Monitoring method and device for changing influence surface

Abstract

The invention provides a monitoring method for changing an influence surface, and the method comprises the steps: obtaining a monitoring target database which records a plurality of monitoring targets; in the execution process of the change operation instruction, for each target system call or each target program call, monitoring context information of a monitoring target in the execution process of the change operation instruction; updating a monitoring target in a monitoring target database based on the context information; after calling of each target system or calling of each target program is completed, monitoring records corresponding to calling of each target system or calling of each target program are obtained based on context information corresponding to monitoring targets in a target database, and the monitoring records are recorded to a monitoring record database; and after the change is completed, determining the change influence surface of the change based on the monitoring record recorded in the monitoring record database. According to the monitoring method for changing the influence surface, provided by the invention, the effects of eliminating a monitoring blind area and reducing data redundancy are realized.

Description

Technical Field

[0001] The present application relates to the technical field of computer systems, and in particular to a method and device for monitoring a change impact surface. Background Art

[0002] On January 11, 2023, the entire U.S. air system was affected by a failure in the NOTAM (Notification of Air Mission) system. According to incomplete statistics, at least 8,000 flights were delayed and more than 1,200 flights were canceled that day. The overall impact was initially estimated to be as high as more than 9,000 flights covering flights across the United States. The airport was once "paralyzed". The Federal Aviation Administration (FAA) said on the 12th that a contractor working for the aviation safety regulator accidentally deleted a computer file used in the pilot alert system, resulting in a failure that caused widespread disruptions to U.S. air traffic last week.

[0003] The above is a typical case of IT system failure caused by changes. With the promotion of digital technology, the business of enterprises and governments has gradually moved to online processing, such as Spring Festival ticket grabbing and health codes. These new technologies require complex IT systems to support them. Due to business changes, IT systems also need to be changed to adapt to business needs. However, IT systems are complex, and changes are very likely to cause failures. Once a failure occurs, it will cause serious social incidents. Therefore, change monitoring technology is needed to promptly detect potential risks in change operations and prevent failures.

[0004] In the case of the United Airlines failure, if the dangerous operation of file deletion by the operation and maintenance personnel could be monitored and an early warning could be issued, the failure would not have occurred. Summary of the invention

[0005] The embodiments of the present application provide a monitoring method for a change impact surface, which dynamically updates the monitoring target during the change process, thereby eliminating monitoring blind spots and reducing data redundancy during the monitoring change process.

[0006] In the first aspect, the present application provides a monitoring method for the impact surface of a change, including obtaining a monitoring target database, which records a number of monitoring targets; during the execution of a change operation instruction, for each target system call or each target program call, monitoring the context information of the monitoring target during the execution of the change operation instruction; based on the context information, updating the monitoring target in the monitoring target database; after each target system call or each target program call is completed, based on the context information corresponding to the monitoring target in the target database, obtaining the monitoring record corresponding to each target system call or each target program call, and recording the monitoring record to the monitoring record database; after the change is completed, determining the change impact surface of this change based on the monitoring record recorded in the monitoring record database.

[0007] The change impact surface monitoring method provided in the present application directly monitors the change operation and dynamically increases or decreases the monitoring targets during the change process. For example, when the monitoring target process starts a new process, the new process is updated to the monitoring target database and monitored as a new monitoring target to eliminate monitoring blind spots; when the monitoring target is deleted, the monitoring target is deleted from the monitoring target database to avoid monitoring data that is not related to the change and reduce data redundancy.

[0008] In one possible implementation, the change impact surface monitoring method provided in the present application can be applied to the monitoring scenario of change operations on system resources. When applied to this scenario, the monitoring targets include target processes and target files. The change impact surface monitoring method provided in the present application also includes: mounting a first probe program on a target system call (for example, several system calls that have an impact on system security); during the execution of the change operation instruction, for each target system call, monitoring the context information of the monitored target during the execution of the change operation instruction. A specific implementation is: the first probe program obtains the current process that calls the target system call, or the first object operated by the target system call; the first probe program determines that the current process is the target process, or the first object is the target file; the first probe program monitors the context information of the current process, or monitors the context information of the first object.

[0009] In this possible implementation, first determine whether the target system call is related to the monitoring target, for example, by determining whether the caller of the target system call is the target process, or whether the object to be operated by the target system call is the target file. If so, it means that the system call is related to the monitoring target, and the execution of the target system call needs to be monitored. In this way, it is avoided to monitor data irrelevant to the change operation instruction, and the redundancy of the monitoring data is reduced. For example, in addition to running the change operation instruction, the computer system also executes a large number of user service instructions. These large number of user service instructions are also implemented by calling system calls. If all target system calls are monitored without discrimination, a large amount of data irrelevant to the change operation instruction will inevitably be monitored, resulting in a large amount of data redundancy.

[0010] In another possible implementation, based on context information, a specific implementation of updating the monitoring target in the monitoring target database is: the upper and lower file information monitored by the first probe program includes that the target process starts the first process, and / or the target process modifies the first file, the first process is not recorded in the monitoring target database, and the first file is not recorded in the monitoring target database; the first probe program adds the first process and / or the first file to the monitoring target database. In other words, when a new monitoring target appears in the monitored upper and lower files, it is necessary to add the new monitoring target to the monitoring target database, dynamically update the monitoring target database, reduce the monitoring blind spot, and realize the complete collection of the set of objects affected by the change. For example, if the target process starts a new process, the new process is added to the monitoring target database as a new target process, and if the target process modifies a new file, the new file is added to the monitoring target database as a new target file.

[0011] For example, when it is monitored that target process A starts a new process B, process B is added to the monitoring target database as a new target process for monitoring; when it is monitored that process B modifies a new file C, file C is added to the monitoring target database as a new target file for monitoring. In this way, the complete trace data can be monitored and captured. For example, process A starts process B, process B modifies file C, and process D reads file C. In such a link, by dynamically updating the monitoring target, the complete change operation link can be monitored, and operations that were not originally in the monitoring target can be captured, such as process D's reading operation on file C.

[0012] In this possible implementation, the monitoring target is dynamically updated according to the monitoring data, and then the monitoring range is adjusted to reduce the monitoring blind area.

[0013] In another possible implementation, a specific implementation of updating the monitoring target in the monitoring target database based on context information is: the context file information monitored by the first probe program includes the first target system call and the object of the first target system call operation includes the second process, and the first target system call is used to exit the process; it is determined that the second process is recorded in the monitoring target database; the record corresponding to the second process is deleted from the monitoring target database; and / or the context file information monitored by the first probe program includes the second target system call, the operation object of the second target system call includes the second file, and the second target system call is used to delete the file; it is determined that the second file is recorded in the monitoring target database; and the record corresponding to the second file is deleted from the monitoring target database.

[0014] For example, during the execution of the change operation instruction, if the operation object of the system call exit_group() or exit() is monitored to be the first process, and the first process is determined to be the target process recorded in the target database by querying the monitoring target database, the first process is deleted from the monitoring target database; if the operation object of the system call unlinkat() or unlink() is monitored to be the first file, and the first file is determined to be the target file recorded in the target database by querying the monitoring target database, the first file is deleted from the monitoring target database. In this way, the invalid monitoring targets are dynamically deleted as the change operation instruction is executed, further reducing data redundancy.

[0015] This possible implementation is coordinated with the previous possible implementation to achieve dynamic increase or decrease of monitoring targets as the change operation instructions are executed, eliminate monitoring blind spots and effectively reduce monitoring data redundancy.

[0016] In another possible implementation, after each target system call is completed, the monitoring record corresponding to each target system call is obtained based on the context information corresponding to the monitoring target in the target database, and the monitoring record is recorded in the monitoring record database. The specific implementation is: the first probe program organizes the context information to obtain the monitoring record; the first probe program applies for recording space from the monitoring record database; the first probe program sends request information to the monitoring record database, and the request information is used to request the monitoring record database to record the monitoring record into the recording space.

[0017] Optionally, the first probe is a kernel state probe, for example, the first probe may be an extended Berkeley packet filter (eBPF) probe program; the target database and the monitoring record database are both deployed in a memory space corresponding to the kernel state.

[0018] In another possible implementation, the monitoring target database includes a first hash table and a second hash table, wherein the first hash table records the process identifier of the target process, and the second hash table records the file identifier of the target file. In this way, it is convenient to query the monitoring target, and by querying whether the monitored process or file is in the hash table in a way with a complexity of 1, it is further determined whether it is a monitoring target that needs to be monitored.

[0019] In another possible implementation, the change impact surface monitoring method provided in the present application also includes: initializing a monitoring target database; the initialized monitoring target data includes an initial monitoring target, the initial monitoring target includes an initial target process, the initial target process includes a terminal process, or a parent process that executes a change script process.

[0020] In another possible implementation, the monitoring record corresponding to each target system call includes at least an identifier of the target system call, a process identifier corresponding to the process executing the target system call, and information about the object operated by the system call.

[0021] In another possible implementation, the change impact surface monitoring method provided in the present application can also be applied to the monitoring scenario of change operations at the application service level, such as monitoring the change operations of database services by operation and maintenance personnel. In this scenario, the monitoring target includes the target data element. The change impact surface monitoring method provided in the present application also includes mounting a second probe program in the target service process; during the execution of the change operation instruction, for each target program call, a specific implementation of monitoring the context information of the monitoring target during the execution of the change operation instruction is: through the second probe program, obtaining the first context information of the target program call; determining that the first context information includes the target data element; and recording the first context information.

[0022] It is understandable that in the scenario of service change monitoring, the monitoring target is what kind of data elements are related to the business. For example, in the database business, the monitoring target can be several target users or several target database tables, and the monitoring target users can monitor which change operations have been performed, or which change operations have been performed on the target database table, and which objects will be affected after the target data table is changed and modified, etc. For another example, in the container / container hosting business, the monitoring target can be several target users or several containers or several images.

[0023] In another possible implementation, a specific implementation of updating the monitoring target in the monitoring target database based on the context information is: determining that the monitored context information includes a first data element that has an association relationship with the target data element, and the first data element is not recorded in the monitoring target database; adding the first data element to the monitoring target database. For example, when it is monitored that the target user has modified a new database table (i.e., a database table that is not recorded in the monitoring target database), the new database table is added to the monitoring record database and monitored as a monitoring target.

[0024] In another possible implementation, a specific implementation of updating the monitoring target in the monitoring target database based on context information is: the monitored context file information includes a first target program call, the object of the first target program call operation includes a third process and a second data element related to the third process, and the first target program call is used to exit the process; it is determined that the second data element is recorded in the monitoring target database; the record corresponding to the second data element is deleted from the monitoring target database; and / or the monitored context file information includes a second target program call, the operation object of the second target program call includes a third data element, and the second target program call is used to delete the data element; it is determined that the third data element is recorded in the monitoring target database; and the record corresponding to the third data element is deleted from the monitoring target database.

[0025] In another possible implementation, after each target program call is completed, based on the context information corresponding to the monitoring target in the target database, a monitoring record corresponding to each target program call is obtained, and the monitoring record is recorded in the monitoring record database. A specific implementation is: determine whether the context information of the target service process is related to the monitoring target; if so, retain the context information of the target process and record it in the monitoring record database; if not, delete the context information of the target process from the monitoring record database.

[0026] Optionally, the second probe is a user-state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the user-state.

[0027] In another possible implementation, when applied to a monitoring scenario of a change operation at the application service level, the initialized monitoring target data includes an initial monitoring target, and the initial monitoring target includes an initial data element. In a database business scenario, the initial data element may be, for example, a pre-set initial target user or an initial database table.

[0028] In the second aspect, the present application also provides a monitoring device for the change impact surface, including an acquisition module, a monitoring module, an update module, a recording module and a determination module, wherein the acquisition module is used to acquire a monitoring target database, which records a number of monitoring targets; the monitoring module is used to monitor the context information of the monitoring target during the execution of the change operation instruction for each target system call or each target program call; the update module is used to update the monitoring target in the monitoring target database based on the context information; the recording module is used to obtain the monitoring record corresponding to each target system call or each target program call based on the context information corresponding to the monitoring target in the target database after each target system call or each target program call is completed, and record the monitoring record to the monitoring record database; the determination module is used to determine the change impact surface of this change based on the monitoring records recorded in the monitoring record database after the change is completed.

[0029] In a possible implementation, the change impact surface monitoring device provided by the present application can be applied to the monitoring scenario of the change operation of the system resources. When applied to this scenario, the monitoring targets include the target process and the target file. The change impact surface monitoring device provided by the present application also includes a probe mounting module, which is used to mount the first probe program on the target system call; the monitoring module is specifically used for: the first probe program obtains the current process that calls the target system call, or the first object operated by the target system call; the first probe program determines that the current process is the target process, or the first object is the target file; the first probe program monitors the context information of the current process, or monitors the context information of the first object.

[0030] In another possible implementation, the update module is specifically used to monitor the upper and lower file information monitored by the first probe program, including that the target process starts the first process, and / or the target process modifies the first file, the first process is not recorded in the monitoring target database, and the first file is not recorded in the monitoring target database; the first probe program adds the first process and / or the first file to the monitoring target database.

[0031] In another possible implementation, the update module is specifically used to monitor the context file information monitored by the first probe program, including the first target system call and the object of the first target system call operation including the second process, and the first target system call is used to exit the process; determine that the second process is recorded in the monitoring target database; delete the record corresponding to the second process from the monitoring target database; and / or the context file information monitored by the first probe program includes the second target system call, the operation object of the second target system call includes the second file, and the second target system call is used to delete the file; determine that the second file is recorded in the monitoring target database; and delete the record corresponding to the second file from the monitoring target database.

[0032] In another possible implementation, the recording module is specifically used for: the first probe program organizes the context information to obtain monitoring records; the first probe program applies for recording space from the monitoring record database; the first probe program sends request information to the monitoring record database, and the request information is used to request the monitoring record database to record the monitoring records into the recording space.

[0033] In another possible implementation, the first probe is a kernel state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the kernel state.

[0034] In another possible implementation, the monitoring target database includes a first hash table and a second hash table, the first hash table records the process identifier of the target process, and the second hash table records the file identifier of the target file.

[0035] In another possible implementation, the change impact surface monitoring device provided by the present application also includes an initialization module: the initialization module is used to initialize the monitoring target database; the initialized monitoring target data includes the initial monitoring target, the initial monitoring target includes the initial target process, the initial target process includes the terminal process, or the parent process of the execution change script process.

[0036] In another possible implementation, the monitoring record corresponding to each target system call includes at least an identifier of the target system call, a process identifier corresponding to the process executing the target system call, and information about an object operated by the system call.

[0037] In another possible implementation, the change impact surface monitoring device provided in the present application can be applied to the monitoring scenario of change operations at the application service level, in which the monitoring target includes the target data element; the probe mounting module is used to mount the second probe program in the target service process; the monitoring module is specifically used to obtain the first context information called by the target program through the second probe program; determine that the first context information includes the target data element; and record the first context information.

[0038] In another possible implementation, the update module is specifically used to determine that the monitored context information includes a first data element associated with the target data element, and the first data element is not recorded in the monitoring target database; and add the first data element to the monitoring target database.

[0039] In another possible implementation, the update module is also specifically used to monitor the upper and lower file information including the first target program call, the object of the first target program call operation including the third process and the second data element related to the third process, and the first target program call is used to exit the process; determine that the second data element is recorded in the monitoring target database; delete the record corresponding to the second data element from the monitoring target database; and / or the monitored upper and lower file information includes the second target program call, the operation object of the second target program call includes the third data element, and the second target program call is used to delete the data element; determine that the third data element is recorded in the monitoring target database; and delete the record corresponding to the third data element from the monitoring target database.

[0040] In another possible implementation, the recording module is specifically used to determine whether the context information of the target service process is related to the monitoring target; if so, the context information of the target process is retained and recorded in the monitoring record database; if not, the context information of the target process is deleted from the monitoring record database.

[0041] In another possible implementation, the second probe is a user-state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the user state.

[0042] It can be understood that when the change impact surface monitoring device provided by the present application can be applied to the monitoring scenario of change operations at the application service level, the corresponding initialization monitoring targets and monitoring records will change adaptively. For example, the initialization monitoring target is an initial data element, and a monitoring record includes at least the identifier of the target program call, the process identifier corresponding to the process that executes the target program call, and the information of the object operated by the program call.

[0043] In a third aspect, an embodiment of the present application provides a computing device, including a memory and a processor, wherein the memory stores instructions, and when the instructions are executed by the processor, the method described in the first aspect is implemented.

[0044] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0045] In a fifth aspect, an embodiment of the present application further provides a computer program or a computer program product, wherein the computer program or the computer program product comprises instructions, which, when executed, cause a computer to execute the method described in the first aspect.

[0046] In a sixth aspect, an embodiment of the present application further provides a chip, comprising at least one processor and a communication interface, wherein the processor is used to execute the method described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 An architectural diagram of a monitoring device for a change impact surface implemented by applying the monitoring method for a change impact surface provided by an embodiment of the present application is shown;

[0048] Figure 2 A schematic diagram of the implementation process of a probe program is shown;

[0049] Figure 3 An architecture diagram of another device for monitoring a change impact surface implemented by applying the method for monitoring a change impact surface provided in an embodiment of the present application is shown;

[0050] Figure 4 A flow chart of a method for monitoring a change impact surface provided in an embodiment of the present application;

[0051] Figure 5 A schematic diagram of the structure of a monitoring device for a change-affected surface provided in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The term "and / or" mentioned in this article is a kind of relationship that describes the association of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0054] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of objects. For example, a first probe program and a second probe program are used to distinguish different probes rather than to describe a specific order of probe programs.

[0055] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0056] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0057] To facilitate understanding of the solutions of the embodiments of the present application, the technical terms involved in this document are first explained below.

[0058] Change: The act of changing the current state of an IT system. The change object can be hardware (server, peripherals) or software (OS, services). In the embodiments of this application, it specifically refers to the change of software.

[0059] Change impact area: The software resources operated by a change. For example, starting a program, reading or writing a file, accessing a remote URL, modifying a system configuration, etc. The collection of these operated (add, delete, modify, and check) objects is the impact area of ​​a change.

[0060] Monitoring record (Trace): Each system call made by the operation and maintenance personnel during the change process is a trace.

[0061] The technical solution of the present application is further described in detail below through the accompanying drawings and embodiments.

[0062] In order to ensure the security of the system or service applications, when the operation and maintenance personnel make changes to the IT system or service application (such as database), they will monitor the change impact of the change operation. When the change impact is found to have risks, an alarm will be issued to avoid system failures caused by the changes.

[0063] There are many monitoring solutions for the impact of changes, such as the related solution 1, which is a monitoring solution based on logs, traces, and metrics. This technology does not monitor the change operation, but monitors the data of the changed service. Based on this, it analyzes whether the change process is normal. This monitoring solution is usually used in conjunction with grayscale release. First, implement the change on one server and monitor whether the service is running normally. If there is no problem, continue to change on the second server, and finally complete the change operation of the entire cluster.

[0064] For example, Azure's Gandalf system collects data generated by various monitoring data sources for anomaly detection, including logs generated by services, operating system logs, performance counters, etc. Gandalf uses anomaly detection algorithms to detect anomalies in the system and then uses correlation analysis technology to obtain the changes that cause the anomalies.

[0065] In addition to using multiple data types in combination, you can also use only one type of data to discover service failures, such as using log data to determine whether a failure has occurred and analyze the impact of the failure.

[0066] The monitoring target of this monitoring solution is the service being changed, not the change operation itself. It can be understood as focusing only on the results, not the process. If other services are affected during the change process, these dangerous operations will be in the monitoring blind spot and will not be discovered. Moreover, the impact of the change is potential, such as memory leaks, repeated startup and other problems. These problems will not cause system failures immediately, and may only cause failures a week later. This solution cannot handle these problems.

[0067] Related solution 2: monitor system calls. Monitor the system calls of a single process, the system calls of a specific cgroup, or record all system calls during the operation and maintenance process. Record and analyze kernel behavior, and intercept high-risk operations according to predefined rules. For example, monitor all system calls of a container, and then audit and analyze whether there are risks. For another example, when monitoring container system calls, some risky system calls are intercepted and alarms are issued. For another example, first monitor the system calls of the container, and then use the pre-trained model to find high-risk system calls from the monitoring data.

[0068] The main disadvantage of this monitoring solution is data redundancy and loss. The change operation will not have only one command. If only the system calls of a single process are monitored, data loss will inevitably occur, resulting in a blind spot in monitoring. If all system calls are monitored, the amount of data is too large. Moreover, most of the data are system calls of normal services and have nothing to do with the change process.

[0069] Related solution three is a monitoring solution based on command logs. During the operation and maintenance process, the operation commands of the operation and maintenance personnel and the echo data of the target host are recorded. Commands are classified through natural language processing (NLP) methods to identify commands that cause risks during operations. For example, a blacklist mechanism is used. The blacklist is a collection of risky operation and maintenance commands pre-prepared by the operation and maintenance personnel. If the command entered by the operation and maintenance personnel matches the blacklist during the change process, the command is intercepted and cannot be executed. Another example is to comprehensively monitor changes through command logs, blacklist interception, and permission management.

[0070] The disadvantage of this solution is that the command name is difficult to express the actual meaning. Although the "rm" command can be used to determine that the operation and maintenance personnel have performed a deletion operation. However, if the operation and maintenance personnel write the deletion operation into a script "main.sh" and execute this script, only "main.sh" will be recorded in the command log, and the deletion operation cannot be found. Or if command A calls service B to perform an operation, the command log only has the name of command A, and there is no information about the actual operation of command A.

[0071] Related solution 4 is a monitoring solution based on system scanning. The scanning targets include service interfaces, various resources, and various configurations. According to the operating status of the resources, each check item of each resource is given a specific score, which is summarized to form a quantitative evaluation result of the overall security of the cloud platform.

[0072] This solution is usually used in conjunction with a version baseline. A version baseline is a state of the software (version, configuration, and parameters are completely consistent) as a baseline. Unauthorized modification of any software parameters is not allowed, and only changes from one baseline to another are allowed. Therefore, system scans only need to be compared with the baseline. If there is any inconsistency, it means that there is an incorrect change.

[0073] For example, an IT system security model is established, and the scanning program is executed regularly, and the security score of the system is given according to the scanning results. Another example is to scan data only when it is changed, and determine the impact of the change based on the association between the data. Another example is to scan only the service interface, and determine whether the change has modified the service interface based on the return value.

[0074] This solution is similar to the related solution 1, focusing on the results of the change, but not the process of the change. The disadvantages are similar. It cannot monitor the change behavior in the monitoring blind spot, nor can it handle the change failure caused by it. In addition, the system scanning mechanism is very rigid and cannot modify the software configuration according to the actual environment. Because users' businesses are diverse and the hardware environment is diverse, this approach that requires all software to be consistent can only adapt to small-scale clusters.

[0075] Related solution 5: monitoring solution based on code analysis. Obtain the correspondence between each URL and method by analyzing the software code; determine the calling relationship between different URLs in the changed version; and determine the impact area based on the differences in the correspondence and calling relationship between the version to be released and the current version.

[0076] Code analysis can be understood as a special case of system scanning. System scanning is for software running on the existing network, while code analysis is for software before deployment. In contrast, code analysis lacks data in the running state, but the performance requirements are not high due to offline.

[0077] Exemplarily, the software version to be released is first analyzed to determine the correspondence between each URL and method in the version, and the impact surface is determined based on the differences in the correspondence and calling relationship between the version application to be released and the current version application.

[0078] This solution can find the code differences before and after the software is changed. However, it cannot overcome the defect of system scanning - the change process is a blind spot of monitoring. Any risky operations in the blind spot cannot be discovered in time.

[0079] Related solution 6: Monitoring solution based on file comparison. Calculate the file checksum of the update program file as the update program file fingerprint; compare the update program file fingerprint with the current program file fingerprint of the target application to determine whether the target application has been updated.

[0080] File comparison is a simplified solution for system scanning. In contrast, file comparison does not need to scan various configurations and operating status in the operating environment. It only needs to calculate the checksum of the program file to determine whether the file has been changed. In actual processes, MD5 code is often used as the file checksum. This approach is more convenient and has better performance.

[0081] Exemplarily, when a file change instruction of a target application is detected, the changed update program file is obtained, and the file checksum of the update program file is calculated as the update program file fingerprint; the update program file fingerprint is compared with the current program file fingerprint of the target application, and based on the comparison result of the update program file fingerprint and the current program file fingerprint, it is determined whether the target application has been updated.

[0082] This solution is just a simplified solution of system scanning. In addition to the original shortcomings of system scanning, file comparison can only detect file changes in the system, and the blind spot is larger.

[0083] In summary, in related solutions, there are common technical problems such as large monitoring blind spots and redundant monitoring data. It can be understood that the monitoring blind spots of changes include modification behaviors outside the target service during the change process and system behaviors generated by indirect command calls. Data redundancy is data that is not related to the change, including data generated by normal service operation.

[0084] In response to the problems existing in the related technologies, the embodiments of the present application provide a monitoring method for the impact surface of changes, which can realize a management mechanism for dynamic monitoring targets. When the change operation starts a new process or reads and writes new files, these will be dynamically added to the monitoring targets, so that the monitoring scope is limited to the change scope and changes with the changes. This can greatly reduce or even eliminate monitoring blind spots and reduce the problem of monitoring data redundancy.

[0085] The change impact surface monitoring method provided in the embodiment of the present application can be applied to a change scenario for system resources to implement the monitoring of the change impact surface of the change operation of the IT system.

[0086] For example, the change monitoring software program implemented by the change impact surface monitoring method provided by the embodiment of the present application is deployed in the IT system. When the operation and maintenance personnel enter the IT system, the change monitoring program starts. The operation and maintenance personnel then perform any change operation, dynamically increase or decrease the monitoring target, and record the set of all objects operated by the change. After the operation and maintenance personnel complete the change and exit, the change monitoring program stops monitoring, outputs a report and exits.

[0087] Figure 1 The present invention shows an architecture diagram of a monitoring device for a change impact surface implemented by using the monitoring method for a change impact surface provided by an embodiment of the present application. The monitoring device can be applied to a change scenario for system resources to achieve monitoring of the change impact surface of a change operation of an IT system without blind spots and with low data redundancy.

[0088] like Figure 1 As shown, the monitoring device includes a control module (Controller), a consumer module (Consumer), eBPF Probes (eBPF probes), a monitoring record database (Traces), and a monitoring target database (Targets), wherein the control module is used to manage the initialization of other modules and the setting of initial targets. The consumer module is used to read and organize data from Traces. Traces is a memory area for storing trace data. Targets is a memory area for storing target data. The eBPF probe is used to mount in a specified system call or kernel function.

[0089] In one example, the working process of the monitoring device of the change impact surface can be roughly divided into three stages: initialization, change and stop. That is, the working process of the monitoring device of the change impact surface when monitoring the operation and maintenance personnel to complete a change operation can be roughly divided into three stages: initialization, change and stop.

[0090] During the initialization phase, the operation and maintenance personnel access the system. When the control module detects the access behavior, it will first initialize the two memory databases of Traces and Targets, and write the initial target into Targets. Then the consumer module is started. Finally, the eBPF probe is loaded and hung on the specified system call. The specified system call can be understood as a system call that may affect the security of the IT system, such as the write system call. The write system call may rewrite the system configuration, and rewriting the system configuration may cause system failure. Therefore, it is necessary to monitor the write system call and hang the eBPF probe on the write system call.

[0091] In one example, Traces is a memory area in the kernel, organized in the form of an array. Each item in the array is a trace (monitoring record). It contains the id number of the system call, the process identifier (PID) of the process that executes the system call, and the type and related information of the system call operation object (file name, network IP, etc.). Targets is also a memory area in the kernel state, organized in the form of a hash table. It is divided into different hash tables according to type, such as process hash tables and file hash tables. If the monitoring target is a process, it will be queried in the process hash table. The primary key of the process hash table is PID. If the monitoring target is a file, it will be queried in the file hash table. The primary key of the file hash table is the file identifier (inode). The values ​​of these two hash tables are both empty. The hash table is designed to facilitate query. You can query whether the monitoring target is in the hash table with a complexity of 1.

[0092] Of course, in some other examples, the data in Traces and Targets may also be stored in other feasible formats, which is not limited in the embodiments of the present application.

[0093] It can be understood that the process PID is used to uniquely identify a process, and the file inode is used to uniquely identify a file.

[0094] Writing the initial target is related to the change method. In the manual change scenario, the operation and maintenance personnel will log in to the system through the terminal, and the system will start a terminal program (such as the bash program) to accept the user's command. In this scenario, the initial target is the PID of the Bash program, which is written to the process hash table. In the automatic change scenario, the system automatically executes the change script. In this scenario, the initial target is the parent program that executes the change script, such as the PID of the control program, which is also written to the process hash table.

[0095] The function of the consumer module is to read and organize data from Traces. After the control module initializes the consumer module, the consumer module will not start reading data immediately, but will be blocked, waiting for the eBPF probe program to send a signal.

[0096] The eBPF program is a probe program. The eBPF program is inserted into the kernel functions that need to be monitored, such as the functions of reading and writing files, creating processes, network communication, etc. Once the operating system executes the relevant system call, the program will be triggered.

[0097] During the change phase, the operation and maintenance personnel modify the system through various commands. However, any operation on system resources must be completed through the system call interface. Here, the operation and maintenance personnel modify the configuration file as an example to illustrate the change process.

[0098] When the operation and maintenance personnel modify the configuration file service.confg, they can use various commands such as sed, awk, vim, echo, and vi. These commands will eventually call the write system call of the operating system to complete the write operation. Since the eBPF function has been mounted on the write system call during the initialization phase, the eBPF probe program will also be executed when the write program is executed. The flow of this program is as follows Figure 2 As shown. First, determine whether the monitoring target (i.e. the monitored object) is in Targets. The judgment method has two conditions. Condition one is to obtain the PID of the current process and determine whether the PID is in the process hash table of Targets. Condition two is to obtain the inode number of the file to be written and determine whether the inode number is in the file hash table of Targets. If neither condition one nor condition two is met, exit the eBPF probe program and continue to execute the original system call. If any condition is met, collect the data of the system call context. Then apply for a trace storage space from Traces, organize the previously collected data into a trace and write it into Traces.

[0099] In operation and maintenance changes, the resource objects of the operation are very extensive, and a change operation may involve hundreds of files. However, these operations are not self-contained, but are interconnected. For example, process A starts process B, process B modifies file C, and process D reads file C. In such a link, the entire link can be monitored starting from process A. The key is to adjust the scope of the target in each monitoring. When process A starts process B, process B must also be added to the target Targets. When process B modifies file C, file C must also be added to the file hash table of Targets. Only in this way can the reading of file C by process D be captured to form trace data. Therefore, in the eBPF program of the write system call, Targets needs to be modified. If condition one is met and condition two is not met, the inode of the file to be written is written to the file hash table. Targets are not modified in other cases. The reason why PID is not added when condition one is not met and condition two is met is because this PID is the reading behavior of the configuration file for the normal service. If the PID of the normal service is added to the process hash table of Targets. All subsequent behaviors of the service will also be included in the monitoring. These data are irrelevant to the change and are not needed by us. In this way, while eliminating the blind spots of monitoring, the redundancy of monitoring data is reduced.

[0100] After dynamic target modification is completed, the eBPF program finally sends a read signal to the consumer module. After the eBPF program ends, the system will continue to execute the system call program to complete the file writing. The consumer module program in user mode is always in a blocked state, and only after receiving the signal from the eBPF program will it read the data in Traces.

[0101] During the change phase, each command from the operation and maintenance personnel will trigger the above process. By continuously collecting data and modifying the target, the set of operation objects in a change is finally obtained, that is, the impact area of ​​this change.

[0102] In the stop phase, the operation and maintenance personnel have completed all the change operations, exit the system, and the corresponding Bash program will also stop. The control module is also in the blocking stage during the change phase, but it will be awakened once every preset time (for example, 5 seconds). After waking up, it will check whether the process of the initial target still exists. If it does, it will continue to block. If it is found that the initial target has stopped, the monitoring program will be stopped, each module will be cleaned up and the data will be output. In this process, all eBPF programs are first uninstalled, and then the consumer module will read all the Traces data and then execute the output program. The output program will write the data to a specific file or send it to the host of the remote node according to the settings in the configuration file. After the output is completed, the consumer thread stops. The control module finally reclaims the two memory areas of Targets and Traces and exits.

[0103] It is understandable that in some other examples, the functions of the eBPF probe program can also be implemented in other ways, such as using the preload technology to modify the libc library, or using the kprobe technology to mount the probe and other solutions. These technologies can realize the functions of the eBPF probe. Traces and Targets can also be transformed into user-mode processes, using pipes, sockets, message queues and other technologies to support queries of other processes.

[0104] In operation and maintenance changes, in addition to modifying system resources, there is another type of change scenario. The change to be modified is not the system resources, but the status or data of the service (such as a database service). The monitoring method of the change impact surface provided in the embodiment of the present application can also be applied to the change scenario of the service status or data to realize the monitoring of the change impact surface of the change operation of the application service.

[0105] In the operation and maintenance changes of the service, system calls are generally not triggered, so user-mode probes are required to complete the monitoring of the service process.

[0106] Figure 3The present invention shows an architecture diagram of another monitoring device for a change impact surface implemented by applying the monitoring method for a change impact surface provided by an embodiment of the present application. The monitoring device can be applied to a scenario for a change of service resources (e.g., the status and / or data of a service) to implement monitoring of the change impact surface of a change operation of a service without a monitoring blind spot and with low data redundancy.

[0107] The initialization and stop phases are the same as the initialization node and stop phases of the monitoring device for the change impact surface in the change scenario of system resources. The control module controls other modules to complete the initialization and stop process. The difference is that the user-mode probe is mounted in the service process instead of the kernel's system call function. Traces and Targets are deployed in user mode instead of kernel mode.

[0108] During the change phase, each call to the service application will trigger the Probes. User-mode probe programs cannot interact with Targets, so each call will record and write Traces. The filtering function is completed by the consumer module. After the consumer module reads the data from the Traces, it queries the Targets and determines whether the trace is related to the change process. If so, the data is retained, otherwise it is discarded. Targets management is also completed by the consumer module.

[0109] That is to say, the biggest difference compared to the monitoring device for the change impact surface in the change scenario of system resources is that the query and increase and decrease of the monitoring target are completed by the consumer module, not the Probes.

[0110] In another example, during the change phase, each call to the service application will trigger Probes. User-mode probes monitor and collect context information of target program calls. User-mode probe programs query Targets through pipes, sockets, message queues, shared memory and other technologies to determine whether the monitored context information is related to the change process. If so, the user-mode probe applies for a trace memory space from Traces, organizes the monitored context information into a trace, and records the trace in Traces.

[0111] Figure 4 A flow chart of a method for monitoring a change impact surface provided in an embodiment of the present application, which method can be applied to Figure 1 The monitoring device shown or Figure 3 The monitoring device shown in the figure realizes monitoring of the change impact surface of the change operation of the IT system without blind spots and low data redundancy, or monitoring of the change impact surface of the change operation of the service without blind spots and low data redundancy. Figure 4 As shown, the method for monitoring the change impact surface provided in the embodiment of the present application at least includes steps S401 to S405.

[0112] In step S401, Targets are obtained, and the targets are recorded in Targets.

[0113] Targets will be initialized during the initialization phase, and the initial monitoring target will be recorded in the initialized Targets. When the monitoring method for the change impact surface provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of system resources, the initial target is related to the change method. For example, when the manual change method is adopted, the operation and maintenance personnel will log in to the system through the terminal, and the system will start a terminal program (such as a bash program) to accept the user's command. The initial monitoring target corresponding to the change method is the Bash program, and the PID of the Bash program is written into the process hash table. When the automatic change method is adopted, the system will automatically execute the change script. The initial target in this change method is the parent program that executes the change script, such as the PID of the control program, and the PID of the control program is written into the process hash table.

[0114] When the change impact surface monitoring method provided in the present application is applied to the monitoring scenario of the change operation of the application service, the initial monitoring target in the initialized Targets is related to the business, and different businesses correspond to different initial monitoring targets. For example, in the database business, the initial monitoring target can be several target users and / or several target database tables, that is, the target user id and / or database table id will be recorded in the hash table in the initialized monitoring target database; in the container / container hosting business, the initial monitoring target can be several target users or several containers or several images, that is, the target user id and / or the id of the target container, the id of the image, etc. will be recorded in the hash table in the initialized monitoring target database.

[0115] It should be explained that the monitoring method of the change impact surface provided in this application can be applied to the change monitoring scenario of any service, such as user service or middleware service. User service can be understood as a service related to the user's business, which carries the user's business, such as web services, chat services, and shopping services. Middleware service can be understood as not directly providing business services, but used to support business services, such as database services, container services, container hosting services, message queue services, etc.

[0116] However, as the change operation instruction is executed, Targets will be dynamically updated and adjusted. For example, the monitoring targets in Targets will be dynamically increased or decreased according to the context information of the monitoring targets during the execution of the change operation instruction. Specifically, when it is detected that the context information includes the target process starting a new process, and / or when it is detected that the monitoring target has modified a new file, the new process and / or new file will be updated to Targets and monitored as a new target process and / or new target file. When it is detected that the context information includes the exit of the target process and / or the deletion of the target file, the target process and / or target file will be deleted from Targets.

[0117] In step S402, for each target system call or each target program call, the context information of the monitored target during the execution of the monitoring change operation instruction is monitored.

[0118] When the change impact surface monitoring method provided in the embodiment of the present application is applied to a monitoring scenario of a change operation on system resources, for each target system call, the context information of the monitored target is monitored during the execution of the change operation instruction.

[0119] Exemplarily, each target system call can be monitored by a kernel-mode probe program. Specifically, in the initialization phase, the eBPF probe program is loaded and the probe program is mounted on the specified system call. The specified system call here can be understood as a number of system calls that may affect system security, such as the write system call, selected by the developer based on experience. For the convenience of description, the specified system call is referred to as the target system call. After the initialization phase, the eBPF probe program is mounted on the target system call. When the target system call is called for execution, the eBPF probe program will also be executed to monitor the target system call.

[0120] Through the eBPF probe program, the current process that calls the target system call, or the object operated by the target system call, such as the file to be modified, can be monitored; the current process is determined to be the target process, or the object is the target file; the first probe program monitors the context information of the current process, or monitors the context information of the object.

[0121] For example, when the eBPF probe program monitors the current process that calls the target system call, or the object (such as a file) operated by the target system call, it first determines whether the monitored current process or the operated object is in Targets. The judgment method has two conditions. Condition one is to obtain the PID of the current process and determine whether the PID is in the process hash table of Targets. Condition two is to obtain the inode number of the operated file and determine whether the inode number is in the file hash table of Targets. If neither condition one nor condition two is met, exit the eBPF probe program and continue to execute the original system call. If any condition is met, collect system call context data.

[0122] Optionally, the context file information includes at least the id number of the system call, the process number PID that executes the system call, and the type and related information (file name, network IP, etc.) of the system call operation object.

[0123] When the change impact surface monitoring method provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of the application service, for each target program call, the context information of the monitored target is monitored during the execution of the change operation instruction.

[0124] Each target program call can be monitored by a user-mode probe program. Specifically, during the initialization phase, the user-mode probe program is loaded and attached to the specified program call. The specified system call here can be understood as a number of program calls that may have an impact on the application service and that the developer has selected based on experience to change the program call. For the sake of convenience, the specified program call is referred to as the target program call. After the initialization phase, the user-mode probe program is attached to the target system call. When the target program call is called for execution, the user-mode probe program will also be executed to monitor the target system call.

[0125] Through the user-mode probe program, the context information of the target program call can be monitored. Taking database changes as an example, the context information of the target program call includes the user ID that calls the database service (for example, the user can be the UserID that logs in to the database), the PID of the target program call, and the object to be operated by the target program call, such as the database table ID that the target program calls to modify. Query Targets to determine whether the user ID and / or database table ID that appears in the monitored context is recorded in Targets. If so, the context information of the target program call is recorded. In this way, it is possible to monitor which users have made changes to the database and which database tables have been changed, etc.

[0126] In step S403, the monitoring targets in the monitoring target database are updated based on the context information.

[0127] Based on the context information, during the execution of the change operation instruction, the monitoring targets in the monitoring database are dynamically increased or decreased. In other words, during the execution of the change operation instruction, based on the context information, the monitoring targets can be dynamically increased or decreased.

[0128] Exemplarily, when the change impact surface monitoring method provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of system resources, the upper and lower file information monitored by the eBPF probe program includes that the target process has started a new process, or the target process has accessed a new file. The new process can be understood as a process not recorded in Targets, and the new file can be understood as a file not recorded in Targets; the eBPF probe program updates the new process and / or new file to Targets as a new target process and / or target file for monitoring.

[0129] For example, when the execution link of a change operation instruction is: process A starts process B, process B modifies file C, and process D reads file C. In such a link, the entire link can be monitored starting from process A. The key is to adjust the scope of the target in each monitoring. When process A starts process B, process B should also be added to the target Targets. When process B modifies file C, file C should also be added to the file hash table of Targets. Only in this way can the reading of file C by process D be captured to form trace data. Therefore, in the process of monitoring the change operation instruction, Targets needs to be modified. For example, when the eBPF probe program monitors that the target process starts a new process, the PID of the new process is added to the process hash table of Targets. When the eBPF probe program monitors that the target process reads a new file, the inode number of the new file is added to the file hash table of Targets.

[0130] It should be pointed out that the inode number of the file monitored by the eBPF probe program for the target system call operation is recorded in the file hash table of Targets, but the PID of the process that calls the target system call is not recorded in the process hash table of Targets. In this case, Targets is not updated because this process is a normal service reading the configuration file. If the PID of the normal service is added to the process hash table of Targets, all subsequent behaviors of the service will also be included in the monitoring. These data are irrelevant to the change and are not needed by us. In this way, while eliminating the blind spots of monitoring, the data redundancy of monitoring is reduced.

[0131] When the context file information monitored by the eBPF probe program includes the first target system call and the object of the first target system call operation includes the second process, the first target system call is used to exit the process; determine that the second process is recorded in the monitoring target database; delete the record corresponding to the second process from the monitoring target database; and / or the context file information monitored by the first probe program includes the second target system call, the operation object of the second target system call includes the second file, and the second target system call is used to delete the file; determine that the second file is recorded in the monitoring target database; delete the record corresponding to the second file from the monitoring target database.

[0132] For example, during the execution of the change operation instruction, if the process PID of the system calling exit_group() or exit() is monitored in the process hash table, the PID is deleted from the process hash table. If the file inode of the system calling unlinkat() or unlink() is monitored in the file hash table, the inode is deleted from the file hash table. In this way, the invalid monitoring targets are dynamically deleted as the change operation instruction is executed, further reducing data redundancy.

[0133] Exemplarily, when the monitoring method of the change impact surface provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of the application service, the context information monitored by the user-mode probe program includes a first data element associated with the target data element, and the query Targets determines that the first data element is not recorded in the monitoring target database; the first data element is added to the monitoring target database. For example, when it is monitored that the target user has modified a new database table (i.e., a database table that is not recorded in the monitoring target database), the new database table is added to the monitoring record database and monitored as a monitoring target.

[0134] When the upper and lower file information monitored by the user-state probe program includes a first target program call, and the object of the first target program call operation includes a third process and a second data element related to the third process, the first target program call is used to exit the process; the user-state probe program queries Targets through pipes, sockets, message queues, and shared memory to determine that the second data element is recorded in the monitoring target database; deletes the record corresponding to the second data element from the monitoring target database; and / or the upper and lower file information monitored includes a second target program call, and the object of the second target program call operation includes a third data element, and the second target program call is used to delete the data element; determines that the third data element is recorded in the monitoring target database; and deletes the record corresponding to the third data element from the monitoring target database.

[0135] For example, when the service is a database service, the target user ID and the target database table ID are recorded in Targets. When the user-state probe monitors that the target database table is deleted, the target database table ID is deleted from Targets.

[0136] In step S404, after each target system call or each target program call is completed, based on the context information corresponding to the monitoring target in the target database, a trace corresponding to each target system call or each target program call is obtained, and the trace is recorded in Traces.

[0137] When the change impact surface monitoring method provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of system resources, after each target system call is executed, the eBPF probe program organizes the context information to obtain a trace; the eBPF probe program applies for recording space from Traces; the eBPF probe program sends a request message to Traces, and the request message is used to request Traces to record the trace in the recording space.

[0138] Optionally, a trace includes the PID of the target system call, the PID of the process executing the target system call, and information about the object operated by the system call (eg, file i node, network IP), etc.

[0139] When the change impact surface monitoring method provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of the application service, after each target program call is executed, the user-state probe program organizes the context information to obtain a trace; the user-state probe program applies for recording space from Traces through pipes, sockets, message queues, shared memory, etc.; the user-state probe program sends request information to Traces, and the request information is used to request Traces to record the trace in the recording space.

[0140] Optionally, a trace includes the PID of the target program call, the PID of the process that executes the target program call, the user ID associated with the process, and information about the object operated by the program call (such as file i node, network IP, data element), etc.

[0141] In step S405, after the change is completed, the change impact area of ​​the change is determined based on the trace recorded in Traces.

[0142] During the change phase, every command from the operation and maintenance personnel will trigger the above process. By continuously collecting data and modifying the monitoring target, all monitoring records about the change are obtained after the change is completed, that is, all traces recorded in Traces, and finally the set of operation objects in a change is obtained, that is, the impact area of ​​the change.

[0143] Exemplarily, when the monitoring method of the change impact surface provided in the embodiment of the present application is applied to the monitoring scenario of the change operation of the system resources, in the stop phase, the operation and maintenance personnel have completed all the change operations, exit the system, and the corresponding Bash program will also stop. The control module is also in a blocked stage during the change phase, but it will be awakened once every preset time (for example, 5 seconds). After waking up, it will check whether the process of the initial target still exists. If it exists, continue to block. If it is found that the initial target has stopped, stop the monitoring program, clean up each module and output the data. In this process, first uninstall all eBPF programs, and then let the consumer module read all Traces data and then execute the output program. The output program will write the data to a specific file or send it to the host of the remote node according to the settings in the configuration file. After the output is completed, the consumer thread stops. The control module finally recycles the two memory areas of Targets and Traces and exits.

[0144] It should be explained that in the service resource change scenario, such as Figure 3 As shown in the figure, the probe program is a user-mode probe, which is mounted in the service process instead of the kernel's system call function. Traces and Targets are deployed in user mode instead of kernel mode.

[0145] Based on the same concept as the above-mentioned embodiment of the method for monitoring the impact surface of a change, the embodiment of the present application further provides a monitoring device 500 for the impact surface of a change. The monitoring device 500 for the impact surface of a change is deployed on a computing device, which can be any computing device with a processor, and is used to monitor the impact surface of the change operation without a monitoring blind spot and low data redundancy during the change operation. The monitoring device 500 for the impact surface of a change includes a Figure 1-4 The units or modules of each step in the method shown.

[0146] Figure 5 A schematic diagram of a monitoring device for a change-affected surface provided in an embodiment of the present application. Figure 5As shown, the monitoring device 500 for the change impact surface at least comprises an acquisition module 501, a monitoring module 502, an update module 503, a recording module 504 and a determination module 505, wherein the acquisition module 501 is used to acquire a monitoring target database, which records a number of monitoring targets; the monitoring module 502 is used to monitor the context information of the monitoring target during the execution of the change operation instruction for each target system call or each target program call; the update module 503 is used to update the monitoring target in the monitoring target database based on the context information; the recording module 504 is used to obtain the monitoring record corresponding to each target system call or each target program call based on the context information corresponding to the monitoring target in the target database after each target system call or each target program call is completed, and record the monitoring record to the monitoring record database; the determination module 505 is used to determine the change impact surface of this change based on the monitoring records recorded in the monitoring record database after the change is completed.

[0147] In a possible implementation, the change impact surface monitoring device 500 provided in the present application can be applied to a monitoring scenario of change operations on system resources. When applied to this scenario, the monitoring targets include target processes and target files. The change impact surface monitoring device 500 provided in the present application also includes a probe mounting module 506, which is used to mount a first probe program on a target system call; the monitoring module 502 is specifically used for: the first probe program obtains the current process that calls the target system call, or the first object operated by the target system call; the first probe program determines that the current process is the target process, or the first object is the target file; the first probe program monitors the context information of the current process, or monitors the context information of the first object.

[0148] In another possible implementation, the update module 503 is specifically used to monitor the upper and lower file information monitored by the first probe program, including that the target process starts the first process, and / or the target process modifies the first file, the first process is not recorded in the monitoring target database, and the first file is not recorded in the monitoring target database; the first probe program adds the first process and / or the first file to the monitoring target database.

[0149] In another possible implementation, the update module 503 is specifically used to monitor the context file information monitored by the first probe program, including the first target system call and the object of the first target system call operation including the second process, and the first target system call is used to exit the process; determine that the second process is recorded in the monitoring target database; delete the record corresponding to the second process from the monitoring target database; and / or the context file information monitored by the first probe program includes the second target system call, the operation object of the second target system call includes the second file, and the second target system call is used to delete the file; determine that the second file is recorded in the monitoring target database; and delete the record corresponding to the second file from the monitoring target database.

[0150] In another possible implementation, the recording module 504 is specifically used for: the first probe program organizes the context information to obtain monitoring records; the first probe program applies for recording space from the monitoring record database; the first probe program sends request information to the monitoring record database, and the request information is used to request the monitoring record database to record the monitoring records into the recording space.

[0151] In another possible implementation, the first probe is a kernel state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the kernel state.

[0152] In another possible implementation, the monitoring target database includes a first hash table and a second hash table, the first hash table records the process identifier of the target process, and the second hash table records the file identifier of the target file.

[0153] In another possible implementation, the change impact surface monitoring device 500 provided in the present application also includes an initialization module 507: the initialization module 507 is used to initialize the monitoring target database; the initialized monitoring target data includes the initial monitoring target, the initial monitoring target includes the initial target process, the initial target process includes the terminal process, or the parent process of the execution change script process.

[0154] In another possible implementation, the monitoring record corresponding to each target system call includes at least an identifier of the target system call, a process identifier corresponding to the process executing the target system call, and information about an object operated by the system call.

[0155] In another possible implementation, the change impact surface monitoring device 500 provided in the present application can be applied to the monitoring scenario of change operations at the application service level, in which the monitoring target includes the target data element; the probe mounting module 506 is used to mount the second probe program in the target service process; the monitoring module 502 is specifically used to obtain the first context information called by the target program through the second probe program; determine that the first context information includes the target data element; and record the first context information.

[0156] In another possible implementation, the update module 503 is specifically used to determine that the monitored context information includes a first data element associated with the target data element, and the first data element is not recorded in the monitoring target database; and add the first data element to the monitoring target database.

[0157] In another possible implementation, the update module 503 is further specifically used to monitor the context information including the first target program call, the object of the first target program call operation including the third process and the second data element related to the third process, and the first target program call is used to exit the process; determine that the second data element is recorded in the monitoring target database; delete the record corresponding to the second data element from the monitoring target database; and / or the context information includes the second target program call, the object of the second target program call operation including the third data element, and the second target program call is used to delete the data element; determine that the third data element is recorded in the monitoring target database;

[0158] The record corresponding to the third data element is deleted from the monitoring target database.

[0159] In another possible implementation, the recording module 504 is specifically used to determine whether the context information of the target service process is related to the monitoring target; if so, the context information of the target process is retained and recorded in the monitoring record database; if not, the context information of the target process is deleted from the monitoring record database.

[0160] In another possible implementation, the second probe is a user-state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the user state.

[0161] It can be understood that when the change impact surface monitoring device 500 provided in the present application can be applied to the monitoring scenario of change operations at the application service level, the corresponding initialization monitoring target and monitoring record will change adaptively. For example, the initialization monitoring target is an initial data element, and a monitoring record includes at least the identifier of the target program call, the process identifier corresponding to the process that executes the target program call, and the information of the object operated by the program call.

[0162] The monitoring device 500 for the change-affected surface according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module in the monitoring device 500 for the change-affected surface are respectively to implement Figure 1-4 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0163] The change impact surface monitoring device 500 provided in the embodiment of the present application can be deployed on a computing device in the form of software to implement local monitoring of the change impact surface, or it can be deployed in the cloud to provide users with change impact surface monitoring services in the form of cloud services and generate change reports, which record information on the change impact surface.

[0164] The present application also provides a computing device, including at least one processor, a memory and a communication interface, wherein the processor is used to execute Figure 1-4 The method described.

[0165] Figure 6 A schematic diagram of the structure of a computing device provided in an embodiment of the present application.

[0166] like Figure 6 As shown, the computing device 600 includes at least one processor 601, a memory 602 and a communication interface 603. The processor 601, the memory 602 and the communication interface 603 are communicatively connected, and the communication connection can be realized by wired means (such as a bus) or by wireless means. The communication interface 603 is used to receive data sent by other devices; the memory 602 stores computer instructions, and the processor 601 executes the computer instructions to execute the monitoring method of the change impact surface in the aforementioned method embodiment, so as to realize the change impact surface of the monitoring change operation without monitoring blind spots and low data redundancy during the change operation, thereby ensuring the safety of the operation and maintenance personnel in performing the change operation.

[0167] It should be understood that in the embodiment of the present application, the processor 601 may be a central processing unit CPU, and the processor 601 may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0168] The memory 602 may include a read-only memory and a random access memory, and provides instructions and data to the processor 601. The memory 602 may also include a nonvolatile random access memory.

[0169] The memory 602 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0170] It should be understood that the computing device 600 according to the embodiment of the present application can execute the implementation of the embodiment of the present application. Figure 1-4 The method shown, the detailed description of the implementation of this method can be found above, for the sake of brevity, it will not be repeated here.

[0171] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer instructions are executed by a processor, the above-mentioned method is implemented.

[0172] An embodiment of the present application provides a chip, which includes at least one processor and an interface, wherein the at least one processor determines program instructions or data through the interface; the at least one processor is used to execute the program instructions to implement the method mentioned above.

[0173] An embodiment of the present application provides a computer program or a computer program product, wherein the computer program or the computer program product comprises instructions, and when the instructions are executed, the computer is caused to execute the above-mentioned method.

[0174] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0175] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented by hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0176] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation method of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for monitoring a change impact surface, characterized in that: include: Acquire a monitoring target database, wherein the monitoring target database records a number of monitoring targets; During the execution of the change operation instruction, for each target system call or each target program call, monitoring the context information of the monitoring target during the execution of the change operation instruction; Based on the context information, updating the monitoring target in the monitoring target database; After each target system call or each target program call is completed, based on the context information corresponding to the monitoring target in the target database, a monitoring record corresponding to each target system call or each target program call is obtained, and the monitoring record is recorded in a monitoring record database; After the change is completed, the change impact area of ​​the change is determined based on the monitoring records recorded in the monitoring record database.

2. The method according to claim 1, characterized in that The monitoring targets include target processes and target files; The method further comprises: Mount the first probe program on the target system call; During the execution of the change operation instruction, for each target system call, monitoring the context information of the monitoring target during the execution of the change operation instruction includes: The first probe program acquires the current process that calls the target system call, or the first object operated by the target system call; The first probe program determines that the current process is the target process, or the first object is the target file; The first probe program monitors the context information of the current process, or monitors the context information of the first object.

3. The method according to claim 2, characterized in that The updating of the monitoring target in the monitoring target database based on the context information includes: The context file information monitored by the first probe program includes that the target process starts the first process and / or the target process modifies the first file, the first process is not recorded in the monitoring target database, and the first file is not recorded in the monitoring target database; The first probe program adds the first process and / or the first file to the monitoring target database.

4. The method according to claim 2 or 3, characterized in that: The updating of the monitoring target in the monitoring target database based on the context information includes: The context file information monitored by the first probe program includes a first target system call and an object operated by the first target system call includes a second process, and the first target system call is used to exit the process; Determining that the second process is recorded in the monitoring target database; Deleting the record corresponding to the second process from the monitoring target database; and / or The upper and lower file information monitored by the first probe program includes a second target system call, the operation object of the second target system call includes a second file, and the second target system call is used to delete a file; Determining that the second file is recorded in the monitoring target database; The record corresponding to the second file is deleted from the monitoring target database.

5. The method according to any one of claims 2 to 4, characterized in that: After each target system call is completed, based on the context information corresponding to the monitoring target in the target database, a monitoring record corresponding to each target system call is obtained, and the monitoring record is recorded in a monitoring record database, including: The first probe program organizes the context information to obtain the monitoring record; The first probe program applies for record space from the monitoring record database; The first probe program sends a request message to the monitoring record database, where the request message is used to request the monitoring record database to record the monitoring record into the record space.

6. The method according to any one of claims 2 to 5, characterized in that: The first probe is a kernel state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the kernel state.

7. According to the method described in any one of claims 2-6, the monitoring target database includes a first hash table and a second hash table, the first hash table records the process identifier of the target process, and the second hash table records the file identifier of the target file.

8. The method according to any one of claims 1 to 7, characterized in that: Also includes: Initializing the monitoring target database; The initialized monitoring target data includes an initial monitoring target, and the initial monitoring target includes an initial target process, and the initial target process includes a terminal process, or a parent process of a process that executes a change script.

9. According to the method described in any one of claims 1-8, the monitoring record corresponding to each target system call at least includes an identifier of the target system call, a process identifier corresponding to the process executing the target system call, and information about the object operated by the system call.

10. The method according to claim 1, characterized in that The monitoring target includes a target data element; The method further comprises: Mount the second probe program in the target service process; During the execution of the change operation instruction, for each target program call, monitoring the context information of the monitoring target during the execution of the change operation instruction includes: Acquiring, by means of the second probe program, first context information called by the target program; Determining that the first context file information includes the target data element; The first context information is recorded.

11. The method according to claim 10, characterized in that The updating of the monitoring target in the monitoring target database based on the context information includes: Determining that the monitored context information includes a first data element associated with the target data element, and the first data element is not recorded in the monitoring target database; The first data element is added to the monitoring target database.

12. The method according to claim 10 or 11, characterized in that: The updating of the monitoring target in the monitoring target database based on the context information includes: The monitored context file information includes a first target program call, an object of the first target program call operation includes a third process and a second data element related to the third process, and the first target program call is used to exit the process; Determining that the second data element is recorded in the monitoring target database; Deleting the record corresponding to the second data element from the monitoring target database; and / or The monitored context file information includes a second target program call, an operation object of the second target program call includes a third data element, and the second target program call is used to delete the data element; Determining that the third data element is recorded in the monitoring target database; The record corresponding to the third data element is deleted from the monitoring target database.

13. The method according to any one of claims 10 to 12, characterized in that: The second probe is a user-state probe, and the target database and the monitoring record database are both deployed in a memory space corresponding to the user state.

14. The method according to any one of claims 10 to 13, characterized in that: Also includes: Initializing the monitoring target database; The initialized monitoring target data includes an initial monitoring target, and the initial monitoring target includes an initial data element.

15. A monitoring device for a change-affected surface, characterized in that: include: An acquisition module is used to acquire a monitoring target database, wherein the monitoring target database records a number of monitoring targets; A monitoring module, used for monitoring the context information of the monitoring target during the execution of the change operation instruction for each target system call or each target program call; An updating module, configured to update the monitoring target in the monitoring target database based on the context information; A recording module, configured to obtain, after each target system call or each target program call is completed, a monitoring record corresponding to each target system call or each target program call based on the context information corresponding to the monitoring target in the target database, and record the monitoring record in a monitoring record database; The determination module is used to determine the change impact area of ​​the change based on the monitoring records recorded in the monitoring record database after the change is completed.

16. A computing device comprising a memory and a processor, characterized in that: Instructions are stored in the memory, and when the instructions are executed by the processor, the method according to any one of claims 1 to 14 is implemented.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 14 is implemented.

Images