Network traffic tracking method and device, equipment and storage medium
By collaborating between user state and kernel state, using the determined tracking function to obtain and transmit HTTPS traffic data, the problem of the inability to capture packet HTTPS traffic in the existing technology is solved, and HTTPS traffic tracking is achieved without a certificate or a secret key.
Patent Information
- Application Number
- CN202411913172.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-24
- Publication Date
- 2025-03-28
AI Technical Summary
The prior art cannot capture packets and track HTTPS network traffic without the help of certificates or secret keys.
By determining the first tracking function and the second tracking function, the target traffic data is obtained from the data transfer input port of these functions in the target user state and sent it to the target user state corresponding to the target kernel state to realize traffic tracking.
It realizes tracking HTTPS network traffic without using any certificate or secret key during packet capture, and solves the problem that the existing technology cannot capture packet HTTPS traffic data.
Smart Images
Figure CN119728469A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the technical field of traffic tracking, and in particular to a network traffic tracking method, apparatus, device and storage medium. Background Art
[0002] HTTPS is a secure version of HTTP. It uses encryption protocols to encrypt communications based on HTTP and adds security features such as data integrity verification and identity authentication. It uses TLS (Transport Layer Security, referred to as TLS) to encrypt data. Since HTTPS encrypts application data, it is impossible to see the specific content by capturing network packets using tools such as tcpdump and wireshark.
[0003] The https data packet is a ciphertext encrypted with a symmetric key (a random number negotiated by the https protocol). The symmetric key is ciphertext on the transmission line (encrypted asymmetrically), but it is plaintext on the client and server (because it is used for encryption and decryption). Google Chrome has an interface. The symmetric key in the https protocol of the Chrome browser will be saved in "SSLKEYLOGFILE" (an environment variable of Windows, the value is a custom text file). Wireshark has an interface to read the symmetric key file. In this way, you can capture packets and decrypt. Even if you get the symmetric key, you can't crack any https data packet on the network. This symmetric key is negotiated temporarily. The next time you visit, the symmetric key will change again. Therefore, if you don't participate in the client and server, and only participate in the transmission process to capture packets, you can't get the symmetric key at that time (encrypted by the asymmetric key), and you can't decrypt https. Summary of the invention
[0004] The embodiments of the present invention provide a network traffic tracking method, apparatus, device and storage medium, which can track HTTPS network traffic without any other certificates or keys during the packet capture process.
[0005] In a first aspect, an embodiment of the present invention provides a network traffic tracking method, the method comprising:
[0006] Determine a first tracing function and a second tracing function; obtain target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracing process between the target user state and the target user state.
[0007] In a second aspect, an embodiment of the present invention provides a network traffic tracking device, the device comprising:
[0008] A tracing function determination module is used to determine a first tracing function and a second tracing function; a traffic data acquisition module is used to obtain target traffic data from the data transmission entrances of the first tracing function and the second tracing function in a target user state respectively; a traffic data sending module is used to send the target traffic data to a target user state corresponding to the target kernel state, so as to complete the traffic tracking process between the target user state and the target user state.
[0009] In a third aspect, an embodiment of the present invention provides a computer device, the computer device comprising:
[0010] one or more processors;
[0011] A memory for storing one or more programs;
[0012] When the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic tracking method described in any embodiment.
[0013] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network traffic tracking method described in any embodiment.
[0014] The technical solution provided by the embodiment of the present invention determines a first tracing function and a second tracing function; obtains target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; sends the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state. The technical solution of the embodiment of the present invention solves the problem that the prior art cannot capture https traffic data. By obtaining the entrance data of the first tracing function and the second tracing function in the kernel state, the network traffic of HTTPS can be tracked without the help of any other certificates or keys during the packet capture process. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 It is a flow chart of a network traffic tracking method provided by an embodiment of the present invention;
[0016] Figure 2 It is a flow chart of another network traffic tracking method provided by an embodiment of the present invention;
[0017] Figure 3 This is a workflow diagram for network traffic tracking provided by an embodiment of the present invention;
[0018] Figure 4 It is a structural schematic diagram of a network traffic tracking device provided by an embodiment of the present invention;
[0019] Figure 5 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0021] Figure 1 It is a flow chart of a network traffic tracking method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of capturing traffic data of an HTTPS network. The method can be executed by a network traffic tracking device, which can be implemented by software and / or hardware.
[0022] like Figure 1 As shown, the network traffic tracking method includes the following steps:
[0023] S210: Determine a first tracking function and a second tracking function.
[0024] Wherein, the target kernel state may be a kernel state that needs to track network traffic. The target kernel state corresponds to the target user state, that is, the technical solution of the embodiment of the present invention needs to track the network traffic data from the target kernel state to the target user state. The first tracking function and the second tracking function may be functions for tracking network traffic. Specifically, the first tracking function may be an SSL_read function, and the second tracking function may be an SSL_write function.
[0025] Among them, user state is different from kernel state, and the source code, programming language, and runtime environment of each application are different. Therefore, when selecting trace points, it is necessary to find the common parts of these applications so as to cover a wider range of application scenarios and avoid adapting each application separately.
[0026] The main difficulty in tracking is TLS encryption. OpenSSL is the most popular and common TLS encryption library, and most application developers implement encrypted communication by dynamically linking the OpenSSL library.
[0027] In a typical TLS communication process, there are stages such as TCP handshake, TLS handshake, data transmission and connection termination. The SSL_read and SSL_write functions of OpenSSL are the key points that need to be tracked using eBPF.
[0028] S120. In the target user state, obtain target traffic data from the data transmission entrances of the first tracing function and the second tracing function respectively.
[0029] The data transmission entry may be an entry for receiving data transmission by the first tracking function and the second tracking function. That is, during the data transmission process, the flow data will be transmitted to the tracking function through the data transmission entry. The target flow data may be the flow data finally tracked. Exemplarily, the corresponding flow data may be determined based on the entry parameters in the preset mapping, and the determined flow data may be used as the target flow data.
[0030] S130. Send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state.
[0031] Among them, after obtaining the target traffic data, the target traffic data can be sent to the target user state corresponding to the target kernel state, so that the target user state can further process or analyze the target traffic data sent by the target kernel state to realize traffic tracking between the target user state and the target user state.
[0032] The technical solution provided by the embodiment of the present invention determines a first tracing function and a second tracing function; obtains target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; sends the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state. The technical solution of the embodiment of the present invention solves the problem that the prior art cannot capture https traffic data. By obtaining the entrance data of the first tracing function and the second tracing function in the kernel state, the network traffic of HTTPS can be tracked without the help of any other certificates or keys during the packet capture process.
[0033] Figure 2It is another flow chart of a network traffic tracking method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of capturing traffic data of an HTTPS network. Based on the above embodiment, this embodiment further illustrates how to obtain target traffic data from the data transmission entrances of the first tracking function and the second tracking function in the target user state respectively; and how to send the target traffic data to the target user state corresponding to the target kernel state. The device can be implemented by software and / or hardware and integrated in a computer device with application development function.
[0034] like Figure 2 As shown, the network traffic tracking method includes the following steps:
[0035] S210: Determine a first tracking function and a second tracking function.
[0036] Wherein, the target kernel state may be a kernel state that needs to track network traffic. The target kernel state corresponds to the target user state, that is, the technical solution of the embodiment of the present invention needs to track the network traffic data from the target kernel state to the target user state. The first tracking function and the second tracking function may be functions for tracking network traffic. Specifically, the first tracking function may be an SSL_read function, and the second tracking function may be an SSL_write function.
[0037] S220: Construct a first tracking program corresponding to the target kernel state.
[0038] The first tracking program may be a program for executing a traffic tracking task in a user state. Exemplarily, libbpf may be used to construct an eBPF program in a kernel state, and the constructed eBPF program may be used as the first tracking program.
[0039] S230: Based on the first tracing program, obtain entry parameters from data transmission entries of the first tracing function and the second tracing function, and store the entry parameters in a preset mapping.
[0040] Among them, the data transmission entrance can be an entrance for the first tracing function and the second tracing function to receive data transmission. That is, during the data transmission process, the traffic data will be transmitted to the tracing function through the data transmission entrance. The entrance parameter can pass through the traffic data parameters of the first tracing function and the second tracing function. Specifically, the traffic data parameters can be obtained from the data transmission entrance of the first tracing function and the second tracing function, and the obtained traffic data parameters can be used as the entrance parameters. Furthermore, the preset mapping can be a mapping for storing the entrance parameters. Exemplarily, the eBPF mapping can be selected as the preset mapping.
[0041] Optionally, obtaining entry parameters from the data transmission entry of the first tracing function and the second tracing function, and storing the entry parameters in a preset mapping, includes: obtaining at least one buffer address from the data transmission entry of the first tracing function and the second tracing function; for each buffer address, determining a hash value based on the buffer address and the storage thread number, and storing all the hash values in the preset mapping.
[0042] The buffer address may be a storage address for traffic data in the buffer. The hash value may represent a correspondence between the buffer address and the storage thread number. Specifically, based on the correspondence between the buffer address and the storage thread number, the hash value data corresponding to each buffer address may be determined.
[0043] User-mode function tracing includes uprobe and uretprobe, which are used to track function entry (such as tracking entry parameters) and function return (such as tracking return value) scenarios. For the SSL_read / SSL_write functions we want to trace, they all have a void*buf parameter, but data is only read from the SSL connection and saved in buf inside the SSL_read() function, and the future data of buf cannot be read at the entry of the function call. Therefore, we need to read the data in uretprobe. However, uretprobe can only read the return value directly. To read the entry parameters, you need to use an eBPF map, store the entry parameters in the eBPF map in uprobe, and then read them out in uretprobe.
[0044] S240: Determine the target flow data according to the preset mapping.
[0045] The target flow data may be the flow data finally tracked. Specifically, the corresponding flow data may be determined based on the entry parameters in the preset mapping, and the determined flow data may be used as the target flow data.
[0046] Optionally, determining the target traffic data according to the preset mapping includes: for each hash value in the preset mapping, determining a buffer address according to the hash value, obtaining buffer data corresponding to the buffer address, and using all the obtained buffer data as the target traffic data. The buffer data is the traffic data stored at the buffer address.
[0047] S250. Send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state.
[0048] Optionally, sending the target traffic data to a target user state corresponding to the target kernel state includes: constructing a second tracking program corresponding to the target user state; and loading the target traffic data based on the second tracking program.
[0049] The second tracking program may be a program in user mode for performing data tracking. Exemplarily, an eBPF program may be constructed in user mode as the second tracking program. Further, libbpf may be used to load the compiled eBPF program, and then receive the target traffic data sent from the target kernel mode.
[0050] Optionally, the loading of the target traffic data based on the second tracking program includes: constructing an event processing callback function corresponding to the second tracking program; and reading the target traffic data based on the event processing callback function.
[0051] The event processing callback function may be a callback function for executing a task of receiving traffic data. The example creates a perf buffer and binds the event processing callback function to receive target traffic data sent from the kernel state.
[0052] For example, in order to better understand the technical solution provided by the present invention, the following is an introduction to the specific implementation code:
[0053] Definition of SSL_read function
[0054] int SSL_read_ex(SSL*ssl,void*buf,size_t num,size_t*readbytes);
[0055] int SSL_read(SSL*ssl,void*buf,int num);
[0056] SSL_write
[0057] int SSL_write_ex(SSL*ssl,const void*buf,size_t num,size_t*written);
[0058] int SSL_write(SSL*ssl,const void*buf,int num);
[0059] 2 Use libbpf to construct a kernel-mode program for HTTPS network tracking eBPF program
[0060] 2.1Tracking logic of SSL_read / SSL_write functions
[0061] Since the first three parameters and return value definition formats of the SSL_read / SSL_write functions are the same, their tracking program logic can be shared. For example, a common processing function can be defined for them. The specific code is as follows:
[0062] SEC("uprobe / SSL_read")
[0063] int BPF_UPROBE(probe_SSL_read_entry,void*ssl,void*buf,int num)
[0064] {
[0065] return SSL_rw_entry(ctx,ssl,buf,num);
[0066] }
[0067] SEC("uprobe / SSL_write")
[0068] int BPF_UPROBE(probe_SSL_write_entry,void*ssl,void*buf,int num)
[0069] {
[0070] return SSL_rw_entry(ctx,ssl,buf,num);
[0071] }
[0072] SEC("uretprobe / SSL_read")
[0073] int BPF_URETPROBE(probe_SSL_read_exit)
[0074] {
[0075] return SSL_rw_exit(ctx,0); / / 0 means read
[0076] }
[0077] SEC("uretprobe / SSL_write")
[0078] int BPF_URETPROBE(probe_SSL_write_exit)
[0079] {
[0080] return SSL_rw_exit(ctx,1); / / 1 means write
[0081] }
[0082] 2.2 What SSL_rw_entry() needs to do is to store the entry parameters into the BPF map (for example, using a hash map). The specific code is as follows:
[0083] / / Hash map used to store SSL read and write buffers
[0084] struct{
[0085] __uint(type,BPF_MAP_TYPE_HASH);
[0086] __uint(max_entries,1024);
[0087] __type(key,__u32); / / tid
[0088] __type(value,__u64); / / buf address
[0089] }bufs SEC(".maps");
[0090] / / Store the address of the SSL read and write buffers into a hash map
[0091] static int SSL_rw_entry(struct pt_regs*ctx,void*ssl,void*buf,int num)
[0092] {
[0093] u64 pid_tgid=bpf_get_current_pid_tgid();
[0094] u32 tid = (u32)pid_tgid;
[0095] bpf_map_update_elem(&bufs,&tid,(u64*)&buf,BPF_ANY);
[0096] return 0;
[0097] }
[0098] 2.3 What SSL_rw_exit() needs to do is to take out the buffer address from the hash map, read the buffer data, and finally transfer the data to the user state through the perf event. The specific code is as follows:
[0099] static int SSL_rw_exit(struct pt_regs*ctx,int rw)
[0100] {
[0101] u64 pid_tgid=bpf_get_current_pid_tgid();
[0102] u32 pid = pid_tgid >> 32;
[0103] u32 tid = (u32)pid_tgid;
[0104] / / Read the address of the SSL read / write buffer from the hash map
[0105] u64*bufp=bpf_map_lookup_elem(&bufs,&tid);
[0106] if(!bufp){
[0107] return 0;
[0108] }
[0109] / / Read the return value of the function call from the register
[0110] int len = PT_REGS_RC(ctx);
[0111] if(len<=0){
[0112] return 0;
[0113] }
[0114] / / Allocate a data buffer
[0115] __u32 zero = 0;
[0116] struct event_t*event=bpf_map_lookup_elem(&data_buffer_heap,&zero); if(!event){
[0117] return 0;
[0118] }
[0119] / / Metadata filling
[0120] event->rw=rw;
[0121] event->pid = pid;
[0122] event->uid=bpf_get_current_uid_gid();
[0123] bpf_get_current_comm(&event->comm,sizeof(event->comm));
[0124]
[0125] 3. Use libbpf to construct a user-mode program for HTTPS network tracking eBPF program
[0126] 3.1 Find the path to the OpenSSL library
[0127] 3.2 Loading ebpf program
[0128] 3.3 Create a buffer and bind event processing callback
[0129] 3.4 Mount uprobe to OpenSSL library
[0130] 3.5 Reading Data from Buffer
[0131] Accordingly, Figure 3 FIG. 1 is a flowchart of a network traffic tracking method provided by an embodiment of the present invention. Figure 3 As shown in the figure, the workflow for network traffic tracking is:
[0132] 1. Determine the user-mode tracking point
[0133] 2.1Tracking logic of SSL_read / SSL_write functions
[0134] Since the first three parameters and return value definition formats of SSL_read and SSL_write functions are the same, their tracer logic can be shared. The code can be simplified by defining a common processing function.
[0135] In the sample code, probe_SSL_read_entry and probe_SSL_write_entry are triggered at the entry of SSL_read and SSL_write functions respectively, and call the common SSL_rw_entry function.
[0136] probe_SSL_read_exit and probe_SSL_write_exit are triggered at the exit of SSL_read and SSL_write functions respectively and call the common SSL_rw_exit function, where 0 indicates a read operation and 1 indicates a write operation.
[0137] 2.2 SSL_rw_entry() Function
[0138] The SSL_rw_entry function stores the entry parameters (such as the buffer address) into the BPF map for use when the function exits. A hash map bufs is used in the sample code to store the correspondence between the thread ID and the buffer address.
[0139] 2.3 SSL_rw_exit() Functionality
[0140] The SSL_rw_exit function takes the buffer address from the hash map, reads the buffer data, and transfers the data to user state via perfevent. In the sample code, the buffer address is first obtained from the hash map, then the return value of the function call is read, a data buffer is allocated, metadata is filled, the buffer data is read, the entry in the hash map is deleted, and finally the data is sent to user state via bpf_perf_event_output.
[0141] Use libbpf to construct an eBPF program for HTTPS network tracking (user mode)
[0142] 3.1 Find the path to the OpenSSL library
[0143] In the user-mode program, you first need to find the path of the OpenSSL library so that you can subsequently mount uprobe.
[0144] 3.2 Loading eBPF Program
[0145] Use libbpf to load the compiled eBPF program. Specifically, eBPF can be mounted to the dynamic link library libssl.so, and when the user program calls libssl.so for encryption and decryption, the plaintext is obtained into the buffer.
[0146] 3.3 Create a buffer and bind event processing callback
[0147] Create a perf buffer and bind the event processing callback function to receive data sent from kernel state.
[0148] 3.4 Mount uprobe to OpenSSL library
[0149] Use libbpf to mount uprobe on the SSL_read and SSL_write functions of the OpenSSL library.
[0150] 3.5 Reading Data from Buffer
[0151] In the event processing callback function, read the data from the perf buffer and perform further processing or analysis.
[0152] The whole solution monitors HTTPS network communications by tracing the SSL_read and SSL_write functions of the OpenSSL library using eBPF technology through collaboration between user mode and kernel mode. The user mode program is responsible for loading the eBPF program, creating the perf buffer, mounting the uprobe, and processing the data sent from the kernel mode. The kernel mode program is responsible for capturing relevant parameters and data at the entry and exit of the function, and transmitting the data to the user mode through the perf event.
[0153] The technical solution provided by the embodiment of the present invention determines a first tracing function and a second tracing function; constructs a first tracing program corresponding to the target kernel state; based on the first tracing program, obtains entry parameters from the data transmission entry of the first tracing function and the second tracing function, and stores the entry parameters in a preset mapping; determines the target traffic data according to the preset mapping; sends the target traffic data to the target user state corresponding to the target kernel state, so as to complete the traffic tracking process between the target user state and the target user state. The technical solution of the embodiment of the present invention solves the problem that the prior art cannot capture https traffic data. By obtaining the entry data of the first tracing function and the second tracing function of the kernel state, the network traffic of HTTPS can be tracked without the help of any other certificates or keys during the packet capture process.
[0154] Figure 4 It is a structural diagram of a network traffic tracking device provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of capturing traffic data of an HTTPS network. The device can be implemented by software and / or hardware and integrated into a computer device with application development function.
[0155] like Figure 4 As shown, the network traffic tracking device includes: a road information acquisition module 310, a control parameter determination module 320 and a control parameter determination module 330.
[0156] Among them, the tracking function determination module 310 is used to determine the first tracking function and the second tracking function; the traffic data acquisition module 320 is used to obtain the target traffic data from the data transmission entrances of the first tracking function and the second tracking function respectively in the target user state; the traffic data sending module 330 is used to send the target traffic data to the target user state corresponding to the target kernel state, so as to complete the traffic tracking process between the target user state and the target user state.
[0157] The technical solution provided by the embodiment of the present invention determines a first tracing function and a second tracing function; obtains target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; sends the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state. The technical solution of the embodiment of the present invention solves the problem that the prior art cannot capture https traffic data. By obtaining the entrance data of the first tracing function and the second tracing function in the kernel state, the network traffic of HTTPS can be tracked without the help of any other certificates or keys during the packet capture process.
[0158] In an optional embodiment, the traffic data acquisition module 320 is specifically used to: construct a first tracking program corresponding to the target kernel state; based on the first tracking program, obtain entry parameters from the data transmission entry of the first tracking function and the second tracking function, and store the entry parameters in a preset mapping; determine the target traffic data according to the preset mapping.
[0159] In an optional embodiment, the traffic data acquisition module 320 includes: an entry parameter storage unit, used to: obtain at least one buffer address from the data transmission entry of the first tracking function and the second tracking function; for each buffer address, determine a hash value based on the buffer address and the storage thread number, and store all the hash values in the preset mapping.
[0160] In an optional embodiment, the traffic data acquisition module 320 includes: a traffic data determination unit, used to: for each hash value in the preset mapping, determine the buffer address according to the hash value, obtain the buffer data corresponding to the buffer address, and use all the obtained buffer data as the target traffic data.
[0161] In an optional implementation, the control parameter determination module 330 is specifically used to: construct a second tracking program corresponding to the target user state; and load the target traffic data based on the second tracking program.
[0162] In an optional implementation, the control parameter determination module 330 includes: a flow data loading unit, used to: construct an event processing callback function corresponding to the second tracking program; and read the target flow data based on the event processing callback function.
[0163] In an optional implementation, the first tracing function is an SSL_read function, and the second tracing function is an SSL_write function.
[0164] The network traffic tracking device provided in the embodiment of the present invention can execute the network traffic tracking method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0165] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capability and can be configured in a network traffic tracking device.
[0166] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).
[0167] The bus 18 may be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.
[0168] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.
[0169] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.
[0170] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.
[0171] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 5 As shown, the network adapter 20 communicates with other modules of the computer device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with computer device 12, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0172] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing the network traffic tracking method provided by the embodiment of the present invention, the method comprising:
[0173] Determine a first tracing function and a second tracing function; obtain target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracing process between the target user state and the target user state.
[0174] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the network traffic tracking method provided by any embodiment of the present invention is implemented, including:
[0175] Determine a first tracing function and a second tracing function; obtain target traffic data from the data transmission entrances of the first tracing function and the second tracing function in the target user state respectively; send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracing process between the target user state and the target user state.
[0176] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.
[0177] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.
[0178] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
[0179] Computer program code for performing the operations of the present invention may be written in one or more programming languages or combinations thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0180] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.
[0181] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.
Claims
1. A network traffic tracking method, characterized in that: include: determining a first tracking function and a second tracking function; In the target user state, respectively, target flow data is acquired from the data transmission entrances of the first tracking function and the second tracking function; The target traffic data is sent to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state.
2. The method according to claim 1, characterized in that The acquiring target traffic data from the data transmission entrances of the first tracking function and the second tracking function in the target user state respectively includes: Constructing a first tracking program corresponding to the target kernel state; Based on the first tracing program, acquiring entry parameters from data transmission entrances of the first tracing function and the second tracing function, and storing the entry parameters in a preset mapping; The target flow data is determined according to the preset mapping.
3. The method according to claim 2, characterized in that The acquiring the entry parameters from the data transmission entry of the first tracing function and the second tracing function, and storing the entry parameters in a preset mapping, comprises: Acquire at least one buffer address from the data transmission entry of the first tracing function and the second tracing function; For each buffer address, a hash value is determined according to the buffer address and the storage thread number, and all the hash values are stored in the preset map.
4. The method according to claim 3, characterized in that The determining the target flow data according to the preset mapping includes: For each hash value in the preset mapping, a buffer address is determined according to the hash value, buffer data corresponding to the buffer address is obtained, and all the obtained buffer data is used as the target traffic data.
5. The method according to claim 1, characterized in that The sending of the target traffic data to the target user state corresponding to the target kernel state includes: Constructing a second tracking program corresponding to the target user state; The target flow data is loaded based on the second tracking program.
6. The method according to claim 5, characterized in that The loading of the target traffic data based on the second tracking program includes: Constructing an event processing callback function corresponding to the second tracking program; The target traffic data is read based on the event processing callback function.
7. The method according to claim 1, characterized in that The first tracing function is an SSL_read function, and the second tracing function is an SSL_write function.
8. A network traffic tracking device, characterized in that: The device comprises: A tracking function determination module, used to determine a first tracking function and a second tracking function; A flow data acquisition module, used to acquire target flow data from the data transmission entrances of the first tracking function and the second tracking function respectively in the target user state; The traffic data sending module is used to send the target traffic data to the target user state corresponding to the target kernel state to complete the traffic tracking process between the target user state and the target user state.
9. A computer device, characterized in that: The computer device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic tracking method as described in any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the network traffic tracking method as described in any one of claims 1 to 7 is implemented.