A network connection processing method, device, apparatus and storage medium

Abstract

The application discloses a network connection processing method, device and equipment and a storage medium. The method comprises the following steps: obtaining relevant information of a network connection event through a kernel function, and storing the relevant information in a kernel map; reading process ID information of the relevant information from the kernel map; and obtaining network connection information of the network connection event from a network state file according to the process ID information. The embodiment of the application can realize real-time recording and tracking of network connection events in a terminal.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for processing network connections. Background Technology

[0002] For network security purposes, some application security scenarios require analyzing process anomalies directly using data such as process-level network connections and inbound / outbound traffic. For example, is there a continuous malicious transmission of sensitive data from an internal network host? This necessitates obtaining more granular process-level network traffic data to directly pinpoint abnormal services.

[0003] Linux systems have several open-source commands for collecting information such as network connections, processes, and traffic. For example, the `netstat` command displays host network connection information, the `ps` command collects process information, and the `iftop` command retrieves real-time network interface card (NIC) traffic data. This has led to the development of small Linux-based process-level network traffic monitoring tools, such as the network process monitoring tool nethogs. NetHogs is an open-source command-line tool used to calculate network bandwidth usage in real time by process or program, without requiring any special kernel module to be loaded.

[0004] However, it has a drawback: it cannot capture and record process-related information for short connections (such as commands executed by curl). This is due to the limitation of its periodic traversal and refresh of the / proc directory to obtain process and connection association information tables. Additionally, Linux offers comprehensive analysis tools such as Sysdig, which can capture specific event types in real time by setting them for analysis. For example, setting `sysdig evt.type = connect accept` can capture process PID information related to connection events in real time. However, it also has a drawback: its event driver includes a kernel module called `sysdig-probe`. This driver module utilizes the kernel component tracepoint to capture various kernel-level events, making it strongly kernel-dependent. Summary of the Invention

[0005] This invention provides a network connection processing method, apparatus, device, and storage medium to enable real-time recording and tracking of network connection events in a terminal.

[0006] According to one aspect of the present invention, a network connection processing method is provided, comprising:

[0007] The kernel function retrieves information related to network connection events and stores this information in the kernel map.

[0008] Read the process ID information of the relevant information from the kernel map;

[0009] The network connection information of the network connection event is obtained from the network status file based on the process ID information.

[0010] According to another aspect of the present invention, a network connection processing apparatus is provided, comprising:

[0011] The relevant information acquisition module is used to acquire relevant information about network connection events through kernel functions and store the relevant information in the kernel map;

[0012] The ID information acquisition module is used to read the process ID information of the relevant information from the kernel map;

[0013] The first connection information acquisition module is used to obtain the network connection information of the network connection event from the network status file based on the process ID information.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the network connection processing method according to any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the network connection processing method according to any embodiment of the present invention.

[0019] Based on EBPF technology and independent of the kernel and BTF, this invention uses kernel-independent data structures to obtain PID and UID information, and obtains the five-tuple information and PID of the corresponding connection socket from the network status file under Linux. It can realize real-time recording and tracking of network connection events in UOS terminals for security analysis and event backtracking auditing, and can be compiled once and run anywhere.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a network connection processing method according to an embodiment of the present invention;

[0023] Figure 2A This is a flowchart of a network connection processing method according to another embodiment of the present invention;

[0024] Figure 2B This is a schematic diagram illustrating the distinction between kernel space and user space according to another embodiment of the present invention;

[0025] Figure 2C This is a flowchart of a network event logging and message processing procedure according to another embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of the structure of a network connection processing device according to another embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device that implements an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] To facilitate understanding of the application scenarios of this invention and to clarify the scope of protection, the relevant technologies of this invention are first described as follows:

[0031] Currently, real-time capture of network events on Linux systems (such as UnionTech Desktop Operating System UOS) is mainly achieved in the following two ways:

[0032] One is based on kernel modules, such as the Elkeid Driver module of Elkeid, which collects various event data at the Linux kernel level, such as the five-tuple information of network connections and their corresponding process PID information.

[0033] Second, there are user-space programs based on eBPF, such as bcc's tcp connect tool, which is used to track active TCP connections. It records connection 5-tuple information and PID information by dynamically tracking the kernel tcp_v4_connect and tcp_v6_connect functions.

[0034] The distribution and deployment of the latter eBPF program currently faces some challenges: eBPF programs need to access kernel structures to obtain the required data, and therefore depend on the layout of these kernel structures. eBPF programs compiled for a specific kernel version typically cannot work on another kernel version because the layout of the relevant kernel data structures may have changed: for example, fields may have been added or deleted, or their types may have been changed; even changes to the kernel compilation configuration can alter the entire structure layout.

[0035] The solution to this problem is usually to compile and load the eBPF program using kernel header files on the target machine, which is the approach used by the BCC project. However, this method has the following problems during compilation: 1. A compiler that consumes a lot of space must be installed on the target machine; 2. Compiling the program requires resources, which may affect workload scheduling in some cases; 3. Compilation takes a considerable amount of time, so there will be some delay in event collection; 4. It depends on the kernel header file package being installed on the target machine.

[0036] eBPF has evolved alongside the kernel. In 2018, kernel version 4.18 introduced BTF (Best Format Type Information), and in 2020, kernel version 4.20 introduced CO-RE (Copy-Reproducible Execution Environment). The CO-RE mechanism is a solution proposed to address the aforementioned issues. In this solution, eBPF programs are compiled once and then updated (patched) at runtime: the execution instructions are updated based on the kernel architecture layout of the running machine. CO-RE requires the target kernel's BTF information (BPF Type Format). The BTF information is provided by the kernel itself, which requires setting the CONFIG_DEBUG_INFO_BTF=y option during kernel compilation. Therefore, using CO-RE presupposes that the runtime environment's kernel has already exported BTF information. However, analysis has revealed that all distributions of UOS do not export BTF information, limiting deployment options.

[0037] Therefore, this invention proposes a user-space implementation method for process-based network connection tracking in a UOS terminal system (UOS is also a type of Linux system; this paper mainly discusses the UOS terminal system, i.e., the UOS desktop system, but it is also applicable to other Linux systems). This method is based on EBPF technology but does not rely on the kernel or BTF, and can be compiled once and run anywhere (CO-RE). Its features include three parts: the first part is real-time capture of network connection events based on EBPF; the second part is the correlation query and acquisition of network connection information and process information; and the third part is DNS packet capture and domain name resolution based on the EBPF filter, the AF_packet kernel protocol, and packet_mmap zero-copy technology.

[0038] Figure 1This is a flowchart illustrating a network connection processing method according to an embodiment of the present invention. This embodiment is applicable to situations where network connection events are captured in real time via EBPF, and network connection information for different types of network connection events is distinguished using network status files and a shared map circular buffer, so as to record and track network connection events in real time. This method can be executed by a network connection processing device, which can be implemented in hardware and / or software, and can be configured in an electronic device with corresponding data processing capabilities. Figure 1 As shown, the method includes:

[0039] S110. Obtain relevant information about network connection events through kernel functions and store the relevant information in the kernel map.

[0040] The kernel functions used to track network communication connections are tcp_v4_connect and tcp_v6_connect, ipv4_datagram_connect and ipv6_datagram_connect. The kernel map, as an eBPF map, is essentially a general-purpose data structure that stores different types of data, providing functions such as user-space and kernel-space data interaction, data storage, and data sharing among multiple programs.

[0041] Specifically, the BPF probe and kernel maps modules in kernel space are the kernel-mode representation of the user-mode eBPF program during runtime. They are the main functions of the BPF program. Here, the kprobe technology is used to hook network connection events triggered when system calls enter related kernel functions, obtain relevant information about the network connection events, and then record the relevant information about the events through the eBPF map. Here, only the PID and UID are recorded. In the user-mode program, the relevant information about the event can be obtained by reading the eBPF map.

[0042] Optionally, obtaining relevant information about network connection events through kernel functions includes:

[0043] The process ID and user ID information of the network connection event are obtained by hooking the kernel function in user space, and used as relevant information of the network event.

[0044] Specifically, the EBPF program primarily uses kprobe technology to hook the kernel functions tcp_v4_connect and tcp_v6_connect to obtain the PID and UID information of the process corresponding to the network connection event. Both of these pieces of information are uint32_t values, without using complex kernel data structures, capturing TCP connection requests sent from the local machine. Similarly, hooking the kernel functions ipv4_datagram_connect and ipv6_datagram_connect can capture the PID and UID information of the process that created the UDP connection.

[0045] S120. Read the process ID information of the relevant information from the kernel map.

[0046] S130. Obtain the network connection information of the network connection event from the network status file based on the process ID information.

[0047] The network state file stores the 5-tuple information for socket connections, typically located in the host's / proc / net / tcp or proc / net / udp folder. Network connection information includes at least one of the following: 5-tuple information, process ID, process name, process runtime parameters, and event triggering stamp. The 5-tuple includes source IP, destination IP, source port, destination port, and protocol.

[0048] Specifically, a separate thread module – network event reader – implemented in Go is pre-built. After the BPF program in the kernel records the event information into the corresponding map when a network connection event is triggered, the thread module – network event reader – immediately reads the PID and UID information of the event, and retrieves the network connection information of the network connection event from the network status file based on the PID information, such as the five-tuple information of TCP or UDP connection. The obtained network connection information is then output through the event output module, completing the real-time recording and tracking of network connection events.

[0049] Based on EBPF technology and independent of the kernel and BTF, this invention uses kernel-independent data structures to obtain PID and UID information, and obtains the five-tuple information and PID of the corresponding connection socket from the network status file under Linux. It can realize real-time recording and tracking of network connection events in UOS terminals for security analysis and event backtracking auditing, and can be compiled once and run anywhere.

[0050] Optionally, obtaining the network connection information of the network connection event from the network status file based on the process ID information includes:

[0051] Based on the process ID information, the inode numbers under the inode directory are traversed to obtain the target inode number; the network connection information of the corresponding socket connection is obtained from the network status file according to the target inode number, and used as the network connection information of the network connection event.

[0052] In Linux systems, the network status files ` / proc / net / tcp` and ` / proc / net / udp` contain the 5-tuple information of TCP and UDP connection sockets and their corresponding file system inode numbers, respectively. The ` / proc / pid / fd` directory contains information about all open files of a process, where 0, 1, and 2 represent standard input, output, and error, respectively. Network connections are file descriptors starting with `socket:`, and the inode number within square brackets [] corresponds to the socket's inode number. This allows for a direct mapping to the inode numbers in the network status file ` / proc / net / tcp`.

[0053] Specifically, after a network connection event is triggered and the BPF program in the kernel records the event information into the corresponding map, the network event reader immediately reads the PID and UID information of the event. Based on the PID, it can traverse the inode numbers of all socket connection files in the / proc / pid / fd directory to obtain the inode number corresponding to the PID information as the target inode number. Then, based on the inode number, it retrieves the 5-tuple information of the socket connection corresponding to the inode number from the network status file / proc / net / tcp or proc / net / udp, which serves as the network connection information.

[0054] Figure 2A This is a flowchart illustrating a network connection processing method according to another embodiment of the present invention. This embodiment is an optimization and improvement upon the above embodiment. Figure 2A As shown, the method includes:

[0055] S210. Obtain relevant information about network connection events through kernel functions and store the relevant information in the kernel map.

[0056] S220. Obtain the target network connection packet of the process ID through the filter, and store the target network connection packet in the shared map ring buffer.

[0057] S230. The target network connection packets in the shared map ring buffer are parsed by the user-space program to obtain the network connection information corresponding to the process ID information.

[0058] Specifically, for ordinary UDP connections without a connection and DNS queries, BPF can capture the events and obtain the corresponding PID and UID information. However, it cannot retrieve the five-tuple information of the corresponding connection from the network information file ` / proc / net / udp` based on the PID, nor can it obtain the DNS request domain name and corresponding IP address. Therefore, this invention also deploys a BPF filter module to record and track these two types of network connection events. The BPF filter module is a socket communication module based on the kernel's AF_PACKET protocol. It filters specific packets by setting the BPF filter `structsock_filter`. It passes the system call to the kernel via a pointer to a `struct sock_fprog` structure `&Filter` and `setsockopt` to set the `SO_ATTTACH_FILTER` option. It is mainly used to obtain the target processing packet for these two types of network connection events based on the PID information and place the packet in the shared map ring buffer. Since the shared map ring buffer can be shared and read by both user-space programs and kernel programs, user-space programs can directly parse and process the target processing packet in the shared map ring buffer to obtain the corresponding network connection information. Optionally, the step of parsing the target network connection packets in the shared map ring buffer through a user-space program to obtain the network connection information corresponding to the process ID information includes:

[0059] Obtain the target network connection packet of the user processing status from the user buffer of the shared map ring buffer; parse the target network connection packet to obtain the network connection information corresponding to the process ID information; reset the parsed target network connection packet to the kernel processing status and forward it to the kernel buffer of the shared map ring buffer.

[0060] The shared map ring buffer is a configurable ring buffer mapped from the kernel to user space, consisting of a user buffer and a kernel buffer. User-space programs can read packets simply by calling poll.

[0061] Specifically, the BPF filter module first places the UDP / DNS packets filtered by the network interface card (NIC) into a shared map ring buffer between the kernel and user space. The packet processing module then reads and processes the packets from this buffer. When the kernel captures a packet containing a target network connection and places it into the ring buffer, the poll function called by the user-space program will be aware of this information. Simultaneously, the user layer can determine which data in the ring buffer is processable by the user based on the user processing status (TP_STATUS_USER), process it, and then set the status to kernel processing status (TP_STATUS_KERNEL), transmitting it to the kernel buffer to inform the kernel that the user has finished processing this data and the kernel can process it itself. After the kernel finishes processing, it sets the status back to TP_STATUS_USER and transmits it to the user buffer for subsequent user-level processing.

[0062] For example, Figure 2B This is a schematic diagram illustrating the distinction between kernel space and user space according to another embodiment of the present invention. The host space can be simply divided into kernel space and user space. For TCP connection events and UDP events with a connect connection (UDP), the corresponding network connection information can be directly obtained and output by querying the network status file. For DNS query events and UDP events without a connect connection (UDP), the bpffilter module and a shared map ring buffer are needed to resolve DNS and UDP to obtain and output the corresponding network connection information. Furthermore, since a BPF program differs from a regular user-space program—it runs in the kernel—an eBPF loader needs to be designed to load the written eBPF program into the kernel and then execute the eBPF program in kernel space. The essence of eBPF program loading is the BPF system call. The Linux kernel provides all eBPF-related operations through the BPF system call, such as program loading, map creation and deletion, etc. Common loaders are wrappers around this system call; some loaders provide more native operations closer to the system call, while others provide further encapsulation to make programming more convenient. This invention uses the cilium / ebpf library to load user-space programs into the kernel using eBPF. It is written in pure Go and has minimal external dependencies. At the same time, it also provides the bpf2go tool, which can be used to compile eBPF programs into a part of the Go language, thereby compiling them into a complete user-space program that does not depend on external components for distribution and deployment.

[0063] For example, Figure 2CThis is a network event recording and message processing flow provided according to another embodiment of the present invention. Network connection events can be divided into two processing methods: for TCP connection events and UDP events with a connect connection, the corresponding network connection information can be obtained and output by querying the network status file; for DNS query events and UDP events without a connect connection, the corresponding network connection information can be obtained and output using the kernel PDF filter and the shared map circular buffer.

[0064] This invention utilizes packet_map technology based on the kernel AF_PACKET protocol and ebpf filter technology to filter packets with specific characteristics at the kernel level and read packets for processing using a map ring buffer that can be accessed simultaneously in kernel and user modes. Compared to solutions such as nethogs based on libpcap, this significantly reduces the performance loss on the host.

[0065] Figure 3 This is a schematic diagram of a network connection processing device provided in another embodiment of the present invention. Figure 3 As shown, the device includes:

[0066] The relevant information acquisition module 310 is used to acquire relevant information about network connection events through kernel functions and store the relevant information in the kernel map;

[0067] ID information acquisition module 320 is used to read the process ID information of the relevant information from the kernel map;

[0068] The first connection information acquisition module 330 is used to acquire network connection information of the network connection event from the network status file based on the process ID information.

[0069] The network connection processing apparatus provided in this embodiment of the invention can execute the network connection processing method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0070] Optionally, the first connection information acquisition module includes:

[0071] The index node acquisition unit is used to traverse the index node numbers under the index node directory based on the process ID information to obtain the target index node number.

[0072] The first connection information acquisition unit is used to obtain the network connection information of the corresponding socket connection from the network status file according to the target inode number, and use it as the network connection information of the network connection event.

[0073] Optionally, the device further includes:

[0074] The connection message storage module is used to obtain the target network connection message of the process ID through a filter and store the target network connection message in a shared map ring buffer.

[0075] The second connection information acquisition module is used to parse the target network connection packets in the shared map ring buffer through a user-space program to obtain the network connection information corresponding to the process ID information.

[0076] Optionally, the second connection information acquisition module includes:

[0077] The connection message acquisition unit is used to acquire the target network connection message of the user processing status from the user buffer of the shared map ring buffer.

[0078] A connection message parsing unit is used to parse the target network connection message to obtain the network connection information corresponding to the process ID information;

[0079] The connection packet forwarding unit is used to reset the parsed target network connection packet to the kernel processing state and forward it to the kernel cache of the shared map ring buffer.

[0080] Optionally, the relevant information acquisition module 310 is specifically used to obtain the process ID information and user ID information of the network connection event through the user-mode program hooking the kernel function, as relevant information of the network event.

[0081] Optionally, the network connection information includes at least one of the following: 5-tuple information, process ID information, process name, process running parameters, and event triggering event stamp.

[0082] The network connection processing device described in further detail can also execute the network connection processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0083] Figure 4 A schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0084] like Figure 4 As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded into the RAM 43 from storage unit 48. The RAM 43 may also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0085] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0086] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as network connectivity processing methods.

[0087] In some embodiments, the network connectivity processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the network connectivity processing method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the network connectivity processing method by any other suitable means (e.g., by means of firmware).

[0088] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0089] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0090] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0091] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0092] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0093] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0094] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0095] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network connection processing method, characterized in that, The method includes: The kernel function retrieves information related to network connection events and stores this information in a kernel map; the kernel map is a general-purpose data structure used to store different types of data. Read the process ID information of the relevant information from the kernel map; Based on the process ID information, obtain the network connection information of the network connection event from the network status file; Wherein, when the network connection event is a normal UDP connection without a connect and a DNS lookup, after reading the process ID information of the relevant information from the kernel map, the process ID information further includes: The target network connection packet with the process ID is obtained through the filter, and the target network connection packet is stored in the shared map ring buffer. The target network connection packets in the shared map ring buffer are parsed by the user-space program to obtain the network connection information corresponding to the process ID information.

2. The method according to claim 1, characterized in that, The step of obtaining the network connection information of the network connection event from the network status file based on the process ID information includes: Based on the process ID information, the inode numbers under the inode directory are traversed to obtain the target inode number; Based on the target inode number, obtain the network connection information of the corresponding socket connection from the network status file, and use it as the network connection information of the network connection event.

3. The method according to claim 1, characterized in that, The step of parsing the target network connection packets in the shared map ring buffer through a user-space program to obtain the network connection information corresponding to the process ID information includes: Retrieve the target network connection message of the user's processing status from the user buffer of the shared map ring buffer; The target network connection message is parsed to obtain the network connection information corresponding to the process ID information; The parsed target network connection packet is reset to kernel processing state and forwarded to the kernel cache of the shared map ring buffer.

4. The method according to claim 1, characterized in that, The information obtained through kernel functions regarding network connection events includes: The process ID and user ID information of the network connection event are obtained by hooking the kernel function in user space, and are used as relevant information of the network connection event.

5. The method according to any one of claims 1-4, characterized in that, The network connection information includes at least one of the following: quintuple information, process ID information, process name, process running parameters, and event trigger timestamp.

6. A network connection processing device, characterized in that, The device includes: The relevant information acquisition module is used to acquire relevant information about network connection events through kernel functions and store the relevant information in the kernel map; the kernel map is a general data structure used to store different types of data; The ID information acquisition module is used to read the process ID information of the relevant information from the kernel map; The first connection information acquisition module is used to acquire network connection information of the network connection event from the network status file based on the process ID information. Wherein, when the network connection event is a normal UDP connection without a connect and a DNS lookup, the device further includes: The connection message storage module is used to obtain the target network connection message of the process ID through a filter and store the target network connection message in a shared map ring buffer. The second connection information acquisition module is used to parse the target network connection packets in the shared map ring buffer through a user-space program to obtain the network connection information corresponding to the process ID information.

7. The apparatus according to claim 6, characterized in that, The first connection information acquisition module includes: The index node acquisition unit is used to traverse the index node numbers under the index node directory based on the process ID information to obtain the target index node number. The first connection information acquisition unit is used to obtain the network connection information of the corresponding socket connection from the network status file according to the target inode number, and use it as the network connection information of the network connection event.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network connection processing method according to any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network connection processing method according to any one of claims 1-5.

Images