File operation tracking method, device, computer equipment and storage medium

Abstract

The present invention relates to the field of operating system technology, and discloses a file operation tracking method, apparatus, computer equipment, and storage medium. The method comprises: creating a first tracking point and a second tracking point for each file operation function; in response to the file operation function being called, triggering the corresponding first tracking point; based on the first tracking point, collecting the file path and call information of the file operation function; storing the file path when the file path meets a preset filtering rule; in response to the file operation function returning, triggering the second tracking point, obtaining the return value of the file operation function, and sending it to the user layer together with the file path and call information. By setting tracking points, the present invention comprehensively monitors the entire life cycle of the file operation function, obtains the complete context information of the file operation, including the file path and call information, and reduces the amount of unnecessary data through preset filtering rules, thereby achieving efficient and accurate tracking of file operations and improving the stability and security of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of operating systems, and in particular to a file operation tracking method, device, computer equipment and storage medium. Background Art

[0002] In modern computer systems, the stability and security of file systems are crucial. File systems are used to store, retrieve, and manage data and are core components of operating systems. Ensuring the integrity, reliability, and security of file systems is particularly important for enterprise applications, critical business systems, and security-sensitive environments. For example, modifications to configuration files can impact system operation and even lead to security vulnerabilities. Unauthorized file access can lead to data leakage or corruption. Therefore, tracking file operations and identifying file changes has become a pressing issue.

[0003] Traditional file operation tracking methods, such as auditd and inotify, are capable of tracking file operations, but they have significant shortcomings in performance and accuracy. When using auditd to track file operations, each time an audit event occurs, it is necessary to switch from the kernel layer to the user layer in order to write the event log to a file or send it to other destinations. Frequent context switches increase the system burden, especially in high-concurrency environments, which significantly affects system performance. When using inotify to track file operations, it is necessary to switch from the kernel layer to the user layer. For a large number of file operations or high-frequency events, this switch will result in high performance overhead. In addition, inotify may miss events or generate delays in high-load environments. It can be seen that the two existing file operation tracking methods have the problems of high system performance overhead and inaccurate tracking. Summary of the Invention

[0004] In view of this, the present invention provides a file operation tracking method, apparatus, computer equipment and storage medium to solve the problems of large system performance overhead and inaccurate tracking in existing file operation tracking methods.

[0005] In a first aspect, the present invention provides a file operation tracking method, the method comprising:

[0006] For a plurality of file operation functions of a virtual file system located in a kernel layer, a first tracking point and a second tracking point are created for each file operation function;

[0007] In response to any file operation function being called, triggering a first tracking point corresponding to the file operation function;

[0008] Based on the first tracking point, collect the file path and call information of the file operation function;

[0009] If the file path meets the preset filtering rules, the file path is stored;

[0010] In response to the file operation function returning, the second tracking point of the file operation function is triggered, the return value of the file operation function is obtained, and the return value of the file operation function, the file path and the calling information are sent to the user layer.

[0011] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored, reducing unnecessary data volume and improving storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and file path, a complete file operation link is provided to the user layer, helping to analyze performance bottlenecks and error causes, and comprehensively tracking the entire process of file operations, thereby achieving efficient and accurate tracking of file operations and improving system stability and security.

[0012] In an optional implementation, the file operation function includes a file opening function, and collecting the file path of the file operation function based on the first tracking point includes:

[0013] Based on the first tracking point of the file operation function, parsing the file directory parameter of the file operation function to obtain the file directory of the file operation function;

[0014] Determine whether the file operation function is a file opening function;

[0015] When the file operation function is not a file opening function, the file directory of the file operation function is used as the file path.

[0016] The file operation tracking method provided by an embodiment of the present invention parses the file directory parameter of the file operation function through the first tracking point, extracts the specific file directory involved in the file operation, checks whether the file operation function is a file opening function, and adopts different processing logic to ensure that different types of file operation functions can be correctly processed, thereby improving tracking accuracy.

[0017] In an optional embodiment, after determining whether the file operation function is a file opening function, the method further includes:

[0018] In the case where the file operation function is a file open function, based on the first tracking point of the file open function, parsing the mount point parameter of the file open function to obtain the mount point directory of the file directory;

[0019] Based on the mount point directory and the file directory, determine the file path of the file open function.

[0020] The file operation tracking method provided by an embodiment of the present invention, after confirming that the file operation function is a file open function, parses the mount point parameter through the first tracking point, extracts the specific mount point directory, combines the file directory, and generates the final file path to ensure that the file operation can be correctly tracked and recorded.

[0021] In an optional implementation, parsing a file directory parameter of a file operation function to obtain the file directory of the file operation function includes:

[0022] Parse the file directory parameters of the file operation function to obtain the file directory structure;

[0023] For the last level directory entry of the file directory structure, determine whether the directory entry is equal to the parent directory of the directory entry;

[0024] If a directory entry is not equal to its parent directory, the name of the directory entry is recorded;

[0025] The parent directory of the directory entry is used as the directory entry in the next loop, and the process returns to the step of determining whether the directory entry and the parent directory of the directory entry are equal. This process continues until the directory entry and the parent directory of the directory entry are consistent, and the names of all recorded directory entries are sequentially concatenated as the file directory.

[0026] The file operation tracking method provided by the embodiment of the present invention can quickly and accurately obtain the complete file path by traversing the directory entries level by level, avoiding repeated traversal or redundant operations, thereby ensuring that the final generated file path is accurate.

[0027] In an optional embodiment, before sending the return value, file path, and call information of the file operation function to the user layer, the method further includes:

[0028] Detect abnormal behavior based on the file path and call information of file operation functions;

[0029] Generate alerts when abnormal behavior is detected;

[0030] Add warning information to the call information.

[0031] The file operation tracking method provided by the embodiment of the present invention detects whether there is abnormal behavior by analyzing the file path and call information, and can promptly discover potential security threats or non-compliant operations, thereby enhancing the security of the system.

[0032] In an optional implementation, the calling information includes a calling function, a process ID, a user layer stack, a kernel layer stack, and a user ID.

[0033] The file operation tracking method provided by the embodiment of the present invention can clarify the execution process of the file operation through calling information, which is helpful for comprehensive tracking of file operations.

[0034] In a second aspect, the present invention provides a file operation tracking device, the device comprising:

[0035] A creation module is used to create a first tracking point and a second tracking point for each of a plurality of file operation functions of a virtual file system located in a kernel layer;

[0036] a trigger module, configured to trigger a first tracking point corresponding to any file operation function in response to any file operation function being called;

[0037] A collection module, configured to collect file paths and call information of file operation functions based on the first tracking point;

[0038] A storage module, used for storing the file path if the file path meets the preset filtering rules;

[0039] The sending module is used to trigger the second tracking point of the file operation function in response to the return of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path and the calling information to the user layer.

[0040] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, computer instructions being stored in the memory, and the processor executing the file operation tracking method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the file operation tracking method of the first aspect or any corresponding embodiment thereof.

[0042] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the file operation tracking method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 is a flowchart of a file operation tracking method according to an embodiment of the present invention;

[0045] Figure 2 is a flowchart of another file operation tracking method according to an embodiment of the present invention;

[0046] Figure 3 is a flowchart of determining a file directory according to an embodiment of the present invention;

[0047] Figure 4 is a structural block diagram of a file operation tracking device according to an embodiment of the present invention;

[0048] Figure 5 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0050] Traditional file operation tracking methods, such as auditd and inotify, can track file operations, but they have significant deficiencies in performance and accuracy. The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of file operation functions by setting tracking points at function calls and returns, ensuring that no important execution details are missed. Moreover, through preset filtering rules, only specific file paths are stored to reduce the amount of unnecessary data. Based on the file path, call information and return value of the file operation function, a complete file operation link is provided to the user layer, helping to analyze performance bottlenecks and error causes, comprehensively tracking the entire process of file operations, achieving efficient and accurate tracking of file operations, and improving system stability and security.

[0051] According to an embodiment of the present invention, an embodiment of a file operation tracking method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] In this embodiment, a file operation tracking method is provided, which can be used in an operating system. Figure 1 : is a flowchart of a file operation tracking method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0053] Step S101, for multiple file operation functions of the virtual file system located in the kernel layer, a first tracking point and a second tracking point are created for each file operation function. Specifically, the Virtual File System (VFS) is an abstract layer in the operating system kernel that provides a unified interface for various file systems so that users and applications can perform file operations. File operation functions include functions such as vfs_create (create file function), vfs_open (open file function), and vfs_mkdir (create folder function). A first tracking point and a second tracking point are created for each file operation function. The first tracking point is a kprobe, and the second tracking point is a kreprobe, both of which are dynamic tracking points used to comprehensively track changes in the file operation function during the calling process.

[0054] Step S102: In response to any file operation function being called, the first tracking point corresponding to the file operation function is triggered. Specifically, when any file operation function is called, the first tracking point corresponding to the function is immediately triggered. This allows the capture of relevant information at the instant the file operation function is called, ensuring that no important operation details are missed, ensuring timely tracking, and enabling rapid response and recording of each file operation initiation.

[0055] Step S103 collects the file path and call information of the file operation function based on the first tracking point. Specifically, the file path is the specific path of the file or directory involved in the call process of the file operation function. The call information is various aspects of information involved in the call process of the file operation function. By collecting this information based on the first tracking point, the context information of the file operation function during the call process is fully recorded.

[0056] Step S104: If the file path meets the preset filtering rules, the file path is stored. Specifically, based on the preset filtering rules, such as storing only specific directories or file types, a determination is made as to whether the file path needs to be stored. Optionally, when the preset filtering rule is 0, filtering is considered disabled and the file path is directly stored. If the rules are met, the file path is stored. Only file paths that meet the specified criteria are stored, reducing unnecessary data, improving storage and processing efficiency, and achieving efficient tracking.

[0057] In step S105, in response to the file operation function returning, the second tracking point of the file operation function is triggered, the return value of the file operation function is obtained, and the return value, file path, and call information of the file operation function are sent to the user layer. Specifically, when the file operation function is executed and returns, the corresponding second tracking point is triggered to obtain the return value of the file operation function. The return value is used to indicate whether the file operation function was executed successfully. The second tracking point then sends the return value, file path, and call information to the user layer, ensuring that the user layer can obtain complete operation results and contextual information, facilitating further processing and decision-making, and achieving comprehensive, efficient, and accurate tracking of file operations.

[0058] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored, reducing unnecessary data volume and improving storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and file path, a complete file operation link is provided to the user layer, helping to analyze performance bottlenecks and error causes, and comprehensively tracking the entire process of file operations, thereby achieving efficient and accurate tracking of file operations and improving system stability and security.

[0059] In this embodiment, a file operation tracking method is provided, which can be used in the above-mentioned operating system. Figure 2 FIG. 1 is a flowchart of another file operation tracking method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201: For each of the multiple file operation functions of the virtual file system located in the kernel layer, a first tracking point and a second tracking point are created. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0061] Step S202: In response to any file operation function being called, trigger the first tracking point corresponding to the file operation function. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0062] Step S203: Based on the first tracking point, collect the file path and call information of the file operation function, where the file operation function includes a file opening function.

[0063] Specifically, the above step S203 includes:

[0064] Step S2031 : Based on the first tracking point of the file operation function, the file directory parameter of the file operation function is parsed to obtain the file directory of the file operation function.

[0065] In some optional implementations, step S2031 includes:

[0066] Step a1: Parse the file directory parameter of the file operation function to obtain a file directory structure. Specifically, since all file operation functions have a file directory parameter (dentry), the file directory parameter can be parsed to obtain a file directory structure (struct dentry).

[0067] Step a2: For the last level of the directory structure, determine whether the directory entry is equal to its parent directory. Specifically, check whether the current directory entry (dentry) is equal to its parent directory (parent dentry) to determine whether the root directory has been reached, thereby determining whether to continue traversing upwards or whether the root directory or mount point has been reached, thereby terminating the loop.

[0068] Step a3, when the directory entry and the parent directory of the directory entry are not equal, record the name of the directory entry. Specifically, if the current directory entry and its parent directory are not equal, it is thought that the root directory has not yet been reached, so the name (d_name) of the current directory entry is recorded.

[0069] In step a4, the parent directory of the directory entry is used as the directory entry for the next loop. The process returns to the step of determining whether the directory entry and its parent directory are equal. Until the directory entry and its parent directory are consistent, the names of all recorded directory entries are sequentially concatenated to form the file directory. Specifically, the current directory entry is updated to be the parent directory, and the above-mentioned checking and name collection operations are repeated until the current directory entry and its parent directory are equal, at which point the root directory is considered to have been reached. Finally, all recorded directory entry names are sequentially concatenated to form the complete file path. By looping through the process, the complete file path is gradually constructed.

[0070] Step S2032, determines whether the file operation function is a file open function. Specifically, a mount point refers to a directory in a file system, and another file system (usually a different device or partition) is connected to this directory. In this way, accessing this directory is equivalent to accessing the mounted file system. Mount points are usually used to integrate file systems on different devices or partitions into a unified file tree. Files operated by file operation functions may all be mounted, but only the mount point parameter (vfsmnt) of the vfs_open function can be parsed to obtain the specific situation of mounting to other file systems.

[0071] Step S2033, when the file operation function is not a file open function, the file directory of the file operation function is used as the file path. Specifically, when the file operation function is not a vfs_open function, the mount point parameter cannot be parsed, and the file directory obtained in step S2031 is used as the file path.

[0072] Step S2034: When the file operation function is a file open function, the mount point parameter of the file open function is parsed based on the first tracking point of the file open function to obtain the mount point directory of the file directory. Specifically, when the file path contains a mount point parameter, that is, when it contains a mount point, the file directory structure in step S2031 above will reflect the new file system structure after the mount point, and the mount point directory can record the mount point information. The vfs_open function can parse the complete path, including the mount point, when opening a file, thereby obtaining the correct file path and mount information. This design enables VFS to flexibly manage and access multiple file systems.

[0073] Step S2035 determines the file path for the file open function based on the mount point directory and the file directory. Specifically, assume that there is a file c in the mount device and the mount point directory is / mnt / data, that is, it is mounted at / mnt / data. If the file directory obtained in step S2031 is c, considering the mount point and the mount point directory, the actual file path can be obtained as / mnt / data / c.

[0074] In some optional embodiments, Figure 3 is a flow chart of determining a file directory according to an embodiment of the present invention, such as Figure 3 As shown, the file directory parameters are parsed to obtain the file directory structure. For the last level directory entry, determine whether the directory entry is equal to its parent directory. If so, the parent directory is the root directory. If not, record the name of the directory entry. Then, update the parent directory to the new directory entry, and return to the judgment step until the directory entry is equal to the parent directory. After determining the root directory, sort the names of all recorded directory entries in order to obtain the file directory.

[0075] In some optional implementations, the call information includes a calling function, a process ID, a user-level stack, a kernel-level stack, and a user ID. Specifically, the above-mentioned specific call information can be used to locate which process is executed by which user and triggers the operation on the current file. The user-level stack and the kernel-level stack are used to accurately locate the path through which the user's program is executed to this point. For example, the vfssnoop program opens the " / usr / lib64 / libz.so.1.2.13" file via vfs_open, the process ID is 3318, the user ID is 0, and the code executes to this point by calling the openat2 system call via the libc.so function.

[0076] Step S204: If the file path meets the preset filtering rules, the file path is stored. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0077] Step S205 , in response to the file operation function returning, triggering the second tracking point of the file operation function, obtaining the return value of the file operation function, and sending the return value of the file operation function, the file path and the calling information to the user layer.

[0078] In some optional implementations, before sending the return value, file path, and call information of the file operation function to the user layer, step S205 further includes:

[0079] Step b1: Detect abnormal behavior based on the file path and call information of the file operation function. Specifically, abnormal behavior includes illegal path access (such as access to a restricted directory), excessive file operation frequency, file operation function parameters that do not meet expectations, and file operation function execution failure (if the return value is 0, the file operation function execution is successful, if the return value is 1, the execution fails), etc. This is just an example and is not intended to be limiting. By analyzing the file path and call information, abnormal behavior is identified, thereby ensuring system security and stability and preventing potential security threats or erroneous operations.

[0080] Step b2: Generate an alert if abnormal behavior is detected. Specifically, if abnormal behavior is detected, a corresponding alert is generated. This alert should include a detailed description of the abnormality, such as the time the abnormality occurred, the file path involved, the specific function and parameters called, the specific abnormality type and cause, etc., to help relevant personnel identify and resolve the problem in a timely manner.

[0081] Step b3: Add the alarm information to the call information. Specifically, the generated alarm information is added to the original call information to ensure that the alarm information is delivered to the user layer together with the above multiple information.

[0082] The file operation tracking method provided by the embodiment of the present invention can comprehensively monitor the entire life cycle of the file operation function by setting tracking points at the function call and return respectively, ensuring that no important execution details are missed. When a file operation function is called, the first tracking point corresponding to the function is triggered to obtain the complete context information of the file operation, including the file path and call information, to provide detailed data support for subsequent analysis. Through preset filtering rules, only specific file paths are stored, reducing unnecessary data volume and improving storage and processing efficiency. When the file operation function returns, the second tracking point is triggered to obtain the return value. Combined with the call information and file path, a complete file operation link is provided to the user layer, helping to analyze performance bottlenecks and error causes, and comprehensively tracking the entire process of file operations, thereby achieving efficient and accurate tracking of file operations and improving system stability and security.

[0083] This embodiment also provides a file operation tracking device for implementing the above-mentioned embodiments and preferred implementations. Details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0084] This embodiment provides a file operation tracking device, such as Figure 4 Shown, including:

[0085] The creation module 401 is configured to create a first tracking point and a second tracking point for each of the plurality of file operation functions of the virtual file system located in the kernel layer.

[0086] The trigger module 402 is configured to trigger a first tracking point corresponding to any file operation function in response to any file operation function being called.

[0087] The collecting module 403 is configured to collect the file path and calling information of the file operation function based on the first tracking point.

[0088] The storage module 404 is configured to store the file path if the file path meets the preset filtering rule.

[0089] The sending module 405 is used to trigger the second tracking point of the file operation function in response to the return of the file operation function, obtain the return value of the file operation function, and send the return value of the file operation function, the file path and the calling information to the user layer.

[0090] In some optional implementations, the file operation function includes a file opening function, and the collection module 403 includes:

[0091] The parsing unit is used to parse the file directory parameter of the file operation function based on the first tracking point of the file operation function to obtain the file directory of the file operation function.

[0092] The judging unit is used to judge whether the file operation function is a file opening function.

[0093] A determination unit is used to use the file directory of the file operation function as the file path when the file operation function is not a file opening function.

[0094] In some optional implementations, after the determination unit, the device further includes:

[0095] The parsing module is used to parse the mount point parameter of the file open function based on the first tracking point of the file open function when the file operation function is a file open function, and obtain the mount point directory of the file directory.

[0096] Determine the module, which is used to determine the file path of the file open function based on the mount point directory and the file directory.

[0097] In some optional implementations, the parsing unit includes:

[0098] The parsing subunit is used to parse the file directory parameters of the file operation function to obtain the file directory structure.

[0099] The judgment subunit is used to judge whether the directory entry at the last level of the file directory structure is equal to the parent directory of the directory entry.

[0100] The first determining subunit is configured to record the name of the directory entry when the directory entry is not equal to the parent directory of the directory entry.

[0101] The second determination sub-unit is used to use the parent directory of the directory entry as the directory entry in the next loop, and return to the step of determining whether the directory entry is equal to the parent directory of the directory entry, until the directory entry is consistent with the parent directory of the directory entry, and the names of all recorded directory entries are sequentially spliced ​​as the file directory.

[0102] In some optional implementations, before sending module 405, the apparatus further includes:

[0103] The detection module is used to detect abnormal behavior based on the file path and call information of the file operation function.

[0104] The generation module is used to generate alarm information when abnormal behavior is detected.

[0105] Add a module to add alarm information to the call information.

[0106] In some optional implementations, the calling information includes a calling function, a process identifier, a user layer stack, a kernel layer stack, and a user identifier.

[0107] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0108] The file operation tracking device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0109] The embodiment of the present invention also provides a computer device having the above Figure 4 The file operation tracking device shown.

[0110] See also Figure 5 , Figure 5 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0111] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0112] The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0113] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0114] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0115] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0116] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0117] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0118] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A file operation tracking method, characterized in that: The method comprises: For a plurality of file operation functions of a virtual file system located at a kernel layer, a first tracking point and a second tracking point are created for each file operation function, wherein the file operation function includes a create file function, a file open function, and a create folder function located at a VFS layer; In response to any file operation function being called, triggering a first tracking point corresponding to the file operation function; Based on the first tracking point, collecting the file path and call information of the file operation function; If the file path meets the preset filtering rules, storing the file path; In response to the file operation function returning, triggering a second tracking point of the file operation function, obtaining a return value of the file operation function, and sending the return value of the file operation function, the file path, and the calling information to the user layer; The collecting the file path of the file operation function based on the first tracking point includes: parsing a file directory parameter of the file operation function based on the first tracking point of the file operation function to obtain the file directory of the file operation function; Determine whether the file operation function is a file opening function; In the case where the file operation function is not a file opening function, the file directory of the file operation function is used as the file path; The parsing of the file directory parameter of the file operation function to obtain the file directory of the file operation function includes: Parsing the file directory parameter of the file operation function to obtain a file directory structure; For the directory entry at the last level of the file directory structure, determining whether the directory entry is equal to the parent directory of the directory entry; If the directory entry is not equal to the parent directory of the directory entry, recording the name of the directory entry; The parent directory of the directory entry is used as the directory entry for the next loop, and the process returns to the step of determining whether the directory entry and the parent directory of the directory entry are equal. Until the directory entry and the parent directory of the directory entry are consistent, the names of all recorded directory entries are sequentially concatenated as the file directory. Alternatively, in a case where the file operation function is a file open function, parsing a mount point parameter of the file open function based on a first tracking point of the file open function to obtain a mount point directory of the file directory; Based on the mount point directory and the file directory, a file path of the file open function is determined.

2. The method according to claim 1, characterized in that Before sending the return value, file path, and call information of the file operation function to the user layer, the method further includes: Detecting abnormal behavior based on the file path and call information of the file operation function; Generate alerts when abnormal behavior is detected; The warning information is added to the calling information.

3. The method according to claim 1, characterized in that The calling information includes a calling function, a process identifier, a user layer stack, a kernel layer stack, and a user identifier.

4. A file operation tracking device, characterized in that: The device comprises: A creation module is configured to create a first tracking point and a second tracking point for each of a plurality of file operation functions of a virtual file system located at a kernel layer, wherein the file operation functions include a create file function, a file open function, and a create folder function located at a VFS layer; a triggering module, configured to trigger a first tracking point corresponding to any file operation function in response to the function being called; A collecting module, configured to collect the file path and call information of the file operation function based on the first tracking point; A storage module, configured to store the file path if the file path meets a preset filtering rule; a sending module, configured to trigger a second tracking point of the file operation function in response to a return of the file operation function, obtain a return value of the file operation function, and send the return value of the file operation function, the file path, and the calling information to the user layer; The collection module is specifically used for: parsing a file directory parameter of the file operation function based on the first tracking point of the file operation function to obtain the file directory of the file operation function; Determine whether the file operation function is a file opening function; In the case where the file operation function is not a file opening function, the file directory of the file operation function is used as the file path; The collection module is specifically used for: Parsing the file directory parameter of the file operation function to obtain a file directory structure; For the directory entry at the last level of the file directory structure, determining whether the directory entry is equal to the parent directory of the directory entry; If the directory entry is not equal to the parent directory of the directory entry, recording the name of the directory entry; The parent directory of the directory entry is used as the directory entry for the next loop, and the process returns to the step of determining whether the directory entry and the parent directory of the directory entry are equal. Until the directory entry and the parent directory of the directory entry are consistent, the names of all recorded directory entries are sequentially concatenated as the file directory. Alternatively, in a case where the file operation function is a file open function, parsing a mount point parameter of the file open function based on a first tracking point of the file open function to obtain a mount point directory of the file directory; Based on the mount point directory and the file directory, a file path of the file open function is determined.

5. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the file operation tracking method according to any one of claims 1 to 3 by executing the computer instructions.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the file operation tracking method according to any one of claims 1 to 3.

7. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the file operation tracking method according to any one of claims 1 to 3.

Images