Conversation monitoring method, device, computer equipment and readable storage medium

Abstract

The present invention relates to the field of network monitoring, and discloses a monitoring method, device, computer equipment and readable storage medium for a session, the method comprising: injecting a network monitoring module including a session connection probe and a session acceptance probe into the kernel layer of the operating system of the computer equipment; using the session connection probe to obtain the first session identifier and the first process identifier corresponding to the session connection function call when the session connection function is called, and then associating the two identifiers and storing them in a session process tracking table; using the session acceptance probe to obtain the second session identifier and the second process identifier corresponding to the session acceptance function when the session acceptance function is called, and then associating the two identifiers and storing them in a session process tracking table. Based on this, the embodiment of the present invention realizes effective monitoring of network sessions, so that after the process corresponding to the network session is transferred, the process of the network session before and after the transfer can be determined through the data in the session process tracking table, thereby realizing accurate monitoring of the network session.

Description

Technical Field

[0001] The present invention relates to the field of network monitoring, and in particular to a session monitoring method, device, computer equipment and readable storage medium. Background Art

[0002] In the process of monitoring network sessions, a session may involve multiple processes. Taking the session in the Linux system as an example, after the network service process accepts the client process connection request to establish a session connection, it can call the fork function to generate a child process and complete the communication with the client process according to the child process; it can also send the network socket handle of the ongoing session communication to other processes as needed to maintain communication.

[0003] Because of this, the monitoring of network sessions is very complicated and difficult to monitor reasonably. Summary of the invention

[0004] In view of this, the present invention provides a conversation monitoring method, apparatus, computer equipment and readable storage medium, which are used to improve the current situation that network conversations are difficult to be reasonably monitored.

[0005] In a first aspect, an embodiment of the present invention provides a method for monitoring a session, which is applied to a computer device, wherein a session process tracking table is provided in the computer device, and the device comprises:

[0006] Injecting a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, the network monitoring module includes a plurality of probes, each probe is used to start when a corresponding session-related function in the operating system is called, and the plurality of probes includes at least a session connection probe and a session acceptance probe;

[0007] Based on the session connection probe, when the session connection function of the operating system is called, a first session identifier and a first process identifier corresponding to the session connection function are obtained, wherein the operating system is used to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices;

[0008] Associating the first session identifier with the first process identifier, and writing the associated first session identifier and the first process identifier into the session process tracking table;

[0009] Based on the session acceptance probe, when the session acceptance function of the operating system is called, a second session identifier and a second process identifier corresponding to the session acceptance function are obtained, wherein the operating system is used to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive a session establishment request from the other device to establish session communication;

[0010] The second session identifier and the second process identifier are associated, and the associated second session identifier and the second process identifier are written into the session process tracking table.

[0011] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a data sending probe and a data receiving probe, and the method further includes:

[0012] Based on the data receiving probe, when the operating system calls the data receiving function, a third session identifier and a third process identifier corresponding to the data receiving function are obtained, wherein the operating system is also used to call the called data receiving function to receive the transfer data of the session corresponding to the third session identifier and the third process identifier;

[0013] querying the first target process identifier associated with the third session identifier through the session process tracking table, and updating the first target process identifier in the session process tracking table by using the third process identifier when the first target process identifier is inconsistent with the third process identifier;

[0014] Based on the data sending probe, when the operating system calls the data sending function, a fourth session identifier and a fourth process identifier corresponding to the data sending function are obtained, wherein the operating system is also used to call the calling data sending function to send data through the session corresponding to the fourth session identifier and the fourth process identifier;

[0015] The second target process identifier associated with the fourth session identifier is queried through the session process tracking table, and when the second target process identifier is inconsistent with the fourth process identifier, the second target process identifier in the session process tracking table is updated using the fourth process identifier.

[0016] Optionally, in a feasible manner provided by an embodiment of the present invention, the method further includes:

[0017] If the first target process identifier is not found, writing the third session identifier and the third process identifier into the session process tracking table;

[0018] If the second target process identifier is not found, the fourth session identifier and the fourth process identifier are written into the session process tracking table.

[0019] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a session closing probe, a session monitoring record file is further provided in the computer device, and the method further includes:

[0020] Setting a monitoring process in the application layer of the operating system;

[0021] Based on the session closing probe, when the operating system calls the session closing function, obtaining a fifth session identifier and a fifth process identifier corresponding to the session closing function;

[0022] Deleting the fifth session identifier and the fifth process identifier in the session process tracking table;

[0023] When any type of probe performs a data change operation on the session process tracking table, a first change event is generated based on the type of the probe and the session identifier and process identifier corresponding to the data change operation, and the first change event is reported to the monitoring module, wherein the data change operation includes a new operation, an update operation, and a deletion operation of the session identifier and the process identifier;

[0024] Based on the monitoring process, data in the first change event is written into the session monitoring record file.

[0025] Optionally, in a feasible manner provided by an embodiment of the present invention, a sending data table and a receiving data table are further provided in the computer device;

[0026] The method further comprises: after obtaining the third session identifier and the third process identifier corresponding to the data receiving function based on the data receiving probe when the operating system calls the data receiving function;

[0027] Determine the sending data size corresponding to the data sending function, associate the third session identifier, the third process identifier and the sending data size, and then store the associated third session identifier, the third process identifier and the sending data size in the sending data table;

[0028] The method further comprises: after obtaining the fourth session identifier and the fourth process identifier corresponding to the data sending function based on the data sending probe when the operating system calls the data sending function;

[0029] Determine the received data size corresponding to the data receiving function, associate the fourth session identifier, the fourth process identifier and the received data size, and then store the associated fourth session identifier, the fourth process identifier and the received data size in the received data table.

[0030] Optionally, in a feasible manner provided by an embodiment of the present invention, a session traffic statistics table is further provided in the computer device, and the method further includes:

[0031] Based on the monitoring process, the data in the receiving data table and the sending data table are stored in the session traffic statistics table at preset time intervals, and the data in the receiving data table and the sending data table are cleared.

[0032] Optionally, in a feasible manner provided by an embodiment of the present invention, the method further includes:

[0033] When the first target process identifier is inconsistent with the third process identifier, querying the sending data table and the receiving data table using the third session identifier and the first target process identifier to obtain first target sending data and first target receiving data;

[0034] generating a second change event based on the first target sending data, the first target receiving data, the first target process identifier, the third process identifier, and the third session identifier;

[0035] When the second target process identifier is inconsistent with the fourth process identifier, querying the sending data table and the receiving data table using the third session identifier and the second target process identifier to obtain the second target sending data and the second target receiving data;

[0036] generating a third change event based on the second target sending data, the second target receiving data, the second target process identifier, the fourth process identifier, and the fourth session identifier;

[0037] Based on the monitoring process, the data in the second change event and the third change event are respectively written into the session monitoring record file.

[0038] In a second aspect, an embodiment of the present invention provides a session monitoring device, which is applied to a computer device, wherein a session process tracking table is provided in the computer device, and the device comprises:

[0039] An injection module, used for injecting a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, the network monitoring module includes a plurality of probes, each probe is used for starting when a corresponding session-related function in the operating system is called, and the plurality of probes includes at least a session connection probe and a session acceptance probe;

[0040] A first identifier acquisition module, configured to acquire, based on the session connection probe, a first session identifier and a first process identifier corresponding to the session connection function when the session connection function of the operating system is called, wherein the operating system is configured to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices;

[0041] A first identifier storage module, used for associating the first session identifier with the first process identifier, and writing the associated first session identifier and the first process identifier into the session process tracking table;

[0042] a second identifier acquisition module, configured to acquire, based on the session acceptance probe, a second session identifier and a second process identifier corresponding to the session acceptance function when the session acceptance function of the operating system is called, wherein the operating system is configured to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive a session establishment request from the other device to establish session communication;

[0043] The second identifier storage module is used to associate the second session identifier with the second process identifier, and write the associated second session identifier and the second process identifier into the session process tracking table.

[0044] In a third aspect, an embodiment of the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program runs on the processor, it executes a session monitoring method as disclosed in any one of the first aspects.

[0045] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run on a processor, it executes a session monitoring method as disclosed in any one of the first aspects.

[0046] In the session monitoring method provided by the embodiment of the present invention, a network monitoring module is first injected into the kernel layer of the operating system of the computer device; then, using the session connection probe in the network monitoring module, when the session connection function of the operating system is called, the first session identifier and the first process identifier generated in the calling process of the session connection function are obtained, and the first session identifier and the first process identifier are associated, and then the associated first session identifier and the first process identifier are stored in the session process tracking table; at the same time, using the session acceptance probe in the network monitoring module, when the session acceptance function of the operating system is called, the second session identifier and the second process identifier generated in the calling process of the session acceptance function are obtained, and the two are associated and stored in the session process tracking table.

[0047] Based on this, the embodiment of the present invention realizes effective monitoring of network sessions, so that after the process corresponding to the network session is transferred, the process of the network session before and after the transfer can be determined through the data in the session process tracking table, thereby realizing accurate monitoring of the network session. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope of protection of the present invention. In each of the drawings, similar components are numbered similarly.

[0049] Figure 1 A schematic diagram showing a flow chart of a method for monitoring a session provided by an embodiment of the present invention;

[0050] Figure 2 A schematic diagram of a first software structure provided by an embodiment of the present invention is shown;

[0051] Figure 3 A second software structure diagram provided by an embodiment of the present invention is shown;

[0052] Figure 4 A schematic diagram of the structure of a session monitoring device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0054] The components of the embodiments of the present invention generally described and shown in the drawings herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or adding the possibility of one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0056] Furthermore, the terms “first”, “second”, “third”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0057] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present invention belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present invention.

[0058] Example 1

[0059] Reference Figure 1 , shows a flow chart of a method for monitoring a session provided by an embodiment of the present invention. The method for monitoring a session provided by an embodiment of the present invention is applied to a computer device, wherein a session process tracking table is provided in the computer device, and the method comprises:

[0060] Step S110, injecting a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, and the network monitoring module includes multiple probes, each probe is used to start when a corresponding session-related function in the operating system is called, and the multiple probes include at least a session connection probe and a session acceptance probe.

[0061] That is, the embodiment of the present invention injects a pre-generated network monitoring module into the kernel layer of the operating system, so that after the network session related function in the operating system is called, the incoming parameters, return values ​​and other parameters of the network session related function are obtained through the probe in the network monitoring module, and then the process to which the network session running in the operating system belongs is determined.

[0062] It is understandable that the Berkeley packet filter based on the extension can be inserted (kprobe) at any position in the kernel layer of the operating system (such as the function return position or the function start position), and then can monitor the call, launch and operation of any event in the kernel layer. In addition, because the Berkeley packet filter based on the extension has higher security and stability, it can run stably in the kernel layer and has higher robustness. Therefore, the embodiment of the present invention adopts the Berkeley packet filter based on the extension to complete the setting of the network monitoring module.

[0063] Optionally, because the execution / triggering of the session process in the Linux system is closely related to the kernel layer, and the extended Berkeley packet filter can operate in a relatively stable state in the Linux system, in a feasible method provided in an embodiment of the present invention, the aforementioned operating system is a Linux system.

[0064] It can also be understood that, because the TCP protocol (Transmission Control Protocol) is widely used, the network session under the TCP protocol is monitored, and thus the aforementioned probes can be of 5 types, namely, data sending probe, data receiving probe, session closing probe, session connection probe and session acceptance probe. Among them, the data sending probe and the data receiving probe are respectively started when the inet_csk_accep function is called and when the tcp_v4_connect function outputs a return value, and the two are respectively used to monitor the processes corresponding to the network session acceptance and the network session connection; the data sending probe and the data receiving probe are respectively started when the tcp_cleanup_rbuf function is called and when the tcp_sendmsg function outputs a return value, and are respectively used to monitor the processes corresponding to the session data reception and the session data sending; the session closing probe is started when the tcp_close function is called, and it is used to monitor the process corresponding to the session closing.

[0065] Furthermore, since the network session based on the TCP protocol has a connection establishment process, there are calls to the session connection function and the session acceptance function, that is, there are calls to the aforementioned tcp_v4_connect function and the inet_csk_accep function. Therefore, in the embodiment of the present invention, at least the probe session connection probe and the session acceptance probe will be used to perform process monitoring on the session connection function and the session acceptance function.

[0066] Step S120, based on the session connection probe, when the session connection function of the operating system is called, obtain the first session identifier and the first process identifier corresponding to the session connection function, wherein the operating system is used to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices.

[0067] That is, the embodiment of the present invention monitors different session-related functions based on various probes in the aforementioned network monitoring module, thereby determining the session identifier corresponding to each network session and determining the process identifier corresponding to the network session, that is, the identification number of the process to which the network session belongs.

[0068] Furthermore, since the various probes in the embodiment of the present invention will be started when the session-related functions are called, the relevant data of any session can be detected. Therefore, even if the session involves multiple processes, in other words, involves process switching / transfer, as long as the data sending function and / or data receiving function and other functions are called during the process running, the embodiment of the present invention can also collect the relevant data of each session based on the probe, and then determine each process corresponding to the session.

[0069] It should be understood that when a network session involves multiple processes, the identifiers of each process involved are different, but each process will contain / use the same session identifier.

[0070] Furthermore, when a computer device needs to communicate with other devices through a network session, the operating system of the computer device will call the session connection function to send a session connection establishment request to the aforementioned other devices. After the session sending function is called, a session identifier will be generated to refer to the network session, and a process will be called / generated through a process identifier to be responsible for the execution of the network session.

[0071] It is conceivable that, because the session connection functions in different operating systems are different, the embodiment of the present invention does not impose further restrictions on the session connection function. In one feasible manner, the session connection function can be regarded as the aforementioned tcp_v4_connect function. Furthermore, the session connection probe is used to start when the tcp_v4_connect function outputs a return value, and is used to determine the session identifier and process identifier involved in the running process of the tcp_v4_connect function, that is, the aforementioned first session identifier and first process identifier.

[0072] Step S130: Associating the first session identifier with the first process identifier, and writing the associated first session identifier and the first process identifier into the session process tracking table.

[0073] That is, after obtaining the first session identifier and the first process identifier, the embodiment of the present invention associates / binds the first session identifier and the first process identifier, and then stores the two in the session process tracking table, so that any identifier in the session process tracking table can point to an associated network identifier or process identifier, and then the mutually associated network identifier and process identifier can point to a network session to which a process and a session identifier have been assigned.

[0074] Optionally, in a preferred embodiment provided by the present invention, the present invention will set a mapping key value storage area based on the eBPF technology, and establish the aforementioned session process tracking table in the mapping key value storage area, that is, the aforementioned session process tracking table will store various data in the form of key-value pairs. Furthermore, in this preferred embodiment, after obtaining the first session identifier and the first process identifier, the session connection probe will use the first session identifier as the key and the first process identifier as the value, and store the two in the session process tracking table.

[0075] Step S140, based on the session acceptance probe, when the session acceptance function of the operating system is called, obtain the second session identifier and the second process identifier corresponding to the session acceptance function, wherein the operating system is used to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive the session establishment request of the other device to establish session communication.

[0076] That is, when other devices need to communicate with the computer device through a network session, they will initiate a session communication establishment request to the computer device. After receiving the session communication establishment request, the computer device will call the session acceptance function to complete the establishment of the session communication. During the execution of the session acceptance function, the operating system will control a process to be responsible for the operation of this session and assign an identification number to this session. Among them, the session acceptance function can be regarded as the aforementioned inet_csk_accep function.

[0077] Therefore, after the session acceptance function is called, the session acceptance probe in the embodiment of the present invention obtains the second session identifier and the second process identifier adopted / generated / allocated by the session acceptance function.

[0078] Step S150: Associating the second session identifier with the second process identifier, and writing the associated second session identifier and the second process identifier into the session process tracking table.

[0079] That is, the embodiment of the present invention associates the second session identifier with the second process identifier and stores the two in the session process tracking table. Then, after searching the session process tracking table by the session identifier or process identifier, the process identifier or session identifier associated with the session identifier or process identifier can be obtained.

[0080] Optionally, similar to the storage process of the aforementioned session connection probe, when the session process tracking table belongs to the aforementioned mapping key value storage area, the session acceptance probe in the embodiment of the present invention will use the second session identifier as the key and the second process identifier as the value, and store both in the session process tracking table.

[0081] Therefore, since the session identifier and process identifier in the session process tracking table are mutually associated, and the session identifiers of the same session are consistent, after searching the session process tracking table with the session identifier to obtain one or more corresponding / associated process identifiers, each process involved in the session identifier can be known, thereby accurately knowing the process transfer of the session, so that the session can be effectively monitored. Based on this, the embodiment of the present invention realizes effective monitoring of network sessions, so that after the process corresponding to the network session is transferred, the process of the network session before and after the transfer can be determined through the data in the session process tracking table, thereby realizing accurate monitoring of the network session.

[0082] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a data sending probe and a data receiving probe, and the method further includes:

[0083] Based on the data receiving probe, when the operating system calls the data receiving function, a third session identifier and a third process identifier corresponding to the data receiving function are obtained, wherein the operating system is also used to call the called data receiving function to receive the transfer data of the session corresponding to the third session identifier and the third process identifier;

[0084] querying the first target process identifier associated with the third session identifier through the session process tracking table, and updating the first target process identifier in the session process tracking table by using the third process identifier when the first target process identifier is inconsistent with the third process identifier;

[0085] Based on the data sending probe, when the operating system calls the data sending function, a fourth session identifier and a fourth process identifier corresponding to the data sending function are obtained, wherein the operating system is also used to call the calling data sending function to send data through the session corresponding to the fourth session identifier and the fourth process identifier;

[0086] The second target process identifier associated with the fourth session identifier is queried through the session process tracking table, and when the second target process identifier is inconsistent with the fourth process identifier, the second target process identifier in the session process tracking table is updated using the fourth process identifier.

[0087] That is, in order to accurately monitor the transfer of the process where the network session is located, the embodiment of the present invention will complete the detection of process transfer based on the data receiving probe and the data sending probe. Specifically, when the computer device needs to receive data sent by other devices and therefore calls the data receiving function, or when the computer device needs to send data to other devices and therefore calls the data sending function, the embodiment of the present invention will use the data receiving probe and the data sending probe to respectively determine the network session corresponding to the data receiving function and the data sending function, that is, obtain the third session identifier and the third process identifier to determine the network session that is currently receiving data, or obtain the fourth session identifier and the fourth process identifier to determine the session that is currently sending data. Among them, the data receiving function can be regarded as the aforementioned tcp_cleanup_rbuf function, and the data sending function can be regarded as the aforementioned tcp_sendmsg function.

[0088] Furthermore, after the data receiving probe or the data sending probe obtains the process identifier and the session identifier, it will use the session identifier to query the aforementioned session process tracking table to determine the target process identifier associated with the session identifier in the session process tracking table.

[0089] Furthermore, if the target process identifier obtained by querying the session process tracking table is inconsistent with the process identifier obtained at the current moment, that is, the first target process identifier is inconsistent with the third process identifier, or the second target process identifier is inconsistent with the fourth process identifier, then it indicates that there is a process transfer phenomenon in the network session corresponding to the third session identifier / fourth session identifier, and the process of this network session is transferred from the process corresponding to the third process identifier to the process corresponding to the first target process identifier, or from the process corresponding to the fourth process identifier to the process corresponding to the second target process identifier.

[0090] Furthermore, the data receiving probe and the data sending probe in the embodiment of the present invention will respectively use the third process identifier and the fourth process identifier to update the content in the aforementioned session process tracking table, that is, use the third process identifier to update the first target process identifier associated with the third session identifier in the session process tracking table, or use the fourth process identifier to update the second target process identifier associated with the third session identifier in the session process tracking table.

[0091] It is not difficult to imagine that if the first target process identifier is consistent with the third process identifier, or the second target process identifier is consistent with the fourth process identifier, the data receiving probe / data sending probe does not perform the process identifier update operation.

[0092] Therefore, the embodiment of the present invention enables the process identifier associated with the session identifier in the session process tracking table to be updated accordingly after the process of the network session is transferred, so that the network session can also be monitored after the process is transferred, thereby further improving the effectiveness of session monitoring.

[0093] Optionally, when the session process tracking table belongs to the aforementioned mapping key value storage area, the data receiving probe and the data sending probe will respectively update the session process tracking table with the third session identifier as the key and the third process identifier as the value when the first target process identifier is inconsistent with the third process identifier, or the second target process identifier is inconsistent with the fourth process identifier, or update the session process tracking table with the fourth session identifier as the key and the fourth process identifier as the value.

[0094] Optionally, in a feasible manner provided by an embodiment of the present invention, the method further includes:

[0095] If the first target process identifier is not found, writing the third session identifier and the third process identifier into the session process tracking table;

[0096] If the second target process identifier is not found, the fourth session identifier and the fourth process identifier are written into the session process tracking table.

[0097] It should be understood that if the data receiving probe or the data sending probe fails to query the aforementioned first target process identifier / second target process identifier, it may be because an unexpected error occurred in the session connection probe and / or the session acceptance probe, and the obtained session identifier and process identifier were not stored in the session process tracking table.

[0098] It is also possible that the network session is conducted under the UDP protocol (User Datagram Protocol). That is, due to the connectionless network communication corresponding to the UDP protocol, there is no call to the session acceptance function and the session connection function, which results in the session connection probe and the session acceptance probe being unable to obtain the session identifier and the process identifier.

[0099] In response to the above situation, the embodiment of the present invention also enables the data sending probe and the data receiving probe to store the directly acquired third process identifier and third session identifier, and the acquired fourth process identifier and fourth session identifier when the first target process identifier / second target process identifier is not detected.

[0100] Therefore, the embodiment of the present invention avoids the phenomenon of missing process identifiers and session identifiers due to unexpected errors, resulting in the situation where relevant data of the network session is not stored in the process tracking table, so that network sessions under the TCP protocol and / or UDP protocol can be accurately monitored.

[0101] In addition, it should be understood that if the process monitoring is performed for the network session under the UDP protocol, since the network session under the UDP protocol does not have a communication connection establishment process, there is no need to set up a session acceptance probe and a session connection probe. Therefore, for the process monitoring of the network session under the UDP protocol, the types of probes in the embodiment of the present invention can include three types: data sending probes, data receiving probes, and session closing probes. Among them, the data sending probe and the data receiving probe will be started when the udp_sendmsg function and the udp_recvmsg function output return values ​​respectively; the session closing probe will be started when the udp_destroy_sock function is called.

[0102] It can be understood that by combining the above-mentioned five probes under the TCP protocol and the three probes under the UDP protocol, network session monitoring when the TCP protocol and the UDP protocol are mixed can be monitored.

[0103] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a session closing probe, a session monitoring record file is further provided in the computer device, and the method further includes:

[0104] Setting a monitoring process in the application layer of the operating system;

[0105] Based on the session closing probe, when the operating system calls the session closing function, obtaining a fifth session identifier and a fifth process identifier corresponding to the session closing function;

[0106] Deleting the fifth session identifier and the fifth process identifier in the session process tracking table;

[0107] When any type of probe performs a data change operation on the session process tracking table, a first change event is generated based on the type of the probe and the session identifier and process identifier corresponding to the data change operation, and the first change event is reported to the monitoring module, wherein the data change operation includes a new operation, an update operation, and a deletion operation of the session identifier and the process identifier;

[0108] Based on the monitoring process, data in the first change event is written into the session monitoring record file.

[0109] For a better illustration of how this is possible, please refer to Figure 2, showing a first software structure schematic diagram provided by an embodiment of the present invention.

[0110] Furthermore, it should be noted that the session process tracking table in the embodiment of the present invention is used to store the relevant data of the running network session. Therefore, after the network session ends / is closed, the embodiment of the present invention deletes the relevant data of the ended network session from the session process tracking table, thereby avoiding invalid records in the session process tracking table. That is, based on the session closing probe, when the computer device ends a certain network session, the embodiment of the present invention obtains the relevant data of the ended network session and performs the corresponding deletion operation on the session process tracking table. Among them, the session closing function can be regarded as the aforementioned udp_destroy_sock function or tcp_close function.

[0111] It should also be noted that the monitoring process in the embodiment of the present invention is used to store the content uploaded by the network session monitoring module.

[0112] Furthermore, since the embodiment of the present invention needs to monitor the network session, the empty session process tracking table only indicates that there is no active network session at present, but does not mean that there has been no network session before. Therefore, when there is a change in the session process tracking table, the embodiment of the present invention will store the data / information related to the change.

[0113] Specifically, when any probe needs to perform a data change operation on the session process tracking table, this probe will generate and report a first change event based on its own type and the relevant data of the network session to be written / updated / deleted when writing / deleting / updating the session process tracking table, so that the monitoring process will write the data in the first change event into the session monitoring record file to complete the global monitoring of the network session.

[0114] It can be understood that the probe data change operations include the following situations: the session acceptance probe and the session sending probe store the acquired network session related data into the session process tracking table; the data sending probe and the data receiving probe update or store the data in the session process tracking table; the session closing probe deletes the data in the session process tracking table.

[0115] It can also be understood that the types of probes in the embodiment of the present invention include session acceptance probes, session sending probes, data sending probes, data receiving probes and session closing probes.

[0116] Exemplarily, when the session acceptance probe obtains the first process identifier and the first session identifier, it will use the first process identifier, the first session identifier and its own type (that is, the "session acceptance probe") to generate a first change event, and submit the first change event to the monitoring module; after receiving the first change event, the monitoring module parses and reads the data in the first change event, and then stores the read data in the session monitoring record file.

[0117] Therefore, the session monitoring record file in the embodiment of the present invention can record the processes belonging to five states: session acceptance, session connection, session data sending, session data receiving and session closing. That is, the processes belonging to the network session in different states can be clearly known, thereby effectively completing the monitoring of the network session.

[0118] Optionally, in a feasible method provided by an embodiment of the present invention, the network monitoring module also includes a session setting status probe, which is used to start after the socket status setting function in the operating system is called, and is used to obtain the session identifier, process identifier and session status corresponding to the socket status function.

[0119] Furthermore, in a feasible manner provided by an embodiment of the present invention, the session closing probe may also be used to start when the session setting status probe detects that the session status is closed.

[0120] Optionally, in a feasible manner provided by an embodiment of the present invention, a sending data table and a receiving data table are further provided in the computer device;

[0121] Furthermore, the method based on the data receiving probe, after obtaining the third session identifier and the third process identifier corresponding to the data receiving function when the operating system calls the data receiving function, further includes:

[0122] Determine the sending data size corresponding to the data sending function, and after associating the third session identifier, the third process identifier and the sending data size, store the associated third session identifier, the third process identifier and the sending data size in the sending data table.

[0123] Furthermore, the method based on the data sending probe, after acquiring the fourth session identifier and the fourth process identifier corresponding to the data sending function when the operating system calls the data sending function, further includes:

[0124] Determine the received data size corresponding to the data receiving function, associate the fourth session identifier, the fourth process identifier and the received data size, and then store the associated fourth session identifier, the fourth process identifier and the received data size in the received data table.

[0125] That is, the data sending probe and data receiving probe in the embodiment of the present invention are also used to obtain the sending data size / receiving data size corresponding to the data receiving function / data sending function after the data receiving function or the data sending function is called, and after associating the sending data size / receiving data size with the obtained process identifier and session identifier, store the three together in the sending data table or the receiving data table.

[0126] It can be understood that if the data sending probe / data receiving probe is in the process of storing data in the sending data table / receiving data table, the process identifier and session identifier of the data to be stored already exist in the data sending table / receiving data table, then the embodiment of the present invention will add the sending data size / receiving data size in the data to be stored to the sending data size / receiving data size corresponding to the process identifier.

[0127] Exemplarily, when the data sending probe obtains the process identifier A1, the session identifier B1, and the sending data size C2, and the sending data table already contains data with the process identifier A1, the session identifier B1, and the sending data size C1, then C1 will be updated to C3, C3=C1+C2.

[0128] Optionally, in a feasible manner, both the data sending table and the receiving data table belong to the aforementioned mapping key value storage area, and both the data sending table and the receiving data table will use the process identifier and the session identifier as the key, and the sending data size or the receiving data size as the value. The data receiving probe and the data sending probe both use the process identifier and the session identifier as the key, and the sending data size or the receiving data size as the value, and store the three in the data sending table and the receiving data table.

[0129] Optionally, in a feasible manner provided by an embodiment of the present invention, a session traffic statistics table is further provided in the computer device, and the method further includes:

[0130] Based on the monitoring module, the data in the received data table and the sent data table are stored in the session traffic statistics table at every preset time interval, and the data in the received data table and the sent data table are cleared.

[0131] For a better explanation of this possible approach, please refer to Figure 3 , showing a second software structure schematic diagram provided by an embodiment of the present invention.

[0132] That is, the embodiment of the present invention will utilize the monitoring module to obtain the data in the receiving data table and the sending data table at every preset period / time interval, and store the obtained data in the session traffic statistics table. After completing the data storage of the session traffic statistics table, the receiving data table and the sending data table will be cleared.

[0133] Optionally, in a feasible manner provided by an embodiment of the present invention, the method further includes:

[0134] When the first target process identifier is inconsistent with the third process identifier, querying the sending data table and the receiving data table using the third session identifier and the first target process identifier to obtain first target sending data and first target receiving data;

[0135] generating a second change event based on the first target sending data, the first target receiving data, the first target process identifier, the third process identifier, and the third session identifier;

[0136] When the second target process identifier is inconsistent with the fourth process identifier, querying the sending data table and the receiving data table using the third session identifier and the second target process identifier to obtain the second target sending data and the second target receiving data;

[0137] generating a third change event based on the second target sending data, the second target receiving data, the second target process identifier, the fourth process identifier, and the fourth session identifier;

[0138] Based on the monitoring process, the data in the second change event and the third change event are respectively written into the session monitoring record file.

[0139] Exemplarily, the session identifier, process identifier, and received data size acquired by the data receiving probe at the previous time point are Q1, W1, and E1, respectively, and the session identifier, process identifier, and received data size acquired at the next time point are Q1, W2, and E2, respectively. Furthermore, after Q1, W1, and E1 are associated and stored in the received data table, because W2 is not consistent with W1 in the received data table, the data receiving probe associates Q1, W2, and E2 and stores them in the received data table. As a result, the received data table includes "Q1-W2-E2" and "Q1-W1-E1".

[0140] But it can be imagined that "Q1-W1-E1" and "Q1-W2-E2" actually correspond to the same network session, and therefore, "Q1-W2-E2" should be updated to "Q1-W2-E3", where E3 = E1 + E2.

[0141] In view of this situation, the embodiment of the present invention also enables the data receiving probe and the data sending probe to query the sending data table and the receiving data table using the currently acquired session identifier (i.e., the third session identifier or the fourth session identifier) ​​and the target process identifier when determining that the target process identifier (i.e., the first target process identifier or the second process identifier) ​​and the currently acquired process identifier (i.e., the third process identifier or the fourth process identifier) ​​are inconsistent, and then obtain the target sending data and the target receiving data. For example, in the above example, when the receiving data table is queried with Q1 and W1, E1 is obtained, and then E1 is the target sending data.

[0142] Next, the data receiving probe and the data sending probe generate a change event (i.e., the second change event or the third change event) based on the queried target sending data (i.e., the first target sending data or the second target sending data) and the target receiving data (i.e., the first target receiving data or the second target receiving data), the currently acquired session identifier and process identifier, and the target process identifier, and then submit the generated change time to the monitoring process in the application layer. Exemplarily, still using the above example, the data receiving probe will use Q1, W1, E1, T1 (T1 is the first target sending data) and W2 to generate the second change event, and submit the second change event to the monitoring process.

[0143] Finally, when the monitoring process receives the second change event or the third change event, the data in the second change event or the third change event is written into the session monitoring record file. For example, if the first change event includes Q1, W1, E1, T1 and W2, then Q1, W1, E1, T1 and W2 will be recorded in the session monitoring record file, so that the received data of the network session Q1 when the process transfer occurs can be known through the session monitoring record.

[0144] Optionally, in a feasible method provided by an embodiment of the present invention, after sending the third change event or the second change event, the data receiving probe and the data sending probe will also delete the target sending data, target receiving data, currently acquired session identifier and target process identifier in the sending data table and the receiving data table. Exemplarily, when the data receiving probe generates a second change event based on Q1, W1, E1, T1 and W2 and uploads it, the data receiving probe deletes Q1, W1 and T1 in the sending data table, and deletes Q1, W1 and E1 in the receiving data table.

[0145] Optionally, in a feasible manner provided by an embodiment of the present invention, the first change event, the second change event and the third change event are uploaded to the monitoring process of the application layer in the form of perf.

[0146] Example 2

[0147] Corresponding to the method for monitoring a session provided in Embodiment 1 of the present invention, Embodiment 2 of the present invention further provides a device for monitoring a session, referring to Figure 4 , shows a schematic diagram of the structure of a session monitoring device provided by an embodiment of the present invention. The session monitoring device 200 provided by an embodiment of the present invention is applied to a computer device, wherein a session process tracking table is provided in the computer device, and the device comprises:

[0148] An injection module 210 is used to inject a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, and the network monitoring module includes a plurality of probes, each of which is used to be started when a corresponding session-related function in the operating system is called, and the plurality of probes includes at least a session connection probe and a session acceptance probe;

[0149] A first identifier acquisition module 220, configured to acquire, based on the session connection probe, a first session identifier and a first process identifier corresponding to the session connection function when the session connection function of the operating system is called, wherein the operating system is configured to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices;

[0150] A first identifier storage module 230 is used to associate the first session identifier with the first process identifier, and write the associated first session identifier and the first process identifier into the session process tracking table;

[0151] A second identifier acquisition module 240 is used to acquire, based on the session acceptance probe, a second session identifier and a second process identifier corresponding to the session acceptance function when the session acceptance function of the operating system is called, wherein the operating system is used to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive a session establishment request from the other device to establish session communication;

[0152] The second identifier storage module 250 is used to associate the second session identifier with the second process identifier, and write the associated second session identifier and the second process identifier into the session process tracking table.

[0153] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a data sending probe and a data receiving probe, and the device further includes:

[0154] A first acquisition module is used to acquire, based on the data receiving probe, a third session identifier and a third process identifier corresponding to the data receiving function when the operating system calls the data receiving function, wherein the operating system is also used to call the called data receiving function to receive the transfer data of the session corresponding to the third session identifier and the third process identifier;

[0155] A first updating module is configured to query a first target process identifier associated with the third session identifier through the session process tracking table, and to update the first target process identifier in the session process tracking table using the third process identifier when the first target process identifier is inconsistent with the third process identifier;

[0156] A second acquisition module is used to acquire, based on the data sending probe, a fourth session identifier and a fourth process identifier corresponding to the data sending function when the operating system calls the data sending function, wherein the operating system is further used to call the called data sending function to send data through a session corresponding to the fourth session identifier and the fourth process identifier;

[0157] The second update module is used to query the second target process identifier associated with the fourth session identifier through the session process tracking table, and when the second target process identifier is inconsistent with the fourth process identifier, use the fourth process identifier to update the second target process identifier in the session process tracking table.

[0158] Optionally, in a feasible manner provided in an embodiment of the present invention, the device further includes:

[0159] a first writing module, configured to write the third session identifier and the third process identifier into the session process tracking table if the first target process identifier is not found;

[0160] The second writing module is used to write the fourth session identifier and the fourth process identifier into the session process tracking table if the second target process identifier is not found.

[0161] Optionally, in a feasible manner provided by an embodiment of the present invention, the multiple probes further include a session closing probe, a session monitoring record file is further provided in the computer device, and the apparatus further includes:

[0162] A setting module, used for setting a monitoring process in the application layer of the operating system;

[0163] A third acquisition module is used to acquire, based on the session closing probe, a fifth session identifier and a fifth process identifier corresponding to the calling session closing function when the operating system session closing function is called;

[0164] A deleting module, used for deleting the fifth session identifier and the fifth process identifier in the session process tracking table;

[0165] A reporting module, for generating a first change event based on the type of the probe and the session identifier and process identifier corresponding to the data change operation when any probe performs a data change operation on the session process tracking table, and reporting the first change event to the monitoring module, wherein the data change operation includes a new operation, an update operation, and a deletion operation of the session identifier and the process identifier;

[0166] The first file writing module is used to write the data in the first change event into the session monitoring record file based on the monitoring process.

[0167] Optionally, in a feasible manner provided by an embodiment of the present invention, a sending data table and a receiving data table are further provided in the computer device;

[0168] Furthermore, the first acquisition module further includes:

[0169] The first determination submodule is used to determine the sending data size corresponding to the data sending function, and after associating the third session identifier, the third process identifier and the sending data size, store the associated third session identifier, the third process identifier and the sending data size in the sending data table.

[0170] Furthermore, the second acquisition module further includes:

[0171] The second determination submodule is used to determine the received data size corresponding to the data receiving function, and after associating the fourth session identifier, the fourth process identifier and the received data size, store the associated fourth session identifier, the fourth process identifier and the received data size in the received data table.

[0172] Optionally, in a feasible manner provided by an embodiment of the present invention, a session traffic statistics table is further provided in the computer device, and the apparatus further includes:

[0173] The clearing module is used to store the data in the receiving data table and the sending data table into the session traffic statistics table at preset time intervals based on the monitoring process, and clear the data in the receiving data table and the sending data table.

[0174] Optionally, in a feasible manner provided in an embodiment of the present invention, the device further includes:

[0175] A first query module, configured to query the sending data table and the receiving data table using the third session identifier and the first target process identifier to obtain first target sending data and first target receiving data when the first target process identifier is inconsistent with the third process identifier;

[0176] A first event generating module, configured to generate a second change event based on the first target sending data, the first target receiving data, the first target process identifier, the third process identifier, and the third session identifier;

[0177] A second query module is used to query the sending data table and the receiving data table by using the third session identifier and the second target process identifier to obtain second target sending data and second target receiving data when the second target process identifier is inconsistent with the fourth process identifier;

[0178] A second event generating module, configured to generate a third change event based on the second target sending data, the second target receiving data, the second target process identifier, the fourth process identifier and the fourth session identifier;

[0179] The second file writing module is used to write the data in the second change event and the third change event into the session monitoring record file respectively based on the monitoring process.

[0180] The conversation monitoring device 200 provided in the embodiment of the present application can implement each process of the conversation monitoring method corresponding to Example 1, and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0181] An embodiment of the present invention further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program runs on the processor, the method for monitoring a session as described in Embodiment 1 is executed.

[0182] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run on a processor, the method for monitoring a session as described in Embodiment 1 is executed.

[0183] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow chart, and the combination of boxes in the structure diagram and / or the flow chart, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0184] In addition, the functional modules or units in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0185] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0186] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for monitoring a session, characterized in that: Applied to a computer device, wherein a session process tracking table is provided in the computer device, the method comprises: Injecting a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, the network monitoring module includes a plurality of probes, each probe is used to start when a corresponding session-related function in the operating system is called, and the plurality of probes includes at least a session connection probe and a session acceptance probe; Based on the session connection probe, when the session connection function of the operating system is called, a first session identifier and a first process identifier corresponding to the session connection function are obtained, wherein the operating system is used to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices; Associating the first session identifier with the first process identifier, and writing the associated first session identifier and the first process identifier into the session process tracking table; Based on the session acceptance probe, when the session acceptance function of the operating system is called, a second session identifier and a second process identifier corresponding to the session acceptance function are obtained, wherein the operating system is used to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive a session establishment request from the other device to establish session communication; Associating the second session identifier with the second process identifier, and writing the associated second session identifier and the second process identifier into the session process tracking table; The plurality of probes further include a data sending probe and a data receiving probe, and the method further includes: Based on the data receiving probe, when the operating system calls the data receiving function, a third session identifier and a third process identifier corresponding to the data receiving function are obtained, wherein the operating system is also used to call the called data receiving function to receive the transfer data of the session corresponding to the third session identifier and the third process identifier; querying the first target process identifier associated with the third session identifier through the session process tracking table, and updating the first target process identifier in the session process tracking table by using the third process identifier when the first target process identifier is inconsistent with the third process identifier; Based on the data sending probe, when the operating system calls the data sending function, a fourth session identifier and a fourth process identifier corresponding to the data sending function are obtained, wherein the operating system is also used to call the calling data sending function to send data through the session corresponding to the fourth session identifier and the fourth process identifier; The second target process identifier associated with the fourth session identifier is queried through the session process tracking table, and when the second target process identifier is inconsistent with the fourth process identifier, the second target process identifier in the session process tracking table is updated using the fourth process identifier.

2. The method for monitoring a conversation according to claim 1, characterized in that: The method further comprises: If the first target process identifier is not found, writing the third session identifier and the third process identifier into the session process tracking table; If the second target process identifier is not found, the fourth session identifier and the fourth process identifier are written into the session process tracking table.

3. The method for monitoring a conversation according to claim 2, characterized in that: The multiple probes also include a session closing probe, and a session monitoring record file is also provided in the computer device. The method also includes: Setting a monitoring process in the application layer of the operating system; Based on the session closing probe, when the operating system calls the session closing function, obtaining a fifth session identifier and a fifth process identifier corresponding to the session closing function; Deleting the fifth session identifier and the fifth process identifier in the session process tracking table; When any type of probe performs a data change operation on the session process tracking table, a first change event is generated based on the type of the probe and the session identifier and process identifier corresponding to the data change operation, and the first change event is reported to the monitoring module, wherein the data change operation includes a new operation, an update operation, and a deletion operation of the session identifier and the process identifier; Based on the monitoring process, data in the first change event is written into the session monitoring record file.

4. The method for monitoring a conversation according to claim 3, characterized in that: The computer device is also provided with a sending data table and a receiving data table; The method further comprises: after obtaining the third session identifier and the third process identifier corresponding to the data receiving function based on the data receiving probe when the operating system calls the data receiving function; Determine the sending data size corresponding to the data sending function, associate the third session identifier, the third process identifier and the sending data size, and then store the associated third session identifier, the third process identifier and the sending data size in the sending data table; The method further comprises: after obtaining the fourth session identifier and the fourth process identifier corresponding to the data sending function based on the data sending probe when the operating system calls the data sending function; Determine the received data size corresponding to the data receiving function, associate the fourth session identifier, the fourth process identifier and the received data size, and then store the associated fourth session identifier, the fourth process identifier and the received data size in the received data table.

5. The method for monitoring a conversation according to claim 4, characterized in that: The computer device is also provided with a session flow statistics table, and the method further comprises: Based on the monitoring process, the data in the receiving data table and the sending data table are stored in the session traffic statistics table at preset time intervals, and the data in the receiving data table and the sending data table are cleared.

6. The method for monitoring a conversation according to claim 4, characterized in that: The method further comprises: When the first target process identifier is inconsistent with the third process identifier, querying the sending data table and the receiving data table using the third session identifier and the first target process identifier to obtain first target sending data and first target receiving data; generating a second change event based on the first target sending data, the first target receiving data, the first target process identifier, the third process identifier, and the third session identifier; When the second target process identifier is inconsistent with the fourth process identifier, querying the sending data table and the receiving data table using the third session identifier and the second target process identifier to obtain the second target sending data and the second target receiving data; generating a third change event based on the second target sending data, the second target receiving data, the second target process identifier, the fourth process identifier, and the fourth session identifier; Based on the monitoring process, the data in the second change event and the third change event are respectively written into the session monitoring record file.

7. A conversation monitoring device, characterized in that: Applied to a computer device, wherein a session process tracking table is provided in the computer device, the device comprises: An injection module, used for injecting a network monitoring module into the kernel layer of the operating system, wherein the network monitoring module is generated based on an extended Berkeley packet filter, the network monitoring module includes a plurality of probes, each probe is used for starting when a corresponding session-related function in the operating system is called, and the plurality of probes includes at least a session connection probe and a session acceptance probe; A first identifier acquisition module, configured to acquire, based on the session connection probe, a first session identifier and a first process identifier corresponding to the session connection function when the session connection function of the operating system is called, wherein the operating system is configured to generate the first session identifier and the first process identifier in the process of calling the session connection function, and send a session establishment request to other devices; A first identifier storage module, used for associating the first session identifier with the first process identifier, and writing the associated first session identifier and the first process identifier into the session process tracking table; a second identifier acquisition module, configured to acquire, based on the session acceptance probe, a second session identifier and a second process identifier corresponding to the session acceptance function when the session acceptance function of the operating system is called, wherein the operating system is configured to generate the second session identifier and the second process identifier in the process of calling the session acceptance function, and receive a session establishment request from the other device to establish session communication; A second identifier storage module, used for associating the second session identifier with the second process identifier, and writing the associated second session identifier and the second process identifier into the session process tracking table; The plurality of probes further include a data sending probe and a data receiving probe, and the device further includes: A first acquisition module is used to acquire, based on the data receiving probe, a third session identifier and a third process identifier corresponding to the data receiving function when the operating system calls the data receiving function, wherein the operating system is also used to call the called data receiving function to receive the transfer data of the session corresponding to the third session identifier and the third process identifier; A first updating module is configured to query a first target process identifier associated with the third session identifier through the session process tracking table, and to update the first target process identifier in the session process tracking table using the third process identifier when the first target process identifier is inconsistent with the third process identifier; A second acquisition module is used to acquire, based on the data sending probe, a fourth session identifier and a fourth process identifier corresponding to the data sending function when the operating system calls the data sending function, wherein the operating system is further used to call the called data sending function to send data through a session corresponding to the fourth session identifier and the fourth process identifier; The second update module is used to query the second target process identifier associated with the fourth session identifier through the session process tracking table, and when the second target process identifier is inconsistent with the fourth process identifier, use the fourth process identifier to update the second target process identifier in the session process tracking table.

8. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is run on the processor, the method for monitoring a session according to any one of claims 1 to 6 is executed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is run on a processor, the method for monitoring a session according to any one of claims 1 to 6 is executed.

Images