File operation tracking method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of operating systems, and discloses a file operation tracking method and device, computer equipment and a storage medium, and the method comprises the following steps: creating a first tracking point and a second tracking point for each file operation function; in response to the fact that the file operation function is called, triggering a corresponding first tracking point; based on the first tracking point, collecting a file path and calling information of the file operation function; storing the file path under the condition that the file path conforms to a preset filtering rule; and in response to return of the file operation function, triggering the second tracking point, obtaining a return value of the file operation function, and sending the return value, the file path and the calling information to a user layer. According to the method, the tracking points are set, the whole life cycle of the file operation function is comprehensively monitored, the complete context information, including the file path and the calling information, of the file operation is obtained, the unnecessary data volume is reduced through the preset filtering rule, efficient and accurate tracking of the file operation is achieved, and the stability and the safety of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of operating systems, and in particular to a file operation tracking method, device, computer equipment and storage medium. Background Art

[0002] In modern computer systems, the stability and security of the file system are crucial. The file system is used to store, retrieve and manage data and is one of the core components of the operating system. For enterprise-level applications, critical business systems and security-sensitive environments, it is particularly important to ensure the integrity, reliability and security of the file system. For example, the modification of configuration files may affect the normal operation of the system and even cause security vulnerabilities; unauthorized file access may lead to data leakage or corruption. Therefore, tracking file operations to identify file changes has become an urgent problem to be solved.

[0003] Traditional file operation tracking methods, such as auditd and inotify, can track file operations, but they have significant deficiencies in performance and accuracy. When using auditd to track file operations, each time an audit event occurs, it is necessary to switch from the kernel layer to the user layer in order to write the event log to a file or send it to other destinations. Frequent context switching will increase the system burden, especially in a high-concurrency environment, which will significantly affect system performance. When using inotify to track file operations, it is necessary to switch from the kernel layer to the user layer. For a large number of file operations or high-frequency events, this switch will result in high performance overhead. In addition, inotify may miss events or generate delays in a high-load environment. It can be seen that the two existing file operation tracking methods have problems such as large system performance overhead and inaccurate tracking. Summary of the invention

[0004] In view of this, the present invention provides a file operation tracking method, apparatus, computer equipment and storage medium to solve the problems of large system performance overhead and inaccurate tracking in existing file operation tracking methods.

[0005] In a first aspect, the present invention provides a file operation tracking method, the method comprising:

[0006] For a plurality of file operation functions of a virtual file system located at a kernel layer, a first tracking point and a second tracking point are created for each file operation function;

[0007] In response to any file operation function being called, triggering a first tracking point corresponding to the file operation function;

[0008] Based on the first tracking point, collect the file path and call information of the file operation function;

[0009] If the file path meets the preset filtering rules, the file path is stored;

[0010] In response to the file operation function returning, the second tracking point of the file operation function is triggered, the return value of the file operation function is obtained, and the return value of the file operation function, the file path and the calling information are sent to the user layer.

[0011] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored to reduce unnecessary data volume and improve storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and the file path, a complete file operation link is provided to the user layer, which helps to analyze performance bottlenecks and error causes, comprehensively track the entire process of file operations, achieve efficient and accurate tracking of file operations, and improve the stability and security of the system.

[0012] In an optional implementation, the file operation function includes a file opening function, and based on the first tracking point, collecting the file path of the file operation function includes:

[0013] Based on the first tracking point of the file operation function, a file directory parameter of the file operation function is parsed to obtain the file directory of the file operation function;

[0014] Determine whether the file operation function is a file opening function;

[0015] When the file operation function is not a file opening function, the file directory of the file operation function is used as the file path.

[0016] The file operation tracking method provided by the embodiment of the present invention parses the file directory parameter of the file operation function through the first tracking point, extracts the specific file directory involved in the file operation, checks whether the file operation function is a file opening function, and adopts different processing logics to ensure that different types of file operation functions can be correctly processed, thereby improving tracking accuracy.

[0017] In an optional implementation, after determining whether the file operation function is a file opening function, the method further includes:

[0018] In the case where the file operation function is a file opening function, based on the first tracking point of the file opening function, the mount point parameter of the file opening function is parsed to obtain the mount point directory of the file directory;

[0019] Based on the mount point directory and the file directory, determine the file path of the file open function.

[0020] The file operation tracking method provided by the embodiment of the present invention, after confirming that the file operation function is a file open function, parses the mount point parameter through the first tracking point, extracts the specific mount point directory, combines the file directory, and generates the final file path, thereby ensuring that the file operation can be correctly tracked and recorded.

[0021] In an optional implementation, parsing a file directory parameter of a file operation function to obtain a file directory of the file operation function includes:

[0022] Parse the file directory parameters of the file operation function to obtain the file directory structure;

[0023] For the last level directory entry of the file directory structure, determine whether the directory entry is equal to the parent directory of the directory entry;

[0024] If the directory entry is not equal to the parent directory of the directory entry, the name of the directory entry is recorded;

[0025] The parent directory of the directory entry is used as the directory entry for the next loop, and the process returns to the step of determining whether the directory entry is equal to the parent directory of the directory entry, until the directory entry is consistent with the parent directory of the directory entry, and the names of all recorded directory entries are sequentially concatenated as the file directory.

[0026] The file operation tracking method provided by the embodiment of the present invention can quickly and accurately obtain the complete file path by traversing the directory entries level by level, avoiding repeated traversal or redundant operations, thereby ensuring that the file path finally generated is accurate.

[0027] In an optional implementation, before sending the return value, file path, and call information of the file operation function to the user layer, the method further includes:

[0028] Detect abnormal behavior based on the file path and call information of the file operation function;

[0029] Generate alert information when abnormal behavior is detected;

[0030] Add warning information to the call information.

[0031] The file operation tracking method provided by the embodiment of the present invention can detect whether there is abnormal behavior by analyzing the file path and call information, and can promptly discover potential security threats or non-compliant operations, thereby enhancing the security of the system.

[0032] In an optional implementation, the calling information includes a calling function, a process identifier, a user layer stack, a kernel layer stack, and a user identifier.

[0033] The file operation tracking method provided by the embodiment of the present invention can clarify the execution process of the file operation through calling information, which is helpful for comprehensive tracking of file operations.

[0034] In a second aspect, the present invention provides a file operation tracking device, the device comprising:

[0035] A creation module is used to create a first tracking point and a second tracking point for each file operation function of a virtual file system located in the kernel layer;

[0036] A trigger module, configured to trigger a first tracking point corresponding to a file operation function in response to any file operation function being called;

[0037] A collection module, used for collecting the file path and call information of the file operation function based on the first tracking point;

[0038] A storage module, used for storing the file path when the file path meets the preset filtering rules;

[0039] The sending module is used to trigger the second tracking point of the file operation function in response to the return of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path and the calling information to the user layer.

[0040] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the file operation tracking method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the file operation tracking method of the first aspect or any corresponding embodiment thereof.

[0042] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the file operation tracking method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 is a flowchart of a file operation tracking method according to an embodiment of the present invention;

[0045] Figure 2 is a flowchart of another file operation tracking method according to an embodiment of the present invention;

[0046] Figure 3 is a flowchart of determining a file directory according to an embodiment of the present invention;

[0047] Figure 4 is a structural block diagram of a file operation tracking device according to an embodiment of the present invention;

[0048] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] Traditional file operation tracking methods, such as auditd and inotify, can track file operations, but have significant deficiencies in performance and accuracy. The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed, and only storing specific file paths through preset filtering rules to reduce unnecessary data volume, and providing a complete file operation link for the user layer based on the file path, call information and return value of the file operation function, helping to analyze performance bottlenecks and error causes, comprehensively tracking the entire process of file operations, achieving efficient and accurate tracking of file operations, and improving the stability and security of the system.

[0051] According to an embodiment of the present invention, an embodiment of a file operation tracking method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] In this embodiment, a file operation tracking method is provided, which can be used in an operating system. Figure 1 is a flowchart of a file operation tracking method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0053] Step S101, for multiple file operation functions of the virtual file system located in the kernel layer, a first tracking point and a second tracking point are created for each file operation function. Specifically, the virtual file system (Virtual File System, VFS) is an abstract layer in the operating system kernel, which provides a unified interface for various file systems to enable users and applications to perform file operations. The file operation function includes functions such as vfs_create (create file function), vfs_open (open file function) and vfs_mkdir (create folder function), and a first tracking point and a second tracking point are created for each file operation function. Among them, the first tracking point is kprobe, and the second tracking point is kreprobe, both of which are dynamic tracking points, used to comprehensively track the changes of the file operation function during the calling process.

[0054] Step S102, in response to any file operation function being called, trigger the first tracking point corresponding to the file operation function. Specifically, when any file operation function is called, the first tracking point corresponding to the function is immediately triggered, and relevant information can be captured at the moment the file operation function is called, ensuring that no important operation details are missed, ensuring the timeliness of tracking, and being able to quickly respond to and record the start of each file operation.

[0055] Step S103, based on the first tracking point, collect the file path and call information of the file operation function. Specifically, the file path is the specific path of the file or directory involved in the calling process of the file operation function. The call information is various information involved in the calling process of the file operation function. By collecting the above information based on the first tracking point, it is ensured that the context information of the file operation function in the calling process is fully recorded.

[0056] Step S104, if the file path meets the preset filtering rules, the file path is stored. Specifically, according to the preset filtering rules, such as storing only specific directories or file types, it is determined whether the file path needs to be stored. Optionally, when the preset filtering rule is 0, it is considered that the filtering is not turned on, and the file path is directly stored. If it meets the rules, the file path is stored, and only the file path that meets the specific conditions is stored, which reduces the amount of unnecessary data, improves storage and processing efficiency, and achieves efficient tracking.

[0057] Step S105, in response to the return of the file operation function, trigger the second tracking point of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path, and the call information to the user layer. Specifically, when the file operation function is executed and returns, the corresponding second tracking point is triggered to obtain the return value of the file operation function. Among them, the return value is used to indicate whether the file operation function is executed successfully. Then, the second tracking point sends the return value, file path, and call information to the user layer together, ensuring that the user layer can obtain complete operation results and context information, which is convenient for further processing and decision-making, and realizes comprehensive, efficient and accurate tracking of file operations.

[0058] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored to reduce unnecessary data volume and improve storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and the file path, a complete file operation link is provided to the user layer, which helps to analyze performance bottlenecks and error causes, comprehensively track the entire process of file operations, achieve efficient and accurate tracking of file operations, and improve the stability and security of the system.

[0059] In this embodiment, a file operation tracking method is provided, which can be used in the above-mentioned operating system. Figure 2 is a flowchart of another file operation tracking method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201: For multiple file operation functions of the virtual file system located in the kernel layer, create a first tracking point and a second tracking point for each file operation function. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0061] Step S202: In response to any file operation function being called, trigger the first tracking point corresponding to the file operation function. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0062] Step S203: Based on the first tracking point, collect the file path and call information of the file operation function, where the file operation function includes a file opening function.

[0063] Specifically, the above step S203 includes:

[0064] Step S2031, based on the first tracking point of the file operation function, parsing the file directory parameter of the file operation function to obtain the file directory of the file operation function.

[0065] In some optional implementations, step S2031 includes:

[0066] Step a1, parsing the file directory parameter of the file operation function to obtain the file directory structure. Specifically, since all file operation functions have a file directory parameter (dentry), the file directory parameter can be parsed to obtain the file directory structure (struct dentry).

[0067] Step a2, for the last level of the file directory structure, determine whether the directory entry is equal to the parent directory of the directory entry. Specifically, check whether the current directory entry (dentry) is equal to its parent directory (parent dentry) to determine whether the root directory has been reached, so as to determine whether it is necessary to continue traversing upwards, or whether the root directory or mount point has been reached, so as to terminate the loop.

[0068] Step a3, when the directory entry is not equal to the parent directory of the directory entry, record the name of the directory entry. Specifically, if the current directory entry is not equal to its parent directory, it is considered that the root directory has not yet been reached, so the name (d_name) of the current directory entry is recorded.

[0069] Step a4, taking the parent directory of the directory entry as the directory entry for the next loop, and returning to the step of determining whether the directory entry is equal to the parent directory of the directory entry, until the directory entry is consistent with the parent directory of the directory entry, the names of all recorded directory entries are sequentially spliced ​​as the file directory. Specifically, the current directory entry is updated as the parent directory, and the above-mentioned checking and name collection operations are repeatedly performed until the current directory entry is equal to its parent directory, at which time it is considered that the root directory has been reached. Finally, all recorded directory entry names are sequentially spliced ​​to form a complete file path. By looping through, a complete file path is gradually constructed.

[0070] Step S2032, determine whether the file operation function is a file open function. Specifically, a mount point refers to a directory in a file system, and another file system (usually a different device or partition) is connected to this directory. In this way, accessing this directory is equivalent to accessing the mounted file system. Mount points are usually used to integrate file systems on different devices or partitions into a unified file tree. Files operated by file operation functions may all be mounted, but only the mount point parameter (vfsmnt) of the vfs_open function can be parsed to obtain the specific situation of mounting to other file systems.

[0071] Step S2033, when the file operation function is not a file open function, the file directory of the file operation function is used as the file path. Specifically, when the file operation function is not a vfs_open function, the mount point parameter cannot be parsed, and the file directory obtained in step S2031 is used as the file path.

[0072] Step S2034, when the file operation function is a file open function, based on the first tracking point of the file open function, parse the mount point parameter of the file open function to obtain the mount point directory of the file directory. Specifically, when the file path contains the mount point parameter, that is, contains the mount point, the file directory structure in the above step S2031 will reflect the new file system structure after the mount point, and the mount point directory can record the mount point information. The vfs_open function can parse the complete path, including the mount point, when opening a file, so as to obtain the correct file path and mount information. This design enables VFS to flexibly manage and access multiple file systems.

[0073] Step S2035, based on the mount point directory and the file directory, determine the file path of the file open function. Specifically, assuming that there is a file c in the mount device, the mount point directory is / mnt / data, that is, mounted at / mnt / data. If the file directory obtained in step S2031 is c, considering the mount point and the mount point directory, the actual file path can be obtained as / mnt / data / c.

[0074] In some optional embodiments, Figure 3 is a flowchart of determining a file directory according to an embodiment of the present invention, such as Figure 3 As shown, the file directory parameters are parsed to obtain the file directory structure. For the last level directory entry, determine whether the directory entry is equal to its parent directory. If they are equal, then its parent directory is the root directory. If they are not equal, then the name of the directory entry is recorded. Then, the parent directory is updated to a new directory entry, and the judgment step is returned until the directory entry is equal to the parent directory. After determining the root directory, the names of all recorded directory entries are arranged in order to obtain the file directory.

[0075] In some optional implementations, the call information includes a call function, a process identifier, a user layer stack, a kernel layer stack, and a user identifier. Specifically, the above specific call information can be used to locate which process is executed by which user to trigger the operation on the current file. The user layer stack and the kernel layer stack are used to accurately locate the path through which the user's program is executed to this point. For example, the vfssnoop program opens the " / usr / lib64 / libz.so.1.2.13" file through vfs_open, the process identifier is 3318, the user identifier is 0, and the code calls the openat2 system call through the libc.so function to execute here.

[0076] Step S204: If the file path meets the preset filtering rules, store the file path. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0077] Step S205, in response to the file operation function returning, triggering the second tracking point of the file operation function, obtaining the return value of the file operation function, and sending the return value of the file operation function, the file path and the calling information to the user layer.

[0078] In some optional implementations, before sending the return value, file path, and call information of the file operation function to the user layer, step S205 further includes:

[0079] Step b1, based on the file path and call information of the file operation function, detect abnormal behavior. Specifically, the abnormal behavior includes illegal path access (such as access to restricted directories), excessive file operation frequency, parameters of the file operation function not meeting expectations, and failure of the file operation function to execute (if the return value is 0, the file operation function is executed successfully, if the return value is 1, the execution fails), etc. This is just an example and is not limited to this. By analyzing the file path and call information, abnormal behavior is identified, thereby ensuring system security and stability and preventing potential security threats or erroneous operations.

[0080] Step b2, if abnormal behavior is detected, generate an alarm message. Specifically, if abnormal behavior is detected, a corresponding alarm message is generated. The alarm message should contain a detailed description of the abnormality, such as the time when the abnormality occurred, the file path involved, the specific function and parameters called, the specific abnormality type and cause, etc., to help relevant personnel to discover and solve the problem in a timely manner.

[0081] Step b3, adding the alarm information to the call information. Specifically, the generated alarm information is added to the original call information to ensure that the alarm information is transmitted to the user layer together with the above multiple information.

[0082] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored to reduce unnecessary data volume and improve storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and the file path, a complete file operation link is provided to the user layer, which helps to analyze performance bottlenecks and error causes, comprehensively track the entire process of file operations, achieve efficient and accurate tracking of file operations, and improve the stability and security of the system.

[0083] In this embodiment, a file operation tracking device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0084] This embodiment provides a file operation tracking device, such as Figure 4 As shown, including:

[0085] The creation module 401 is used to create a first tracking point and a second tracking point for each of the multiple file operation functions of the virtual file system located in the kernel layer.

[0086] The trigger module 402 is used to trigger a first tracking point corresponding to a file operation function in response to any file operation function being called.

[0087] The collecting module 403 is used to collect the file path and calling information of the file operation function based on the first tracking point.

[0088] The storage module 404 is used to store the file path when the file path meets the preset filtering rule.

[0089] The sending module 405 is used to trigger the second tracking point of the file operation function in response to the return of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path and the calling information to the user layer.

[0090] In some optional implementations, the file operation function includes a file opening function, and the collection module 403 includes:

[0091] The parsing unit is used to parse the file directory parameter of the file operation function based on the first tracking point of the file operation function to obtain the file directory of the file operation function.

[0092] The judging unit is used to judge whether the file operation function is a file opening function.

[0093] A determination unit is used to use the file directory of the file operation function as the file path when the file operation function is not a file opening function.

[0094] In some optional implementations, after the determination unit, the device further includes:

[0095] The parsing module is used to parse the mount point parameter of the file open function based on the first tracking point of the file open function when the file operation function is a file open function, and obtain the mount point directory of the file directory.

[0096] A determination module is used to determine the file path of the file open function based on the mount point directory and the file directory.

[0097] In some optional implementations, the parsing unit includes:

[0098] The parsing subunit is used to parse the file directory parameters of the file operation function to obtain the file directory structure.

[0099] The judgment subunit is used to judge whether the directory entry at the last level of the file directory structure is equal to the parent directory of the directory entry.

[0100] The first determining subunit is used to record the name of the directory entry when the directory entry is not equal to the parent directory of the directory entry.

[0101] The second determination sub-unit is used to use the parent directory of the directory entry as the directory entry in the next loop, and return to the step of determining whether the directory entry is equal to the parent directory of the directory entry, until the directory entry is consistent with the parent directory of the directory entry, and concatenate the names of all recorded directory entries in sequence as the file directory.

[0102] In some optional implementations, before sending module 405, the device further includes:

[0103] The detection module is used to detect abnormal behavior based on the file path and call information of the file operation function.

[0104] The generation module is used to generate alarm information when abnormal behavior is detected.

[0105] Add a module to add warning information to the call information.

[0106] In some optional implementations, the calling information includes a calling function, a process identifier, a user layer stack, a kernel layer stack, and a user identifier.

[0107] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0108] The file operation tracking device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0109] The embodiment of the present invention also provides a computer device having the above Figure 4 The file operation tracking device shown.

[0110] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0111] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0112] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0113] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0114] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0115] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0116] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0117] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0118] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A file operation tracking method, characterized in that: The method comprises: For a plurality of file operation functions of a virtual file system located at a kernel layer, a first tracking point and a second tracking point are created for each file operation function; In response to any file operation function being called, triggering a first tracking point corresponding to the file operation function; Based on the first tracking point, collecting the file path and calling information of the file operation function; If the file path meets the preset filtering rule, store the file path; In response to the return of the file operation function, a second tracking point of the file operation function is triggered, the return value of the file operation function is obtained, and the return value of the file operation function, the file path and the calling information are sent to the user layer.

2. The method according to claim 1, characterized in that: The file operation function includes a file opening function, and collecting the file path of the file operation function based on the first tracking point includes: Based on the first tracking point of the file operation function, parsing the file directory parameter of the file operation function to obtain the file directory of the file operation function; Determine whether the file operation function is a file opening function; When the file operation function is not a file opening function, the file directory of the file operation function is used as the file path.

3. The method according to claim 2, characterized in that After determining that the file operation function is a file opening function, the method further includes: In the case where the file operation function is a file opening function, based on a first tracking point of the file opening function, parsing a mount point parameter of the file opening function to obtain a mount point directory of the file directory; Based on the mount point directory and the file directory, a file path of the file open function is determined.

4. The method according to claim 2, characterized in that: The parsing the file directory parameter of the file operation function to obtain the file directory of the file operation function includes: Parsing the file directory parameter of the file operation function to obtain a file directory structure; For the directory entry at the last level of the file directory structure, determining whether the directory entry is equal to the parent directory of the directory entry; If the directory entry is not equal to the parent directory of the directory entry, recording the name of the directory entry; The parent directory of the directory entry is used as the directory entry for the next loop, and the process returns to the step of determining whether the directory entry is equal to the parent directory of the directory entry, until the directory entry is consistent with the parent directory of the directory entry, and the names of all recorded directory entries are sequentially concatenated as the file directory.

5. The method according to claim 1, characterized in that: Before sending the return value, file path and call information of the file operation function to the user layer, the method further includes: Detecting abnormal behavior based on the file path and call information of the file operation function; Generate alert information when abnormal behavior is detected; The warning information is added to the calling information.

6. The method according to claim 1, characterized in that The calling information includes a calling function, a process identifier, a user layer stack, a kernel layer stack and a user identifier.

7. A file operation tracking device, characterized in that: The device comprises: A creation module is used to create a first tracking point and a second tracking point for each file operation function of a virtual file system located in the kernel layer; A trigger module, configured to trigger a first tracking point corresponding to any file operation function in response to the file operation function being called; A collecting module, used for collecting the file path and calling information of the file operation function based on the first tracking point; A storage module, used for storing the file path if the file path meets the preset filtering rules; The sending module is used to trigger the second tracking point of the file operation function in response to the return of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path and the calling information to the user layer.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the file operation tracking method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the file operation tracking method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the file operation tracking method according to any one of claims 1 to 6.

Images