File monitoring method and device, storage medium and program product

Abstract

The embodiment of the invention discloses a file monitoring method and device, a storage medium and a program product. The method comprises the following steps: creating an initial mirror image of a specified folder; acquiring folder information of the initial mirror image; judging whether the system is idle; if the specified folder is idle, creating a temporary mirror image of the specified folder; acquiring folder information of the temporary mirror image; judging whether the folder information between the initial mirror image and the temporary mirror image is consistent or not; if not, acquiring change information between the temporary mirror image and the initial mirror image; generating a monitoring report based on the change information; and taking the temporary mirror image as a new initial mirror image. According to the method, when the system is idle, whether the specified folder is changed or not can be quickly determined by utilizing the mirror image principle, the change information is accurately captured, and the monitoring efficiency and precision are improved under the condition that the system performance is not influenced.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a file monitoring method, device, storage medium, and program product. Background Art

[0002] In the field of file synchronization and management, monitoring changes in a folder and synchronizing it to another folder in real time to ensure the consistency of the content on both ends is an important requirement. Especially when the folder content changes frequently, an efficient method is needed to monitor these changes and synchronize only the changed parts to reduce the burden on system resources.

[0003] At present, the commonly used methods for monitoring folder changes in the prior art mainly use the APIs provided by the operating system, such as ReadDirectoryChangesW under Windows, inotify under Linux, kqueue in the BSD system, and by hooking the system service dispatch table (SSDT). Although these methods can achieve a certain degree of folder monitoring, they have some limitations. For example, APIs such as ReadDirectoryChangesW and inotify may miss some useful file change information, and although more details can be captured by hooking SSDT, this will cause the performance of the entire operating system to deteriorate, and the development technology is difficult. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide a file monitoring method, device, storage medium, and program product, which can use the principle of mirroring to quickly determine whether a specified folder has changed when the system is idle, and accurately capture the change information, thereby improving the efficiency and accuracy of monitoring without affecting system performance.

[0005] In a first aspect, the present disclosure provides a file monitoring method, which adopts the following technical solution:

[0006] Create an initial image of the specified folder;

[0007] Obtaining folder information of the initial image;

[0008] Determine whether the system is idle;

[0009] If idle, create a temporary mirror of the specified folder;

[0010] Obtaining folder information of the temporary image;

[0011] Determine whether the folder information between the initial image and the temporary image is consistent;

[0012] If they are inconsistent, obtaining the change information between the temporary image and the initial image;

[0013] generating a monitoring report based on the change information;

[0014] The temporary image is used as a new initial image.

[0015] Optionally, determining whether the system is idle includes:

[0016] Get the current interval time;

[0017] Collect the system's CPU usage and memory usage according to the current interval;

[0018] Determine whether the CPU usage is less than a first preset threshold, and the memory usage is less than a second preset threshold;

[0019] If so, the system is determined to be idle;

[0020] If not, the system is determined to be busy.

[0021] Optionally, obtaining the current interval time includes:

[0022] Count the number of changes to the specified folder according to the preset sampling period;

[0023] Based on the sampling period and the number of changes, construct a change distribution graph;

[0024] Perform regularity analysis on the change distribution graph to obtain multiple phase cycles;

[0025] Get the historical average number of changes in each phase cycle;

[0026] Based on the historical average number of changes, the optimal interval time of each phase cycle is obtained;

[0027] Determine the current phase period to which the current time belongs from the multiple phase periods;

[0028] The optimal interval time of the current phase cycle is determined as the current interval time.

[0029] Optionally, the calculation formula for the optimal interval time is:

[0030]

[0031] Where s is the sequence number of the phase cycle; T s is the optimal interval time of the sth periodic cycle; T idle is the optimal duration; C sis the historical average number of changes in the sth period; ∈ is a preset constant.

[0032] Optionally, the calculation formula for the optimal duration is:

[0033]

[0034] Among them, T max is the preset maximum interval time; L cpu is the first preset threshold; L ram is the second preset threshold.

[0035] Optionally, the folder information includes at least one of a total number of directory entries, a directory structure path set, a directory structure name set, and a hash value set.

[0036] Optionally, obtaining change information between the temporary image and the initial image includes:

[0037] Determine the change position between the temporary image and the initial image according to the hash value set and the directory structure path set of the initial image and the temporary image by a binary algorithm;

[0038] The change information is extracted according to the change position through the KMP algorithm.

[0039] In a second aspect, the present disclosure also provides a file monitoring system, which adopts the following technical solution:

[0040] A first creation module, used to create an initial image of a specified folder;

[0041] A first acquisition module, used to acquire folder information of the initial image;

[0042] An idle judgment module, used to judge whether the system is idle; if it is idle, the second creation module is executed;

[0043] A second creation module, used to create a temporary mirror image of the specified folder;

[0044] A second acquisition module, used to acquire the folder information of the temporary image;

[0045] A consistency judgment module, used to judge whether the folder information between the initial image and the temporary image is consistent; if not, executing the third acquisition module;

[0046] A third acquisition module, used to acquire change information between the temporary image and the initial image;

[0047] A report generation module, used for generating a monitoring report based on the change information;

[0048] The image updating module is used to use the temporary image as a new initial image.

[0049] In a third aspect, the embodiments of the present disclosure further provide a computer device, which adopts the following technical solution:

[0050] The computer device comprises:

[0051] at least one processor; and,

[0052] a memory communicatively connected to the at least one processor; wherein,

[0053] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-mentioned file monitoring methods.

[0054] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned file monitoring methods.

[0055] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0056] The file monitoring method provided by the disclosed embodiment can accurately identify the detailed changes in the specified folder by creating an initial image and a temporary image and comparing the folder information between the two images. This high-precision monitoring ensures that the integrity of the file system is maintained. The temporary image is created only when the system is idle, so as not to occupy too many resources when the system is busy, thereby ensuring that the overall performance of the system is not affected. Moreover, only when the specified folder changes, a monitoring report is generated and the initial image is updated, avoiding unnecessary operations, and by updating the initial image, the latest state of the initial image can be maintained, not only providing the latest benchmark for future comparisons, thereby maintaining continuous monitoring of the specified folder, but also reducing the workload of manual updates and maintenance. This method of regularly creating temporary images and comparing them reduces the difficulty of development technology, realizes real-time monitoring of changes in the specified folder, and enables administrators to promptly discover and respond to changes in the file system, and can improve synchronization accuracy and reduce synchronization error rates in file synchronization scenarios.

[0057] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 A flowchart of a file monitoring method provided by an embodiment of the present disclosure;

[0060] Figure 2 A flowchart of a method for determining system idleness provided by an embodiment of the present disclosure;

[0061] Figure 3 A schematic diagram of a flow chart of a method for obtaining a current interval time provided in an embodiment of the present disclosure;

[0062] Figure 4 A functional block diagram of a file monitoring system provided by an embodiment of the present disclosure;

[0063] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0064] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0065] It should be clear that the following embodiments of the present disclosure are described by specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0066] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0067] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0068] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0069] Reference Figure 1 The present disclosure provides a file monitoring method, comprising the following steps:

[0070] S1: Create an initial image of the specified folder;

[0071] S2: Get the folder information of the initial image;

[0072] S3: Determine whether the system is idle; if not, execute S4; if yes, execute S5;

[0073] S4: No need to create a temporary image of the specified folder;

[0074] S5: Create a temporary image of the specified folder;

[0075] S6: Obtain folder information of the temporary image;

[0076] S7: Determine whether the folder information between the initial image and the temporary image is consistent; if so,

[0077] Then execute S8; if not, execute S9;

[0078] S8: Delete the temporary image;

[0079] S9: Obtain change information between the temporary image and the initial image;

[0080] S10: Generate a monitoring report based on the change information;

[0081] S11: Use the temporary image as a new initial image.

[0082] The file monitoring method provided by the present disclosure can accurately identify the detailed changes in the specified folder by creating an initial image and a temporary image and comparing the folder information between the two images. This high-precision monitoring ensures that the integrity of the file system is maintained. The temporary image is created only when the system is idle, so as not to occupy too many resources when the system is busy, thereby ensuring that the overall performance of the system is not affected. Moreover, only when the specified folder changes, a monitoring report is generated and the initial image is updated, avoiding unnecessary operations, and by updating the initial image, the latest state of the initial image can be maintained, not only providing the latest benchmark for future comparisons, so as to maintain continuous monitoring of the specified folder, but also reducing the workload of manual updates and maintenance. This method of regularly creating temporary images and comparing them reduces the difficulty of development technology, realizes real-time monitoring of changes in specified folders, and enables administrators to promptly discover and respond to changes in the file system, and can improve synchronization accuracy and reduce synchronization error rates in file synchronization scenarios.

[0083] In summary, this method can improve the accuracy of monitoring folders without affecting the normal operating speed of the system, and has strong scalability and wide applicability.

[0084] In S1, the user selects the folder to be monitored according to actual needs, and passes the full path of the folder as a parameter to the initialization function of the monitoring program (such as iniwatchpath), completing the folder designation so that the program knows which folder needs to be monitored.

[0085] When the program is initialized, the system kernel API is called to start a thread. The thread is responsible for traversing the specified folder and creating images of all subfolders and all files in the specified folder. This initial image can be regarded as a snapshot of the specified folder. The initial image is the basic state when the monitoring program starts working, and all subsequent changes are compared relative to this state.

[0086] Different methods can be used to create threads according to different operating systems. For example, CreateThread function can be used in Windows system, and pthread_create function can be used in Linux system. The thread traverses the specified folder through the file system API. For example, FindFirstFile and FindNextFile can be used in Windows, and opendir and readdir can be used in Linux.

[0087] In S2, the folder information includes at least one of the total number of directory items, the directory structure path set, the directory structure name set, and the hash value set. The total number of directory items is the total number of all subfolders and all files under the specified folder; the directory structure path set is the set of paths of all subfolders and paths of all files under the specified folder; the directory structure name set is the set of names of all subfolders and names of all files under the specified folder; the hash value set is the set of paths of all subfolders, paths of all files, and contents under the specified folder converted into hash values.

[0088] Among them, a standard hash algorithm library (such as SHA-256, MD5, etc.) is used to calculate the hash value. For example, in a Python system, the hashlib module can be used to calculate the hash value.

[0089] In S3, refer to Figure 2 The flowchart of the method for determining whether the system is idle is shown. Determining whether the system is idle includes the following steps:

[0090] S31: Get the current interval time;

[0091] S32: Collect the CPU usage and memory usage of the system according to the current interval time;

[0092] S33: Determine whether the CPU usage is less than a first preset threshold, and the memory usage is less than a second preset threshold; if so, execute S34; if not, execute S35;

[0093] S34: determining that the system is idle;

[0094] S35: Determine that the system is busy.

[0095] In the above, the current interval is the collection period of CPU usage and memory usage. This collection frequency is equivalent to the monitoring frequency of whether the system is idle, which is convenient for understanding the system load. When the system is determined to be idle, it means that the current system load is good. Immediately create a temporary image of the current specified folder to avoid competing for resources with other programs, improve the effective utilization of system resources, and avoid resource waste. At this time, the current specified folder may have changed compared to the initial specified folder, so the temporary image may be different from the initial image.

[0096] The initial value of the current interval is equal to the preset optimal duration, but as the monitoring progresses, the current interval will be dynamically adjusted according to the monitoring details. Figure 3 The flowchart of the method for obtaining the current interval time is shown. The method for obtaining the current interval time includes the following steps:

[0097] S311: Counting the number of changes to the specified folder according to a preset sampling period;

[0098] S312: constructing a change distribution graph based on the sampling period and the number of changes;

[0099] S313: Analyze the change distribution diagram to obtain multiple phase cycles;

[0100] S314: Obtain the historical average number of changes in each phase cycle;

[0101] S315: based on the historical average number of changes, obtaining the optimal interval time of each phase cycle;

[0102] S316: Determine the current phase period to which the current time belongs from the multiple phase periods;

[0103] S317: Determine the optimal interval time of the current phase cycle as the current interval time.

[0104] In S311, the sampling period can be 12 hours or 24 hours, which can be adjusted according to the actual situation. The number of changes of the specified folder in each sampling period is counted, that is, the number of times the folder information of the initial image and the temporary image is inconsistent in the sampling period.

[0105] In S312, an xOy coordinate system is constructed, and a point cloud is drawn in the xOy coordinate system based on the sampling period and the number of changes. Each point is represented as (x, y), where x represents the sequence number of the sampling period in the time series, and y represents the number of changes within the sampling period. Each point is connected in sequence to form a change distribution diagram.

[0106] In S313, a regular analysis is performed on the change distribution graph using manual, statistical, trend analysis or machine learning methods to determine the change regularity of the specified folder, and multiple phased cycles are determined according to the regularity. For example, the specified folder changes frequently on weekdays but changes less on holidays, so each week is divided into two phased cycles according to the statutory holidays of each year: a weekday cycle and a holiday cycle.

[0107] In S314, the historical average number of changes is the historical average number of changes of the specified folder in the phased cycle. For example, the total number of changes of the specified folder in a 10-day cycle is counted, and the historical average number of changes in the working day cycle can be calculated by dividing the total number of changes by 10.

[0108] In S315-S317, the optimal interval time of the corresponding phased cycle is calculated by the historical average number of changes in each phased cycle. The current time is obtained, the current time is matched with multiple phased cycles, the phased cycle with successful matching is determined as the current phased cycle, and the optimal interval time of the current phased cycle is used as the current interval time.

[0109] The calculation formula for the optimal interval time is as follows:

[0110]

[0111] In formula 1, s is the sequence number of the phase cycle; T s is the optimal interval time of the sth periodic cycle; T idle is the optimal duration; C s is the historical average number of changes in the sth period; ∈ is a preset constant.

[0112] Among them, the optimal duration is the preset basic duration, and its calculation formula is as follows:

[0113]

[0114] In Formula 2, T max The preset maximum interval time, that is, the maximum interval time allowed by the system, to ensure that temporary creation and file monitoring will not affect the normal performance of the system; L cpu is the first preset threshold; L ram is the second preset threshold.

[0115] For different users, the changes in designated folders have different patterns. The above method can be used to analyze the change pattern of designated folders. According to this change pattern, the current interval time can be dynamically adjusted to reduce the burden on the system without affecting the monitoring of designated folders as much as possible, reduce unnecessary temporary image creation and other operations, effectively increase the effectiveness of monitoring, and realize personalized monitoring services for users.

[0116] In S6, the method and principle of obtaining the folder information of the temporary image is the same as that of obtaining the folder information of the initial image, which will not be described in detail here.

[0117] In S7-S9, the initial image and the temporary image are compared in order of the total number of directory items, the directory structure path set, the directory structure name set, and the hash value set; if it is detected that any information is different between the two, the folder information between the initial image and the temporary image is determined to be inconsistent, and the changes of the temporary image are monitored according to the preset target API to obtain the change information; if it is detected that each information of the two is the same, the folder information between the initial image and the temporary image is determined to be consistent, the temporary image is deleted, and the next temporary image is waited for to be created.

[0118] The target API is selected according to the system type. Specifically, in Windows, the ReadDirectoryChangesW API is used, which is a Windows API function used to monitor file system changes in a specified directory. In Linux, inotify is used, which is a Linux kernel feature that allows user-level programs to monitor file system changes. In macOS, kqueue is used, which is a mechanism used to monitor file descriptor events in BSD systems (including macOS) and can also be used to monitor file system changes.

[0119] Use the target API to monitor the temporary image and obtain the change information of the temporary image compared with the initial image. The monitoring content includes: modification, addition, deletion, and renaming. Modification means that the file content is modified, addition means that a new file or a new subfolder is added to the specified folder, deletion means that the file or new subfolder is deleted from the specified folder, and renaming means that the name of the file or folder is changed.

[0120] The target API records and feeds back the monitoring log according to the monitoring details, and obtains the change information according to the fed-back monitoring log, and the change information includes at least one of the file operation type, subfolder path, file path, subfolder current name, file current name, subfolder original name in the rename action, and file original name in the rename action. Among them, the file operation type is represented by a specific hexadecimal value, including at least one of 0x00000001, 0x00000002, 0x00000003, and 0x00000004, 0x00000001 means adding; 0x00000002 means deleting; 0x00000003 means modifying; 0x00000004 means renaming.

[0121] The principle of the target API obtaining change information is as follows: by using a binary search algorithm (also known as a binary search algorithm), by comparing the hash value set of the initial image and the hash value set of the temporary image, the inconsistent hash values ​​between the two images are queried. By using the directory structure path set of the initial image and the temporary image and the inconsistent hash values, the change position between the initial image and the temporary image (i.e., the position of the subfolders or files that are different when comparing the two images) is determined. By using the KMP algorithm (Knuth-Morris-Pratt Algorithm), the change information is extracted according to the change position.

[0122] For example, both the initial image and the temporary image include 2 subfolders and 8 files. The 2 subfolders are A and B. The binary algorithm is used to determine that B has changed. The path of B in the two images is transmitted to the KMP algorithm, and the specific changes of B are detected by the KMP algorithm.

[0123] Among them, the binary algorithm is an efficient algorithm for finding specific elements in an ordered array, and its time complexity is O(log n). In file monitoring, the binary algorithm can be used to quickly locate the location of changed files in the directory structure. The KMP algorithm is an improved string matching algorithm that can match two strings within the time complexity of O(n+m). In file monitoring, the KMP algorithm can be used to quickly identify changes in file content.

[0124] The XKS algorithm is implemented by combining the advantages of the binary algorithm and the KMP algorithm. The XKS algorithm uses the binary algorithm to quickly locate the scope of file changes, and because the design of the hash value set covers two layers of directories, it can limit the traversal range of the binary algorithm to the two layers of directories, reducing unnecessary traversal and improving efficiency. Then the KMP algorithm is used to accurately obtain the specific content of the changes and improve the accuracy of change capture. This combination can reduce unnecessary file content comparisons and improve the monitoring efficiency of the target API.

[0125] In S10 and S11, a detailed monitoring report is generated based on the extracted change information, which comprehensively displays all changes between the temporary image and the initial image, including the location, type, file or directory information involved, and detailed description of the changes. The monitoring report can also provide corresponding statistics and charts so that users can more intuitively analyze and understand the changes, and support the setting of automatic warnings based on monitoring details. After obtaining the change information, the temporary image is automatically used to overwrite the initial image to obtain a new initial image, ensuring that the initial image always reflects the latest status of the file system, providing the latest benchmark for future comparisons, so that subsequent monitoring can accurately detect new changes and help maintain an accurate file system status history, which is crucial for data synchronization.

[0126] Reference Figure 4 The present disclosure provides a file monitoring system, comprising:

[0127] A first creation module 101 is used to create an initial image of a specified folder;

[0128] A first acquisition module 102 is used to acquire folder information of an initial image;

[0129] The idle judgment module 103 is used to judge whether the system is idle; if it is idle, the second creation module is executed;

[0130] The second creation module 104 is used to create a temporary image of a specified folder;

[0131] The second acquisition module 105 is used to acquire folder information of the temporary image;

[0132] A consistency determination module 106 is used to determine whether the folder information between the initial image and the temporary image is consistent; if not, the third acquisition module is executed;

[0133] The third acquisition module 107 is used to obtain the change information between the temporary image and the initial image;

[0134] A report generation module 108, for generating a monitoring report based on the change information;

[0135] The image updating module 109 is used to use the temporary image as a new initial image.

[0136] The various variations and specific examples of the file monitoring method provided above are also applicable to the file monitoring system provided in the present disclosure. Through the above detailed description of the file monitoring method, those skilled in the art can clearly understand the implementation method of the file monitoring system. For the sake of brevity of the specification, it will not be described in detail here.

[0137] The computer device according to the embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0138] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the computer device performs all or part of the steps of the file monitoring method of each embodiment of the present disclosure.

[0139] Those skilled in the art should be able to understand that in order to solve the technical problem of how to obtain a good user experience, the present embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the protection scope of the present disclosure.

[0140] like Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure is shown, which is a schematic diagram of the structure of a computer device suitable for implementing the embodiment of the present disclosure. Figure 5 The computer device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0141] like Figure 5 As shown, the computer device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer device are also stored. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0142] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes, hard disks, etc.; and communication devices. The communication device can allow the computer device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 5 A computer device having various devices is shown, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0143] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the file monitoring method of the embodiment of the present disclosure are executed.

[0144] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0145] According to the computer-readable storage medium of the embodiment of the present disclosure, non-transitory computer-readable instructions are stored thereon. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the file monitoring method of each embodiment of the present disclosure are executed.

[0146] The above-mentioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or mobile hard disk), media with built-in rewritable non-volatile memory (e.g., memory card) and media with built-in ROM (e.g., ROM box).

[0147] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0148] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0149] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of the devices, apparatuses, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems may be connected, arranged, and configured in any manner. Words such as "include," "comprise," "have," and the like are open words, meaning "including but not limited to," and may be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and may be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and may be used interchangeably therewith.

[0150] Used interchangeably with.

[0151] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0152] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0153] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0154] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0155] The foregoing description has been presented for purposes of illustration and description.

[0156] The figures limit the embodiments of the present disclosure to the forms disclosed herein.While various example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions, and sub-combinations thereof.

Claims

1. A file monitoring method, characterized in that: include: Create an initial image of the specified folder; Obtaining folder information of the initial image; Determine whether the system is idle; If idle, create a temporary mirror of the specified folder; Obtaining folder information of the temporary image; Determine whether the folder information between the initial image and the temporary image is consistent; If they are inconsistent, obtaining the change information between the temporary image and the initial image; generating a monitoring report based on the change information; The temporary image is used as a new initial image.

2. The file monitoring method according to claim 1, characterized in that: The determining whether the system is idle includes: Get the current interval time; Collect the system's CPU usage and memory usage according to the current interval; Determine whether the CPU usage is less than a first preset threshold, and the memory usage is less than a second preset threshold; If so, the system is determined to be idle; If not, the system is determined to be busy.

3. The file monitoring method according to claim 2, characterized in that: The obtaining of the current interval time includes: Count the number of changes to the specified folder according to the preset sampling period; Based on the sampling period and the number of changes, construct a change distribution graph; Perform regularity analysis on the change distribution graph to obtain multiple phase cycles; Get the historical average number of changes in each phase cycle; Based on the historical average number of changes, the optimal interval time of each phase cycle is obtained; Determine the current phase period to which the current time belongs from the multiple phase periods; The optimal interval time of the current phase cycle is determined as the current interval time.

4. The file monitoring method according to claim 3, characterized in that: The calculation formula of the optimal interval time is: Where s is the sequence number of the phase cycle; T s is the optimal interval time of the sth periodic cycle; T idle is the optimal duration; C s is the historical average number of changes in the sth period; ∈ is a preset constant.

5. The file monitoring method according to claim 4, characterized in that: The calculation formula for the optimal duration is: Among them, T max is the preset maximum interval time; L cpu is the first preset threshold; L ram is the second preset threshold.

6. The file monitoring method according to claim 1, characterized in that: The folder information includes at least one of the total number of directory items, a directory structure path set, a directory structure name set, and a hash value set.

7. The file monitoring method according to claim 6, characterized in that: Obtain YY+242337P The change information between the temporary image and the initial image includes: Determine the change position between the temporary image and the initial image according to the hash value set and the directory structure path set of the initial image and the temporary image by a binary algorithm; The change information is extracted according to the change position through the KMP algorithm.

8. A computer device, characterized in that: The computer device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the file monitoring method described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the file monitoring method described in any one of claims 1-7.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images