracking point is divided into two tracking points, entry and exit. The first tracking point is the entry tracking point, and the second tracking point is the exit tracking point. The second tracking point is also a static tracking point and has the same performance as the first tracking point. Assuming that the process enters the open system call, the process exits the open system call after execution, and the second tracking point is triggered at this time.

[0058] Step S104, based on the second tracking point, collect the second information of the process exiting the system call, the second information includes the system call return value and the process capabilities at the time of exit. Specifically, referring to step S101, register the processing function of the second tracking point so that the second information is collected by calling the processing function of the second tracking point. The return value of the open system call is obtained when the process exits, which is used to describe whether the open system call is successful. And, referring to the above-mentioned process of collecting the process capabilities at the time of entry through the first tracking point when entering the system call, the process capabilities at the time of exit are collected through the second tracking point when the process exits the system call.

[0059] Step S105, based on the first information and the second information, the process of the application is tracked. Specifically, by comparing the first information at the time of entry and the second information at the time of exit, it can be determined whether various aspects of the process information have changed before and after the execution of the system call, such as whether certain process capabilities have been increased or decreased, function call status, and system call status. For each process of the application, it is necessary to track the changes caused by its entry and exit of the system call separately, so as to fully understand the behavior of the entire application and its security.

[0060] The process tracking method provided by the embodiment of the present invention triggers a first tracking point to collect first information when any process of the application enters a system call, and triggers a second tracking point to collect second information when the process exits the system call. By comparing the information before and after the system call, the changes before and after the system call can be accurately detected, thereby achieving comprehensive tracking of the process of the system call and enhancing the security of the system. At the same time, when the system has an abnormality or security problem, the cause of the problem can be quickly located through these records, which is convenient for troubleshooting and repair.

[0061] In this embodiment, a process tracking method is provided, which can be used in the above-mentioned operating system. Figure 2 FIG. 1 is a flow chart of another process tracking method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0062] Step S201, in response to any process of the application entering a system call, triggering a first tracking point, obtaining a system call number, and the system call number is used to distinguish the type of system call. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0063] Step S202: Based on the first tracking point and the system call number, collect the first information of the process entering the system call, the first information includes the application layer stack, the passed parameters and the process capabilities at the time of entry. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0064] Step S203, determine whether a key-value pair with the process ID of the process as the key exists in the kernel layer hash table. Specifically, each process has a unique identifier for uniquely identifying the process. The kernel layer hash table is a storage structure for key-value pairs, using the key-value format, where the key is the process ID and the value is the stored information. The value is retrieved according to the key, and has the advantage of fast search speed, so as to quickly find and access the process information. When the process enters the system call and obtains the first information, it is determined whether a key-value pair with the process ID of the current process as the key already exists in the kernel layer hash table, so as to determine whether a new key-value pair needs to be created or the existing key-value pair needs to be updated.

[0065] Step S204, when the key-value pair with the process ID of the process as the key does not exist in the kernel layer hash table, create a key-value pair of the process in the kernel layer hash table, and store the first information in the key-value pair. Specifically, if the key-value pair with the current process ID as the key is not found in the kernel layer hash table, it means that this is the first time to record the information of the process. At this time, a new key-value pair is created in the kernel layer hash table, where the key is the process ID of the current process, and the value is used to store the first information related to the system call made by the process.

[0066] Step S205, when a key-value pair with the process ID of the process as the key exists in the kernel layer hash table, the key-value pair of the process is updated, and the first information is stored in the key-value pair. Specifically, if a key-value pair with the current process ID as the key is found in the kernel layer hash table, it means that the information of the process has been recorded before. At this time, the existing key-value pair of the process is updated, and the new first information is overwritten or appended to the existing information to ensure that the kernel layer hash table always stores the latest and most complete information.

[0067] Step S206, sending the tracking storage information to the user layer, the tracking storage information is used to instruct the user layer to store the first information in the user layer hash table. Specifically, since the kernel layer hash table and the user layer hash table are different in terms of location, authority, data type, purpose, performance and security, considering the advantages of performance optimization, flexibility and scalability, security, debugging and maintenance for the operating system, the information can be stored in the kernel layer hash table and then stored again in the user layer. By sending the tracking storage information to the user layer, the user layer can store the first information in the user layer hash table, so that the system call information of the related process can be quickly found from the user layer hash table, helping to quickly locate the problem. More specifically, when storing the first information, the user layer can refer to the above steps S203 to S205, first determine whether there is a key-value pair with the process identifier of the process as the key in the user layer hash table, if it exists, update the key-value pair based on the first information, if it does not exist, create a key-value pair and store the first information. It should be noted that after obtaining the tracking and storage information, the user layer can continue to track and store the information of the process during the system call process, and there is no need to indicate the storage operation through information.

[0068] Step S207, in response to the process exiting the system call, triggering the second tracking point. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0069] Step S208: Based on the second tracking point, collect the second information of the process exiting the system call, the second information includes the system call return value and the process capability at the time of exit. Figure 1Step S104 of the illustrated embodiment will not be described in detail here.

[0070] Step S209: Track the progress of the application based on the first information and the second information.

[0071] Specifically, the above step S209 includes:

[0072] Step S2091, based on the process power at the time of entry in the first information and the process power at the time of exit in the second information, determine the power change of the process. Specifically, the first information is stored in the kernel layer hash table, and the second information is also stored in the kernel layer hash table. When executing step S209, the changes before and after the process system call are tracked based on the first information and the second information stored in the kernel layer hash table. When the process enters the system call, the first information includes the power state at that time. Powers usually include the permission level, privileged mode, etc. of the process. When the process exits the system call, the second information includes the power state at the time of exit. By comparing the process power at the time of entry with the process power at the time of exit, the power change of the process is obtained, and it can be determined whether the process power has changed. The power change can help analyze whether the process has a privilege upgrade or downgrade during the system call, and based on this, the power of the process can be adjusted accordingly to ensure system security.

[0073] Step S2092, when the capabilities of the process change, based on the application layer stack in the first information and the system call return value in the second information, determine the function when the capabilities of the process change. Specifically, if the capabilities of the process change, it can be further analyzed in which function call the change occurs. Since the application layer stack records the function call path of the process when entering the system call, including each function and its parameters, the system call return value is the result value returned by the system call when the process exits the system call, providing the execution result of the system call, helping to determine whether the system call is successful and the specific information returned. More specifically, first obtain the application layer stack information when the process enters the system call from the first information. Then, obtain the system call return value when the process exits the system call from the second information. Then, parse the application layer stack to extract the calling order and parameters of each function. Finally, associate the system call return value with the function call in the application layer stack to determine which function call caused the change in capabilities. By analyzing the application layer stack and system call return values, it is possible to pinpoint which function caused the change in process capabilities, helping to quickly identify and fix problems in permission management, achieve real-time tracking and response, and reduce potential security risks.

[0074] Step S2093, based on the application layer stack in the first information, determine the function call status of the process. Specifically, the application layer stack refers to the state of the application stack when the process enters the system call, and the stack contains each function and its parameters in the call chain. By parsing the information in the application layer stack, the calling order and parameters of each function are extracted to display the calling relationship between each function, which helps to analyze the behavior of the process and understand which functions it calls during the system call, thereby facilitating performance analysis and debugging.

[0075] Step S2094, based on the passed parameters in the first information and the system call return value in the second information, determine the system call status of the process. Specifically, when the process enters the system call, the parameters passed to the system call determine the specific behavior of the system call. By comparing these parameters and the system call return value, analyzing the input and output of the system call, it is helpful to analyze the behavior of the process during the system call and understand its interaction with the operating system, thereby facilitating performance optimization and troubleshooting.

[0076] Step S210, in response to the process ending, triggering a third tracking point. Specifically, when the process terminates in the operating system, the third tracking point is triggered, which is usually achieved through a specific mark or function call in the kernel code. The third tracking point is also a static tracking point.

[0077] Step S211, based on the third tracking point, clearing information is sent to the user layer, and the clearing information is used to instruct the user layer to clear the key-value pair with the process ID of the process as the key from the user layer hash table. Specifically, when the third tracking point is triggered, it means that the process has ended, and no storage resources are needed at this time, so clearing information is sent to the user layer to make the user layer clear the key-value pair with the process ID of the process as the key from the user layer hash table, ensuring that the user layer no longer retains the information of the ended process, releasing the corresponding memory resources, avoiding resource leakage, and maintaining efficient operation of the system.

[0078] The process tracking method provided by the embodiment of the present invention triggers a first tracking point to collect first information when any process of the application enters a system call, and triggers a second tracking point to collect second information when the process exits the system call. By comparing the information before and after the system call, the changes before and after the system call can be accurately detected, thereby achieving comprehensive tracking of the process of the system call and enhancing the security of the system. At the same time, when the system has an abnormality or security problem, the cause of the problem can be quickly located through these records, which is convenient for troubleshooting and repair.

[0079] In this embodiment, a process tracking device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0080] This embodiment provides a process tracking device, such as Figure 3 As shown, including:

[0081] The first trigger module 301 is used to trigger a first tracking point in response to any process of the application entering a system call, and obtain a system call number, where the system call number is used to distinguish the type of the system call.

[0082] The first collecting module 302 is used to collect first information about a process entering a system call based on a first tracking point and a system call number, where the first information includes an application layer stack, transfer parameters, and process capabilities at the time of entry.

[0083] The second trigger module 303 is used to trigger the second tracking point in response to the process exiting the system call.

[0084] The second collecting module 304 is used to collect second information of the process exiting the system call based on the second tracking point, where the second information includes the system call return value and the process capability at the exit time.

[0085] The tracking module 305 is used to track the process of the application based on the first information and the second information.

[0086] In some optional implementations, after the first collection module 302, the device further includes:

[0087] The judgment module is used to judge whether a key-value pair with a process ID of a process as a key exists in a kernel layer hash table.

[0088] The first storage module is used to create a key-value pair of the process in the kernel layer hash table and store the first information in the key-value pair when the key-value pair with the process identifier of the process as the key does not exist in the kernel layer hash table.

[0089] In some optional implementations, after the determination unit, the device further includes:

[0090] The second storage module is used to update the key-value pair of the process and store the first information in the key-value pair when a key-value pair with the process identifier of the process as the key exists in the kernel layer hash table.

[0091] In some optional implementations, after the first collection module 302, the device further includes:

[0092] The third storage module is used to send tracking storage information to the user layer, where the tracking storage information is used to instruct the user layer to store the first information in the user layer hash table.

[0093] In some optional embodiments, the device further comprises:

[0094] The third trigger module is used to trigger the third tracking point in response to the end of the process.

[0095] The first sending module is used to send clearing information to the user layer based on the third tracking point, where the clearing information is used to instruct the user layer to clear the key-value pair with the process identifier of the process as the key from the user layer hash table.

[0096] In some optional implementations, the tracking module 305 includes:

[0097] The first determining unit is used to determine the change of the process's capabilities based on the process capabilities at the entry time in the first information and the process capabilities at the exit time in the second information.

[0098] The second determining unit is used to determine the function calling status of the process based on the application layer stack in the first information.

[0099] The third determining unit is used to determine the system call status of the process based on the transfer parameters in the first information and the system call return value in the second information.

[0100] In some optional implementations, after the first determining unit, the device further includes:

[0101] The determination module is used to determine the function when the capabilities of the process change based on the application layer stack in the first information and the system call return value in the second information when the capabilities of the process change.

[0102] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0103] The process tracking device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0104] The embodiment of the present invention also provides a computer device having the above Figure 3 The process tracking device shown.

[0105] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0106] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0107] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0108] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0110] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0111] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0112] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0113] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A process tracking method, characterized in that: The method comprises: In response to any process of the application program entering a system call, triggering a first tracking point, and obtaining a system call number, wherein the system call number is used to distinguish a type of the system call; Based on the first tracking point and the system call number, collecting first information of the process entering the system call, the first information including an application layer stack, a transfer parameter, and a process capability at an entry time; In response to the process exiting the system call, triggering a second tracking point; Based on the second tracking point, collecting second information of the process exiting the system call, the second information including the system call return value and the process capability at the exit time; Based on the first information and the second information, the progress of the application is tracked.

2. The method according to claim 1, characterized in that: After collecting the first information of the process entering the system call based on the first tracking point and the system call number, the method further includes: Determine whether a key-value pair with the process identifier of the process as the key exists in the kernel layer hash table; When a key-value pair with the process identifier of the process as a key does not exist in the kernel layer hash table, a key-value pair of the process is created in the kernel layer hash table, and the first information is stored in the key-value pair.

3. The method according to claim 2, characterized in that After determining whether a key-value pair with the process identifier of the process as a key exists in the kernel layer hash table, the method further includes: When a key-value pair with the process identifier of the process as the key exists in the kernel layer hash table, the key-value pair of the process is updated, and the first information is stored in the key-value pair.

4. The method according to claim 1, characterized in that After collecting the first information of the process entering the system call based on the first tracking point and the system call number, the method further includes: The tracking storage information is sent to the user layer, where the tracking storage information is used to instruct the user layer to store the first information in a user layer hash table.

5. The method according to claim 4, characterized in that The method further comprises: In response to the process ending, triggering a third tracking point; Based on the third tracking point, clearing information is sent to the user layer, where the clearing information is used to instruct the user layer to clear a key-value pair with the process identifier of the process as a key from the user layer hash table.

6. The method according to claim 1, characterized in that Tracking the process of the application based on the first information and the second information includes: Determine a change in the capabilities of the process based on the process capabilities at the entry time in the first information and the process capabilities at the exit time in the second information; Determine, based on the application layer stack in the first information, a function call status of the process; Based on the passed parameters in the first information and the system call return value in the second information, the system call status of the process is determined.

7. The method according to claim 6, characterized in that After determining the change of the process capabilities based on the process capabilities at the entry time in the first information and the process capabilities at the exit time in the second information, the method further includes: In the case where the capability of the process changes, a function when the capability of the process changes is determined based on the application layer stack in the first information and the system call return value in the second information.

8. A process tracking device, characterized in that: The device comprises: A first trigger module is used to trigger a first tracking point in response to any process of the application entering a system call, and obtain a system call number, wherein the system call number is used to distinguish the type of the system call; A first collecting module, configured to collect first information of the process entering the system call based on the first tracking point and the system call number, wherein the first information includes an application layer stack, transfer parameters, and process capabilities at the time of entry; A second trigger module, configured to trigger a second tracking point in response to the process exiting the system call; A second collecting module, configured to collect second information of the process exiting the system call based on the second tracking point, wherein the second information includes a system call return value and a process capability at the exit time; A tracking module is used to track the process of the application based on the first information and the second information.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the process tracking method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the process tracking method according to any one of claims 1 to 7.

Images