Methods, devices, media, and electronic equipment for detecting code manipulation behavior

Abstract

This disclosure relates to a method, apparatus, storage medium, and electronic device for detecting code operation behavior. The method includes: responding to a recording operation of a remote code repository operation log, acquiring log information corresponding to the recording operation; determining, based on the log information, whether there is an operation to push code files to the remote code repository; if it is determined that there is an operation to push code files to the remote code repository, acquiring the address of the remote code repository to which the code files are pushed; and determining, based on the address of the remote code repository and a pre-configured platform identification policy, whether the operation to push to the remote code repository complies with safe operation practices. This disclosure proposes a novel method for detecting code operation behavior.

Description

Technical Field

[0001] This disclosure relates to the field of code security management technology, specifically to a method, apparatus, medium, and electronic device for detecting code operation behavior. Background Technology

[0002] Enterprise development code is a core asset of a company. During the development process, code is generally managed using code version management tools such as Git (an open-source distributed version control system). However, there is a possibility that internal employees may unauthorizedly push enterprise code to public code hosting platforms, potentially leading to code leaks. Therefore, monitoring code push operations to code repositories is crucial.

[0003] However, the methods for detecting code push to code repositories in related technologies have certain limitations and need to be improved. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] Firstly, this disclosure provides a method for detecting code operation behavior, the method comprising:

[0006] In response to a recording operation of the remote code repository operation log, obtain the log information corresponding to the recording operation;

[0007] Determine whether there was an operation to push code files to a remote code repository based on the log information;

[0008] When it is determined that there is an operation to push code files to the remote code repository, the address of the remote code repository to which the code files are pushed is obtained;

[0009] Based on the address of the remote code repository and the pre-configured platform identification policy, it is determined whether the operation of pushing to the remote code repository complies with safe operation; wherein, the pre-configured platform identification policy is used to indicate the security scope of the operation of pushing to the remote code repository.

[0010] Secondly, this disclosure provides a code operation behavior detection device, the device comprising:

[0011] The first acquisition module is configured to acquire log information corresponding to the recording operation in response to the remote code repository operation log;

[0012] The first determining module is configured to determine, based on the log information, whether there is an operation to push code files to a remote code repository;

[0013] The second acquisition module is configured to acquire the address of the remote code repository to which the code file is pushed when it is determined that there is an operation to push code files to the remote code repository;

[0014] The second determining module is configured to determine whether the operation of pushing to the remote code repository complies with the security operation based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation of pushing to the remote code repository.

[0015] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method described in the first aspect.

[0016] Fourthly, this disclosure provides an electronic device, comprising:

[0017] A storage device on which computer programs are stored;

[0018] A processing device for executing the computer program in the storage device to implement the steps of the method described in the first aspect.

[0019] The above technical solution responds to the recording operation of remote code repository operation logs, obtains the log information corresponding to the recording operation, and determines whether there is an operation to push code files to the remote code repository based on the log information. If it is determined that there is an operation to push code files to the remote code repository, the address of the remote code repository to which the code files are pushed is further obtained. Then, based on the address of the remote code repository and the pre-configured platform identification policy, it can be determined whether the operation to push to the remote code repository complies with security operations. Considering that regardless of the tools and protocols used to push code files to various remote code repositories, remote code repository operation logs are recorded locally, monitoring the recording operation of remote code repository operation logs can obtain code operation behaviors performed for different tools, different transmission protocols, different remote code repositories, and different network environments, thereby improving detection coverage. Furthermore, since the monitoring is only of the recording operation of remote code repository operation logs, it does not intrude on the user's development process and is imperceptible to the user.

[0020] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0021] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings:

[0022] Figure 1 This is a flowchart illustrating a code manipulation behavior detection method according to an exemplary embodiment of the present disclosure.

[0023] Figure 2 This is a flowchart illustrating a code manipulation behavior detection method according to an exemplary embodiment of the present disclosure.

[0024] Figure 3 This is a block diagram illustrating a code manipulation behavior detection device according to an exemplary embodiment of the present disclosure.

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0026] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0027] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0028] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0032] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, monitoring or use of the data) shall comply with the requirements of relevant laws and regulations and related provisions, and shall be acquired, monitored or used with the user's authorization.

[0033] In related technologies, there are three solutions to prevent code leakage.

[0034] The first approach is "traffic auditing," which involves auditing the computer's network traffic. This approach first monitors the internet traffic of the terminal device, identifies code snippets from HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) traffic, detects push requests, and then extracts the remote code repository address from the push hosting platform. Based on this remote repository address, it audits the code push operation to determine its compliance. However, this approach has low coverage, only auditing HTTP / HTTPS protocols and not SSH (Secure Shell) protocols. Furthermore, user request traffic must pass through the auditing device, limiting its effectiveness to corporate network environments; it cannot detect private home networks or hotspots.

[0035] The second approach is "hosting platform monitoring," which involves monitoring publicly available code hosting platforms such as GitHub and periodically scanning the publicly available code on these platforms. If code related to the company is found during the scan, it is considered a code leak. However, these monitoring tools are often not timely and cannot fully cover various hosting platforms or remote code repositories, making it impossible to determine whether the code was pushed by company employees.

[0036] The third approach is "git hooks," a built-in feature of the Git tool. Git comes with many hook scripts that are triggered when a user performs a push operation. This approach defines a push auditing hook script that is automatically triggered when a user pushes a file. This script retrieves the pushed code file and the remote repository address, and then determines the compliance of the push operation based on the remote repository address. This approach is more intrusive to the user's development workflow and may conflict with the user's existing development management software.

[0037] It is evident that the code push operation detection methods in the aforementioned related technologies each have shortcomings and need to be improved.

[0038] Therefore, this disclosure proposes a code operation behavior detection method. By monitoring the recording operations of remote code repository operation logs, in response to these recording operations, the method obtains the corresponding log information. Based on the log information, it determines whether an operation to push code files to a remote code repository exists. If such an operation is confirmed, the method further obtains the address of the remote code repository to which the code files were pushed. Then, based on the address of the remote code repository and a pre-configured platform identification policy, it determines whether the operation to push the code files to the remote code repository complies with security regulations. Considering that regardless of the tools and protocols used to push code files to various remote code repositories, remote code repository operation logs are recorded locally, monitoring the recording operations of these logs allows for the identification of code operation behaviors performed using different tools, different transmission protocols, different remote code repositories, and different network environments. This improves detection coverage. Furthermore, since the monitoring only involves the recording operations of remote code repository operation logs, it does not intrude on the user's development process and is imperceptible to the user.

[0039] Figure 1 This is a flowchart illustrating a code manipulation behavior detection method according to an exemplary embodiment of the present disclosure. This code manipulation behavior detection method can be applied to electronic devices, see below. Figure 1 The code operation behavior detection method includes the following steps:

[0040] S110, responding to the recording operation of the remote code repository operation log, retrieves the log information corresponding to the recording operation.

[0041] S120, determine whether there is an operation to push code files to a remote code repository based on log information.

[0042] S130: When it is determined that there is an operation to push code files to a remote code repository, obtain the address of the remote code repository to which the code files are pushed.

[0043] S140 determines whether the operation of pushing to the remote code repository complies with safe operation based on the address of the remote code repository and the pre-configured platform identification policy.

[0044] In some implementations, a pre-configured platform identification policy can be used to indicate the security scope of operations pushed to a remote code repository. That is, the pre-configured platform identification policy indicates the range within which the remote code repository's address constitutes a secure operation, and the range within which such an operation is not secure.

[0045] Considering that code operations performed on remote code repositories hosted on remote platforms using code version control tools such as Git, such as code push or pull operations, will record operations in the remote code repository operation log, i.e., write operation records to the remote code repository operation log file, this embodiment of the disclosure can monitor whether there are recorded operations in the remote code repository operation log. If a recording operation is detected in the remote code repository operation log, the log information corresponding to the recording operation can be obtained in response to the recording operation.

[0046] Furthermore, after obtaining the log information, it can be determined whether there was an operation to push code files to a remote code repository. If it is determined that there was an operation to push code files to a remote code repository, the address of the remote code repository to which the code files were pushed can be obtained.

[0047] Furthermore, after obtaining the address of the remote code repository, it is possible to determine whether the operation of pushing to the remote code repository complies with security procedures based on the address of the remote code repository and the pre-configured platform identification policy.

[0048] The method of this disclosure monitors the recording operations of remote code repository operation logs. In response to these recording operations, log information corresponding to the recording operation is obtained. Based on the log information, it is determined whether an operation to push code files to a remote code repository exists. If such an operation exists, the address of the remote code repository to which the code files were pushed is further obtained. Then, based on the address of the remote code repository and a pre-configured platform identification policy, it can be determined whether the operation to push the code files to the remote code repository complies with security regulations. Considering that regardless of the tools or protocols used to push code files to various remote code repositories, remote code repository operation logs are recorded locally, monitoring the recording operations of these logs allows for the identification of code operation behaviors performed using different tools, different transmission protocols, different remote code repositories, and different network environments. This improves detection coverage. Furthermore, since the monitoring only involves the recording of remote code repository operation logs, it does not intrude on the user's development process and is imperceptible to the user.

[0049] In some implementations, to improve the accuracy of code operation behavior detection, the latest log information corresponding to the recorded operation can be obtained.

[0050] Furthermore, considering that newer log information is written later in the remote code repository operation log file, in some implementations, the latest log information corresponding to the record operation can be obtained by reading the content of the last line of the remote code repository operation log file.

[0051] There are several methods to determine when a remote code repository operation log has been logged.

[0052] Considering that recording remote code repository operation logs involves writing operating system files, in some implementations, the method of this disclosure may further include the following steps:

[0053] When a file write operation is detected on the operating system, the file write path associated with the file write operation is obtained; if the file write path contains a preset specified path, it is determined that a remote code repository operation log recording operation has occurred, wherein the preset specified path represents the storage path characteristics of the remote code repository operation log.

[0054] Recording remote code repository operation logs inevitably involves file write operations, and the storage location of remote code repository operation logs conforms to certain path characteristics. Based on this characteristic, in this embodiment of the disclosure, file write operations in the operating system can be monitored first. If a file write operation is detected on the operating system, it indicates that a remote code repository operation log recording operation may have occurred. Therefore, the file write path associated with the file write operation can be further obtained, and it can be determined whether the file write path includes the characteristics of the storage path corresponding to the remote code repository operation log, that is, whether it includes a preset specified path. If the file write path includes the preset specified path, it can be determined that a remote code repository operation log recording operation has occurred.

[0055] For example, the storage path corresponding to the remote code repository operation log may include "git / logs / refs / remotes / ". Therefore, if the obtained file write path includes "git / logs / refs / remotes / ", it can be determined that a remote code repository operation log recording operation has occurred.

[0056] Listening for file write operations on the operating system can be achieved by calling relevant interfaces or functions, which will not be elaborated here.

[0057] In some implementations, after determining that a recording operation has occurred in the remote code repository operation log, the file write path corresponding to the file write operation can be determined to be the storage path corresponding to the remote code repository operation log. Therefore, the log information corresponding to the recording operation can be obtained from the remote code repository operation log under the file write path.

[0058] In some implementations, obtaining the address of the remote code repository to which the code files are pushed may include the following steps:

[0059] Determine the local code repository based on the file write path; determine the address of the remote code repository based on the configuration file in the local code repository.

[0060] Considering that path directories follow certain rules, for example, different files under the same git project may have the same first few path directories, only the specific file content may differ, while the last few path directories may differ. Therefore, in this embodiment of the disclosure, after determining the file write path, the local code repository can be further determined based on the file write path, and then the address of the remote code repository can be determined based on the configuration file in the local code repository.

[0061] In some implementations, the operations of finding configuration files from the local code repository and further determining the address of the remote code repository from the configuration files can be performed using keyword recognition.

[0062] In some implementations, determining whether an operation to push code files to a remote code repository exists based on log information can also be done through key character recognition. For example, if characters representing a push operation are identified from the log information, such as the key character "push", it can be determined that an operation to push code files to a remote code repository exists.

[0063] In other implementations, the storage paths for the remote code repository operation logs corresponding to all projects can be pre-defined. Then, each remote code repository operation log storage path is monitored. If a file stored under that path changes, a recording operation in the code repository operation log is detected. Furthermore, log information from the changed remote code repository operation logs can be obtained.

[0064] In this embodiment of the disclosure, the local code repository can be determined based on the storage path of the remote code repository operation log where the file has changed, and the address of the remote code repository can be further determined based on the configuration file in the local code repository.

[0065] Furthermore, considering the potential delays in monitoring the results of file write operations or monitoring the storage paths of operation logs in various remote code repositories—for example, if the operating system only records the file write operation a minute after the operation, the obtained remote code repository operation logs may not be up-to-date, resulting in low timeliness of the detection results—in some implementations, to improve the timeliness of the detection results, when it is determined that an operation to push code files to a remote code repository exists, obtaining the address of the remote code repository to which the code files were pushed may include the following steps:

[0066] When it is determined that there is an operation to push code files to the code repository, the operation time corresponding to the operation is obtained from the log information; if the difference between the operation time and the current time is less than the preset duration, the address of the remote code repository to which the code files were pushed is obtained.

[0067] The log information can record the operation time corresponding to the operation of pushing code files to a remote code repository. Therefore, in this embodiment of the disclosure, if it is determined from the log information that there is an operation of pushing code files to a remote code repository, the operation time corresponding to the operation can be obtained from the log information. If the difference between the operation time and the current time is less than a preset duration, the step of obtaining the address of the remote code repository to which the code file was pushed is further executed. Otherwise, the subsequent steps are not executed, thereby improving the timeliness of the detection results.

[0068] Furthermore, considering that the delay in the monitoring results may be due to performance issues, the step of obtaining the address of the remote code repository to which the code file is pushed is only executed if the difference between the operation time and the current time is less than a preset duration. Otherwise, the subsequent steps are not executed. This can save processing resources and avoid further deterioration of processing performance.

[0069] As can be seen from the foregoing, a pre-configured platform identification policy can be used to indicate the security scope of operations pushed to remote code repositories. In this case, in some implementations, the pre-configured platform identification policy includes a whitelist of code hosting platform addresses, which are used to indicate that operations pushed to code hosting platform addresses outside the whitelist are not in accordance with security regulations; or, the pre-configured platform identification policy includes a blacklist of code hosting platform addresses, which are used to indicate that operations pushed to code hosting platform addresses on the blacklist are not in accordance with security regulations.

[0070] In this embodiment of the disclosure, when the pre-configured platform identification policy includes a whitelist of code hosting platform addresses, if the address of the remote code repository belongs to a code hosting platform address outside the whitelist, the operation of pushing to the remote code repository is not a secure operation. When the pre-configured platform identification policy includes a blacklist of code hosting platform addresses, if the address of the remote code repository belongs to a code hosting platform address on the blacklist, the operation of pushing to the remote code repository is not a secure operation.

[0071] In this embodiment of the disclosure, the user may know certain specific illegal addresses. In this case, the user can set up a blacklist of addresses, and the addresses in the blacklist are all addresses that do not comply with the security operation.

[0072] Furthermore, in this embodiment of the disclosure, considering that Internet website addresses are added quickly, diverse, and abundant, users may not be able to list all blacklisted addresses. In this case, users can set up a whitelist of addresses, where the whitelisted addresses are code file push addresses that comply with safe operations. Addresses other than those on the whitelist can then be identified as addresses that do not comply with safe operations.

[0073] In some implementations, the whitelist address and blacklist address of the code hosting platform can be configured by the server-side personnel and sent to the electronic devices of each code operation behavior detection method.

[0074] In some implementations, after determining whether the operation of pushing to the remote code repository complies with security procedures based on the address of the remote code repository and a pre-configured platform identification policy, it may be found that the operation of pushing to the remote code repository does not comply with security procedures. In this case, the method of this disclosure embodiment may further include the following steps:

[0075] When it is determined that pushing an operation to a remote code repository does not comply with safe practices, a violation record is generated. The violation record is used to record unsafe behaviors of pushing code files to a remote code repository.

[0076] In this embodiment of the disclosure, if it is determined that the operation of pushing to the remote code repository does not comply with the security operation, a violation operation record is generated. The violation operation record is used to record unsafe behavior of pushing code files to the remote code repository. Therefore, when a violation operation record is obtained, it can be determined that there is unsafe behavior of pushing code files to the remote code repository.

[0077] In some implementations, after determining whether the operation of pushing to the remote code repository complies with security procedures based on the address of the remote code repository and a pre-configured platform identification policy, it may be found that the operation of pushing to the remote code repository does not comply with security procedures. In this case, the method of this disclosure embodiment may further include the following steps:

[0078] Based on the file attribute information of the code file and the pre-configured file identification policy, it is determined whether the code file belongs to the specified protected code file; when it is determined that the code file belongs to the specified protected file, information is generated to indicate the risk of the specified protected code file being distributed externally.

[0079] In some cases, considering that even if files are pushed to a public code hosting platform, if these pushed code files are not sensitive files, they do not need to be defined as violations and there may not be a risk of data leakage, in this embodiment of the disclosure, after determining that the operation of pushing to a remote code repository does not comply with security operations, it is possible to further determine whether the code file belongs to a designated protected code file based on the file attribute information of the code file and the pre-configured file identification policy. If it is determined that the code file belongs to a designated protected file, information is generated to indicate the risk of externally distributing the designated protected code file.

[0080] In some implementations, the pre-configured file identification strategy includes at least one of the following attribute information: the content of the file to be protected, the file type, the file name, and the file size.

[0081] In this embodiment of the disclosure, when the file attribute information of the code file matches the attribute information included in the pre-configured file identification strategy, it is determined that the code file belongs to the specified protected code file.

[0082] In some implementations, the generated violation records or information indicating the risk of distributing designated protected code files can be sent to the server for further auditing or analysis by server personnel.

[0083] In some implementations, the method of this disclosure may further include the following steps:

[0084] Determine the target commit hash value corresponding to the operation based on the log information; determine the code file corresponding to the target commit hash value based on the correspondence between the commit hash value and the code file.

[0085] In this embodiment of the disclosure, the correspondence between the commit hash value and the code file is recorded locally, and the log information in the remote code repository operation log can record the target commit hash value corresponding to the operation behavior. Thus, the target code file corresponding to this operation behavior can be found through the target commit hash value.

[0086] Figure 2 This is a flowchart illustrating a code manipulation behavior detection method according to an exemplary embodiment of the present disclosure. This code manipulation behavior detection method can be applied to electronic devices, see below. Figure 2 The code operation behavior detection method includes the following steps:

[0087] S201 monitors for file write operations occurring on the operating system.

[0088] S202, when a file write operation is detected on the operating system, obtain the file write path associated with the file write operation.

[0089] S203, determine whether the file write path includes the preset specified path.

[0090] S204: If the file write path includes a preset specified path, retrieve the latest log information from the remote code repository operation log under the file write path. Otherwise, return to step S210.

[0091] S205, determine whether the log information includes the character "push", and whether the difference between the operation time corresponding to the log information and the current time is less than the preset duration.

[0092] S206: If the log information includes the character "push", and the difference between the operation time corresponding to the log information and the current time is less than the preset duration, determine the local code repository based on the file write path, and determine the address of the remote code repository based on the configuration file in the local code repository. Otherwise, return to step S210.

[0093] S207. Determine the target commit hash value corresponding to the operation behavior based on the log information, and determine the code file corresponding to the target commit hash value based on the correspondence between the commit hash value and the code file.

[0094] S208 determines whether the operation of pushing to the remote code repository complies with safe operation based on the address of the remote code repository and the pre-configured platform identification policy.

[0095] S209: When it is determined that the operation of pushing to the remote code repository does not comply with security procedures, the code file is determined to be a designated protected code file based on the file attribute information of the code file and the pre-configured file identification policy.

[0096] S210, when it is determined that the code file belongs to the specified protected file, generates information to indicate the risk of distributing the specified protected code file.

[0097] The detailed description of steps S201-S210 can be found in the foregoing embodiments, and will not be repeated here.

[0098] Figure 3 This is a block diagram illustrating a code manipulation behavior detection device according to an exemplary embodiment of the present disclosure, with reference to... Figure 3 The code operation behavior detection device 300 includes:

[0099] The first acquisition module 310 is configured to acquire log information corresponding to the recording operation in response to the recording operation of the remote code repository operation log;

[0100] The first determining module 320 is configured to determine, based on the log information, whether there is an operation to push code files to a remote code repository.

[0101] The second acquisition module 330 is configured to acquire the address of the remote code repository to which the code file is pushed when it is determined that there is an operation to push code files to the remote code repository;

[0102] The second determining module 340 is configured to determine whether the operation of pushing to the remote code repository complies with the security operation based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation of pushing to the remote code repository.

[0103] Optionally, the code operation behavior detection device 300 further includes:

[0104] The third determining module is configured to determine whether the code file belongs to a specified protected code file based on the file attribute information of the code file and a pre-configured file identification strategy;

[0105] The first generation module is configured to generate information indicating the risk of distributing the specified protected code file when it is determined that the code file belongs to a specified protected file.

[0106] Optionally, the code operation behavior detection device 300 further includes:

[0107] The second generation module is configured to generate a violation record when it is determined that the operation of pushing to the remote code repository does not comply with the security operation. The violation record is used to record the unsafe behavior of pushing the code file to the remote code repository.

[0108] Optionally, the pre-configured file identification strategy includes at least one of the following attribute information: the content of the file to be protected, the file type, the file name, and the file size.

[0109] Optionally, the pre-configured platform identification policy includes a whitelist of code hosting platform addresses, which are used to indicate that operations pushed to code hosting platform addresses outside the whitelist are not in accordance with security practices; or;

[0110] The pre-configured platform identification policy includes a blacklist of code hosting platform addresses, which are used to indicate that operations pushed to code hosting platform addresses on the blacklist are not in accordance with security practices.

[0111] Optionally, the code operation behavior detection device 300 further includes:

[0112] The third acquisition module is configured to acquire the file write path associated with the file write operation when a file write operation is detected on the operating system.

[0113] The fourth determining module is configured to determine that a recording operation of the code repository operation log has occurred when the file writing path contains a preset specified path, wherein the preset specified path represents the storage path characteristics of the code repository operation log.

[0114] Optionally, the second acquisition module 330 includes:

[0115] The first determining submodule is configured to determine the local code repository based on the file write path;

[0116] The second determining submodule is configured to determine the address of the remote code repository based on the configuration file in the local code repository.

[0117] Optionally, the second acquisition module 330 includes:

[0118] The first acquisition submodule is configured to, when it is determined that there is an operation to push code files to the code repository, obtain the operation time corresponding to the operation based on the log information;

[0119] The second acquisition submodule is configured to acquire the address of the remote code repository to which the code file is pushed when the difference between the operation time and the current time is less than a preset duration.

[0120] Optionally, the code operation behavior detection device 300 further includes:

[0121] The fifth determining module is configured to determine the target commit hash value corresponding to the operation based on the log information;

[0122] The sixth determining module is configured to determine the code file corresponding to the target submission hash value based on the correspondence between the submission hash value and the code file.

[0123] The following is for reference. Figure 4 This diagram illustrates a structural schematic of an electronic device 400 suitable for implementing embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, devices such as computers and laptops. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0124] like Figure 4 As shown, electronic device 400 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from storage device 408 into random access memory (RAM) 403. RAM 403 also stores various programs and data required for the operation of electronic device 400. Processing device 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0125] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0126] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 409, or installed from storage device 408, or installed from ROM 402. When the computer program is executed by processing device 401, it performs the functions defined in the methods of embodiments of this disclosure.

[0127] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, solid-state drive, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0128] In some implementations, electronic devices can communicate using any currently known or future-developed network protocol, such as HTTP, and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0129] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0130] The aforementioned computer-readable medium carries one or more programs. When the electronic device executes the aforementioned one or more programs, the electronic device causes the following actions: in response to a recording operation of a remote code repository operation log, to obtain log information corresponding to the recording operation; to determine, based on the log information, whether there is an operation to push code files to the remote code repository; if it is determined that there is an operation to push code files to the remote code repository, to obtain the address of the remote code repository to which the code files are pushed; and to determine, based on the address of the remote code repository and a pre-configured platform identification policy, whether the operation to push to the remote code repository complies with a secure operation; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation to push to the remote code repository.

[0131] The program code can execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0133] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules are not, in some cases, intended to limit the functionality of the module itself.

[0134] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0135] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0136] The description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0137] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0138] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A method of detecting code operational behavior, the method comprising: The method comprises: acquiring a file write path associated with a file write operation when a file write operation is detected on an operating system; determining that a record operation of a remote code repository operation log occurs on the operating system when the file write path contains a preset specified path, wherein the preset specified path represents a storage path feature of the code repository operation log; obtaining log information corresponding to the record operation from the operating system in response to the record operation of the remote code repository operation log; determining whether there is an operation of pushing a code file to a remote code repository according to the log information; acquiring an operation time corresponding to the operation according to the log information when it is determined that there is an operation of pushing a code file to the code repository; acquiring an address of the remote code repository to which the code file is pushed in the case where a difference between the operation time and a current time is less than a preset time length; determining whether the operation of pushing to the remote code repository conforms to a safe operation according to the address of the remote code repository and a preconfigured platform identification strategy, wherein the preconfigured platform identification strategy is used to indicate a safe category of the operation of pushing to the remote code repository.

2. The method of claim 1, wherein, When it is determined that the operation of pushing to the remote code repository does not conform to the safe operation, the method further comprises: determining whether the code file belongs to a specified protected code file according to file attribute information of the code file and a preconfigured file identification strategy; generating information indicating that there is a risk of exporting a specified protected code file when it is determined that the code file belongs to a specified protected file.

3. The method of claim 1, wherein, The method further comprises: generating a violation operation record when it is determined that the operation of pushing to the remote code repository does not conform to the safe operation, wherein the violation operation record is used to record an unsafe behavior of pushing the code file to the remote code repository.

4. The method of claim 2, wherein, The preconfigured file identification strategy comprises at least one of specified to-be-protected file content, file type, file name, and file size.

5. The method of claim 1, wherein, The preconfigured platform identification strategy comprises a code hosting platform whitelist address, wherein the code hosting platform whitelist address is used to indicate that the operation of pushing to a code hosting platform address outside the whitelist address does not conform to the safe operation. Or; The preconfigured platform identification strategy comprises a code hosting platform blacklist address, wherein the code hosting platform blacklist address is used to indicate that the operation of pushing to a code hosting platform address on the blacklist address does not conform to the safe operation.

6. The method of claim 1, wherein, The acquiring of the address of the remote code repository to which the code file is pushed comprises: determining a local code repository according to the file write path; determining the address of the remote code repository according to a configuration file in the local code repository.

7. The method of claim 1, wherein, The method further comprises: determining a target commit hash value corresponding to the operation according to the log information; determining the code file corresponding to the target commit hash value according to a correspondence between a commit hash value and a code file.

8. A code operation behavior detection device, characterized in that, The apparatus comprises: a third acquiring module configured to acquire a file write path associated with a file write operation when a file write operation is detected on an operating system; A fourth determining module is configured to determine that the operating system is in a record operation of a remote code repository operation log when the file writing path contains a preset specified path, where the preset specified path represents a storage path feature of the code repository operation log; A first obtaining module is configured to obtain log information corresponding to the record operation of the remote code repository operation log from the operating system in response to the record operation of the remote code repository operation log; A first determining module is configured to determine whether there is an operation of pushing a code file to a remote code repository according to the log information; A second obtaining module is configured to obtain an operation time corresponding to the operation according to the log information when it is determined that there is the operation of pushing the code file to the code repository, and obtain an address of the remote code repository to which the code file is pushed when a difference between the operation time and a current time is less than a preset time length. A second determining module is configured to determine whether the operation of pushing to the remote code repository conforms to a safe operation according to the address of the remote code repository and a preconfigured platform identification strategy, where the preconfigured platform identification strategy is used to indicate a safe category of the operation of pushing to the remote code repository.

9. A computer readable medium having stored thereon a computer program, characterized in that, The program is executed by a processing device to implement the steps of the method in any one of claims 1-7.

10. An electronic device, comprising: Comprise: A storage device having a computer program stored thereon; A processing device for executing the computer program in the storage device to implement the steps of the method in any one of claims 1-7.

Images