Traffic detection method, device, equipment and medium

Abstract

Embodiments of the present disclosure relate to a traffic detection method, device, equipment and medium, wherein the method comprises: in response to a call request for a preset traffic statistics function in a kernel space, obtaining a first process identifier and corresponding current consumed traffic of the traffic statistics function; calling a query interface of a preset network packet filtering eBPF module, and querying whether the first process identifier is contained according to a preset correspondence relationship in a preset virtual file system; if the first process identifier is contained, querying and obtaining the historical total consumed traffic corresponding to the first process identifier in the correspondence relationship through the query interface; calculating the sum of the historical total consumed traffic and the current consumed traffic to obtain the current total consumed traffic, and calling a write interface of the eBPF module to write the historical total consumed traffic of the correspondence relationship as the current total consumed traffic. In the embodiments of the present disclosure, the current total consumed traffic can be counted with process as granularity, thereby the accuracy of traffic statistics can be improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and particularly relates to a traffic detection method and device, equipment and medium. BACKGROUND

[0002] With the development of computer technology, the types of applications are increasingly diversified, and it is relatively common to facilitate the management of applications and to count the traffic consumption of applications.

[0003] In the related art, the running time of each application is obtained, and the average network speed corresponding to the running time is obtained. The product of the average network speed and the running time is used to determine the consumption traffic of each application.

[0004] However, in the above-mentioned method of counting the consumption traffic based on the product of the running time and the average network speed of the application, since multiple applications may use network resources at the same time, and the real-time network speed of the application is different from the average network speed, the accuracy of traffic counting is low. SUMMARY

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a traffic detection method, device, equipment and medium.

[0006] In a first aspect, the present disclosure provides a traffic detection method, which comprises:

[0007] In response to a call request for a preset traffic counting function in a kernel space, obtaining a first process identifier and a corresponding current consumption traffic of calling the traffic counting function;

[0008] Calling a query interface of a preset network packet filtering eBPF module, and querying whether the first process identifier is included according to a preset correspondence relationship in a preset virtual file system;

[0009] If the first process identifier is included, the historical total consumption traffic corresponding to the first process identifier is obtained in the correspondence relationship through the query interface;

[0010] The sum of the historical total consumption traffic and the current consumption traffic is calculated to obtain a current total consumption traffic, and the write interface of the eBPF module is called to write the historical total consumption traffic of the correspondence relationship as the current total consumption traffic.

[0011] In an optional implementation, before the correspondence relationship is queried according to the preset correspondence relationship in the preset virtual file system, the method further comprises:

[0012] When a system satisfies a preset traffic counting condition, obtaining a shared application identifier in the system;

[0013] obtain all process identifiers corresponding to the shared application identifier, and obtain an initial total consumed traffic value corresponding to each of the process identifiers;

[0014] write a corresponding relationship between each of the process identifiers and the corresponding initial total consumed traffic value in the preset virtual file system.

[0015] In an optional implementation, the obtaining of the first process identifier and the corresponding current consumed traffic of the traffic statistics function includes:

[0016] obtaining a process data structure of a process calling the traffic statistics function;

[0017] obtaining the first process identifier according to the process data structure;

[0018] obtaining the current consumed traffic according to the first process identifier.

[0019] In an optional implementation, the obtaining of the first process identifier according to the process data structure includes:

[0020] extracting a process name of a process name field in the process data structure to obtain the first process identifier; or

[0021] extracting a process identification number in the process data structure, and reading the first process identifier corresponding to the process identification number in the process data structure.

[0022] In an optional implementation, the method further includes:

[0023] obtaining a calling time corresponding to the calling request;

[0024] storing the calling time corresponding to the current total consumed traffic in the corresponding relationship.

[0025] In an optional implementation, the method further includes:

[0026] obtaining at least one second process identifier corresponding to a target application identifier in response to a traffic consumption query request carrying the target application identifier;

[0027] calling the query interface to query whether the at least one second process identifier is included according to a preset corresponding relationship in a preset virtual file system;

[0028] if the at least one second process identifier is included, querying the current total consumed traffic of each of the second process identifiers by querying the corresponding relationship through the query interface;

[0029] The at least one second process identifier corresponding to the sum of all the current total consumption flows is calculated to obtain the flow consumption value of the target application identifier.

[0030] In a second aspect, the embodiments of the present disclosure further provide a flow detection device, and the device comprises:

[0031] The first obtaining module is configured to, in response to a call request for a preset flow statistics function in a kernel space, obtain a first process identifier and corresponding current consumption flow of the flow statistics function;

[0032] The calling module is configured to call a query interface of a preset network packet filtering eBPF module, and query whether the first process identifier is included according to a preset correspondence relationship in a preset virtual file system;

[0033] The first query module is configured to, if the first process identifier is included, query the historical total consumption flow corresponding to the first process identifier in the correspondence relationship through the query interface;

[0034] The calculating module is configured to calculate the sum of the historical total consumption flow and the current consumption flow to obtain a current total consumption flow, and write the historical total consumption flow of the correspondence relationship into the current total consumption flow through a write interface of the eBPF module.

[0035] In a third aspect, the present disclosure provides a computer readable storage medium, and the computer readable storage medium stores instructions, when the instructions are run on a terminal device, the terminal device implements the method described above.

[0036] In a fourth aspect, the present disclosure provides a device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, when the processor executes the computer program, the method described above is implemented.

[0037] In a fifth aspect, the present disclosure provides a computer program product, and the computer program product comprises computer programs / instructions, when the computer programs / instructions are executed by a processor, the method described above is implemented.

[0038] Compared with the prior art, the technical solutions provided by the embodiments of the present disclosure have the following advantages:

[0039] In this embodiment, the current traffic consumption corresponding to the first process identifier, as statistically analyzed by the traffic statistics function, is obtained. The query interface of the eBPF module is then called to retrieve the historical total traffic consumption corresponding to the first process identifier from the corresponding record in the virtual file system. The sum of these two records is calculated to determine the current total traffic consumption corresponding to the first process identifier. Finally, the write interface of the eBPF module is called to update the historical total traffic consumption based on the current total traffic consumption. This embodiment enables the statistical analysis of the current total traffic consumption at the process level, thereby improving the accuracy of traffic statistics. Furthermore, this method is based on the eBPF module to process the kernel space, resulting in minimal modification to the kernel space and reducing the risk of subsequent maintenance operations damaging the kernel space, as well as reducing the investment required for such operations. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0041] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A flowchart illustrating a flow detection method provided for implementation of this disclosure;

[0043] Figure 2 A schematic diagram illustrating the interaction between user space and kernel space based on an eBPF module provided for this disclosure implementation;

[0044] Figure 3 A flowchart illustrating another flow detection method provided for implementation of this disclosure;

[0045] Figure 4 A flowchart illustrating yet another flow detection method provided for implementation of this disclosure;

[0046] Figure 5 This is a schematic diagram of the structure of a flow detection device provided in an embodiment of the present disclosure;

[0047] Figure 6 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this disclosure. Detailed Implementation

[0048] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0049] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0050] Figure 1 This is a flowchart illustrating a traffic detection method provided in an embodiment of the present disclosure. The method can be executed by a traffic detection device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device, such as... Figure 1 As shown, the flow detection method provided in this embodiment includes:

[0051] Step 101: In response to a call request to a pre-defined traffic statistics function in the kernel space, obtain the identifier of the first process that called the traffic statistics function and the corresponding current traffic consumption.

[0052] In this embodiment, traffic refers to the data traffic generated by accessing the Internet or using related data value-added services through mobile communication technologies such as HSDPA (High Speed ​​Downlink Packet Access) and LTE (Long Term Evolution).

[0053] In actual execution, when a process has traffic requirements, it will call the traffic statistics function to count the traffic. Therefore, in order to count the traffic consumed by the relevant process in a timely manner, the traffic statistics function called by the process when using traffic is pre-set, such as bpf_traffic_account.

[0054] In this embodiment, in response to a call request to a preset traffic statistics function in the kernel space, the first process identifier that calls the traffic statistics function and the corresponding current traffic consumption are obtained. The first process identifier can be any unique identifier of a process, such as the process name, process ID, PID, etc.

[0055] In some possible embodiments, the execution logic of the corresponding traffic statistics function is increased to obtain the corresponding first process identifier and the corresponding current consumed traffic. For example, the logic can be added in the bpf_traffic_account and the like traffic statistics function in system / netd / bpf_progs / netd.c.

[0056] Therefore, in the embodiment, the current consumed traffic value is obtained based on the process granularity. Since one application contains multiple processes, the traffic value consumed by the corresponding application can be accurately determined based on the process, thereby providing technical support for determining the traffic consumption value of the application.

[0057] It should be noted that in different application scenarios, the manner of obtaining the first process identifier and the corresponding current consumed traffic of the traffic statistics function is different. For example, in an embodiment of the present disclosure, the process data structure of the traffic statistics function is obtained. Since each process has a unique corresponding process data structure in the kernel space, the process data structure of the traffic statistics function is obtained in the kernel space, and the first process identifier is obtained based on the process data structure.

[0058] For example, the process name in the process name field of the process data structure is extracted to obtain the first process identifier. In the example, when the logic added in the bpf_traffic_account and the like traffic statistics function is charname

[256] =bpf_get_socket_name(skb) logic, the process data structure tast_struct structure of the traffic statistics function can be obtained in the eBPF module based on the logic, and the comm field in the process data structure is extracted as the value of “skb” in the above execution logic, and the corresponding first process identifier is returned by bpf_get_socket_name.

[0059] For example, the process identifier in the process data structure is extracted, and the first process identifier corresponding to the process identifier is read in the process data structure. In the example, the process identifier pid in the process data structure tast_struct is extracted, and the corresponding first process identifier is obtained based on proc / pid / status or proc / pid / cmdline and the like.

[0060] Further, after the corresponding first process identifier is obtained, the current consumed traffic corresponding to the first process identifier is obtained. The current consumed traffic can be implemented based on the source code in the kernel space, for example, based on the statistics in the bpf_traffic_account interface.

[0061] At step 102, a query interface of a preset network packet filtering eBPF module is invoked to query whether the first process identifier is included according to a preset corresponding relationship in a preset virtual file system.

[0062] As shown in the embodiments of the present disclosure, data interaction between the kernel space and the user space can be implemented through an eBPF (extended Berkeley Packet Filter) module. Specifically, high-level language code for implementing traffic statistics can be written in the user space. After the high-level language code is converted into bytecode in the user space, the bytecode is transmitted to the eBPF module in the kernel space. The eBPF module can generate machine code corresponding to the bytecode and associate the machine code with a traffic statistics function. When a process consumes traffic, the kernel invokes the traffic statistics function and implements the traffic statistics function corresponding to the high-level language code. Figure 2 In the embodiments, the eBPF module is used to implement the statistics and detection of traffic. As shown in

[0063] Figure 2 The eBPF module can include the kernel space and the user space. Without changing the source code of the kernel space, the eBPF module supports the writing and reading of data between the kernel space and the user space in both directions.

[0064] Therefore, in the embodiments, in order to implement the traffic usage under the user space and perform the statistics on the traffic in the kernel space in the granularity of a process, a corresponding relationship between a process identifier and a total consumed traffic value is established in the user space in advance according to a standard interface of the eBPF module. The eBPF module can run the corresponding relationship written by the user space as a virtual machine based on the corresponding relationship. The eBPF module interacts with the kernel space based on the relevant interface and obtains a first process identifier and a corresponding current consumed traffic value counted by a traffic statistics function based on the relevant kernel source code. Thus, the total consumed traffic value in the corresponding relationship is updated based on the current consumed traffic value.

[0065] Further, the eBPF module can implement the communication between the user space and the kernel space through a virtual file system (for example, the Maps system in Figure 2 In response to a query request for traffic based on the relevant eBPF interface in the user space, the corresponding total traffic consumption value is transmitted from the kernel space to the user space via the virtual file system. The entire process has a small modification on the source code of the kernel space. In addition to the traffic statistics of the original traffic statistics function, a set of statistical logic for recording the traffic consumption of an application in the granularity of a process of the application is added. The kernel space is not invasive, and the risk and investment caused by subsequent maintenance are avoided.

[0066] ​Therefore, in the embodiment, in order to realize the process granularity-based traffic statistics based on the eBPF module as described above, the process identifier and the corresponding total traffic consumption value are mapped to the eBPF module in advance. In addition to facilitating process granularity-based traffic consumption management, the process granularity-based traffic consumption statistics also provide technical support for traffic consumption statistics of each application in multiple applications sharing the same application identifier. For example, based on the correspondence, the corresponding process identifier of each application corresponding to the shared application identifier can be obtained, and the total traffic consumption value of each application corresponding to the shared application identifier can be obtained based on the sum of the total consumption traffic corresponding to all process identifiers, thereby realizing traffic statistics of a single application.

[0067] Therefore, in the embodiment, based on the correspondence between the process identifier of the shared application and the corresponding total consumption traffic value mapped in the eBPF module, how to realize the mapping of the correspondence between the user space and the kernel control is described.

[0068] In the embodiment, as shown in Figure 3 Before the first process identifier is queried according to the preset correspondence in the preset virtual file system, the method further includes:

[0069] In step 301, when the system meets the preset traffic statistics condition, the shared application identifier in the system is obtained.

[0070] The shared application identifier can be a specific UID value, for example, 1000, and the shared application identifier can be shared by multiple applications. Therefore, based on the shared application identifier, the total traffic consumption value of a single application cannot be realized for the multiple applications sharing the shared application identifier.

[0071] It should be noted that, in order to traverse the corresponding shared application identifier, the shared application identifier in the system can be obtained when the system meets the preset traffic statistics condition. In some possible embodiments, when it is detected that the system is activated for the first time, it is considered that the preset traffic statistics condition is met, and the shared application identifier in the system is obtained. In other possible embodiments, in order to avoid the addition or update of the shared application after the system is started for the first time, when it is detected that there is a new application program installation or uninstallation, it is considered that the preset traffic statistics condition is met, and the shared application identifier in the system is obtained.

[0072] In step 302, all process identifiers corresponding to the shared application identifier are obtained, and an initial total consumption traffic value corresponding to each process identifier is obtained.

[0073] In this embodiment, all process identifiers corresponding to the shared application identifier are obtained. These process identifiers can be obtained based on experimental data statistics or pre-calibrated. The initial total traffic consumption value corresponding to each process identifier is obtained. The initial total traffic consumption value can be 0 or set to other values ​​as needed, which is not limited here.

[0074] Step 303: Write the correspondence between each process identifier and the corresponding initial total traffic consumption value into the preset virtual file system.

[0075] In this embodiment, in order to achieve process-level traffic statistics based on the eBPF module, the correspondence between each process identifier and its corresponding initial total traffic consumption value is written into a preset virtual file system.

[0076] For example, when the virtual file system is in the proc file, the path for saving and persisting in the proc file system is determined based on the eBPF standard: SHARED_UID_TRAFFIC_PATH: " / sys / fs / bpf / map_netd_shareuid_traffic_count". This path stores the correspondence between each process identifier and its corresponding initial total traffic consumption value. / sys / fs / bpf / is specified by the eBPF standard and can be used to query the correspondence through the eBPF standard interface. map_netd_shareuid_traffic_count is a custom name.

[0077] In this embodiment, a custom data structure stores the correspondence in the virtual file system of the eBPF module and creates a mapping in the kernel space. Thus, the custom data structure can realize the agreed communication data structure between the kernel space and the user space, realizing the saving of the correspondence in the kernel space and the transmission to the user space.

[0078] For example, you can use n in the SharedUidTrafficCountValue data structure. a The me field represents the process identifier, and the value field represents the corresponding total traffic consumption value.

[0079] One possible code for the SharedUidTrafficCountValue data structure is:

[0080] typedef struct{

[0081] / / process name(pkg name). / / process identifier

[0082] char name[MAX_LEN]

[0083] / / traffic account.

[0084] uint32_t value; / / total consumed traffic value

[0085] }SharedUidTrafficCountValue;

[0086] User space can call the eBPF-based query interface syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));

[0087] mSharedUidTrafficCountMap.init(SHARED_UID_TRAFFIC_PATH) to call BpfMap<uint32_t, SharedUidTrafficCountValue> mSharedUidTrafficCountMap GUARDED_BY(mMutex) corresponding to the corresponding relationship.

[0088] In actual execution, in order to accurately count the total consumed traffic to the corresponding shared application, all process identifications of the shared application identification can be written from the user space of the upper layer to the kernel space.

[0089] Based on the above SharedUidTrafficCountValue data structure, the application process name identification list of the shared UID is queried through the Android interface of the upper layer (for the system application of the shared UID 1000, the process identification is known and can be counted), and through the eBPF system call, the corresponding relationship is written when the system meets the preset traffic statistics condition.

[0090] Further, in the present embodiment, since the corresponding relationship between the process identification and the initial total consumed traffic has been mapped and stored in the eBPF module, the query interface of the preset network packet filtering eBPF module is called, and it is inquired whether the first process identification is included according to the preset corresponding relationship in the preset virtual file system, if the first process identification is included, the traffic is counted based on the newly added logic in the present embodiment, so as to ensure the accuracy of the total traffic consumption value.

[0091] For example, if the first process identifier is A, the query interface of the eBPF module, that is, the bpf query interface, can be called, and based on the bpf_shared_uid_traffic_map_lookup_elem(A) function, it is determined whether the first process identifier A belongs to the preset corresponding relationship according to whether the return value of the function is a preset value. If it belongs to the preset value, it is determined that the first process identifier A belongs to the preset corresponding relationship.

[0092] In step 103, if the first process identifier is included, the corresponding historical total consumption traffic of the first process identifier is obtained in the corresponding relationship through the query interface.

[0093] In the present embodiment, the corresponding relationship between the process identifier and the historical total consumption traffic is recorded in the preset virtual file system, so that the virtual file system can be queried according to the first process identifier of the first process, thereby determining the corresponding historical total consumption traffic of the process. If it is the first time for the first process identifier to consume traffic, the corresponding historical total consumption traffic is the initial total consumption traffic.

[0094] If the first process identifier is not included, the user can be prompted by an exception prompt information that the process identifier does not exist in the virtual file system, so as to record the total consumption traffic by other original methods.

[0095] In step 104, the sum of the historical total consumption traffic and the current consumption traffic is calculated to obtain the current total consumption traffic, and the write interface of the eBPF module is called to write the historical total consumption traffic of the corresponding relationship as the current total consumption traffic.

[0096] After obtaining the historical total consumption traffic and the current consumption traffic of the first process, the sum of the two can be calculated, and the sum is taken as the current total consumption traffic of the first process. Then, the historical total consumption traffic in the corresponding relationship of the virtual file system is updated according to the current total consumption traffic. The update can be realized by calling the write interface of the eBPF module, which specifically includes: through the write interface of the eBPF module, for example, through the bpf_shared_uid_traffic_map_update_elem(A, value) function, the historical total consumption traffic corresponding to the first process identifier in the virtual file system is updated according to the first process identifier, and the historical total consumption traffic is written as the current total consumption traffic, wherein (A, value) is the value of the corresponding relationship saved in the virtual file system.

[0097] Correspondingly, in the user space, the query interface can be called by the eBPF module to obtain the corresponding current total consumption traffic.

[0098] To sum up, the flow detection method in the embodiment of the present disclosure obtains the current consumption flow corresponding to the first process identifier counted by the flow counting function, calls the query interface of the eBPF module, obtains the historical total consumption flow corresponding to the first process identifier recorded in the corresponding relationship in the virtual file system, calculates the sum of the two, determines the current total consumption flow corresponding to the first process identifier, and calls the write interface of the eBPF module to update the historical total consumption flow based on the current total consumption flow. The embodiment of the present disclosure can count the current total consumption flow with process granularity, thereby improving the accuracy of flow counting, and the method is based on the eBPF module to process the kernel space, thereby reducing the modification of the kernel space and reducing the risk of damaging the kernel space in subsequent maintenance and other operations, and reducing the input of subsequent maintenance and other operations.

[0099] Based on the above embodiment, the eBPF module based on the kernel space realizes the mapping storage of the first process identifier and the corresponding total flow consumption value, and the flow counting of a single application can be realized in the user space.

[0100] In one embodiment of the present disclosure, as shown in Figure 4 The method further comprises:

[0101] Step 401, in response to a flow consumption query request carrying a target application identifier, obtaining at least one second process identifier corresponding to the target application identifier.

[0102] In this embodiment, the user space can pass in the application process identifier through the bpf standard query interface, so as to obtain the flow consumed by a single application, etc. When the shared application identifier is passed in, the total flow consumption value of a single application in the shared application can be obtained.

[0103] In this embodiment, in response to a flow consumption query request carrying a target application identifier, at least one second process identifier corresponding to the target application identifier is obtained, and the second process identifier is the process identifier of all processes of a single application corresponding to the target application identifier.

[0104] Step 402, calling the query interface to query whether the at least one second process identifier is contained according to the preset corresponding relationship in the preset virtual file system.

[0105] In this embodiment, the query interface in the eBPF is called to query whether the at least one second process identifier is contained according to the preset corresponding relationship in the preset virtual file system. That is, it is judged whether the target application identifier corresponds to the process identifier stored in the eBPF module.

[0106] Step 403, if the at least one second process identifier is contained, the current total consumption flow of each second process identifier is obtained through the query interface according to the corresponding relationship.

[0107] In the embodiment, if the at least one second process identifier is contained, the current total consumption traffic of each second process identifier is obtained by querying the correspondence through the querying interface. For example, if the second process identifier is B, the current total consumption traffic of the corresponding second process identifier is obtained by querying the correspondence through the bpf_shared_uid_traffic_map_lookup_elem(B) querying interface.

[0108] In step 404, the sum of all current total consumption traffics corresponding to the at least one second process identifier is calculated to obtain the traffic consumption value of the target application identifier.

[0109] In the embodiment, the sum of all current total consumption traffics corresponding to the at least one second process identifier is calculated to obtain the traffic consumption value of the target application identifier, and when the target application identifier is a shared application identifier, the total consumption traffic of a single application of the shared application is realized.

[0110] In another embodiment of the present disclosure, in order to further meet the traffic statistics requirement, when the first process identifier and the current total consumption traffic are stored in the eBPF module in the kernel space, the calling time corresponding to the calling request of the first process identifier to the preset traffic statistics function is obtained, and the calling time corresponding to the current total consumption traffic is stored in the correspondence.

[0111] Therefore, in the embodiment, in response to the traffic consumption query request carrying the target application identifier and the traffic use time, the at least one second process identifier corresponding to the target application identifier is obtained, the querying interface is called, whether the at least one second process identifier is contained is queried according to the preset correspondence in the preset virtual file system, if the at least one second process identifier is contained, the current total consumption traffic matched with each second process identifier and the corresponding traffic use time is obtained by querying the correspondence through the querying interface, and then the sum of all current total consumption traffics corresponding to the at least one second process identifier is calculated to obtain the traffic consumption value of the target application identifier.

[0112] In summary, the traffic detection method of the embodiment of the present disclosure realizes the statistics of the consumption traffic value of any related single application based on the total consumption traffic value of all processes of the related application queried based on the interface of the eBPF and the sum of the total consumption traffic values of all processes contained by the application.

[0113] Figure 5 A structural schematic diagram of a traffic detection device provided by the embodiment of the present disclosure is shown in FIG. 5. The device can be realized by software and / or hardware, and can be integrated in a terminal device. As shown in the figure, the device 500 includes: Figure 5

[0114] ​The first obtaining module 501 is configured to, in response to a calling request for a preset traffic statistics function in a kernel space, obtain a first process identifier and corresponding current consumed traffic of a process that calls the traffic statistics function.

[0115] The calling module 502 is configured to call a query interface of a preset network packet filtering eBPF module, and query whether the first process identifier is included according to a preset correspondence relationship in a preset virtual file system.

[0116] The first query module 503 is configured to, if the first process identifier is included, query and obtain historical total consumed traffic corresponding to the first process identifier in the correspondence relationship through the query interface.

[0117] The calculating module 504 is configured to calculate a current total consumed traffic by summing up the historical total consumed traffic and the current consumed traffic, and write the historical total consumed traffic of the correspondence relationship into the current total consumed traffic by calling a write interface of the eBPF module.

[0118] Optionally, the apparatus further includes:

[0119] The second obtaining module is configured to, when a system satisfies a preset traffic statistics condition, obtain a shared application identifier in the system.

[0120] The third obtaining module is configured to obtain all process identifiers corresponding to the shared application identifier, and obtain an initial total consumed traffic value corresponding to each process identifier.

[0121] The writing module is configured to write a correspondence relationship between each process identifier and the corresponding initial total consumed traffic value in the preset virtual file system.

[0122] Optionally, the first obtaining module includes:

[0123] The first obtaining unit is configured to obtain a process data structure of the process that calls the traffic statistics function.

[0124] The second obtaining unit is configured to obtain the first process identifier according to the process data structure.

[0125] The third obtaining unit is configured to obtain the current consumed traffic according to the first process identifier.

[0126] Optionally, the second obtaining unit is configured to:

[0127] extract a process name of a process name field in the process data structure to obtain the first process identifier; or

[0128] extract a process identification number in the process data structure, and read the first process identifier corresponding to the process identification number in the process data structure.

[0129] Optionally, the apparatus further comprises:

[0130] a fourth obtaining module configured to obtain a calling time corresponding to the calling request;

[0131] a storage module configured to store the calling time corresponding to the current total consumed traffic in association with the corresponding relationship.

[0132] Optionally, the apparatus further comprises:

[0133] a fifth obtaining module configured to obtain at least one second process identifier corresponding to a target application identifier in response to a traffic consumption query request carrying the target application identifier;

[0134] a second querying module configured to call the querying interface and query whether the at least one second process identifier is contained according to a preset corresponding relationship in a preset virtual file system;

[0135] a third querying module configured to, if the at least one second process identifier is contained, query the corresponding relationship through the querying interface to obtain a current total consumed traffic of each second process identifier;

[0136] a sixth obtaining module configured to calculate a sum of all the current total consumed traffics corresponding to the at least one second process identifier to obtain a traffic consumption value of the target application identifier.

[0137] The traffic detection apparatus provided by the embodiments of the present disclosure can execute the traffic detection method provided by any of the embodiments of the present disclosure, and has the corresponding function modules and beneficial effects of the execution method.

[0138] The embodiments of the present disclosure further provide a computer program product, which comprises computer programs / instructions, and the computer programs / instructions are executed by a processor to implement the traffic detection method provided by any of the embodiments of the present disclosure.

[0139] Figure 6 A structural schematic diagram of a terminal device provided by the embodiments of the present disclosure is provided.

[0140] The specific reference is made below Figure 6The diagram illustrates a structural schematic suitable for implementing the terminal device 600 in the embodiments of this disclosure. The terminal device 600 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The terminal device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0141] like Figure 6 As shown, the terminal device 600 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the terminal device 600. The processing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0142] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows terminal device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 A terminal device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0143] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the traffic detection method of embodiments of this disclosure.

[0144] It should be noted that the computer-readable medium described above can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used or used in conjunction with an instruction execution system, apparatus or device. In the disclosure, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained in the computer-readable medium can be transmitted by any suitable medium, including but not limited to a wire, a cable, a RF (radio frequency) or the like, or any suitable combination of the above.

[0145] In some embodiments, the client, server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

[0146] The above computer-readable medium can be contained in the terminal device; or can exist separately without being assembled into the terminal device.

[0147] The computer readable medium described above carries one or more programs, when the one or more programs are executed by the terminal device, the terminal device: in response to a call request for a preset traffic statistics function in a kernel space, obtains a first process identifier of a call traffic statistics function and corresponding current consumed traffic; calls a query interface of a preset network packet filtering eBPF module, and queries whether the first process identifier is contained according to a preset corresponding relationship in a preset virtual file system; if the first process identifier is contained, the historical total consumed traffic corresponding to the first process identifier is queried and obtained in the corresponding relationship through the query interface; the sum of the historical total consumed traffic and the current consumed traffic is calculated to obtain the current total consumed traffic, and the write interface of the eBPF module is called to write the historical total consumed traffic of the corresponding relationship as the current total consumed traffic. In the embodiment of the present disclosure, the current total consumed traffic can be counted with process as granularity, so that the accuracy of traffic statistics can be improved.

[0148] Computer program code for carrying out operations of the present disclosure can be written in one or more programming languages or combinations of languages including object or visual programming languages such as Java, Smalltalk, C++ or conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0149] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts and block diagrams can represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks noted in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or combinations of hardware and software.

[0150] The units described in the embodiments of the present disclosure can be implemented by means of software, or by hardware. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0151] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0152] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0153] It should be noted that, in this document, the terms such as “first” and “second” are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Also, the terms “include”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a process, method, article or device. Without more limitations, an element defined by the phrase “including a…” does not exclude the presence of additional identical elements in the process, method, article or device that includes the element.

[0154] The foregoing is merely illustrative of the various implementations of the present disclosure and the general principles thereof. Numerous modifications can be made to these illustrations, and equivalents can be substituted therefor, without departing from the scope of the present disclosure. The specific embodiments commensurate with the specific application are intended to be illustrative only and not limiting of the scope of the application as set forth in the following claims.

Claims

1. A method of flow detection, characterized by, The method comprises the following steps: In response to a call request for a preset traffic statistics function in a kernel space, obtaining a first process identifier and a corresponding current consumed traffic of the traffic statistics function; Calling a query interface of a preset network packet filtering eBPF module, and querying whether the first process identifier is included according to a preset correspondence in a preset virtual file system; If the first process identifier is included, the historical total consumed traffic corresponding to the first process identifier is obtained by querying the correspondence through the query interface; The sum of the historical total consumed traffic and the current consumed traffic is calculated to obtain a current total consumed traffic, and the write interface of the eBPF module is called to write the historical total consumed traffic of the correspondence as the current total consumed traffic.

2. The method of claim 1, wherein, Before the step of querying whether the first process identifier is included according to the preset correspondence in the preset virtual file system, the method further comprises the following steps: When a system satisfies a preset traffic statistics condition, obtaining a shared application identifier in the system; Obtaining all process identifiers corresponding to the shared application identifier, and obtaining an initial total consumed traffic value corresponding to each process identifier; Writing the correspondence between each process identifier and the corresponding initial total consumed traffic value in the preset virtual file system.

3. The method of claim 1, wherein, The step of obtaining the first process identifier and the corresponding current consumed traffic of the traffic statistics function comprises the following steps: Obtaining a process data structure of the traffic statistics function; Obtaining the first process identifier according to the process data structure; Obtaining the current consumed traffic according to the first process identifier.

4. The method of claim 3, wherein, The step of obtaining the first process identifier according to the process data structure comprises the following steps: Extracting a process name in a process name field of the process data structure to obtain the first process identifier; or Extracting a process identification number in the process data structure, and reading the first process identifier corresponding to the process identification number in the process data structure.

5. The method of claim 1, wherein, The method further comprises the following steps: Obtaining a call time corresponding to the call request; Storing the call time corresponding to the current total consumed traffic in the correspondence.

6. The method of claim 1, wherein, The method further comprises the following steps: In response to a traffic consumption query request carrying a target application identifier, obtaining at least one second process identifier corresponding to the target application identifier; Calling the query interface, and querying whether the at least one second process identifier is included according to the preset correspondence in the preset virtual file system; If the at least one second process identifier is included, the current total consumed traffic of each second process identifier is obtained by querying the correspondence through the query interface; The sum of all current total consumed traffics corresponding to the at least one second process identifier is calculated to obtain a traffic consumption value of the target application identifier.

7. A flow detection device, characterized by The method comprises the following steps: A first obtaining module is configured to obtain a first process identifier and a corresponding current consumed traffic of a traffic statistics function in response to a call request for the traffic statistics function in a kernel space; A calling module is configured to call a query interface of a preset network packet filtering eBPF module, and query whether the first process identifier is included according to a preset correspondence in a preset virtual file system; The first query module is configured to, if the first process identifier is included, query the corresponding relationship through the query interface to obtain a historical total consumption flow corresponding to the first process identifier; The calculation module is configured to calculate a sum of the historical total consumption flow and the current consumption flow to obtain a current total consumption flow, and write the historical total consumption flow of the corresponding relationship as the current total consumption flow by calling a write interface of the eBPF module.

8. An electronic device, comprising: The electronic device comprises: a processor; a memory for storing executable instructions of the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the flow detection method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, and when the instructions run on the terminal device, the terminal device implements the flow detection method of any one of claims 1-6.

10. A computer program product, characterised in that, The computer program product comprises computer programs / instructions, and the computer programs / instructions are executed by the processor to implement the flow detection method of any one of claims 1-6.

Images