Data flow tracking method, system, storage medium and server

Abstract

The present application provides a data flow tracking method, system, storage medium and server, including: obtaining request data; before responding to the request data, obtaining a function to be called when responding to the request data; based on the function to be called when responding to the request data, determining whether to trigger the execution of a data flow tracking process; if it is determined that the execution of the data flow tracking process is triggered, executing the data flow tracking process to perform data flow tracking on the request data. The present application can reduce the introduction of a large amount of unnecessary tracking logic code, reduce memory usage, thereby reducing performance overhead and improving the efficiency of program operation.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data flow tracking method, system, storage medium and server. Background Art

[0002] Data flow tracking technology is a security technology widely used in the field of information security. In data flow tracking technology, taint analysis can be used to more accurately monitor the information flow of an application during operation, such as tracking whether sensitive data is propagated from a preset taint source to a preset security-sensitive operation point. Taint analysis has been widely used in security research fields such as unknown vulnerability detection, malware analysis, and test case generation.

[0003] In the prior art, if you want to track the behavior of tainted data, in the specific implementation process, the instrumentation code needs to involve almost all data operations, that is, the instrumentation is large-scale. In this case, a large amount of unnecessary tracking logic code will be introduced into the execution of a normal program, occupying a large amount of memory, resulting in a large performance overhead and reduced program running efficiency. Summary of the invention

[0004] The embodiments of the present application provide a data flow tracking method, system, storage medium and server to solve the problem in the prior art that large-scale instrumentation introduces a large amount of unnecessary tracking logic code into the execution of a normal program, occupies a large amount of memory, causes relatively large performance overhead, and reduces program running efficiency.

[0005] A first aspect of the present application provides a data flow tracking method, comprising:

[0006] Get request data;

[0007] Before responding to the request data, obtaining a function to be called when responding to the request data;

[0008] Determine whether to trigger the data flow tracking process based on the function to be called when responding to the request data;

[0009] If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed to perform data flow tracking on the request data.

[0010] A second aspect of the present application provides a data flow tracking system, comprising:

[0011] A data acquisition unit, used for acquiring request data;

[0012] A function determination unit, used for obtaining a function to be called when responding to the request data before responding to the request data;

[0013] A data flow tracking judgment unit, used to determine whether to trigger the execution of a data flow tracking process based on the function to be called when responding to the request data;

[0014] The data flow tracking unit is used to execute the data flow tracking process if it is determined that the data flow tracking process is triggered, and perform data flow tracking on the request data.

[0015] A third aspect of the present application provides a server, the server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0016] Get request data;

[0017] Before responding to the request data, obtaining a function to be called when responding to the request data;

[0018] Determine whether to trigger the data flow tracking process based on the function to be called when responding to the request data;

[0019] If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed to perform data flow tracking on the request data.

[0020] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Get request data;

[0022] Before responding to the request data, obtaining a function to be called when responding to the request data;

[0023] Determine whether to trigger the data flow tracking process based on the function to be called when responding to the request data;

[0024] If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed to perform data flow tracking on the request data.

[0025] A fifth aspect of the present application provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by one or more processors, the following steps are implemented:

[0026] Get request data;

[0027] Before responding to the request data, obtaining a function to be called when responding to the request data;

[0028] Determine whether to trigger the data flow tracking process based on the function to be called when responding to the request data;

[0029] If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed to perform data flow tracking on the request data.

[0030] In an embodiment of the present application, by obtaining request data, before responding to the request data, the function to be called when responding to the request data is obtained, and based on the function to be called when responding to the request data, it is determined whether to trigger the execution of the data flow tracking process. If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed, and data flow tracking is performed on the request data. The data flow tracking process is executed for all function calls, thereby reducing the introduction of a large amount of unnecessary tracking logic code, reducing memory usage, thereby reducing performance overhead, and improving the efficiency of program operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0032] Figure 1 It is a flow chart of the implementation of the data flow tracking method provided in the embodiment of the present application;

[0033] Figure 2 is a schematic flowchart of determining whether to trigger the execution of a data tracking process provided by an embodiment of the present application;

[0034] Figure 3 is a structural block diagram of a data flow tracking system provided in an embodiment of the present application;

[0035] Figure 4 It is a schematic diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, features, and advantages of the invention of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the embodiments described below are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] Figure 1The implementation process of the data flow tracking method provided by the embodiment of the present application is shown, and the method flow includes steps S101 to S104. The specific implementation principle of each step is as follows:

[0038] S101: Obtain request data.

[0039] In an embodiment of the present application, the request data carries tainted data, which refers to data sent by a client or a front-end browser, or data sent by another server after secondary packaging of data sent by a client or a front-end browser. The data considered as tainted data in an HTTP request includes: all request header information, all request body information, and all parameter information carried in the URL.

[0040] S102: Before responding to the request data, obtain a function to be called when responding to the request data.

[0041] Specifically, in the embodiment of the present application, in order to respond to the request data, a function corresponding to processing the request data needs to be called. There may be multiple functions that need to be called when responding to the request data.

[0042] In an embodiment of the present application, a function that may propagate tainted data is determined as a target function in advance, and the tainted function is instrumented to insert a data flow tracking function. Before responding to the request data, a function to be called when responding to the request data is obtained to determine whether the function is a target function. If the function is a target function, the function is instrumented with a data flow tracking function that can execute a data flow tracking process.

[0043] S103: Determine whether to trigger the data flow tracking process based on the function to be called when responding to the request data.

[0044] The above step S103 specifically includes: based on the stage to which the function to be called when responding to the request data belongs, and the data flow tracking trigger condition corresponding to the function of the stage, determine whether to trigger the execution of the data flow tracking process. In a possible implementation, a key function is preset and marked, and the key function is a function set by the user that is prone to vulnerabilities. Determine whether the function to be called when responding to the request data is a key function. If so, determine to trigger the execution of the data flow tracking process. If not, even if the function is plugged with a data flow tracking function, the execution of the data flow tracking process will not be triggered.

[0045] As a possible implementation of the present application, since almost all functions are plugged, if there is no complete and efficient control mechanism, all methods will fall into similar infinite recursion. Similar to infinite recursion, the present application is a possible implementation of the present application, such as Figure 2 As shown, the above S103 specifically includes:

[0046] A1: Obtain the phase to which the function called in response to the request data belongs.

[0047] A2: Call and execute the lock mechanism corresponding to the stage to which the function belongs, where the lock mechanism is pre-stored in the local thread and is used to determine whether to execute the data flow tracking process.

[0048] A3: Determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism.

[0049] In a possible implementation, lock mechanisms corresponding to the stages are set according to functions in different stages, that is, functions belonging to a stage have lock mechanisms corresponding to the stage. In the embodiment of the present application, the stages to which the function called in response to the request data belongs include the source stage, the propagation stage, the label stage, and the precipitation stage. Lock mechanisms are established in advance according to the stages, and the lock mechanisms are distinguished by the stage feature names.

[0050] For the source stage, it is necessary to ensure the uniqueness of the tainted data flow tracking process: other source functions may be called inside this source stage function, and other source functions have also been instrumented. If other source functions called inside the source function can enter the data flow tracking process in the instrumentation logic, then other source functions called inside will also initiate a taint tracking process. In this way, the same tainted data will start two or more taint tracking processes.

[0051] In the propagation phase, the web application will perform logical processing on the data input by the user. These processing processes will judge and modify the data, and the data may change state continuously in this process. The propagation phase is the link entered after the taint tracking process is established in the source phase. If there is no taint tracking process established in the source phase, the propagation phase will not track and analyze the relevant tainted data. Similarly, there may be a large number of other propagation functions belonging to the same phase inside the function of this phase. When running to other functions of the same phase inside the function of this phase, it will also try to enter the instrumented tracking and analysis logic. When the taint tracking and analysis logic tracks and analyzes a propagation function, it only needs to pay attention to what data the current propagation function processes and what the data of the processing result is, without worrying about how to process it internally. The tainted data processed internally is all in an intermediate state. The application will not do any processing on these data in the intermediate state. Therefore, by establishing the following lock mechanism, it can be avoided that a large amount of tainted data in the intermediate state is also tracked, thereby causing performance problems. In the propagation phase, there may be a situation where functions belonging to other phases are called.

[0052] In the labeling stage, the web application may perform some verification and security processing on the data input by the user. Once the data is securely processed, it may not meet the reporting conditions of certain vulnerabilities. For example, if the data is HTML-encoded, there will be no XSS problem if the data is directly returned to the browser. However, the web application may also perform HTML decoding after HTML encoding. In this way, the data still has the threat of XSS vulnerabilities. Therefore, different labeling operations need to be performed on the data in this stage. The specific labeling operation is completed in the instrumentation logic. This stage belongs to a type of propagation stage, but the tracking and analysis logic of the instrumentation is different. The instrumentation logic in the propagation stage is mainly responsible for continuous taint tracking, while the instrumentation logic in the labeling stage is mainly responsible for different processing tags for the taint data continuously tracked in the propagation stage. These tags will be used as one of the judgment bases for whether there is a vulnerability in the precipitation stage. The lock mechanism in the labeling stage uses the same lock mechanism and object lock as the propagation stage, that is, the lock in the propagation stage will be valid in the labeling stage.

[0053] For the precipitation stage, the functions entering this stage have met the vulnerability reporting conditions. For example, the precipitation function is Java's PrintWriter.println(String str). Before the content to be displayed is sent to the front end through this function, the code inserted in the function will execute the detection logic to determine whether the content comes from user input and whether the application has been processed securely (whether there are relevant tags). Similarly, the precipitation stage function may call other precipitation stage functions. If it is not controlled, the same vulnerability may be reported repeatedly. The current precipitation function should only report one vulnerability of the same type. There may be other types of functions in this stage, but the processing results of other types of functions will not be analyzed. The precipitation stage is the vulnerability analysis and reporting stage. The function processing in other stages called internally in this stage will not affect the vulnerability detection and reporting process, but may affect the vulnerability reporting of the next precipitation function. Therefore, the processing functions in other stages called by it will not be locked, but will normally enter the tracking and analysis logic of the stubs in other stages, but it will still follow the locking mechanism of other stages.

[0054] In the embodiment of the present application, since each instrumented function is an atomic individual, there are other propagation functions inside an instrumented propagation function, but the data flow tracking module only pays attention to the processing results of the tainted data by this propagation function, and does not care about the internal processing process. Therefore, the propagation function should be atomic, and the propagation function inside it will not enter the data flow tracking process. However, the propagation function inside the propagation function is also instrumented, so in order to control the internal propagation function from entering the data flow tracking process, a lock mechanism is set up to control the execution of the data flow tracking process through the lock mechanism, so as to avoid executing the data flow tracking process for all function calls, reduce the introduction of a large amount of unnecessary tracking logic code, reduce memory usage, thereby reducing performance overhead and improving the efficiency of program operation.

[0055] Specifically, the lock mechanism includes a lock object. The specific implementation process of the above step A3 is described in detail as follows:

[0056] A31: Get the value of the lock object when executing the lock mechanism.

[0057] A32: Determine whether to trigger the execution of the data flow tracking process according to the value of the lock object. Specifically, if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow tracking process does not need to be executed. Specifically, the initial value of the lock object is 0.

[0058] In a possible implementation, after the step of performing data flow tracking on the request data, the method further includes initializing the value of the lock object.

[0059] In the embodiment of the present application, the essence of the lock mechanism is to set a number initialized to 0 as a lock object and store it in the local thread, and set the lock mechanism corresponding to the stage according to the functions of different stages. For example, for the source stage, the source stage feature is named to distinguish the source stage lock object. When the program runs into the function of the source stage, the tracing and analysis logic function inserted in the current function will first take out the applicable lock object of the current stage function, and add 1 to the value in the lock object, and then the tracing and analysis logic will take out the value of the current lock object after adding 1, and judge whether to enter the tracing and analysis logic according to the lock object value, and judge whether the lock object value is 1. As long as it is not 1, it will not enter the subsequent tracing and analysis logic. When the current function calls other functions in the same stage, the internal function will also first enter the internal tracing and analysis logic that is inserted. Similarly, the tracing and analysis logic that is inserted in the internal function will also add 1 to the lock object value in the current thread, and then judge whether the value after adding 1 is 1. If it is not 1, it will not enter the tracing and analysis logic. So far, the lock mechanism has realized the control of entering or not entering the tracing and analysis logic in the inserted function. However, after the lock object is repeatedly incremented by 1, it needs to be restored to the initial value (0); otherwise, after the current plugged function is executed, all other plugged functions of the same type at the same stage will not be able to enter the specific tracking and analysis logic. Specifically, after the current plugged function is executed, the inserted tracking and analysis logic needs to take out the current lock object and subtract 1 from the value in the lock object. Even if it is the plugged tracking and analysis logic in the internal function of the current plugged function, the lock object value must be subtracted by 1 at the end of the internal function, because when entering the internal function, the tracking and analysis logic has already added 1 to the lock object value. In this way, no matter how many times the same type of function is called inside the current function, after the current function ends, the lock object value will be restored to 0, and then enter the next plugged function, running the same locking mechanism.

[0060] S104: If it is determined that the data flow tracking process needs to be executed, data flow tracking is performed on the request data based on the execution of the data flow tracking process.

[0061] In the embodiment of the present application, if it is determined that the data flow tracking process needs to be executed, the data flow tracking of the request data is performed based on the execution data flow tracking process. After the application completes processing the current request, it will send a response message to the front end. Before the request response message is returned, the tainted data may repeatedly enter the four stages of source, propagation, labeling and precipitation until the request response is completely completed, and the data flow tracking for tracking the tainted data is temporarily stopped.

[0062] In an embodiment of the present application, by obtaining request data, before responding to the request data, the function to be called when responding to the request data is obtained, and based on the function to be called when responding to the request data, it is determined whether to trigger the execution of the data flow tracking process. If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed, and data flow tracking is performed on the request data. The data flow tracking process is executed for all function calls, thereby reducing the introduction of a large amount of unnecessary tracking logic code, reducing memory usage, thereby reducing performance overhead, and improving the efficiency of program operation.

[0063] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0064] Corresponding to the data flow tracking method described in the above embodiment, Figure 3 A structural block diagram of a data flow tracking system provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0065] Reference Figure 3 The data flow tracking system includes: a data acquisition unit 31, a function determination unit 32, a data flow tracking judgment unit 33, and a data flow tracking unit 34, wherein:

[0066] A data acquisition unit 31, used to acquire request data;

[0067] The function determination unit 32 is used to obtain the function to be called when responding to the request data before responding to the request data;

[0068] A data flow tracking determination unit 33 is used to determine whether to trigger the execution of a data flow tracking process based on the function to be called when responding to the request data;

[0069] The data flow tracking unit 34 is used to execute the data flow tracking process and perform data flow tracking on the request data if it is determined that the data flow tracking process is triggered.

[0070] As a possible implementation manner of the present application, the data flow tracking and judging unit 33 includes:

[0071] A phase acquisition module, used for acquiring the phase to which the function called in response to the request data belongs;

[0072] A lock mechanism calling module, used to call and execute the lock mechanism corresponding to the stage to which the function belongs, the lock mechanism is pre-stored in the local thread, and is used to determine whether to execute the data flow tracking process;

[0073] The data flow tracking judgment module is used to determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism.

[0074] As a possible implementation of the present application, the lock mechanism includes a lock object, and the data flow tracking and judgment module specifically includes:

[0075] A value acquisition submodule, used to acquire the value of the lock object when executing the lock mechanism;

[0076] The data flow tracking trigger submodule is used to determine whether to trigger the execution of the data flow tracking process according to the value of the lock object. Further, if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow tracking process does not need to be executed.

[0077] As a possible implementation manner of the present application, the data flow tracking and judgment module further includes:

[0078] The data initialization submodule is used to initialize the value of the lock object after executing the data flow tracking process.

[0079] In an embodiment of the present application, by obtaining request data, before responding to the request data, the function to be called when responding to the request data is obtained, and based on the function to be called when responding to the request data, it is determined whether to trigger the execution of the data flow tracking process. If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed, and data flow tracking is performed on the request data. The data flow tracking process is executed for all function calls, thereby reducing the introduction of a large amount of unnecessary tracking logic code, reducing memory usage, thereby reducing performance overhead, and improving the efficiency of program operation.

[0080] Figure 4 Schematic diagram of a server provided by an embodiment of the present application. Figure 4 As shown, the server 4 of this embodiment includes: a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40, such as a data flow tracking program. When the processor 40 executes the computer program 42, the steps in the above-mentioned data flow tracking method embodiments are implemented, such as Figure 1 Alternatively, when the processor 40 executes the computer program 42, the functions of each module / unit in the above-mentioned system embodiments are realized, for example, Figure 3 The functions of the units 31 to 34 are shown.

[0081] Exemplarily, the computer program 42 may be divided into one or more modules / units, which are stored in the memory 41 and executed by the processor 40 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 42 in the server 4. For example, the computer program 42 may be divided into a data acquisition unit, a function determination unit, a data flow tracking judgment unit, and a data flow tracking unit, and the specific functions of each unit are as follows:

[0082] A data acquisition unit, used for acquiring request data;

[0083] A function determination unit, used for obtaining a function to be called when responding to the request data before responding to the request data;

[0084] A data flow tracking judgment unit, used to determine whether to trigger the execution of a data flow tracking process based on the function to be called when responding to the request data;

[0085] The data flow tracking unit is used to execute the data flow tracking process if it is determined that the data flow tracking process is triggered, and perform data flow tracking on the request data.

[0086] The server 4 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The server may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will appreciate that Figure 4 It is only an example of server 4 and does not constitute a limitation on server 4. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the server may also include input and output devices, network access devices, buses, etc.

[0087] It should be understood that in the embodiment of the present application, the processor 40 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0088] The memory 41 may include a read-only memory and a random access memory, and provide instructions and data to the processor 40. A part or all of the memory 41 may also include a non-volatile random access memory. For example, the memory 41 may also store information about the device type.

[0089] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0090] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0091] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0092] In the embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0093] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0094] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0095] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or system that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0096] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A data flow tracking method, characterized in that: include: Get request data; Before responding to the request data, obtaining a function to be called when responding to the request data; Based on the function to be called when responding to the request data, determine whether to trigger the execution of the data flow tracking process, including: obtaining the stage to which the function to be called when responding to the request data belongs; calling and executing the lock mechanism corresponding to the stage to which the function belongs, the lock mechanism is pre-stored in the local thread, and is used to determine whether to execute the data flow tracking process, and the lock mechanism includes a lock object; obtain the value of the lock object when executing the lock mechanism; determine whether to trigger the execution of the data flow tracking process according to the value of the lock object; if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow tracking process does not need to be executed; If it is determined that the data flow tracking process is triggered, the data flow tracking process is executed to track the data flow of the request data; After the step of performing data flow tracking on the request data, the value of the lock object is initialized, and the initial value of the lock object is 0.

2. A data flow tracking system, characterized in that: The data flow tracking system comprises: A data acquisition unit, used for acquiring request data; A function determination unit, used for obtaining a function to be called when responding to the request data before responding to the request data; A data flow tracking judgment unit is used to determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the request data; the data flow tracking judgment unit includes: A phase acquisition module, used for acquiring the phase to which the function called in response to the request data belongs; A lock mechanism calling module, used to call and execute the lock mechanism corresponding to the stage to which the function belongs, the lock mechanism is pre-stored in the local thread, and is used to determine whether to execute the data flow tracking process, and the lock mechanism includes a lock object; A data flow tracking judgment module is used to determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism; the data flow tracking judgment module includes: A value acquisition submodule, used to acquire the value of the lock object when executing the lock mechanism; A data flow tracking trigger submodule is used to determine whether to trigger the execution of the data flow tracking process according to the value of the lock object; if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow tracking process does not need to be executed; A data flow tracking unit is used to execute the data flow tracking process if it is determined that the data flow tracking process is triggered, and perform data flow tracking on the request data; after the step of performing data flow tracking on the request data, initialize the value of the lock object, and the initial value of the lock object is 0.

3. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the data flow tracking method according to claim 1 are implemented.

4. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the data flow tracking method according to claim 1 are implemented.

Images