Network connection information acquisition method and device, electronic equipment and storage medium

Abstract

The application provides a network connection information acquisition method and device, electronic equipment and a storage medium. The network connection information acquisition method comprises the following steps: acquiring a network connection event from a kernel module of a target device, the kernel module being used for tracking a network connection changed in the target device and generating a corresponding event; and extracting network connection information of the target device from the network connection event. Without analyzing network traffic packets transmitted between the target device and an external system, the network connection information can be directly acquired from the network connection event listened to by the kernel module of the target device, which is convenient and simple, and can improve the acquisition efficiency of the network connection information.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, electronic device and storage medium for obtaining network connection information. Background Technology

[0002] In the security operation and maintenance of servers, it is necessary to analyze the network traffic sent and received by the server. One aspect of this analysis is to extract network connection information between the server and external systems from the network traffic, and then detect abnormal connections based on this network connection information.

[0003] Network connection information refers to information such as the five-tuple, namely the source Internet Protocol (IP) address, source port, destination IP address, destination port, and Layer 3 protocol (UDP / TCP / ICMP). Currently, the main methods for obtaining server network connection information are: acquiring network traffic packets sent from external systems to the server, or network traffic packets sent from the server to external systems; then parsing the acquired network traffic packets to extract the network connection information between the server and the external system from the parsed data.

[0004] Network traffic packets contain not only network connection information but also a large amount of transmitted content. This results in a significant workload and long parsing time for network traffic packets, leading to slow acquisition of network connection information between the server and external systems and ultimately low efficiency in obtaining this information. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for obtaining network connection information, so as to improve the efficiency of obtaining network connection information.

[0006] To address the aforementioned technical problems, the embodiments of this application provide the following technical solutions:

[0007] The first aspect of this application provides a method for obtaining network connection information, the method comprising: obtaining network connection events from a kernel module of a target device, the kernel module being used to track changes in network connections in the target device and generate corresponding events; and extracting network connection information of the target device from the network connection events.

[0008] A second aspect of this application provides a network connection information acquisition device, the device comprising: an acquisition module, configured to acquire network connection events from a kernel module of a target device, the kernel module being configured to track changes in network connections in the target device and generate corresponding events; and an extraction module, configured to extract network connection information of the target device from the network connection events.

[0009] A third aspect of this application provides an electronic device, the electronic device comprising: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method of the first aspect.

[0010] A fourth aspect of this application provides a computer-readable storage medium comprising: a stored program; wherein, when the program is executed, the device on which the storage medium is located executes the method of the first aspect.

[0011] Compared to existing technologies, the network connection information acquisition method provided in the first aspect of this application, because the target device's kernel module can track changes in network connections within the target device and generate corresponding events, allows for the acquisition of network connection events from the target device's kernel module, and thus the extraction of network connection information from these events. This method of acquiring network connection information between the target device and external systems eliminates the need to parse network traffic packets transmitted between the target device and external systems; network connection information can be directly obtained from the network connection events monitored by the target device's kernel module. This approach is convenient, simple, and improves the efficiency of network connection information acquisition.

[0012] The network connection information acquisition device provided in the second aspect of this application, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect have the same or similar beneficial effects as the network connection information acquisition method provided in the first aspect. Attached Figure Description

[0013] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:

[0014] Figure 1 This is a schematic diagram of the overall architecture of the network connection information acquisition method in the embodiments of this application. Figure 1 ;

[0015] Figure 2 This is a flowchart illustrating the method for obtaining network connection information in the embodiments of this application. Figure 1 ;

[0016] Figure 3 This is a schematic diagram of the overall architecture of the network connection information acquisition method in the embodiments of this application. Figure 2 ;

[0017] Figure 4 This is a flowchart illustrating the method for obtaining network connection information in the embodiments of this application. Figure 2 ;

[0018] Figure 5 This is a schematic diagram of the network connection information acquisition device in the embodiments of this application;

[0019] Figure 6 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0020] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0021] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0022] Currently, to obtain network connection information between a server and an external system, it is necessary to first acquire the network traffic packets transmitted between the server and the external system, and then parse the network connection information from the network traffic packets. However, the network traffic packets transmitted between the server and the external system contain a large amount of transmission content, which can lead to excessively long parsing times, thereby reducing the efficiency of obtaining network connection information.

[0023] The inventors discovered that instead of parsing network connection information from network traffic packets transmitted between the server and external systems, they could listen to various events on the server to identify network connection events, and then retrieve the network connection information from these events. This bypasses the parsing of network traffic packets, making it simpler and more efficient to obtain network connection information. Listening to these events can be done through the server's kernel module.

[0024] In view of this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for obtaining network connection information. Since the kernel module of the target device can track changes in network connections within the target device and generate corresponding events, network connection events can be obtained from the kernel module of the target device, and thus, network connection information of the target device can be extracted from these events. This method of obtaining network connection information between the target device and external systems eliminates the need to parse network traffic packets transmitted between the target device and external systems. Network connection information can be directly obtained from the network connection events monitored by the target device's kernel module, which is convenient, simple, and improves the efficiency of obtaining network connection information.

[0025] First, the architecture of the network connection information acquisition method provided in the embodiments of this application will be described.

[0026] Figure 1 This is a schematic diagram of the overall architecture of the network connection information acquisition method in the embodiments of this application. Figure 1 See Figure 1 As shown, the target device mainly consists of two layers: an application layer for running various applications and a lower layer for running kernel modules. The target device establishes network connections with various external systems to enable interaction with them.

[0027] During the interaction between the target device and the external system, a network connection is established. During this period, the kernel module in the target device can track the establishment and destruction of this connection, generating corresponding network connection events. At this point, the target device or an application within its application layer can obtain these generated network connection events from the kernel module, and thus retrieve the network connection information between the target device and the external system. This enables rapid acquisition of network connection information between the target device and the external system.

[0028] Next, the method for obtaining network connection information provided in the embodiments of this application will be described in detail.

[0029] Figure 2 This is a flowchart illustrating the method for obtaining network connection information in the embodiments of this application. Figure 1 See Figure 1 As shown, the method may include:

[0030] S201: Obtain network connection events from the kernel module of the target device.

[0031] The kernel module is used to track changes in network connections on the target device and generate corresponding events.

[0032] The kernel module of the target device can be a built-in module of the target device, and this kernel module itself has the function of listening to various behaviors of the target device, especially changes in network connection behavior, and generating corresponding events after listening to the relevant content. For example, if the target device establishes a new network connection with an external system, the kernel module in the target device can track the newly established network connection between the target device and the external system, and thus generate a network connection event, which is a connection creation event.

[0033] When a kernel module generates a network connection event, it adds all the network connection information it has been monitoring to the event. This means adding various information about the target device and the external system involved in the network connection to the event. This information can include the 5-tuple, source MAC address, destination MAC address, uplink traffic information, downlink traffic information, etc. In this way, the target device can obtain the corresponding network connection event from its kernel module.

[0034] S202: Extract network connection information of the target device from network connection events.

[0035] After obtaining network connection events from the kernel module, since the network connection events contain various information about the target device's network connection with the external system, the network connection information between the target device and the external system can be extracted from the network connection events.

[0036] It should be noted that the execution subject of this application embodiment can be the target device itself, or it can be an application in the application layer of the target device.

[0037] As described above, the network connection information acquisition method provided in this application allows the target device's kernel module to track changes in network connections and generate corresponding events. Therefore, network connection events can be obtained from the target device's kernel module, and the target device's network connection information can be extracted from these events. This method of acquiring network connection information between the target device and external systems eliminates the need to parse network traffic packets transmitted between the target device and external systems. Network connection information can be directly obtained from the network connection events monitored by the target device's kernel module, making it convenient, simple, and improving the efficiency of network connection information acquisition.

[0038] Furthermore, as a refinement of step S202 above, changes in network connection either involve creating a new network connection or disconnecting an existing one. In other words, network connection events include connection creation events and connection destruction events. For a complete network connection, it begins with connection creation and ends with connection destruction. Therefore, to obtain more complete network connection information, it is necessary to extract network connection information from both connection creation and connection destruction events, and then merge the extracted network connection information from these two events to obtain the final network connection information between the target device and the external system.

[0039] Specifically, step S202 above may include:

[0040] Step A1: Extract the first connection information of the target device from the connection creation event.

[0041] After the target device establishes a network connection with an external system, the kernel module in the target device can track the establishment of the network connection and obtain information such as the five-tuple information and MAC address used when the target device establishes a network connection with the external system. Then, it generates a connection creation event based on the information obtained.

[0042] The connection creation event can be obtained from the kernel module of the target device, and then the network connection information, i.e. the first connection information, can be extracted from the connection creation event.

[0043] In practical applications, the first connection information mainly consists of information involved when the target device starts connecting with the external system, such as: 5-tuple information, source MAC address, destination MAC address, connection start time, etc.

[0044] Step A2: Extract the second connection information of the target device from the connection destruction event.

[0045] When the target device and the external system no longer need a network connection, the target device and the external system will disconnect. The kernel module in the target device can then track the destruction of the network connection and obtain relevant data about the information transmitted between the target device and the external system from the establishment of the network connection to the destruction of the network connection, such as the size and number of uplink traffic packets, connection time, etc., and then generate a connection destruction event based on this data.

[0046] From the kernel module of the target device, it is possible to obtain the connection destruction event, which belongs to the same network connection as the connection creation event, and then extract the network connection information, i.e., the second connection information, from the connection destruction event.

[0047] In practical applications, the second connection information includes not only the five-tuple information involved when the target device initiates the connection with the external system, but also connection termination time, uplink traffic information, downlink traffic information, shutdown status, Virtual Local Area Network (VLAN), and application layer protocols. Specifically, the uplink traffic information represents the total number and size of network traffic packets sent by the external system to the target device from the start to the end of the connection. The downlink traffic information represents the total number and size of network traffic packets sent by the target device to the external system from the start to the end of the connection.

[0048] It should be noted that some connection information can exist in both the first and second connection information, such as 5-tuple information, source MAC address, destination MAC address, and application layer protocol. Other connection information may exist only in either the first or second connection information; for example, the connection start time may be in the first connection information, while the connection termination time may be in the second. The specific content involved in the first and second connection information needs to be determined based on the actual connection between the target device and the external system, as well as the specific content of events generated by the kernel module in the target device; no specific limitations are made here.

[0049] Step A3: Combine the first connection information and the second connection information to obtain the network connection information of the target device.

[0050] The extracted first and second connection information may contain some duplicate information, such as quintuple information. During the merging of the first and second connection information, some duplicate information can be removed to obtain the final network connection information between the target device and an external system.

[0051] As can be seen from the above, for the same network connection, network connection information is extracted from its connection creation event and connection destruction event respectively, and then the network connection information extracted from these two events is merged. This results in more comprehensive network connection information and improves the completeness of network connection information acquisition.

[0052] Furthermore, as an extension of step A3 above, if the connection creation event and the connection destruction event belong to different network connections, then the first connection information extracted from the connection creation event and the second connection information extracted from the connection destruction event are different external systems corresponding to the target device. Merging these two connection information results in network connection information that is not information of a single network connection, but rather mixed with information from different external systems. Therefore, before merging the first connection information and the second connection information, it is necessary to ensure that the connection creation event and the connection destruction event corresponding to these two connection information belong to the same network connection.

[0053] Specifically, prior to step A3 above, the method may further include:

[0054] Step A01: Extract the first quintuple information from the first connection information.

[0055] The first connection information includes a 5-tuple, source MAC address, destination MAC address, application layer protocol, and other information. The 5-tuple is then selected from this extensive information.

[0056] During the extraction of quintuple information, the characteristics of quintuple information, namely source IP address, source port, destination IP address, destination port, and Layer 3 protocol, can be referenced to filter out quintuple information from the first connection information.

[0057] Step A02: Extract the second quintuple information from the second connection information.

[0058] The second connection information includes 5-tuple information, the number and size of uplink traffic packets, the number and size of downlink traffic packets, connection time, and other information. The 5-tuple information is then selected from the numerous pieces of information in the second connection information.

[0059] During the extraction of quintuple information, the characteristics of quintuple information, namely source IP address, source port, destination IP address, destination port, and Layer 3 protocol, can be referenced to filter out quintuple information from the second connection information.

[0060] Step A03: Determine whether the information in the first quintuple is the same as that in the second quintuple. If yes, proceed to step A3; otherwise, proceed to step A04.

[0061] Since the quintuple information can uniquely represent a network connection, by comparing the quintuple information, it is possible to determine whether the connection creation event corresponding to the first connection information and the connection destruction event corresponding to the second connection information originate from the same network connection.

[0062] When comparing two 5-tuples, you can compare information of the same type within each 5-tuple. Specifically, compare the source IP address, source port, destination IP address, destination port, and Layer 3 protocol. Only when all five comparison results are consistent can the two 5-tuples be considered identical. Conversely, if any one comparison result is inconsistent, the two 5-tuples are considered different.

[0063] Step A3: Combine the first connection information and the second connection information to obtain the network connection information of the target device.

[0064] Step A04: Merge the first connection information with the network connection information of the connection destruction event that matches its 5-tuple information to obtain the first network connection information of the target device; and merge the second connection information with the network connection information of the connection creation event that matches its 5-tuple information to obtain the second network connection information of the target device.

[0065] The inconsistency between the first quintuple information and the second quintuple information indicates that the corresponding connection creation event and connection destruction event do not belong to the same network connection. Therefore, for the first quintuple information, it is necessary to search for the quintuple information that matches it in the quintuple information of the network connection information corresponding to other connection destruction events, and then obtain the network connection information corresponding to the quintuple information that matches it. This information is then merged with the first network connection information to obtain the first network connection information between the target device and the first external system.

[0066] Furthermore, for the second quintuple information, it is necessary to search for the quintuple information that matches it in the quintuple information of the network connection information corresponding to other connection creation events, and then obtain the network connection information corresponding to the quintuple information that matches it, and merge it with the second network connection information to obtain the second network connection information between the target device and the second external system.

[0067] As can be seen from the above, before merging the first connection information and the second connection information, the five-tuple information in the first connection information is compared with the five-tuple information in the second connection information to determine whether the connection creation event corresponding to the first connection information and the connection destruction event corresponding to the second connection information belong to the same network connection. Only when it is determined that the two events belong to the same network connection can the first connection information and the second connection information be merged. This ensures that the final network connection information contains all the information of the same network connection, thus ensuring the accuracy of network connection information acquisition.

[0068] Furthermore, as an extension of step S201 above, the kernel module of the target device can track and generate network connection events. However, the execution entity in this embodiment does not actively obtain network connection events from the kernel module. Therefore, it is necessary to create a network socket to obtain network connection events from the kernel module and thus obtain the corresponding network connection information.

[0069] Specifically, prior to step S201 above, the method may further include:

[0070] Step B: Create a network socket that obtains network connection events from the target device's kernel module through the target device's network programming interface.

[0071] After the kernel module in the target device tracks and generates network connection events, it places the network connection events within the kernel module and does not actively send them out. Therefore, it is necessary to create a network socket to obtain network connection events from the kernel module. In this way, network connection events can be actively obtained from the kernel module of the target device through the network socket.

[0072] The creation of a network socket can be initiated by an application on the target device. This allows the application to obtain various network connection events between the target device and external systems from the kernel module, and then extract network connection information between the target device and each external system from these events.

[0073] In practical applications, network connection events mainly include connection creation events and connection destruction events. To obtain these events from the kernel module, the network socket used for retrieving these events is specified as AF_NETLINK and the protocol as NETLINK_NETFILTER. By specifying the AF_NETLINK type and NETLINK_NETFILTER protocol, it is ensured that connection creation and destruction events are obtained from the kernel module, thus ensuring accurate acquisition of network connection information.

[0074] As can be seen from the above, by creating a network socket for obtaining network connection events through the network programming interface of the application in the target device, it is possible to actively obtain network connection events between the target device and various external systems from the kernel module, ensuring the integrity of the network connection events obtained between the target device and various external systems, and thus obtaining more comprehensive network connection information between the target device and various external systems.

[0075] Furthermore, as an extension of step S201 above, the specific network connection information to be obtained can be pre-configured in the target device. In this way, after the target device obtains a network connection event from its kernel module, it will only obtain the specified network connection information from the network connection event, making the content of the obtained network connection information more standardized.

[0076] Specifically, prior to step S201 above, the method may further include:

[0077] Step C1: Determine the type of network connection information to be acquired.

[0078] In other words, what network connection information ultimately needs to be obtained? For example, the final information needed includes: a five-tuple (local IP, local port, peer IP, peer port, Layer 3 protocol UDP / TCP / ICMP), source MAC address, destination MAC address, connection start time, connection end time, uplink traffic volume, downlink traffic volume, shutdown status, VLAN, and application layer protocol.

[0079] Once the relevant personnel determine which network connection information needs to be obtained, they can input the types of this network connection information into the target device.

[0080] Step C2: Configure the name corresponding to each category in the connection information table.

[0081] The connection information table is used to categorize and store network connection information for the same network connection.

[0082] Once the target device obtains the types of network connection information it needs, it can create a connection information table, writing the types of each network connection type into the table header. In this way, all relevant information for a subsequent connection established between the target device and an external system will be stored in this connection information table.

[0083] In practical applications, connection information tables can exist in the form of key-value pairs, where the key corresponds to various network connection information, such as 5-tuple information, source MAC address, etc., and the value corresponds to the specific network connection information content obtained.

[0084] As can be seen from the above, the connection information table can be used to classify and store the relevant information for each network connection, making it easier to view the specific details of the network connection information.

[0085] Furthermore, as an extension of step S201 above, the kernel module in the target device is not loaded in the target device by default. Therefore, when it is necessary to obtain network connection information, it is necessary to first ensure that the kernel module has been loaded and running in the target device.

[0086] Specifically, prior to step S201 above, the method may include:

[0087] Step D1: Determine whether the kernel module is loaded on the target device. If yes, proceed to step S201; otherwise, proceed to step D2.

[0088] When network connection information needs to be obtained, the kernel module on the target device needs to be enabled. This allows the kernel module to listen for current and subsequent network connection events between the target device and external systems, and then obtain network connection information from these events. However, the kernel module is not loaded on the target device by default. Therefore, when obtaining network connection information, it is necessary to first ensure that the kernel module is loaded and running on the target device.

[0089] When determining whether a kernel module is loaded on a target device, one can check if a process related to the kernel module exists within the target device's processes, or perform an action to retrieve network connection events from the kernel module to see if network connection events can be obtained. The specific method for determining whether a kernel module is loaded is not limited here.

[0090] Step S201: Obtain network connection events from the kernel module of the target device.

[0091] Once it is confirmed that the kernel module is loaded in the target device, it means that the kernel module is currently able to track and generate network connection events normally, so network connection events can be obtained from the kernel module of the target device.

[0092] Step D2: Call the driver loader in the target device to load the kernel module in the target device.

[0093] After determining that the kernel module is not loaded on the target device, it means that the kernel module is not currently tracking and generating network connection events. Therefore, it is necessary to call the driver loader on the target device to load the kernel module. At this point, the kernel module can normally track and generate network connection events, and network connection events can be obtained from the target device's kernel module.

[0094] As can be seen from the above, before obtaining network connection events, it is necessary to confirm whether the kernel module in the target device is loaded. If not, the kernel module should be loaded in the target device first to ensure that the kernel module can track and generate network connection events normally, thereby ensuring that all network connection information can be obtained.

[0095] Finally, a complete example will be used to further illustrate the network connection information acquisition method provided in the embodiments of this application.

[0096] Figure 3This is a schematic diagram of the overall architecture of the network connection information acquisition method in the embodiments of this application. Figure 2 See Figure 3 As shown, the target device can be a Linux host with a Linux kernel running at its core. The Linux kernel can load the nf_conntrack kernel module, which tracks and generates network connection events between the target device and various external systems. An agent program exists at the application layer to retrieve network connection events from the nf_conntrack kernel module and then extract information about a specific network connection between the target device and a particular external system from these events.

[0097] In summary, the nf_conntrack kernel module is loaded on the Linux host, and the Agent program is run. The Agent program aggregates and processes the network connection events generated by the nf_conntrack kernel module to produce network connection information for each connection. After generating the network connection information, the Agent program can store it locally or send it to the server for further analysis.

[0098] It should be noted that the execution entity of the network connection information acquisition method provided in this application embodiment can be an Agent program installed on a Linux host. Agent program: A proxy software program installed on the host that needs to obtain access connection information. After obtaining the connection information, it stores the connection information locally or sends it to a backend processing server.

[0099] Figure 4 This is a flowchart illustrating the method for obtaining network connection information in the embodiments of this application. Figure 2 See Figure 4 As shown, the method may include:

[0100] S401: Ensure that nf_conntrack is loaded.

[0101] nf_conntrack: A Linux kernel module used to track network connection events in the system. Each connection creation, state change, and destruction generates a corresponding event.

[0102] When the agent starts, it checks whether the Linux host has nf_conntrack loaded. If not, it calls the Linux driver loader to load nf_conntrack.

[0103] S402: Initialize ConnectionMap.

[0104] The agent initializes a ConnectionMap: a hash map. The key is a 5-tuple, and the value is the network connection information corresponding to that 5-tuple. This network connection information may also include source and destination MAC addresses, the number and total size of uplink and downlink packets, etc.

[0105] S403: Initialize the socket.

[0106] Socket: The Linux socket interface, providing a set of APIs for network programming, supporting multiple types and protocols. When the specified type is AF_NETLINK and the protocol is NETLINK_NETFILTER, network connection events emitted by nf_conntrack can be retrieved.

[0107] The Agent creates and initializes a socket to obtain network connection events emitted by nf_conntrack. Currently, the network connection events obtained include connection creation events and connection destruction events.

[0108] S404: Receive connection creation event and extract network connection information.

[0109] When the agent receives a connection creation event, it extracts the 5-tuple information from it and initializes the connection information corresponding to that 5-tuple. In addition to the 5-tuple information, the connection creation event also includes the source MAC address, destination MAC address, and Layer 3 protocol. Furthermore, it can use the current event on the Linux host as the connection start event, and then insert the 5-tuple as the key and the connection information as the value into the ConnectionMap.

[0110] S405: Receives a connection creation event and extracts network connection information.

[0111] The agent receives a connection termination event. In addition to the five-tuple information, the event also includes uplink and downlink traffic statistics and the connection's closed status. The agent extracts the necessary information, uses the current system time on the Linux host as the connection termination time, and then updates the corresponding connection information in the ConnectionMap based on the five-tuple.

[0112] S406: Use the connection information in ConnectionMap as network connection information and save it to disk or send it to the server.

[0113] After processing the connection destruction event, the Agent saves the connection information in the ConnectionMap, which is the connection information extracted from the creation and destruction events of the same connection, as the final network connection information of the connection to disk or sends it to the server-side processing program.

[0114] Finally, by continuously repeating the above steps S404, S405, and S4064, all network connection information of the local machine can be obtained.

[0115] This method leverages the built-in `nf_conntrack` kernel module in Linux to track and generate network connection events. An agent program listens for these events at the application layer and aggregates them to generate network connection information. This approach obtains network connection information without requiring network packet capture or kernel drivers. It offers advantages such as low performance overhead on Linux systems, non-intrusiveness, and the ability to obtain relatively complete access connection information, making it easy to implement in practical applications.

[0116] Based on the same inventive concept, as an implementation of the above method, this application also provides a network connection information acquisition device. Figure 5 This is a schematic diagram of the network connection information acquisition device in an embodiment of this application. See also... Figure 5 As shown, the device may include:

[0117] The acquisition module 501 is used to acquire network connection events from the kernel module of the target device. The kernel module is used to track changes in network connections in the target device and generate corresponding events.

[0118] Extraction module 502 is used to extract network connection information of the target device from the network connection event.

[0119] Furthermore, the network connection events include connection creation events and connection destruction events. The extraction module is specifically used to extract the first connection information of the target device from the connection creation event; extract the second connection information of the target device from the connection destruction event; and merge the first connection information and the second connection information to obtain the network connection information of the target device.

[0120] Furthermore, the extraction module is also used to extract a first quintuple information from the first connection information; extract a second quintuple information from the second connection information; determine whether the first quintuple information and the second quintuple information are the same; if so, merge the first connection information and the second connection information to obtain the network connection information of the target device.

[0121] Furthermore, the first connection information includes at least one of the following: 5-tuple information, source MAC address, destination MAC address, and connection start time; the second connection information includes at least one of the following: 5-tuple information, connection termination time, uplink traffic information, downlink traffic information, shutdown status, virtual LAN, and application layer protocol.

[0122] Furthermore, the device further includes: a first configuration module, configured to create a network socket for obtaining network connection events from the kernel module of the target device through the network programming interface of the target device.

[0123] Furthermore, the specified type of the network socket is AF_NETLINK, and the specified protocol is NETLINK_NETFILTER.

[0124] Furthermore, the device also includes: a second configuration module, used to determine the type of network connection information to be acquired; and to configure the name corresponding to each type in a connection information table, wherein the connection information table is used to classify and store network connection information of the same network connection.

[0125] Furthermore, the device further includes: a determination module, used to determine whether the kernel module is loaded in the target device; if not, it calls the driver loader in the target device to load the kernel module in the target device.

[0126] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0127] Based on the same inventive concept, embodiments of this application also provide an electronic device. Figure 6 This is a schematic diagram of the electronic device in an embodiment of this application. See also... Figure 6 As shown, the electronic device may include: a processor 601, a memory 602, and a bus 606; wherein the processor 601 and the memory 602 communicate with each other through the bus 606; the processor 601 is used to call program instructions in the memory 602 to execute the methods in one or more of the above embodiments.

[0128] It should be noted that the descriptions of the above electronic device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the electronic device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0129] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, it controls the device where the storage medium is located to execute the methods in one or more of the above embodiments.

[0130] It should be noted that the descriptions of the storage medium embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0131] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for obtaining network connection information, characterized in that, The method includes: Network connection events are obtained from the kernel module of the target device, which is used to track changes in network connections in the target device and generate corresponding events; Extract the network connection information of the target device from the network connection events; The network connection events include connection creation events and connection destruction events. Extracting the network connection information of the target device from the network connection events includes: Extract the first connection information of the target device from the connection creation event; Extract the second connection information of the target device from the connection destruction event; The first connection information and the second connection information are combined to obtain the network connection information of the target device; Before merging the first connection information and the second connection information to obtain the network connection information of the target device, the method further includes: Extract the first quintuple information from the first connection information; Extract the second quintuple information from the second connection information; Determine whether the information in the first quintuple is the same as the information in the second quintuple; If so, then the step of merging the first connection information and the second connection information to obtain the network connection information of the target device is performed.

2. The method according to claim 1, characterized in that, The first connection information includes at least one of the following: 5-tuple information, source MAC address, destination MAC address, and connection start time. The second connection information includes at least one of the following: 5-tuple information, connection termination time, uplink traffic information, downlink traffic information, shutdown status, virtual LAN, and application layer protocol.

3. The method according to claim 1 or 2, characterized in that, Before obtaining network connection events from the kernel module of the target device, the method further includes: Create a network socket that obtains network connection events from the kernel module of the target device through the network programming interface of the target device.

4. The method according to claim 3, characterized in that, The specified network socket type is AF_NETLINK, and the specified protocol is NETLINK_NETFILTER.

5. The method according to claim 1 or 2, characterized in that, Before obtaining network connection events from the kernel module of the target device, the method further includes: Determine the type of network connection information to be acquired; The name corresponding to each category is configured in the connection information table, which is used to classify and store network connection information for the same network connection.

6. The method according to claim 1 or 2, characterized in that, Before obtaining network connection events from the kernel module of the target device, the method further includes: Determine whether the kernel module is loaded in the target device; If not, the driver loader in the target device is invoked to load the kernel module in the target device.

7. A network connection information acquisition device, characterized in that, The device includes: The acquisition module is used to acquire network connection events from the kernel module of the target device. The kernel module is used to track changes in network connections in the target device and generate corresponding events. The extraction module is used to extract the network connection information of the target device from the network connection event; The network connection events include connection creation events and connection destruction events. The extraction module is specifically used to extract the first connection information of the target device from the connection creation event; extract the second connection information of the target device from the connection destruction event; and merge the first connection information and the second connection information to obtain the network connection information of the target device. The extraction module is further configured to extract a first quintuple from the first connection information; extract a second quintuple from the second connection information; determine whether the first quintuple and the second quintuple are the same; if so, merge the first connection information and the second connection information to obtain the network connection information of the target device.

8. An electronic device, characterized in that, The electronic device includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The storage medium includes: a stored program; wherein, when the program is executed, it controls the device where the storage medium is located to perform the method as described in any one of claims 1 to 6.

Images