Communication connection life cycle monitoring method and system, domain controller and medium

Abstract

The invention relates to the technical field of Internet of Vehicles, and discloses a communication connection life cycle monitoring method and system, a domain controller and a medium. The method comprises the steps that a monitoring file is obtained, the monitoring file is loaded to a kernel, and the monitoring file comprises a hook point; capturing a data packet generated in the communication connection process of the vehicle end and the cloud end based on the hook point; analyzing a message carried by the data packet, and determining communication connection information based on the type of the message; and monitoring the communication connection life cycle according to the communication connection information to obtain a communication connection monitoring result. By implementing the technical scheme of the invention, the real-time monitoring and capturing of the data packet are realized, the leakage of potential information is reduced, the overhead of data replication is reduced, and the processing performance of the data packet is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle networking, and in particular to a method, system, domain controller and medium for monitoring the life cycle of a communication connection. Background Art

[0002] Currently, most of the monitoring of the communication connection lifecycle is done through network sniffing tools, such as the network packet capture tool Tcpdump and the network protocol analysis tool Wireshark. However, network sniffing tools need to copy the captured data from the kernel space to the user space. In a high-traffic environment, this will result in a large performance overhead and affect the normal operation of the system. If a complex scenario requires the capture of a large number of data packets, a large amount of post-processing is required to process and analyze a large number of data packets in the user space, which will result in data delays and poor real-time performance. Summary of the invention

[0003] In view of this, the present invention provides a method, system, domain controller and medium for monitoring the life cycle of a communication connection to solve the problem of poor monitoring effect of the life cycle of a communication connection.

[0004] In a first aspect, the present invention provides a method for monitoring the life cycle of a communication connection, comprising: obtaining a monitoring file, loading the monitoring file into a kernel, wherein the monitoring file includes a hook point; capturing data packets generated during the communication connection between a vehicle and a cloud based on the hook point; parsing messages carried by the data packets, and determining communication connection information based on the type of the messages; monitoring the life cycle of the communication connection according to the communication connection information, and obtaining a communication connection monitoring result.

[0005] In an optional implementation, parsing a message carried by a data packet and determining communication connection information based on the type of the message includes: parsing a message carried by a data packet to determine the communication information of the message; determining whether the message is a target type message based on the communication information; if the message is a target type message, determining the communication connection information corresponding to the target type message.

[0006] In an optional implementation, determining whether a message is a target type message based on communication information includes: parsing the communication information to determine whether there is connection attribute information in the communication information; if there is connection attribute information in the communication information, determining whether the communication connection is ended based on the connection attribute information; if the communication connection is not ended, accumulating communication traffic, and determining whether the message is a target type message according to the communication traffic.

[0007] In an optional implementation, the target type message includes a connection request message, a connection response message, a connection closing message, and a forced closing message; determining the communication connection information corresponding to the target type message includes: if the message is a connection request message, determining that the connection request message is a repeated connection message, and refusing to process the connection request message; if the message is a connection response message, recording the response time of the connection response message, and determining the response time as the communication connection information corresponding to the connection response message; if the message is a connection closing message, and the connection closing message represents the first closing of the communication connection, then recording the establishment time of the communication connection, the capture time of the connection closing message, and the corresponding end method of the connection closing message; if the message is a connection closing message, and the connection closing message represents the second closing of the communication connection, then updating the establishment time of the communication connection, and marking the end of the communication connection; if the message is a forced closing message, recording the establishment time of the communication connection, the corresponding end method of the forced closing message, and marking the end of the communication connection.

[0008] In an optional embodiment, the method further includes: if there is no connection attribute information in the communication information, detecting whether the message is a new connection request message; if the message is a new connection request message, recording the connection time corresponding to the new connection request message, and updating the communication information based on the connection attribute information of the new connection message.

[0009] In an optional implementation, obtaining the monitoring file includes: detecting the running state of the user-mode application process; and if the running state is in a startup state, obtaining the monitoring file.

[0010] In an optional embodiment, the method also includes: storing the data packet in the kernel space according to the target data structure; reading the data packet from the kernel space according to a first preset period; encapsulating the message data carried by the data packet according to a preset data format to obtain the target message data; and caching the target message data.

[0011] In an optional embodiment, the target message data is cached, including: saving the target message data to a first-level cache space; and / or, reading the target message data from the first-level cache space according to a second preset period, and storing it to a second-level cache space; and / or, compressing the target message data in the second-level cache space according to a third preset period to obtain message compression data, and storing the message compression data to a third-level cache space.

[0012] In an optional implementation, the method further includes: detecting whether the vehicle end is powered off; if the vehicle end is in a powered off state, immediately triggering the saving of the target message data.

[0013] In an optional implementation, the method further includes: determining a state change of the communication connection based on the communication connection monitoring result, and visually displaying the state change.

[0014] In a second aspect, the present invention provides a monitoring system for the life cycle of a communication connection, comprising: a vehicle side, used to execute the monitoring method for the life cycle of a communication connection of the first aspect or any corresponding embodiment thereof; a cloud side, communicatively connected to the vehicle side, used to configure monitoring information of the vehicle side, and display the monitoring results of the communication connection between the vehicle side and the cloud side.

[0015] In a third aspect, the present invention provides a vehicle domain controller, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for monitoring the communication connection life cycle of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0016] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for monitoring the life cycle of a communication connection of the first aspect or any corresponding embodiment thereof.

[0017] In a fifth aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the method for monitoring the life cycle of a communication connection of the first aspect or any corresponding embodiment thereof.

[0018] The monitoring method, system, domain controller and medium of the communication connection life cycle provided by the embodiment of the present invention realizes real-time monitoring and capture of data packets by loading the monitoring file into the kernel, setting a hook point in the kernel, and using the hook point in the kernel to capture the data packets generated by the vehicle-side and the cloud-side during the communication connection process, thereby improving the real-time capture of data packets. By parsing the message carried by the data packet to record the communication connection information corresponding to the data packet in the kernel space, there is no need to copy the data of the data packet from the kernel space to the user state space, thereby reducing the leakage of potential information, reducing the overhead of data copying, and improving the processing performance of the data packet. The communication connection life cycle is monitored in combination with the communication connection information to determine the communication connection monitoring result, thereby being able to determine the communication connection state between the vehicle-side and the cloud-side through the monitoring result of the communication connection life cycle, so as to identify whether there is a communication anomaly between the vehicle-side and the cloud-side according to the state change of the tracked communication connection state, and being able to accurately attribute the communication anomaly, so as to take protective measures in time to ensure the communication security between the vehicle-side and the cloud-side. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 is a flow chart of a method for monitoring a communication connection life cycle according to an embodiment of the present invention;

[0021] Figure 2 is a flow chart of another method for monitoring the life cycle of a communication connection according to an embodiment of the present invention;

[0022] Figure 3 is a flow chart of another method for monitoring the life cycle of a communication connection according to an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of reading and storing target message data according to an embodiment of the present invention;

[0024] Figure 5 is a block diagram of a monitoring system for a communication connection life cycle according to an embodiment of the present invention;

[0025] Figure 6 It is a schematic diagram of the hardware structure of a domain controller according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0027] The monitoring of the communication connection lifecycle is mostly achieved through network sniffing tools, but network sniffing tools have the following defects:

[0028] (1) Network sniffing tools need to copy captured data from kernel space to user space. This will cause large performance overhead, especially in high-traffic environments, and may affect the normal operation of the system.

[0029] (2) If a large number of data packets need to be captured and then processed and analyzed in the user space, the flexibility is low and a lot of post-processing is required when dealing with complex scenarios.

[0030] (3) Network sniffing tools usually focus on capturing data, and subsequent analysis and processing may be delayed, especially when processing large-scale data. The real-time performance is poor, especially when tracking occasional problems, which consumes more resources.

[0031] (4) A large amount of data needs to be transferred to user space for analysis, which increases the risk of sensitive data exposure and potential leakage.

[0032] (5) Capturing a large number of raw data packets and transmitting them to the user space will not only increase the system load on the vehicle side, but also require a lot of storage resources and processing resources.

[0033] It can be seen that the effect of monitoring the communication connection life cycle through network sniffing tools is not ideal. However, in the process of communication connection between the vehicle and the cloud, monitoring the communication connection life cycle is crucial. It is specifically reflected in the following aspects:

[0034] (1) By monitoring key control messages (such as SYN, SYN-ACK, FIN, and RST), the establishment, maintenance, and termination status of a connection can be accurately determined, making it possible to track the status changes of each connection and identify abnormal behavior or problems in the network.

[0035] (2) Monitor the communication connection lifecycle to quickly locate the root cause of network problems. For example, by analyzing SYN and SYN-ACK packets, you can find the cause of connection establishment delay or failure, or by analyzing FIN and RST packets, you can find abnormal connection termination.

[0036] (3) By monitoring the establishment and termination of communication connections, the network resource usage can be evaluated and the network configuration can be optimized. For example, frequent connection establishment and termination may mean that the system's connection pool strategy needs to be adjusted or service performance needs to be optimized.

[0037] (4) Monitoring the life cycle of communication connections can help detect abnormal behavior, such as SYN flood attacks or abnormal connection resets (RST attacks). By analyzing these abnormal message patterns, protective measures can be taken in a timely manner to ensure network security.

[0038] (5) Monitoring the communication connection lifecycle can record and trace back the detailed information of each communication connection for future analysis.

[0039] Based on this, the technical solution of the present invention is based on the eBPF program to generate a monitoring file and load it into the kernel space. Since the eBPF program can run directly in the kernel, compared with the network sniffing tool, its way of capturing and processing data packets is more efficient, and there is no need to copy data from the kernel space to the user space, reducing the overhead of context switching and data copying, and significantly reducing the performance impact. The eBPF program provides extremely high flexibility, and custom logic can be written in the kernel to handle network events. For example, users can filter out messages of interest according to specific conditions, or directly calculate the connection duration, capture message timestamps, etc. in the kernel without having to pass all data to the user space, greatly reducing the amount of data transmission and the processing burden of the user space. The eBPF program can also be executed in the kernel immediately when a network event occurs, and supports rapid response and processing. There is no need to expose sensitive data to the user space, reducing the potential risk of information leakage. In addition, the eBPF program can only capture and process specific key data, further reducing the possibility of data leakage.

[0040] According to an embodiment of the present invention, an embodiment of a method for monitoring the life cycle of a communication connection is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] In this embodiment, a method for monitoring the life cycle of a communication connection is provided, which can be used for a domain controller on a vehicle side. Figure 1 is a flow chart of a method for monitoring a communication connection life cycle according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0042] Step S101, obtain a monitoring file, load the monitoring file into the kernel, and set a hook point in the kernel.

[0043] The monitoring file is a bytecode file generated by compiling the pre-written kernel source code. Among them, the kernel source code is a program code written by technicians based on the kernel extension mechanism (Extended Berkeley Packet Filter, eBPF), which allows the user-defined code to be safely run in the kernel without modifying the source code. The eBPF program is compiled to generate a bytecode file, which is an instruction set interpreted and executed by the virtual machine. Specifically, the technician writes the eBPF program according to the processing requirements of the data packet (such as data packet type detection, parsing of the message carried by the data packet), and compiles the program to generate a monitoring file.

[0044] The hook point is a predefined data collection location where technicians insert custom code to monitor the communication connection between the vehicle and the cloud. Specifically, technicians set the control group hook point cgroup_skb in the kernel according to the data packets that need to be tracked for the communication connection, thereby filtering and operating network data packets at the control group (cgroup) level.

[0045] It should be noted that cgroup is the kernel organizing processes or tasks into different groups so that specific resource restrictions and management can be applied to the control groups. cgroup allows technicians to control and limit the use of system resources, such as CPU, memory, disk I / O, network bandwidth, etc. By using cgroup to allocate resources more finely, fairness and resource isolation between different process control groups can be ensured.

[0046] When the vehicle starts its communication process with the cloud, the vehicle-side domain controller reads the monitoring file and loads it into the kernel, and the execution of the monitoring file is triggered based on the hook point, which is triggered when the data packet enters or leaves the cgroup. Therefore, combining the eBPF program with the cgroup can accurately manage and control the use of vehicle-side network resources. For example, the resource allocation strategy can be dynamically adjusted according to the status or traffic pattern of the TCP connection to avoid resource waste or system overload.

[0047] Step S102, based on the hook point, capture the data packets generated during the communication connection between the vehicle and the cloud.

[0048] The communication connection between the vehicle and the cloud has a process from connection establishment to connection termination. During the communication connection process, there is a process of data packets entering or leaving the cgroup. The hook point is set in the kernel and can be triggered when the data packet enters or leaves the cgroup. Then the hook point will trigger the execution of the monitoring file, so that the monitoring file can capture the data packets entering and leaving the cgroup.

[0049] Step S103, parsing the message carried by the data packet, and determining the communication connection information based on the type of the message.

[0050] The type of message is used to characterize the communication connection status, for example, the message generated when establishing a connection, the message generated when closing a connection, etc. The communication connection information is used to characterize the connection attribute information carried by the message, such as the connection start time, connection end time, connection duration, etc.

[0051] As mentioned above, the monitoring file is a pre-written eBPF program for collecting, analyzing and processing data packets. After the data packet is captured, the information carried by the data packet is parsed to determine the format of the data packet. The message type field in the data packet format is parsed to determine the message type flag carried by the data packet, and the type of the message is determined based on the message type flag. Then, according to the type of the message, the message is classified and processed to determine the message that represents the communication connection status, and the communication connection information of the message is recorded based on the communication connection status. Therefore, fine-grained monitoring and statistics of communication connections, such as connection establishment time, connection duration, amount of data transmitted, etc., can be performed through the eBPF program, which can provide data support for performance optimization and resource management.

[0052] Specifically, different network protocols correspond to different data packet formats. For example, a data packet in a TCP / IP protocol usually contains information such as a source IP address, a destination IP address, a source port, and a destination port. Therefore, the format of the data packet can be determined by parsing the information contained in the data packet.

[0053] Taking TCP connection as an example, the message type flag in the data packet format can be SYN, SYN-ACK, FIN, RST, etc. Among them, the SYN flag is used to establish a TCP connection, the SYN-ACK flag indicates that the connection is agreed to be established; the FIN flag is used to close the TCP connection; the RST flag is used to handle abnormal situations or force the connection to be closed. Then, the communication connection information of the message is recorded in combination with the message type.

[0054] Step S104: monitor the communication connection life cycle according to the communication connection information to obtain a communication connection monitoring result.

[0055] Communication connection lifecycle monitoring means real-time tracking and recording of control messages from the establishment to the termination of a communication connection. Control messages are used to characterize connection control messages during a communication connection. Taking TCP connection as an example, control messages include messages carrying flags such as SYN, SYN-ACK, FIN, and RST.

[0056] By analyzing the communication connection information such as the start time, end time, connection duration and state change corresponding to the control message, the communication connection behavior between the vehicle and the cloud is determined, and the corresponding communication connection monitoring result is obtained. The communication connection monitoring result is used to characterize the communication connection process between the vehicle and the cloud, so as to achieve comprehensive monitoring of the communication connection behavior between the vehicle and the cloud.

[0057] The communication connection life cycle monitoring method provided in this embodiment realizes real-time monitoring and capture of data packets by loading the monitoring file into the kernel, setting a hook point in the kernel, and using the hook point in the kernel to capture the data packets generated during the communication connection between the vehicle and the cloud, thereby improving the real-time capture of data packets. By parsing the message carried by the data packet to record the communication connection information corresponding to the data packet in the kernel space, there is no need to copy the data of the data packet from the kernel space to the user space, thereby reducing the leakage of potential information, reducing the overhead of data copying, and improving the processing performance of the data packet. The communication connection life cycle is monitored in combination with the communication connection information to determine the communication connection monitoring result, thereby being able to determine the communication connection status between the vehicle and the cloud through the monitoring result of the communication connection life cycle, so as to identify whether there is a communication anomaly between the vehicle and the cloud according to the state change of the tracked communication connection state, and be able to accurately attribute the communication anomaly, so as to take protective measures in time to ensure the communication security between the vehicle and the cloud.

[0058] In this embodiment, a method for monitoring the life cycle of a communication connection is provided, which can be used for a domain controller on a vehicle side. Figure 2 is a flow chart of a method for monitoring a communication connection life cycle according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0059] Step S201, obtain the monitoring file, load the monitoring file into the kernel, and set a hook point in the kernel. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0060] Step S202: based on the hook point, capture the data packets generated during the communication connection between the vehicle and the cloud. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0061] Step S203, parsing the message carried by the data packet, and determining the communication connection information based on the type of the message.

[0062] Specifically, the above step S203 includes:

[0063] Step S2031, parse the message carried by the data packet to determine the communication information of the message.

[0064] The communication information is the information carried in the message for data communication, which may specifically include the data communication IP address and the data communication port, etc. By parsing the data packet format, the message carried by the data packet is parsed, and the data packet that can represent the communication connection status is filtered out. Then, the message carried by the data packet is parsed to determine the communication information corresponding to the message.

[0065] Taking TCP connection as an example, the communication information can be represented by four-tuple information (source IP address, destination IP address, source port and destination port). The four-tuple information uniquely identifies a network connection, so that data packets can be correctly transmitted and routed between the vehicle and the cloud. Among them, the source IP address represents the IP address of the device (vehicle or cloud) that sends the data packet; the source port represents the port number used by the process sending the data packet on the device (vehicle or cloud); the destination IP address represents the IP address of the device (vehicle or cloud) that receives the data packet; the destination port represents the port number used by the process receiving the data packet on the device (vehicle or cloud).

[0066] Step S2032: determine whether the message is a target type message based on the communication information.

[0067] The target type message is a message type that characterizes the communication connection process, such as a connection establishment message, a connection closing message, and the like. Usually, the communication information between the vehicle and the cloud is searched to determine whether there is a communication connection between the vehicle and the cloud. If there is a communication connection, the message type is further detected to determine whether the message is a target type message; if there is no communication connection, it is possible to further check whether the message carried by the currently captured data packet is used to establish a communication connection between the vehicle and the cloud. If the message is used to establish a communication connection between the vehicle and the cloud, the communication connection information of the message is recorded. If it is a message of other types (i.e., non-communication connection type), it will not be processed. As a result, only target type messages are processed, avoiding the capture or processing of unnecessary messages.

[0068] In some optional implementations, the above step S2032 includes:

[0069] Step a1, parse the communication information to determine whether there is connection attribute information in the communication information.

[0070] Step a2: If there is connection attribute information in the communication information, determine whether the communication connection is terminated based on the connection attribute information.

[0071] Step a3: If the communication connection is not ended, the communication flow is accumulated, and whether the message is a target type message is determined according to the communication flow.

[0072] The connection attribute information is used to characterize the status of the communication connection, including whether the communication connection has ended or not. By parsing the communication information, it can be determined whether there is a communication connection between the vehicle and the cloud. When there is a communication connection, the flag bit used to characterize the connection attribute information is further checked to determine whether the communication connection has ended.

[0073] Among them, the flag bit Fin can be predefined, for example, when the connection is not ended when the end mode is initialized or the power is turned off and saved immediately, the connection end can be defined as DEFAULT_FIN=0, that is, the value of the flag bit Fin is 0; when the client waves to end, the connection end can be defined as CLIENT_FIN=1, that is, the value of the flag bit Fin is 1; when the server waves to end, the connection end can be defined as SERVER_FIN=2, that is, the value of the flag bit Fin is 2; when the client terminates, the connection end can be defined as CLIENT_RST=3, that is, the value of the flag bit Fin is 3; when the server terminates, the connection end can be defined as SERVER_RST=4, that is, the value of the flag bit Fin is 4; when the connection establishment timeout causes the connection to end, the connection end can be defined as TIME_OUT=5, that is, the value of the flag bit Fin is 5. Therefore, by analyzing the value of the flag bit, it is possible to determine whether the communication connection is ended.

[0074] If the communication connection has ended, the communication connection status will not be analyzed and processed for the message carried by the data packet. If the communication connection has not ended, during the duration of the communication connection, the domain controller will continuously accumulate the communication traffic transmitted during the communication process. The communication traffic can be the number of bytes or the number of data packets, which is not specifically limited here. Preset the traffic threshold for different target type messages, compare the accumulated communication traffic with the preset traffic threshold to determine whether the communication traffic reaches the preset traffic threshold corresponding to a certain target type message. If it reaches the preset traffic threshold corresponding to a certain target type message, it is determined to be the target type message corresponding to the preset traffic threshold, and the target type message can be further processed.

[0075] By parsing the communication information, when it is determined that there is connection attribute information in the communication information, the type of message is determined according to the accumulated communication traffic, thereby enabling targeted data capture of target type messages, avoiding unnecessary data capture and processing, and reducing performance consumption.

[0076] Step a4: If there is no connection attribute information in the communication information, it is detected whether the message is a new connection request message.

[0077] Step a5: If the message is a new connection request message, the connection information corresponding to the new connection request message is recorded, and the communication information corresponding to the new connection request message is added to the communication information.

[0078] If it is determined by parsing the communication information that there is currently no communication connection between the vehicle and the cloud, that is, there is no connection attribute information, then the message type is detected for the message carried by the captured data packet. Specifically, the message type flag in the message is parsed, and the message type flag is used to determine whether the message carried by the data packet is a new connection request message for requesting to establish a communication connection.

[0079] If the message carried by the data packet is a new connection request message, the connection time of the new connection request message is recorded, and the communication information (such as four-tuple information) of the new connection request message is determined, and the communication information is updated to the original communication information.

[0080] By parsing the communication information, when it is determined that there is no connection attribute information in the communication information, then when a new connection request message is detected, the connection information corresponding to the new connection request message is obtained, thereby realizing the capture of instant connection request messages, and immediately processing and recording the captured connection request messages, thereby being able to capture the status changes of the communication connection in real time, ensuring that network problems can be quickly detected and responded to.

[0081] Step S2033: If the message is a target type message, determine the communication connection information corresponding to the target type message.

[0082] If it is determined that the message is a target type message, it means that the communication connection between the vehicle and the cloud has not ended. At this time, the communication connection information such as the connection start time, connection end time, connection duration, and connection end method corresponding to the target type message can be determined according to the message type corresponding to the target type message.

[0083] In some optional implementations, the target type message includes a connection request message, a connection response message, a connection close message, and a forced close message. Among them, the connection request message indicates that the vehicle side requests to establish a communication connection with the cloud side, or the cloud side requests to establish a communication connection with the vehicle side; the connection response message indicates that the receiving side agrees to establish a connection feedback to the sending side; the connection close message indicates that the communication connection between the vehicle side and the cloud side is closed; the forced close message indicates that the communication connection between the vehicle side and the cloud side is abnormally closed.

[0084] Accordingly, the above step S2033 includes:

[0085] Step b1: If the message is a connection request message, the connection request message is determined to be a repeated connection message, and the connection request message is rejected. Since the current communication connection has not ended, that is, a communication connection has been established between the vehicle and the cloud, when a connection request message is received again, it can be determined that the connection request message is a repeated connection message, and the domain controller does not process the repeated connection message.

[0086] Step b2: If the message is a connection response message, the response time of the connection response message is recorded, and the response time is determined as the communication connection information corresponding to the connection response message. The response time is the time for capturing the connection response message.

[0087] Step b3: If the message is a connection closing message, and the connection closing message represents the first closing of the communication connection, then the communication connection time, the capture time of the connection closing message, and the corresponding end mode of the connection closing message are recorded. The communication connection time is the time required to establish the communication connection, the capture time of the connection closing message is the time when the connection closing message is first captured, and the end mode includes waving end at the cloud end and waving end at the vehicle end. Combined with the connection end flag, the end mode of the connection closing message can be determined.

[0088] Step b4: If the message is a connection closing message, and the connection closing message indicates the second closing of the communication connection, the communication connection time is updated and the communication connection is marked as ended. When the connection closing message is captured for the second time, it means that the vehicle and the cloud have ended the communication connection with each other. At this time, the communication connection time can be updated according to the time when the connection closing message is captured for the second time to calculate the connection duration.

[0089] Step b5: If the message is a forced close message, the communication connection time and the corresponding end method of the forced close message are recorded, and the communication connection is marked as ended. When the forced close message is captured, it can be determined that the communication connection between the vehicle and the cloud is abnormally interrupted. At this time, the time when the forced close message is captured can be recorded, and the capture time can be used as the communication connection time. According to the connection end flag, the end method of the forced close is determined. At the same time, the communication connection is marked as ended.

[0090] By analyzing the target type message to determine the corresponding communication connection information, the message analysis and filtering can be implemented in the kernel space, so that the necessary communication connection information in the monitoring process can be recorded, and then only the necessary communication connection information needs to be passed to the user space, which significantly reduces the data transmission volume.

[0091] Step S204: monitor the communication connection life cycle according to the communication connection information to obtain the communication connection monitoring result. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0092] The communication connection life cycle monitoring method provided in this embodiment captures and processes data packets during the communication connection process through monitoring files deployed in the kernel space, thereby being able to directly process data packets in the kernel space to obtain communication connection information corresponding to target type messages, without the need to frequently switch data between user space and kernel space, greatly reducing the performance overhead of the vehicle-side system. Moreover, by directly capturing and processing communication connection data packets in the kernel space, the data processing delay will be very low, and low-latency monitoring can be achieved, which can achieve instant feedback and instant response for application scenarios such as real-time performance monitoring and security protection.

[0093] In this embodiment, a method for monitoring the life cycle of a communication connection is provided, which can be used for a domain controller on a vehicle side. Figure 3 is a flow chart of a method for monitoring a communication connection life cycle according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0094] Step S301, obtain the monitoring file, load the monitoring file into the kernel, and set a hook point in the kernel.

[0095] Specifically, the above step S301 includes:

[0096] Step S3011, detecting the running status of the user mode application process.

[0097] User-mode application processes refer to applications running in the vehicle-side operating system, which are usually started and controlled by users to perform various tasks, such as music playback, map navigation, etc. Compared with kernel-mode processes, user-mode application processes are subject to more restrictions and protections, and cannot directly access hardware resources or perform privileged operations, but request resources and perform tasks through interfaces provided by the operating system.

[0098] Specifically, the running status indicates whether the user-mode application process is in the startup state. A process monitoring tool is provided in the vehicle-side operating system, and the running status of the application process is monitored in real time through the process monitoring tool to determine the start and stop of the application process. Of course, a monitoring script can also be written in advance and deployed to the vehicle-side operating system, and the monitoring script can be used to regularly check the existence or status of the process to determine its running status.

[0099] Step S3012: If the running state is in the startup state, obtain the monitoring file.

[0100] If the running status is in the startup state, it means that the user has started the user-mode application process deployed on the vehicle. At this time, the vehicle will request the task of the user-mode application process from the cloud. The vehicle will obtain the monitoring file and load the monitoring file into the kernel state to monitor the life cycle of the communication connection between the vehicle and the cloud based on the user-mode application process. For example, if the vehicle starts the map application, the vehicle will request the cloud to send the map data. At this time, the vehicle will load the monitoring file into the kernel and monitor the communication connection between the vehicle and the cloud through the monitoring file.

[0101] Step S302: based on the hook point, capture the data packets generated during the communication connection between the vehicle and the cloud. Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0102] Step S303: parse the message carried by the data packet and determine the communication connection information based on the type of the message. Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0103] Step S304: monitor the communication connection life cycle according to the communication connection information to obtain the communication connection monitoring result. Figure 2 Step S204 of the illustrated embodiment will not be described in detail here.

[0104] Step S305, determining the status change of the communication connection based on the communication connection monitoring result, and sending the status change to the cloud for visual display.

[0105] According to the communication connection monitoring results, each connection state in the communication connection process can be determined, so that the connection state changes generated in the communication connection process can be determined, and the connection state changes generated in the communication connection process can be sent to the cloud for visual display. Specifically, the cloud can deploy a visualization tool to display the state changes of the communication connection through the visualization tool, and generate a state change report for the communication connection, so as to assist technicians in abnormal analysis of the communication connection process and locate abnormal communication behavior for troubleshooting when abnormal communication connection occurs.

[0106] The communication connection life cycle monitoring method provided in this embodiment obtains the monitoring file for loading when it is detected that the running state of the user-mode application process is in the startup state, thereby being able to dynamically load and update the monitoring file according to the running state of the user-mode application process without restarting the vehicle-side system kernel. As a result, technicians can quickly deploy new monitoring strategies or adjust existing monitoring strategies to cope with changes in the network environment or monitor new requirements. By visually displaying the state changes of the communication connection, it is easy to quickly locate abnormal behavior so that protective measures can be taken in a timely manner.

[0107] In some optional implementations, after capturing the data packet, the method further includes:

[0108] Step c1, storing the communication connection data corresponding to the data packet into the kernel space according to the target data structure.

[0109] The target data structure is a data structure used to store data packets, and the target data structure is used to share data between user space and kernel space. Specifically, the target data structure is an eBPF map (eBPF Maps), which may include hash tables, arrays, stacks, queues, etc. Maps are created in the eBPF program to access and operate the data in the map through a specific interface in the user space, so that the user space can access the communication connection data corresponding to the data packet captured by the kernel space.

[0110] Step c2: reading the communication connection data from the kernel space to the user state according to a first preset period.

[0111] The first preset period is a preset data read and write period, such as 20s, 25s, 30s, etc. Figure 4 As shown, the relevant data of each data packet captured by the hook point is stored in the kernel space in the target data structure, and the user state can read the communication connection data corresponding to the data packet from the kernel space through the corresponding thread according to the first preset period.

[0112] Step c3, encapsulating the communication connection data according to a preset data format to obtain target message data.

[0113] Step c4, cache the target message data.

[0114] The preset data format is a pre-set format for data encapsulation, such as json format. Figure 4 As shown, after acquiring the communication connection data, the user state converts the communication connection data according to the preset data format to obtain the target message data in the preset data format, and stores the obtained target message data in the user state space so that the user state can analyze the target message data.

[0115] The communication connection life cycle monitoring method provided in this embodiment reads the communication connection data from the kernel space to the user state space according to a preset period, so that only specific communication connection data can be transmitted without transmitting all data to the user state space, thereby avoiding exposing sensitive data to the user state space and reducing the possibility of data leakage. At the same time, the data transmission volume and the processing burden of the user state space are greatly reduced.

[0116] In some optional implementations, the above step c4 includes:

[0117] Step c41, save the target message data to the first-level cache space.

[0118] Step c42, reading the target message data from the first-level cache space according to a second preset period, and storing it in the second-level cache space.

[0119] Step c43, compressing the target message data in the second-level cache space according to the third preset period to obtain message compression data, and storing the message compression data in the third-level cache space.

[0120] The first-level cache space is the memory of the user space; the second-level cache space is the temporary file; the third-level cache space is the log file.

[0121] The second preset period is a pre-set period for reading data from the first-level cache space, such as 300s, 600s, etc.; the third preset period is a pre-set period for data compression, such as 600s, 1800s, 3600s, etc., and the third preset period can be configured through the cloud.

[0122] like Figure 4 As shown, the target message data obtained by sorting according to the preset data format is cached in the first-level cache space, that is, the memory of the user state space. The target message data is read from the first-level cache space according to the second preset cycle, and a temporary file corresponding to the target message data is generated. Then, for the target message data in the temporary file, data compression is performed according to the third preset cycle to obtain a compressed log file, thereby saving data storage space.

[0123] When caching target message data, a three-level cache is used to cache the target message data, thereby ensuring the efficient performance of the vehicle-side operating system.

[0124] In some optional implementations, the above method further includes:

[0125] Step d1, detecting whether the vehicle is powered off.

[0126] Step d2: If the vehicle is in a power-off state, the target message data is immediately saved.

[0127] The running status of the vehicle-side operating system is detected to determine whether the vehicle-side operating system is powered off. If the vehicle-side operating system has been powered off and stopped running, it means that the vehicle is in a powered-off state. At this time, the target message data is immediately triggered to store the target message data read from the first-level cache space to the second-level cache space, and the data in the second-level cache space is compressed to generate a corresponding log file.

[0128] The method for monitoring the life cycle of a communication connection provided in this embodiment timely triggers the saving of target message data when detecting that the vehicle end is in a power-off state, thereby avoiding the loss of target message data.

[0129] In this embodiment, a monitoring system for the life cycle of a communication connection is also provided. Figure 5As shown, it includes: a vehicle side 1 and a cloud side 2, and a communication connection between the vehicle side 1 and the cloud side 2. A domain controller is deployed in the vehicle side 1 to execute the method shown in the above embodiment, and the cloud side 2 is used by technicians to configure monitoring information for the vehicle side 1, such as the cycle of reading target message data. The technicians can customize the eBPF program according to the monitoring information to implement the monitoring logic of the communication connection, so as to accurately capture, filter and process specific types of communication connection events according to the monitoring logic of the eBPF program, and take corresponding actions according to different conditions, such as recording logs, triggering alarms or dynamically adjusting system parameters. As a result, the eBPF program can only process and monitor specific network events or connection status, without accessing all data of the entire system or application, thereby reducing security risks.

[0130] When the operating system of the vehicle 1 is started and the user triggers the process of a certain application on the vehicle 1, the domain controller deployed in the vehicle 1 will respond to the user's triggering operation and establish a communication connection with the cloud 2 for the application to obtain the data of the application from the cloud 2, such as map update data, audio data required for music application playback, etc. During the communication connection between the vehicle 1 and the cloud 2, the cloud 2 can display the communication connection monitoring results between the vehicle 1 and the cloud 2.

[0131] The communication connection life cycle monitoring system provided in this embodiment realizes real-time monitoring and capture of data packets by loading the monitoring file into the kernel and using hook points to capture the data packets generated by the vehicle-side and cloud-side during the communication connection process in the kernel, thereby improving the real-time capture of data packets. By parsing the message carried by the data packet to record the communication connection information corresponding to the data packet in the kernel space, there is no need to copy the data of the data packet from the kernel space to the user space, thereby reducing the leakage of potential information, reducing the overhead of data copying, and improving the processing performance of the data packet. The communication connection life cycle is monitored in combination with the communication connection information to determine the communication connection monitoring result, thereby being able to determine the communication connection status between the vehicle-side and the cloud-side through the monitoring result of the communication connection life cycle, so as to identify whether there is a communication anomaly between the vehicle-side and the cloud-side according to the tracked state change of the communication connection state, and being able to accurately attribute the communication anomaly, so as to take protective measures in time to ensure the communication security between the vehicle-side and the cloud-side.

[0132] The embodiment of the present invention also provides a domain controller, see Figure 6 , Figure 6 is a schematic diagram of the structure of a domain controller provided by an optional embodiment of the present invention, such as Figure 6As shown, the domain controller includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the domain controller, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple domain controllers can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0133] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0134] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0135] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created according to the use of the domain controller, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the domain controller via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0136] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0137] The domain controller further includes a communication interface 30 for the domain controller to perform data communication with other devices or communication networks.

[0138] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0139] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0140] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for monitoring the life cycle of a communication connection, characterized in that: The method comprises: Obtaining a monitoring file, and loading the monitoring file into a kernel, wherein a hook point is set in the kernel; Based on the hook point, the data packets generated during the communication connection between the vehicle and the cloud are captured; Parsing a message carried by the data packet, and determining communication connection information based on the type of the message; The communication connection life cycle is monitored according to the communication connection information to obtain a communication connection monitoring result.

2. The method according to claim 1, characterized in that The parsing of the message carried by the data packet and determining the communication connection information based on the type of the message includes: Parsing the message carried by the data packet to determine the communication information of the message; Determining whether the message is a target type message based on the communication information; If the message is the target type message, communication connection information corresponding to the target type message is determined.

3. The method according to claim 2, characterized in that The determining whether the message is a target type message based on the communication information includes: Parsing the communication information to determine whether connection attribute information exists in the communication information; If the connection attribute information exists in the communication information, determining whether the communication connection is terminated based on the connection attribute information; If the communication connection is not ended, the communication flow is accumulated, and whether the message is a target type message is determined according to the communication flow.

4. The method according to claim 2 or 3, characterized in that: The target type message includes a connection request message, a connection response message, a connection closing message, and a forced closing message; and the determining of the communication connection information corresponding to the target type message includes: If the message is a connection request message, determining that the connection request message is a duplicate connection message, and refusing to process the connection request message; If the message is a connection response message, recording the response time of the connection response message, and determining the response time as the communication connection information corresponding to the connection response message; If the message is a connection closing message, and the connection closing message represents the first closing of the communication connection, then the communication connection time, the capture time of the connection closing message, and the end mode corresponding to the connection closing message are recorded; If the message is a connection closing message, and the connection closing message represents the second closing of the communication connection, then the communication connection time is updated, and the communication connection is marked as ended; If the message is a forced closing message, the establishment time of the communication connection and the ending method corresponding to the forced closing message are recorded, and the end of the communication connection is marked.

5. The method according to claim 3, characterized in that: Also includes: If the connection attribute information does not exist in the communication information, detecting whether the message is a new connection request message; If the message is the new connection request message, the connection information corresponding to the new connection request message is recorded, and the communication information corresponding to the new connection request message is added to the communication information.

6. The method according to claim 1, characterized in that The obtaining of monitoring files includes: Detect the running status of user-mode application processes; If the running state is in the starting state, the monitoring file is obtained.

7. The method according to claim 1, characterized in that Also includes: The communication connection data corresponding to the data packet is stored in the kernel space according to the target data structure; Reading the communication connection data from the kernel space to the user state according to a first preset period; Encapsulating the communication connection data according to a preset data format to obtain target message data; The target message data is cached.

8. The method according to claim 7, characterized in that The caching of the target message data includes: Saving the target message data to the first-level cache space; and / or, reading the target message data from the first-level cache space according to a second preset period, and storing it in a second-level cache space; And / or, compressing the target message data in the second-level cache space according to a third preset period to obtain message compression data, and storing the message compression data in the third-level cache space.

9. The method according to claim 7, characterized in that: Also includes: Detecting whether the vehicle end is powered off; If the vehicle end is in a power-off state, the saving of the target message data is immediately triggered.

10. The method according to claim 1, characterized in that Also includes: The status change of the communication connection is determined based on the communication connection monitoring result, and the status change is sent to the cloud for visual display.

11. A communication connection life cycle monitoring system, characterized in that: include: A vehicle end, for executing the method for monitoring the life cycle of a communication connection according to any one of claims 1 to 10; The cloud is connected to the vehicle end for configuring the monitoring information of the vehicle end and displaying the monitoring result of the communication connection between the vehicle end and the cloud end.

12. A vehicle domain controller, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for monitoring the life cycle of a communication connection as described in any one of claims 1 to 10 by executing the computer instructions.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for monitoring the life cycle of a communication connection according to any one of claims 1 to 10.

14. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the method for monitoring the life cycle of a communication connection according to any one of claims 1 to 10.

Images