Tracing log information generation method and device and computer equipment

Abstract

The invention relates to a traceability log information generation method and device and computer equipment. The method is applied to a host device, at least one virtual machine is deployed in the host device, and the method comprises the following steps: monitoring a network message sent by each virtual machine; when a target network message of the new communication connection is monitored, generating a traceability log message based on the target network message; the address information of the traceability log message is the same as that of the network message, and the traceability log message carries identification information of a target virtual machine sending the target network message; and a traceability log message is sent, the traceability log message is used for generating target traceability log information, and the target traceability log information is used for tracing the target virtual machine. By adopting the method, the tracing difficulty can be reduced, and the network security is improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a method, device and computer equipment for generating source tracing log information. Background Art

[0002] With the popularity of cloud computing, more and more applications are running in virtual machines in virtual machine private networks. These virtual machines may be exploited by criminals to use malware to attack external networks, especially public services. When malicious attacks occur, cloud service providers need to have the ability to detect them in advance and trace them afterwards.

[0003] The request for a virtual machine in a virtual private network to access a public service first passes through the Overlay network, then enters the Underlay network, then reaches the Underlay network's egress firewall, and finally enters the public network. When a virtual private network accesses the Underlay network, it usually performs multiple NAT (Network Address Translation) conversions on the source IP address to the Underlay network's egress public network address. In traditional technologies, full-link NAT log collection is required. When a malicious attack occurs, the address of the virtual machine that initiated the attack is found by translating multi-level NAT logs.

[0004] However, the overhead of full-link NAT log collection is high, which takes up a lot of storage space and computing resources. In addition, if any NAT log is lost in the middle, it will make it impossible to trace the source, making tracing difficult and network security low. Summary of the invention

[0005] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for generating traceability log information in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for generating source tracing log information, the method being applied to a host device, wherein at least one virtual machine is deployed in the host device, the method comprising:

[0007] Monitoring network messages sent by each of the virtual machines;

[0008] When a target network message of a newly created communication connection is monitored, a source tracing log message is generated based on the target network message; the address information of the source tracing log message is the same as that of the network message, and carries identification information of the target virtual machine that sends the target network message;

[0009] The source tracing log message is sent, where the source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

[0010] In one embodiment, the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; and generating the source tracing log message based on the target network message includes:

[0011] Copy the target network message to obtain a basic message;

[0012] Obtaining a target TTL value between the target virtual machine and a hardware firewall in the underlying network, an identifier of a virtual private cloud to which the host device belongs, a traceability identifier, and an IP address of the target virtual machine contained in the target network message;

[0013] The TTL value in the basic message is modified to the target TTL value, and the payload of the basic message is generated based on the identifier of the virtual private cloud to which the host device belongs, the tracing identifier, and the source IP address in the target network message to construct a tracing log message.

[0014] In one embodiment, monitoring the network packets sent by the virtual machine includes:

[0015] Receive and parse network messages sent by each of the virtual machines;

[0016] If the preset field of the network message contains a preset identifier, determining that the network message is a target network message for a newly created communication connection;

[0017] If the preset field of the network message does not include the preset identifier, it is determined that the network message is not a target network message of the newly established communication connection; the preset identifier is used to characterize the newly established communication connection.

[0018] In a second aspect, the present application also provides a method for generating source tracing log information, the method being applied to a network node in an underlying network, the method comprising:

[0019] Monitoring the source tracing log message sent by the host device; the source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine, the address information of the source tracing log message is the same as the target network message, and carries the identification information of the target virtual machine;

[0020] Generate target source tracing log information based on the source tracing log message; the target source tracing log information at least includes address information of the source tracing log message and identification information of the virtual machine, and is used to trace the target virtual machine.

[0021] In one embodiment, the payload of the source tracing log message includes a source tracing identifier; the source tracing log message sent by the monitoring host device includes:

[0022] Receive and analyze each message sent by each host device;

[0023] If the payload of the message contains a source tracing identifier, determining that the message is a source tracing log message;

[0024] If the payload of the message does not include a source tracing identifier, it is determined that the message is not a source tracing log message.

[0025] In one of the embodiments, the payload of the source tracing log message includes at least identification information of the target virtual machine, and the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs;

[0026] The generating target source tracing log information based on the source tracing log message includes:

[0027] Parsing the source tracing log message to obtain address information, timestamp information, the IP address of the target virtual machine, and an identifier of the virtual private cloud;

[0028] Based on the address information, the timestamp information, the IP address of the target virtual machine and the identifier of the virtual private cloud, target tracing log information is generated and stored.

[0029] In one embodiment, the method further comprises:

[0030] receiving a traceability request message, wherein the traceability request message includes the address information and the timestamp information;

[0031] In each pre-stored source tracing log information, searching for target source tracing log information that matches the address information and the timestamp information;

[0032] The IP address of the virtual machine and the identifier of the virtual private cloud included in the target source tracing log information are output.

[0033] In a third aspect, the present application further provides a device for generating source tracing log information, the device being applied to a host device, wherein at least one virtual machine is deployed in the host device, and the device comprising:

[0034] A monitoring module, used for monitoring network messages sent by each of the virtual machines;

[0035] A generation module, configured to generate a source tracing log message based on the target network message when a target network message of a newly created communication connection is monitored; the address information of the source tracing log message is the same as that of the network message, and carries identification information of a target virtual machine that sends the target network message;

[0036] The sending module is used to send the source tracing log message, the source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

[0037] In one embodiment, the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; the generating module is specifically used to:

[0038] Copy the target network message to obtain a basic message;

[0039] Obtaining a target TTL value between the target virtual machine and a hardware firewall in the underlying network, an identifier of a virtual private cloud to which the host device belongs, a traceability identifier, and an IP address of the target virtual machine contained in the target network message;

[0040] The TTL value in the basic message is modified to the target TTL value, and the payload of the basic message is generated based on the identifier of the virtual private cloud to which the host device belongs, the tracing identifier, and the source IP address in the target network message to construct a tracing log message.

[0041] In one embodiment, the monitoring module is specifically used to:

[0042] Receive and parse network messages sent by each of the virtual machines;

[0043] If the preset field of the network message contains a preset identifier, determining that the network message is a target network message for a newly created communication connection;

[0044] If the preset field of the network message does not include the preset identifier, it is determined that the network message is not a target network message of the newly established communication connection; the preset identifier is used to characterize the newly established communication connection.

[0045] In a fourth aspect, the present application further provides a device for generating source tracing log information, the device being applied to a network node in an underlying network, the device comprising:

[0046] A monitoring module, used to monitor the source tracing log message sent by the host device; the source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine, the address information of the source tracing log message is the same as the target network message, and carries the identification information of the target virtual machine;

[0047] A generation module is used to generate target tracing log information based on the tracing log message; the target tracing log information at least includes the address information of the tracing log message and the identification information of the virtual machine, and is used to trace the target virtual machine.

[0048] In one embodiment, the payload of the source tracing log message includes a source tracing identifier; and the monitoring module is specifically configured to:

[0049] Receive and analyze each message sent by each host device;

[0050] If the payload of the message contains a source tracing identifier, determining that the message is a source tracing log message;

[0051] If the payload of the message does not include a source tracing identifier, it is determined that the message is not a source tracing log message.

[0052] In one of the embodiments, the payload of the source tracing log message includes at least identification information of the target virtual machine, and the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs;

[0053] The generation module is specifically used for:

[0054] Parsing the source tracing log message to obtain address information, timestamp information, the IP address of the target virtual machine, and an identifier of the virtual private cloud;

[0055] Based on the address information, the timestamp information, the IP address of the target virtual machine and the identifier of the virtual private cloud, target tracing log information is generated and stored.

[0056] In one embodiment, the device further comprises:

[0057] A receiving module, configured to receive a traceability request message, wherein the traceability request message includes the address information and the timestamp information;

[0058] A query module, used to query target source tracing log information matching the address information and the timestamp information in each pre-stored source tracing log information;

[0059] The output module is used to output the IP address of the virtual machine and the identifier of the virtual private cloud contained in the target tracing log information.

[0060] In a fifth aspect, the present application further provides a system for generating source tracing log information, the system comprising a host device and a network node in an underlying network, at least one virtual machine being deployed in the host device, wherein:

[0061] The host device is used to monitor the network messages sent by each of the virtual machines, and when a target network message of a newly established communication connection is monitored, generate a source tracing log message based on the target network message; the address information of the source tracing log message is the same as that of the network message, and carries the identification information of the target virtual machine that sends the target network message; and send the source tracing log message;

[0062] The network node is used to monitor the tracing log message sent by the host device; generate target tracing log information based on the tracing log message; the target tracing log information at least includes the address information of the tracing log message and the identification information of the virtual machine, and is used to trace the target virtual machine.

[0063] In a sixth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method steps of the first aspect or the second aspect when executing the computer program.

[0064] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method steps of the first aspect or the second aspect when executed by a processor.

[0065] In an eighth aspect, the present application further provides a computer program product, comprising a computer program, which implements the method steps of the first aspect or the second aspect when executed by a processor.

[0066] The above-mentioned method, device, computer equipment, computer-readable storage medium and computer program product for generating source tracing log information can be applied to a host device, in which at least one virtual machine is deployed, and the method includes: monitoring network messages sent by each virtual machine; when a target network message of a newly established communication connection is monitored, generating a source tracing log message based on the target network message; the address information of the source tracing log message is the same as the network message, and carries the identification information of the target virtual machine that sends the target network message; sending a source tracing log message, the source tracing log message is used to generate the target source tracing log information, and the target source tracing log information is used to trace the target virtual machine. In this scheme, the source tracing log information is generated by constructing a source tracing log message. Since the source tracing log message has the same address information as the original network message, the NAT result of the source tracing log message is completely consistent with the original message, and can normally reach the network node in the underlying network, so that it can be monitored by the network node. The source tracing log message also contains the unique identification information of the target virtual machine, thereby generating the source tracing log information containing the converted address information and the unique identification information of the target virtual machine, thereby realizing the virtual machine tracing. This solution does not require the collection of full-link NAT logs, which reduces the difficulty of tracing, increases the success rate of tracing, and improves network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0068] Figure 1 An application environment diagram of a method for generating source tracing log information in an embodiment;

[0069] Figure 2 The following is a flow chart of a method for generating source tracing log information in one embodiment;

[0070] Figure 3 is a schematic diagram of a payload in one embodiment;

[0071] Figure 4 It is a flowchart of a method for generating source tracing log information in another embodiment;

[0072] Figure 5 A flowchart of an example of a method for generating source tracing log information in an embodiment;

[0073] Figure 6 A flowchart of an example of an IP tracing method in an embodiment;

[0074] Figure 7 It is a structural block diagram of a device for generating source tracing log information in an embodiment;

[0075] Figure 8 It is a structural block diagram of a device for generating source tracing log information in another embodiment;

[0076] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0078] The present application embodiment provides a method for generating source tracing log information, which can be applied to Figure 1 In the application environment shown in the figure. It includes Overlay network and Underlay network. The Overlay network contains at least one host, in which multiple VMs (virtual machines) are deployed, and a NAT (Network Address Translation) unit can also be deployed; at least one switch and firewall are deployed in the Underlay network. After the network message sent by the virtual machine is converted by the NAT unit, it is sent to the Overlay network through the host's egress port, and then sent to the hardware firewall by the switch in the Overlay network, and then sent to other service devices in the network by the hardware firewall. Among them, the service device can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0079] In an exemplary embodiment, a method for generating source tracing log information is provided. The method is applied to a host device, in which at least one virtual machine is deployed, such as Figure 2 As shown, the method comprises the following steps:

[0080] Step 202: monitor network messages sent by each virtual machine.

[0081] In an embodiment of the present application, a network monitoring unit may be deployed in the host device. Specifically, the network monitoring unit may be deployed at the outlet route of the virtual machine. The network monitoring unit may detect the message data received by the NAT unit. For each message data, the network monitoring unit may determine whether the message is an outbound message (i.e., a network message) based on the destination address and destination port of the message. If so, the message is further parsed. If not, no processing is performed. In this way, the public network traffic message can be accurately identified, the identification accuracy is improved, and processing resources are saved.

[0082] Step 204: when a target network message of a newly created communication connection is monitored, a source tracing log message is generated based on the target network message.

[0083] The address information of the source tracing log message is the same as that of the network message, and carries the identification information of the target virtual machine that sends the target network message.

[0084] In an embodiment of the present application, when the network monitoring unit monitors a network message, it can further determine whether the network message is a network message of a newly established communication connection. Specifically, when a virtual machine communicates, it needs to first establish a communication connection with the opposite device. In the process of establishing a communication connection, a network message containing a preset identifier will be sent. Therefore, the network monitoring unit can parse the network message and determine whether the network message is the target network message of the newly established communication connection by identifying whether the preset identifier is contained in the network message. When the target network message of the newly established communication connection is monitored, the network monitoring unit can construct a tracing log message based on the target network message. Among them, the address information of the tracing log message is exactly the same as that of the network message, and the identification information of the target virtual machine that sends the target network message is carried by the payload of the tracing log message. This identification information can uniquely identify the target virtual machine.

[0085] Step 206: Send a source tracing log message.

[0086] The source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

[0087] In an embodiment of the present application, after the network monitoring unit constructs the source tracing log message, the source tracing log message can be sent. Specifically, the source tracing log message can be sent to the NAT unit for network address translation, and then the source tracing log message after the network address translation is sent through the output port of the host device. Among them, the address information of the source tracing log message is exactly the same as the network message. The address information includes the source IP address, source port, destination IP address and destination port.

[0088] In this solution, since the source tracing log message has exactly the same address information as the original network message (i.e., the target network message), the NAT result of the source tracing log message is exactly the same as the original message, regardless of one or multiple NATs, and the transmission path in the network is also exactly the same. The source tracing log message can be transmitted to the Underlay network boundary along the same path as the target network message, and thus be monitored by the network node where the log collection unit is deployed. The network node can be the previous hop node of the hardware firewall. For example, the log collection unit can be deployed in the NAT gateway.

[0089] The source tracing log message also contains the unique identification information of the target virtual machine. In this way, the network node can generate source tracing log information containing the converted address information and the unique identification information of the target virtual machine based on the content of the source tracing log message to achieve virtual machine source tracing. This solution does not require the collection of full-link NAT logs, reduces the difficulty of source tracing, increases the success rate of source tracing, and improves network security.

[0090] Optionally, the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; generating a tracing log message based on the target network message, including: copying the target network message to obtain a basic message; obtaining the target TTL value between the target virtual machine and the hardware firewall in the underlying network, the identification of the virtual private cloud to which the host device belongs, the tracing identification, and the IP address of the target virtual machine contained in the target network message; modifying the TTL value in the basic message to the target TTL value, and generating the payload of the basic message based on the identification of the virtual private cloud to which the host device belongs, the tracing identification, and the source IP address in the target network message, to construct a tracing log message.

[0091] In an embodiment of the present application, a path hop test unit may also be deployed in the host device, and the path hop test unit may obtain the TTL (Time To Live) value from the virtual machine to the hardware firewall. Specifically, the path hop test unit may send a path detection message to the hardware firewall to obtain the TTL value from the virtual machine to the hardware firewall. The path hop test unit may send the TTL value to the network monitoring unit.

[0092] The network monitoring unit can copy the target network message to obtain the basic message. Then, obtain the target TTL value between the target virtual machine and the hardware firewall in the underlying network, the identifier of the virtual private cloud to which the host device belongs, the preset traceability identifier, and the source IP address contained in the target network message (that is, the IP address of the target virtual machine). The network monitoring unit can modify the TTL value in the basic message to the target TTL value, and use the identifier of the virtual private cloud to which the host device belongs, the traceability identifier, and the source IP address in the target network message as the payload to generate the basic message, and then recalculate the new message checksum to obtain the traceability log message. Figure 3 As shown, it is a schematic diagram of the effective load provided by the embodiment of the present application. Among them, mark is the traceability mark, which can be 2 bytes, length represents the content length, which is 2 bytes, the virtual machine IP address is 4 bytes, and the VPC ID (Virtual Private Cloud Identity) is 4 bytes.

[0093] In this solution, since the source tracing log message and the original network message (i.e., the target network message) have exactly the same address information, the NAT result of the source tracing log message is exactly the same as the original message, regardless of one or multiple NATs, and the transmission path in the network is also exactly the same. The source tracing log message can be transmitted to the Underlay network boundary along the same path as the target network message, so that it can be monitored by the network node. The network node can be the previous hop node of the hardware firewall. The source tracing log message also contains the unique identification information of the target virtual machine. In this way, the network node can generate source tracing log information containing the converted address information and the unique identification information of the target virtual machine based on the content of the source tracing log message to realize virtual machine tracing. This solution does not need to collect full-link NAT logs, which reduces the difficulty of tracing, improves the success rate of tracing, and improves network security.

[0094] Moreover, by modifying the TTL value in the basic message to the target TTL value, when the source tracing log message is transmitted to the hardware firewall in the Underlay network, it will be discarded by the hardware firewall because the TTL value is 0 and will not enter the public network, thus avoiding the waste of communication resources and network congestion. The source tracing log will not be leaked to the public network, ensuring the security of the source tracing information.

[0095] In addition, the source tracing log message also includes a source tracing identifier, which enables the log collection unit to distinguish the source tracing log message from other messages, thereby improving the detection rate of the source tracing log message and ensuring the integrity of the source tracing log information.

[0096] Optionally, monitoring network messages sent by virtual machines includes: receiving and parsing network messages sent by each virtual machine; if a preset field of the network message contains a preset identifier, determining that the network message is a target network message for a newly created communication connection; if the preset field of the network message does not contain a preset identifier, determining that the network message is not a target network message for a newly created communication connection; the preset identifier is used to characterize the newly created communication connection.

[0097] In an embodiment of the present application, after the network monitoring unit obtains the network message, it can parse the network message to obtain the content data contained in the preset field. If the content data is a preset identifier, it is determined that the network message is the target network message of the new communication connection; if the content data is not a preset identifier, it is determined that the network message is not the target network message of the new communication connection. Among them, the preset identifier is used to characterize the new communication connection. Specifically, network messages are usually transmitted using protocols such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol) or ICMP (Internet Control Message Protocol). Different protocols can use different preset identifiers to characterize the new communication connection. The network monitoring unit can determine the preset identifier based on the communication protocol of the network message, and then determine whether the network message is the target network message of the new communication connection.

[0098] In this solution, the network message of the newly created communication message of the virtual machine can be identified, so as to copy the network message and fill the traceability information into the payload, and then route the message carrying the traceability information to the log collection unit to realize the collection and recording of the traceability log information, so as to facilitate the subsequent IP traceability of the virtual machine.

[0099] In an exemplary embodiment, a method for generating source tracing log information is provided. The method is applied to network nodes in the underlying network, such as Figure 4 As shown, the method comprises the following steps:

[0100] Step 402: monitor the source tracing log message sent by the host device.

[0101] The source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine. The address information of the source tracing log message is the same as that of the target network message, and carries the identification information of the target virtual machine.

[0102] In the embodiment of the present application, a log collection unit may be deployed in the network node. After receiving the message, the log collection unit may parse the message to determine whether the message is a source tracing log message carrying source tracing information. If the message is a source tracing log message, the message may be further parsed and step 304 may be executed. If the message is not a source tracing log message, only routing forwarding processing may be performed.

[0103] Step 404: Generate target source tracing log information based on the source tracing log message.

[0104] The target source tracing log information at least includes the address information of the source tracing log message and the identification information of the virtual machine, which is used to trace the source of the target virtual machine.

[0105] In an embodiment of the present application, the log collection unit can parse the tracing log message to obtain the address information, network protocol type and identification information of the virtual machine in the tracing log message. Wherein, the address information may include the destination address, destination port, source address and source port, and the identification information is the information used to uniquely identify the virtual machine. The generation process of the tracing log message can be parameterized by the above-mentioned related instructions, which will not be repeated here. The log collection unit can upload the parsed address information, network protocol type and identification information of the virtual machine to the global log controller. The global log controller can gather the information uploaded by each log collection unit, and construct and store the tracing log information based on this information. In an example, the tracing log information may at least include the address information, network protocol type and identification information of the virtual machine in the tracing log message. After the global log controller constructs the tracing log information, the tracing log information can be stored in the database system. Wherein, the global log controller can be deployed in a network node or in other nodes, and the embodiment of the present application is not limited.

[0106] In this solution, the source tracing log information is generated by constructing a source tracing log message. Since the source tracing log message has the same address information as the original network message, the NAT result of the source tracing log message is completely consistent with the original message and can reach the network node in the underlying network normally, so that it can be monitored by the network node. The source tracing log message also contains the unique identification information of the target virtual machine, thereby generating source tracing log information containing the converted address information and the unique identification information of the target virtual machine, thereby realizing virtual machine tracing. This solution does not need to collect full-link NAT logs, which reduces the difficulty of tracing, increases the success rate of tracing, and improves network security.

[0107] Optionally, the payload of the source tracing log message contains a source tracing identifier; monitoring the source tracing log messages sent by the host device includes: receiving and parsing each message sent by each host device; if the payload of the message contains a source tracing identifier, determining that the message is a source tracing log message; if the payload of the message does not contain a source tracing identifier, determining that the message is not a source tracing log message.

[0108] In the embodiment of the present application, for each message routed to the log collection unit, after receiving the message, the log collection unit can parse the message and identify whether the payload contains a traceability identifier. If the payload of the message contains a traceability identifier, it is determined that the message is a traceability log message; if the payload of the message does not contain a traceability identifier, it is determined that the message is not a traceability log message.

[0109] In this solution, the source tracing log message contains a source tracing identifier, which enables the log collection unit to distinguish the source tracing log message from other messages, thereby improving the detection rate of the source tracing log message and ensuring the integrity of the source tracing log information.

[0110] Optionally, the payload of the source tracing log message contains at least the identification information of the target virtual machine, and the identification information of the target virtual machine contains the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs. Accordingly, generating target source tracing log information based on the source tracing log message includes: parsing the source tracing log message to obtain the address information, timestamp information, IP address of the target virtual machine and identification of the virtual private cloud of the source tracing log message; generating and storing the target source tracing log information based on the address information, timestamp information, IP address of the target virtual machine and identification of the virtual private cloud.

[0111] In an embodiment of the present application, the payload of the tracing log message may also include identification information of the target virtual machine, which can uniquely identify the target virtual machine. Specifically, the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs. The log collection unit can parse the tracing log message to obtain the address information (i.e., destination address, destination port, source address and source port) of the tracing log message, timestamp information, the IP address of the target virtual machine and the identification of the virtual private cloud; based on the address information, timestamp information, the IP address of the target virtual machine and the identification of the virtual private cloud, generate the target tracing log information, and then upload the target tracing log information to the global log controller, and the global log controller saves the target tracing log information to the database. In one example, the log collection unit can parse the tracing log message and construct the following information: VM IP, snat IP, snat port, dst ip, dst port, vpcid, timetamp, and save the information to the database. Among them, VM IP represents the IP address of the virtual machine, vpc id represents the unique ID of the virtual private cloud, timestamp represents the starting timestamp of the target network message, snat IP represents the source IP address, snat port represents the source port, dst ip represents the destination IP address, and dst port represents the destination port.

[0112] This solution can adapt to various heterogeneous networks and virtual private networks, support multiple SNAT (source network address translation) scenarios during data forwarding, and only record the last SNAT log of multi-level SNAT, simplifying the content of the source tracing log, greatly reducing the demand for storage space, and not relying on hardware firewall logs. In addition, its implementation architecture is simple, non-invasive to the existing network system, and can be adapted without any modification to the existing network architecture.

[0113] In addition, the log collection unit can sniff new communication connection messages of multiple protocols such as TCP, UDP or ICMP through the network monitoring unit, can support multiple network protocols such as TCP / UDP / IMCP, and does not require the destination end to have IP option parsing function.

[0114] Optionally, the method also includes: receiving a traceability request message, the traceability request message including address information and timestamp information; querying target traceability log information that matches the address information and timestamp information in each pre-stored traceability log information; and outputting the IP address of the virtual machine and the identifier of the virtual private cloud contained in the target traceability log information.

[0115] In an embodiment of the present application, when a user needs to perform IP tracing, a tracing request message can be sent to the global log controller through the user device, and the tracing request message includes address information and timestamp information. The global log controller can parse the tracing request message to obtain the address information and timestamp information, and then based on the address information and timestamp information, query the target tracing log information containing the address information and the timestamp information in each tracing log information stored in the database, and the global log controller can send the target tracing log information to the user device, or, it can also extract the IP address of the virtual machine and the identifier of the virtual private cloud from the target tracing log information, and send the IP address of the virtual machine and the identifier of the virtual private cloud to the user device. In an example, the user can configure the destination IP address, destination port, source IP address, source port, timestamp and other information in the user device, triggering the user device to generate a tracing request message based on the user configuration, and send it to the global log controller.

[0116] In this solution, users can query the corresponding virtual machine through address information and timestamp information, thereby realizing the IP tracing function of the virtual machine.

[0117] like Figure 5 As shown, the embodiment of the present application provides an example of a method for generating source tracing log information, including the following steps:

[0118] Step 501: The network monitoring unit monitors the network messages sent by each virtual machine.

[0119] Step 502: When a target network message of a newly created communication connection is detected, the network monitoring unit copies the target network message to obtain a basic message.

[0120] Step 503: The network monitoring unit obtains the identifier and the source tracing identifier of the virtual private cloud to which the host device belongs, and parses the target network message to obtain the IP address of the target virtual machine.

[0121] Step 504: The path hop count test unit obtains the target TTL value between the target virtual machine and the hardware firewall in the underlying network, and sends it to the network monitoring unit.

[0122] In step 505, the network monitoring unit modifies the TTL value in the basic message to the target TTL value, and generates the payload of the basic message based on the identifier of the virtual private cloud to which the host device belongs, the tracing identifier, and the source IP address in the target network message, and recalculates the message checksum to obtain the tracing log message.

[0123] Step 506: The network monitoring unit injects the source tracing log message into the network.

[0124] Step 507: The log collection unit monitors the source tracing log message sent by the host device.

[0125] Step 508: The log collection unit parses the source tracing log message to obtain the destination address, destination port, source address and source port, and timestamp information of the source tracing log message, and extracts the IP address and VPC ID of the target virtual machine from the payload.

[0126] Step 509: The log collection unit generates and stores target tracing log information based on the address information, timestamp information, the IP address of the target virtual machine, and the identifier of the virtual private cloud.

[0127] like Figure 6 As shown, the embodiment of the present application provides an example of an IP tracing method, including the following steps:

[0128] Step 601: The user equipment sends a source tracing request message to the global log controller.

[0129] The traceability request message includes the destination IP address, destination port, source IP address, source port and timestamp.

[0130] Step 602: The global log controller sends a query request to the database.

[0131] The query request includes the destination IP address, destination port, source IP address, source port and timestamp.

[0132] Step 603: query the target source tracing log information matching the query request from each source tracing log information stored in the database, and send the identification information of the virtual machine in the target source tracing log information to the global log controller.

[0133] The identification information of the virtual machine includes the IP address and VPC ID of the virtual machine.

[0134] Step 604: The global log controller sends the identification information of the virtual machine to the user device.

[0135] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0136] Based on the same inventive concept, the embodiment of the present application also provides a device for generating source tracing log information for implementing the method for generating source tracing log information involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more devices for generating source tracing log information provided below can refer to the limitations of the method for generating source tracing log information above, and will not be repeated here.

[0137] In an exemplary embodiment, Figure 7 As shown, a device for generating source tracing log information is provided, the device is applied to a host device, at least one virtual machine is deployed in the host device, and the device includes:

[0138] A monitoring module 710, configured to monitor network messages sent by each of the virtual machines;

[0139] A generating module 720 is used to generate a source tracing log message based on the target network message when monitoring the target network message of the newly created communication connection; the address information of the source tracing log message is the same as that of the network message, and carries the identification information of the target virtual machine that sends the target network message;

[0140] The sending module 730 is used to send the source tracing log message, where the source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

[0141] In one embodiment, the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; the generating module 720 is specifically used to:

[0142] Copy the target network message to obtain a basic message;

[0143] Obtaining a target TTL value between the target virtual machine and a hardware firewall in the underlying network, an identifier of a virtual private cloud to which the host device belongs, a traceability identifier, and an IP address of the target virtual machine contained in the target network message;

[0144] The TTL value in the basic message is modified to the target TTL value, and the payload of the basic message is generated based on the identifier of the virtual private cloud to which the host device belongs, the tracing identifier, and the source IP address in the target network message to construct a tracing log message.

[0145] In one embodiment, the monitoring module 710 is specifically used to:

[0146] Receive and parse network messages sent by each of the virtual machines;

[0147] If the preset field of the network message contains a preset identifier, determining that the network message is a target network message for a newly created communication connection;

[0148] If the preset field of the network message does not include the preset identifier, it is determined that the network message is not a target network message of the newly established communication connection; the preset identifier is used to characterize the newly established communication connection.

[0149] In an exemplary embodiment, Figure 8 As shown, a device for generating source tracing log information is provided, the device is applied to a network node in an underlying network, and the device includes:

[0150] A monitoring module 810 is used to monitor the source tracing log message sent by the host device; the source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine, the address information of the source tracing log message is the same as the target network message, and carries the identification information of the target virtual machine;

[0151] The generating module 820 is used to generate target tracing log information based on the tracing log message; the target tracing log information at least includes the address information of the tracing log message and the identification information of the virtual machine, and is used to trace the target virtual machine.

[0152] In one embodiment, the payload of the source tracing log message includes a source tracing identifier; the monitoring module 810 is specifically used to:

[0153] Receive and analyze each message sent by each host device;

[0154] If the payload of the message contains a source tracing identifier, determining that the message is a source tracing log message;

[0155] If the payload of the message does not include a source tracing identifier, it is determined that the message is not a source tracing log message.

[0156] In one of the embodiments, the payload of the source tracing log message includes at least identification information of the target virtual machine, and the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs;

[0157] The generating module 820 is specifically used for:

[0158] Parsing the source tracing log message to obtain address information, timestamp information, the IP address of the target virtual machine, and an identifier of the virtual private cloud;

[0159] Based on the address information, the timestamp information, the IP address of the target virtual machine and the identifier of the virtual private cloud, target tracing log information is generated and stored.

[0160] In one embodiment, the device further comprises:

[0161] A receiving module, configured to receive a traceability request message, wherein the traceability request message includes the address information and the timestamp information;

[0162] A query module, used to query target source tracing log information matching the address information and the timestamp information in each pre-stored source tracing log information;

[0163] The output module is used to output the IP address of the virtual machine and the identifier of the virtual private cloud contained in the target tracing log information.

[0164] Each module in the above-mentioned device for generating source tracing log information can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0165] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store relevant data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for generating tracing log information is implemented.

[0166] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0167] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method for generating source tracing log information when executing the computer program.

[0168] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for generating the tracing log information are implemented.

[0169] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned method for generating source tracing log information when executed by a processor.

[0170] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0171] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0172] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0173] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for generating source tracing log information, characterized in that: The method is applied to a host device, in which at least one virtual machine is deployed, and the method includes: Monitoring network messages sent by each of the virtual machines; When a target network message of a newly created communication connection is monitored, a source tracing log message is generated based on the target network message; the address information of the source tracing log message is the same as that of the network message, and carries identification information of the target virtual machine that sends the target network message; The source tracing log message is sent, where the source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

2. The method according to claim 1, characterized in that The identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; The generating a source tracing log message based on the target network message includes: Copy the target network message to obtain a basic message; Obtaining a target TTL value between the target virtual machine and a hardware firewall in the underlying network, an identifier of a virtual private cloud to which the host device belongs, a traceability identifier, and an IP address of the target virtual machine contained in the target network message; The TTL value in the basic message is modified to the target TTL value, and the payload of the basic message is generated based on the identifier of the virtual private cloud to which the host device belongs, the tracing identifier, and the source IP address in the target network message to construct a tracing log message.

3. The method according to claim 1, characterized in that The monitoring of the network message sent by the virtual machine includes: Receive and parse network messages sent by each of the virtual machines; If the preset field of the network message contains a preset identifier, determining that the network message is a target network message for a newly created communication connection; If the preset field of the network message does not include the preset identifier, it is determined that the network message is not a target network message of the newly established communication connection; the preset identifier is used to characterize the newly established communication connection.

4. A method for generating source tracing log information, characterized in that: The method is applied to a network node in an underlying network, and the method comprises: Monitoring the source tracing log message sent by the host device; the source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine, the address information of the source tracing log message is the same as the target network message, and carries the identification information of the target virtual machine; Generate target source tracing log information based on the source tracing log message; the target source tracing log information at least includes address information of the source tracing log message and identification information of the virtual machine, and is used to trace the target virtual machine.

5. The method according to claim 4, characterized in that The payload of the source tracing log message includes a source tracing identifier; the source tracing log message sent by the monitoring host device includes: Receive and analyze each message sent by each host device; If the payload of the message contains a source tracing identifier, determining that the message is a source tracing log message; If the payload of the message does not include a source tracing identifier, it is determined that the message is not a source tracing log message.

6. The method according to claim 4, characterized in that The payload of the source tracing log message includes at least the identification information of the target virtual machine, and the identification information of the target virtual machine includes the IP address of the target virtual machine and the identification of the virtual private cloud to which the host device belongs; The generating target source tracing log information based on the source tracing log message includes: Parsing the source tracing log message to obtain address information, timestamp information, the IP address of the target virtual machine, and an identifier of the virtual private cloud; Based on the address information, the timestamp information, the IP address of the target virtual machine and the identifier of the virtual private cloud, target tracing log information is generated and stored.

7. The method according to claim 6, characterized in that The method further comprises: receiving a traceability request message, wherein the traceability request message includes the address information and the timestamp information; In each pre-stored source tracing log information, searching for target source tracing log information that matches the address information and the timestamp information; The IP address of the virtual machine and the identifier of the virtual private cloud included in the target source tracing log information are output.

8. A device for generating traceability log information, characterized in that: The apparatus is applied to a host device, in which at least one virtual machine is deployed, and the apparatus includes: A monitoring module, used for monitoring network messages sent by each of the virtual machines; A generation module, configured to generate a source tracing log message based on the target network message when a target network message of a newly created communication connection is monitored; the address information of the source tracing log message is the same as that of the network message, and carries identification information of a target virtual machine that sends the target network message; The sending module is used to send the source tracing log message, the source tracing log message is used to generate target source tracing log information, and the target source tracing log information is used to trace the target virtual machine.

9. A device for generating traceability log information, characterized in that: The device is applied to a network node in an underlying network, and the device includes: A monitoring module, used to monitor the source tracing log message sent by the host device; the source tracing log message is generated based on the target network message of the newly created communication connection sent by the target virtual machine, the address information of the source tracing log message is the same as the target network message, and carries the identification information of the target virtual machine; A generation module is used to generate target tracing log information based on the tracing log message; the target tracing log information at least includes the address information of the tracing log message and the identification information of the virtual machine, and is used to trace the target virtual machine.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method of any one of claims 1 to 3 or claims 4 to 7 are implemented.

Images