A cloud desktop file tracking method and system

Abstract

This invention relates to a cloud desktop file tracking method, system, electronic device, and storage medium, belonging to the field of file tracking technology. The method includes: configuring file tracking rules; determining whether to activate a filtering driver module based on a switch in the file tracking rules; if the filtering driver module is activated, monitoring file creation, modification, renaming, and deletion events; if an event is detected, triggering the corresponding callback function to obtain the operation type, process name, and file information, and matching the file information with the file tracking rules; if the file information matches the file tracking rules, recording a log, determining whether the deleted file needs remote backup, and if so, backing it up and marking it as such; performing structured processing on the log to generate file tracking records; reporting the file tracking records and uploading the backup file to the cloud management platform; the cloud management platform processes and displays the file tracking records and stores the backup file. This invention can track all files.

Description

Technical Field

[0001] This invention relates to the field of file tracking technology, and more specifically to a cloud desktop file tracking method, system, electronic device, and storage medium. Background Technology

[0002] Existing document tracking technologies include:

[0003] 1. File Synchronization and Version Control: File tracking in a cloud desktop environment can be achieved through file synchronization and version control mechanisms. This can be done by using cloud storage services (such as Dropbox, Google Drive, OneDrive, etc.) to automatically synchronize and back up files and record file version history. When a file is modified or deleted, its change history and historical versions can be tracked.

[0004] 2. Windows operating system APIs: For example, use FindFirstChangeNotification and ReadDirectoryChanges to monitor the creation, modification, or deletion of Windows files or directories.

[0005] Problems with existing technical solutions:

[0006] The disadvantages of Option 1 are that it relies on third-party cloud storage services, the user configuration process is cumbersome, it has high network requirements, real-time performance cannot be guaranteed, and only a limited number of file directories can be configured.

[0007] The disadvantage of Option 2 is that it requires maintaining a background application layer program, which may be stopped by the user or blocked by antivirus software, and it can only monitor a specific folder. Summary of the Invention

[0008] In view of the shortcomings of the prior art, the purpose of the invention is to provide a cloud desktop file tracking method, system, electronic device and storage medium that can track all files in the system.

[0009] A first aspect of the present invention provides a cloud desktop file tracking method, comprising:

[0010] Administrators configure file tracking rules in the cloud management platform. The file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

[0011] The rule management module obtains the file tracking rules from the cloud management platform via an HTTP interface, and determines whether to start the filter driver module based on the switch in the file tracking rules;

[0012] If the determination result is to start the filter driver module, the filter driver module listens for file creation, modification, renaming and deletion events;

[0013] If the filter driver module detects file creation, modification, renaming, and deletion events, it triggers the execution of the corresponding callback function to obtain the operation type, process name, and file information, and matches the file information with the file tracking rules;

[0014] If the file information matches the file tracking rules, a log is recorded, including the time, operation type, process name, and file information.

[0015] The filter driver module determines whether a deleted file needs to be remotely backed up. If the determination result is that the deleted file needs to be remotely backed up, the filter driver module backs up the file and marks it as a backup before the file is deleted.

[0016] The log processing module performs structured processing on the logs to generate file tracking records;

[0017] The data reporting module reports the file tracking records and uploads the backup files to the cloud management platform;

[0018] The cloud management platform processes and displays the file tracking records and stores backup files.

[0019] Furthermore, the aforementioned cloud desktop file tracking method also includes:

[0020] If the file information does not match the file tracking rules;

[0021] The filter driver module monitors file creation, modification, renaming, and deletion events.

[0022] Furthermore, the aforementioned cloud desktop file tracking method also includes:

[0023] Determine whether the deleted file needs to be remotely backed up; if the result is that the deleted file does not need to be remotely backed up.

[0024] The log processing module performs structured processing on the logs to generate file tracking records;

[0025] The data reporting module periodically reports the file tracking records and uploads the tracking records to the cloud management platform;

[0026] The cloud management platform processes and displays file tracking records and stores backup files.

[0027] Furthermore, in the aforementioned cloud desktop file tracking method, the data reporting module reports file tracking records in the following ways: reporting according to the reporting frequency in the file tracking rules.

[0028] Furthermore, in the aforementioned cloud desktop file tracking method, the data reporting module, rule management module, filter driver module, and log processing module are all located on the cloud desktop.

[0029] Furthermore, in the aforementioned cloud desktop file tracking method, the file information includes at least: path, name, size, and MD5 hash.

[0030] A second aspect of the present invention also proposes a cloud desktop file tracking system, comprising:

[0031] The cloud management platform is used by administrators to configure file tracking rules, store and display file tracking records, and manage backups of deleted files.

[0032] The rule management module is used to obtain file tracking rules through the communication mechanism of the cloud management platform, and to start or stop the filtering driver module according to the switches in the file tracking rules;

[0033] The filter driver module is used to monitor file creation, renaming, modification, and deletion events through Windows drivers, obtain file information, generate logs, back up files, and create tags before deleting them.

[0034] The log processing module is used to perform structured processing on the logs generated by the filtering driver module and generate file tracking records;

[0035] The data reporting module is used to report tracking records according to the reporting frequency and upload backup files to the cloud management platform.

[0036] Furthermore, in the aforementioned cloud desktop file tracking system, the file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

[0037] A third aspect of the present invention also provides an electronic device comprising: a processor and a memory;

[0038] The processor executes a cloud desktop file tracking method as described above by calling programs or instructions stored in the memory.

[0039] In a fourth aspect, the present invention also provides a computer-readable storage medium storing a program or instructions that cause a computer to perform a cloud desktop file tracking method as described in any one of the above claims.

[0040] The beneficial effects of this invention are as follows: This invention can track all files under the operating system by default, and can also be configured to track specific file directories; by configuring multiple target file extensions, it can track specific file types; it supports configuration file deletion and backup strategies, automatically backing up files to the cloud management platform server before deletion, and allowing restoration when necessary; the design of rule management modules, filter driver modules, log processing modules, and data reporting modules achieves low-coupling communication between modules, which helps save development and maintenance costs; the filter driver module, implemented based on system kernel technology, can track all files within the system with low performance overhead and high reliability; it can track all file change events within the system in real time, record relevant file information when events occur, and then upload the tracking records to the cloud management platform via the network for subsequent tracking and auditing. Attached Figure Description

[0041] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0042] Figure 1 A cloud desktop file tracking method provided in this embodiment of the invention Figure 1 ;

[0043] Figure 2 A cloud desktop file tracking method provided in this embodiment of the invention Figure 2 ;

[0044] Figure 3 A cloud desktop file tracking method provided in this embodiment of the invention Figure 3 ;

[0045] Figure 4 A diagram of a cloud desktop file tracking system provided in an embodiment of the present invention;

[0046] Figure 5 This is a schematic block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0047] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0048] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0049] In the description of this invention, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0050] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0051] This invention proposes a cloud desktop file tracking method, system, electronic device, and storage medium, which can track all files within the system with low performance overhead and high reliability.

[0052] Method Implementation Examples

[0053] Before introducing this method, let me first introduce the technical terms involved in this patent.

[0054] Cloud desktop: A virtual desktop solution based on cloud computing technology that moves the traditional desktop environment to the cloud. Users can access and use their own desktop environment through a network connection without relying on specific physical devices.

[0055] File tracking refers to the process of monitoring, recording, and tracking the activities and changes of files or documents in real time. It helps users or organizations track events such as file creation, modification, and deletion, while recording information such as file path, size, and timestamps to improve the security, compliance, and visibility of file management.

[0056] Figure 1 A cloud desktop file tracking method provided in this embodiment of the invention Figure 1 .

[0057] In a first aspect, embodiments of the present invention provide a cloud desktop file tracking method, combined with Figure 1 It includes nine steps, S1 to S9:

[0058] S1: The administrator configures file tracking rules in the cloud management platform. The file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

[0059] Specifically, in this embodiment of the invention, the administrator configures file tracking rules on the cloud management platform, such as switches, file extensions, file paths, specified directories, operation types, excluded directories, whether files need to be backed up or deleted, and reporting frequency.

[0060] It should be understood that file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency. In some embodiments, other file tracking rules may also be included, but this does not limit the scope of protection of the present invention.

[0061] S2: The rule management module obtains the file tracking rules from the cloud management platform via an HTTP interface, and determines whether to start the filter driver module based on the switch in the file tracking rules.

[0062] Specifically, in this embodiment of the invention, the rule management module obtains file tracking rules from the cloud management platform via an HTTP interface: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency. Based on the switch in the file tracking rules, it determines whether to start the filtering driver module.

[0063] S3: If the judgment result is to start the filter driver module, the filter driver module listens for file creation, modification, renaming and deletion events.

[0064] Specifically, in this embodiment of the invention, the filter driver module is activated based on the switch in the file tracking rules. If the activation result is to activate the filter driver module, the Windows driver of the filter driver module monitors the creation, modification, renaming, and deletion events of files.

[0065] S4: If the filter driver module detects file creation, modification, renaming, and deletion events, it triggers the corresponding callback function to execute, obtains the operation type, process name, and file information, and matches the file information with the file tracking rules.

[0066] Specifically, in this embodiment of the invention, if the Windows driver of the filtering driver module detects file creation, modification, renaming and deletion events, it triggers the execution of the corresponding callback function to obtain the operation type, process name and file information, and matches the file information such as path, name, size and md5 with the file tracking rules.

[0067] S5: If the file information matches the file tracking rules, log the information, including the time, operation type, process name, and file information.

[0068] Specifically, if the file information matches the file tracking rules, the creation, modification, renaming, and deletion logs are recorded.

[0069] S6: Determine whether the deleted file needs to be backed up remotely. If the result is that the deleted file needs to be backed up remotely, the filter driver module backs up the file and marks it as a backup before deletion.

[0070] Specifically, in this embodiment of the invention, after generating the deletion event log, it is determined whether the deleted file needs to be remotely backed up. If the determination result is that the deleted file needs to be remotely backed up, the filter driver module backs up the file and marks it as a backup before the file is deleted.

[0071] S7: The log processing module performs structured processing on the logs and generates file tracking records.

[0072] Specifically, in this embodiment of the invention, after generating creation, modification, and deletion event logs, the log processing module performs structured processing on the logs to generate file tracking records.

[0073] S8: The data reporting module reports file tracking records and uploads backup files to the cloud management platform.

[0074] Specifically, in this embodiment of the invention, after generating the file tracking record, the data reporting module reports the file tracking record and uploads the backup file to the cloud management platform.

[0075] S9: The cloud management platform processes and displays file tracking records and stores backup files.

[0076] Specifically, in this embodiment of the invention, files are automatically backed up to the cloud management platform server before being deleted, and can be restored when necessary, thus improving the user experience.

[0077] Figure 2A cloud desktop file tracking method provided in this embodiment of the invention Figure 2 .

[0078] Furthermore, the aforementioned cloud desktop file tracking method, combined with Figure 2 It also includes two steps, S21 and S22:

[0079] S21: If the file information does not match the file tracking rules;

[0080] S22: The filter driver module listens for file creation, modification, renaming, and deletion events.

[0081] Specifically, in this embodiment of the invention, if the Windows driver of the filter driver module detects file creation, modification, renaming, and deletion events, it determines whether the file information matches the file tracking rules. If the file information does not match the file tracking rules, the Windows driver of the filter driver module re-monitors for file creation, modification, renaming, and deletion events.

[0082] Figure 3 A cloud desktop file tracking method provided in this embodiment of the invention Figure 3 .

[0083] Furthermore, the aforementioned cloud desktop file tracking method, combined with Figure 3 It also includes four steps, S31 to S34:

[0084] S31: Determine whether the deleted file needs to be remotely backed up. If the result is that the deleted file does not need to be remotely backed up;

[0085] S32: The log processing module performs structured processing on the logs and generates file tracking records;

[0086] S33: The data reporting module periodically reports file tracking records and uploads them to the cloud management platform;

[0087] S34: The cloud management platform processes and displays file tracking records.

[0088] Specifically, in this embodiment of the invention, if the determination result is that the file extension and file path of the deleted file detected by the Windows driver of the filter driver module match the file extension and file path in the file tracking rules, the file path, time, size and other information of the deleted event are obtained, and after generating the deleted event log, it is determined whether the deleted file needs to be remotely backed up. If the determination result is that the deleted file does not need to be remotely backed up, the log processing module performs structured processing on the log to generate file tracking records. The data reporting module periodically reports the file tracking records and uploads them to the cloud management platform. The cloud management platform processes and displays the file tracking records.

[0089] Furthermore, in the aforementioned cloud desktop file tracking method, the data reporting module reports file tracking records in the following ways: reporting according to the reporting frequency in the file tracking rules.

[0090] Specifically, in this embodiment of the invention, the data reporting module reports file tracking records in the following ways: reporting according to the reporting frequency in the file tracking rules. It should be understood that the reporting frequency here is flexibly set, such as once every half hour, once a day, once a week, etc., and is not intended to limit the scope of protection of this invention.

[0091] Furthermore, in the aforementioned cloud desktop file tracking method, the data reporting module, rule management module, filter driver module, and log processing module are all located on the cloud desktop.

[0092] Specifically, in this embodiment of the invention, the data reporting module, rule management module, filter driver module, and log processing module are all located on the cloud desktop; the rule management module, filter driver module, log processing module, and data reporting module achieve low-coupling communication between modules, which helps to save development and maintenance costs.

[0093] Furthermore, in the aforementioned cloud desktop file tracking method, the file information includes at least:

[0094] File path and file size.

[0095] Specifically, in this embodiment of the invention, if the determination result is that the file extension and file path of the file in the creation event monitored by the Windows driver of the filter driver module match the file extension and file path in the file tracking rules, information such as file path, time, and size are obtained, and a creation event log is generated; if the determination result is that the file extension and file path of the file in the modification event monitored by the Windows driver of the filter driver module match the file extension and file path in the file tracking rules, information such as file path, time, and size are obtained, and a modification event log is generated; if the determination result is that the file extension and file path of the file in the deletion event monitored by the Windows driver of the filter driver module match the file extension and file path in the file tracking rules, information such as file path, time, and size of the deletion event is obtained, and a deletion event log is generated.

[0096] The file information here includes at least the following: path, name, size, and md5.

[0097] The following section describes a cloud desktop file tracking method of the present invention with reference to two specific embodiments.

[0098] Example 1:

[0099] Administrators track rules through configuration files on the cloud management platform;

[0100] The application starts after the cloud desktop boots up, calls the cloud management platform interface to obtain file tracking rules, and if the switch in the file tracking rules is turned on, it starts the filter driver module.

[0101] After the filter driver module starts, it establishes a communication mechanism with the application layer program and reads the file tracking rules configured by the cloud management platform.

[0102] The filter driver module registers WDM IRP event callback functions with the system. Among them, IRP_MJ_CREATE is used to intercept file creation requests, and IRP_MJ_SET_INFORMATION is used to intercept file deletion or renaming requests, obtain file attributes, etc.

[0103] The filter driver module creates a thread that listens for and waits for system events. When a file is created, deleted, modified, or renamed, the corresponding callback function is triggered to obtain the operation type, process name, and file information such as path, name, size, and MD5.

[0104] The obtained file information is matched with file tracking rules. If a match is found, a log is recorded, including the time, operation type, process name, and file information.

[0105] The filter driver module notifies the application layer to back up the files to be deleted. After the application layer completes the backup, the logs and files are uploaded to the cloud management platform.

[0106] The cloud management platform saves logs and files, and provides functions such as interface display and file download;

[0107] If the administrator modifies the file tracking rules, the background will automatically send a signal, the application layer will re-request the policy and notify the driver to update the policy, ensuring that it takes effect in real time;

[0108] The filter driver module continues to listen for the next event, repeating the above process, and exits when the system is shut down or the function switch is turned off.

[0109] Example 2:

[0110] Administrators can configure rules for tracking in the cloud management platform, including: enabling features, setting file extensions (.doc), specifying the directory D:\documents, and enabling remote backup.

[0111] When the user's cloud desktop is powered on, the application layer program starts and calls the HTTP interface to obtain file tracking information from the cloud management platform.

[0112] The filter driver module of the driver layer starts up, reads the file tracking strategy into memory, and registers the system IRP callback function at the same time;

[0113] The filter driver module monitors file creation, deletion, modification, or renaming events;

[0114] An application called danger.exe silently deletes the file C:\Users\John\A.doc in the background, triggering the execution of a callback function.

[0115] The filter driver module determines whether A.doc matches the configured file extension;

[0116] The filter driver module obtains information such as time, operation type (delete), application name (danger.exe), and file A.doc to be deleted (path, name, size, md5, etc.) and logs it.

[0117] The filter driver module notifies the application layer to back up the file and waits. The application layer backs up the file A.doc and then replies to the driver layer.

[0118] The application layer uploads files and tracing logs together to the cloud management platform;

[0119] The filter driver module continues to listen for the next system event;

[0120] The cloud management platform processes and displays file tracking logs, including the time, type, process name, and path of file operations, allowing the administrator to identify the suspicious program danger.exe.

[0121] The cloud management platform provides a download link for the backup file, and the user successfully recovered the deleted file A.doc.

[0122] System Implementation Examples

[0123] Figure 4 This is a diagram of a cloud desktop file tracking system provided in an embodiment of the present invention.

[0124] Secondly, embodiments of the present invention also provide a cloud desktop file tracking system, combined with Figure 4 ,include:

[0125] The cloud management platform 41 is used by administrators to configure file tracking rules, store and display file tracking records, and manage backups of deleted files.

[0126] Specifically, in this embodiment of the invention, the administrator can configure file tracking rules through the cloud management platform 41. The file tracking rules include switches, file extensions, file paths, whether files need to be backed up and deleted, reporting frequency, etc. The cloud management platform is also used to store and visualize file tracking records and manage backed-up deleted files.

[0127] The rule management module 42 is used to obtain file tracking rules through the communication mechanism of the cloud management platform, and to start or stop the filtering driver module according to the switch in the file tracking rules.

[0128] Specifically, in this embodiment of the invention, the rule management module 42 obtains file tracking rules through the communication mechanism with the cloud management platform 41: switch, file extension, file path, whether to back up or delete files and reporting frequency, and determines whether to start the filter driver module 43 based on the switch in the file tracking rules.

[0129] The filter driver module 43 is used to monitor file creation, modification, and deletion events through Windows drivers, obtain file information, generate logs, back up files and create tags before deleting them.

[0130] Specifically, in this embodiment of the invention, the filter driver module 43 listens for file creation, modification, and deletion events through the Windows driver, obtains the file path, time, and size to generate creation, modification, and deletion event logs, and backs up the file and creates a marker before the file is deleted.

[0131] The log processing module 44 is used to perform structured processing on the logs generated by the filter driver module and generate file tracking records.

[0132] Specifically, in this embodiment of the invention, the log processing module 44 is used to perform structured processing on the logs generated by the filter driver module to generate file tracking records.

[0133] The data reporting module 45 is used to report tracking records according to the reporting frequency and upload backup files to the cloud management platform.

[0134] Specifically, in this embodiment of the invention, the data reporting module 45 is used to report tracking records to the cloud management platform according to the reporting frequency, and to upload backup files of deleted files to the cloud management platform.

[0135] Furthermore, in the aforementioned cloud desktop file tracking system, the file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

[0136] Thirdly, embodiments of the present invention also provide an electronic device, including: a processor and a memory;

[0137] The processor executes any of the above cloud desktop file tracing methods by calling programs or instructions stored in memory.

[0138] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a program or instructions that cause a computer to execute any of the above-mentioned cloud desktop file tracking methods.

[0139] Figure 5 This is a schematic block diagram of an electronic device provided in an embodiment of the present invention.

[0140] like Figure 5 As shown, the electronic device includes at least one processor 501, at least one memory 502, and at least one communication interface 503. The various components in the electronic device are coupled together via a bus system 504. The communication interface 503 is used for information transmission with external devices. It is understood that the bus system 504 is used to implement communication between these components. In addition to a data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 5 The general designated all buses as Bus System 504.

[0141] It is understood that the memory 502 in this embodiment can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0142] In some implementations, memory 502 stores elements such as executable units or data structures, or subsets thereof, or extended sets thereof: operating systems and applications.

[0143] The operating system includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application programs include various applications, such as media players and browsers, used to implement various application functions. A program implementing any method in the cloud desktop file tracking method provided in this embodiment of the invention can be included in the application programs.

[0144] In this embodiment of the invention, the processor 501 executes the steps of various embodiments of the cloud desktop file tracking method provided by the present invention by calling the program or instructions stored in the memory 502, specifically, the program or instructions stored in the application.

[0145] Administrators configure file tracking rules in the cloud management platform. The file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

[0146] The rule management module obtains the file tracking rules from the cloud management platform via an HTTP interface, and determines whether to start the filter driver module based on the switch in the file tracking rules;

[0147] If the determination result is to start the filter driver module, the filter driver module listens for file creation, modification, renaming and deletion events;

[0148] If the filter driver module detects file creation, modification, renaming, and deletion events, it triggers the execution of the corresponding callback function to obtain the operation type, process name, and file information, and matches the file information with the file tracking rules;

[0149] If the file information matches the file tracking rules, a log is recorded, including the time, operation type, process name, and file information.

[0150] The filter driver module determines whether a deleted file needs to be remotely backed up. If the determination result is that the deleted file needs to be remotely backed up, the filter driver module backs up the file and marks it as a backup before the file is deleted.

[0151] The log processing module performs structured processing on the logs to generate file tracking records;

[0152] The data reporting module reports the file tracking records and uploads the backup files to the cloud management platform;

[0153] The cloud management platform processes and displays the file tracking records and stores backup files.

[0154] Any method in the cloud desktop file tracking method provided in this embodiment of the invention can be applied to, or implemented by, the processor 501. The processor 501 can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 501 or by instructions in software form. The processor 501 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor.

[0155] The steps of any method in the cloud desktop file tracking method provided in this embodiment of the invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software units in the decoding processor. The software units can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 502, and processor 501 reads the information in memory 502 and combines it with hardware to complete the steps of the method.

[0156] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention and form different embodiments.

[0157] Those skilled in the art will understand that the descriptions of the various embodiments have different focuses, and for parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0158] Although embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention. All such modifications and variations fall within the scope defined by the appended claims. The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0159] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A cloud desktop file tracking method, characterized in that, include: Administrators configure file tracking rules in the cloud management platform. The file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency. The rule management module obtains the file tracking rules from the cloud management platform via an HTTP interface, and determines whether to start the filter driver module based on the switch in the file tracking rules; If the determination result is to start the filter driver module, the filter driver module monitors the creation, modification, renaming and deletion events of files through Windows drivers; If the filter driver module detects file creation, modification, renaming, and deletion events, it triggers the execution of the corresponding callback function to obtain the operation type, process name, and file information, and matches the file information with the file tracking rules; If the file information matches the file tracking rules, a log is recorded, including the time, operation type, process name, and file information. The filter driver module determines whether a deleted file needs to be remotely backed up. If the determination result is that the deleted file needs to be remotely backed up, the filter driver module backs up the file and marks it as a backup before the file is deleted. The log processing module performs structured processing on the logs to generate file tracking records; The data reporting module reports the file tracking records and uploads the backup files to the cloud management platform; The cloud management platform processes and displays the file tracking records and stores backup files.

2. The cloud desktop file tracking method according to claim 1, characterized in that, The method further includes: If the file information does not match the file tracking rules; The filter driver module monitors file creation, modification, renaming, and deletion events.

3. The cloud desktop file tracking method according to claim 1, characterized in that, The method further includes: Determine whether the deleted file needs to be remotely backed up; if the result is that the deleted file does not need to be remotely backed up. The log processing module performs structured processing on the logs to generate file tracking records; The data reporting module periodically reports the file tracking records and uploads the tracking records to the cloud management platform; The cloud management platform processes and displays file tracking records and stores backup files.

4. The cloud desktop file tracking method according to claim 1, characterized in that, The data reporting module reports the file tracking records in the following ways: according to the reporting frequency in the file tracking rules.

5. The cloud desktop file tracking method according to claim 1, characterized in that, The data reporting module, the rule management module, the filter driver module, and the log processing module are all located on the cloud desktop.

6. The cloud desktop file tracking method according to claim 1, characterized in that, The file information includes at least: path, name, size, and md5.

7. A cloud desktop file tracking system, applied in any one of the cloud desktop file tracking methods according to claims 1-6, characterized in that, include: The cloud management platform is used by administrators to configure tracking rules, store and display file tracking records; Manage backups of deleted files; The rule management module is used to obtain file tracking rules through the communication mechanism of the cloud management platform, and to start or stop the filtering driver module according to the switches in the file tracking rules; The filter driver module is used to monitor file creation, renaming, modification, and deletion events through Windows drivers, obtain file information, generate logs, back up files, and create tags before deleting them. The log processing module is used to perform structured processing on the logs generated by the filtering driver module and generate file tracking records; The data reporting module is used to report tracking records according to the reporting frequency and upload backup files to the cloud management platform; The file tracking rules include at least: switch, file extension, file path, specified directory, operation type, excluded directory, whether to back up or delete files, and reporting frequency.

8. An electronic device, characterized in that, include: Processor and memory; The processor executes a cloud desktop file tracking method as described in any one of claims 1 to 6 by calling programs or instructions stored in the memory.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that cause a computer to perform a cloud desktop file tracking method as described in any one of claims 1 to 6.

Images