Method, device and equipment for processing data in container and storage medium

Abstract

The embodiment of the invention discloses a data processing method and device in a container, equipment and a storage medium, and is suitable for a data processing scene of a target business deployed in the container, the method responds to a business execution request initiated by a service object of the target business, and a business process used for executing the target business is operated in a business container. In the running process of the business process, calling a detection process in the business container to monitor a file directory of the business container so as to obtain a code file of the business process when a crash file of the business process is detected under the file directory; the detection process is called to store the crash file and the code file to a storage space outside the service container, and vulnerability analysis on the target service is executed based on the crash file and the code file in the storage space, so that the stability of vulnerability detection on the target service deployed in a containerization manner can be improved; and vulnerabilities existing in the target business can be fully detected.

Description

Technical Field

[0001] The present application relates to the fields of container technology and computer technology, and in particular to a method, apparatus, device, and storage medium for processing data in a container. Background Art

[0002] Combining computer and container technologies enables containerized deployment of many businesses, allowing for flexible control of business processing capabilities and service scope. Currently, vulnerability detection for containerized businesses typically requires technicians to run the target business processes in the business container according to pre-set business logic and monitor the running of these processes.

[0003] However, pre-set business logic often fails to fully cover actual application scenarios. Furthermore, vulnerabilities in business logic can easily lead to business process crashes, which in turn can cause the business container to be automatically destroyed. This makes it difficult for current detection solutions to fully and reliably detect vulnerabilities in containerized businesses. Consequently, improving the stability of vulnerability detection for containerized businesses and fully detecting existing business defects and logic vulnerabilities has become a pressing technical challenge. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, device, and storage medium for processing data within a container, which can improve the stability of vulnerability detection for containerized deployed services and fully detect business defects and logical vulnerabilities in the services.

[0005] In one aspect, an embodiment of the present application provides a method for processing data in a container, comprising:

[0006] In response to a service execution request initiated by a service object of a target service, running a service process in a service container, wherein the service process is used to execute the target service, and a detection process is running in the service container;

[0007] During the operation of the business process, calling the detection process in the business container to monitor the file directory of the business container;

[0008] If a crash file of the business process is detected in the file directory, obtaining a code file of the business process, wherein the crash file is generated when the business process is interrupted;

[0009] The detection process is called to store the crash file and the code file in a storage space outside the business container, and the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0010] In another aspect, an embodiment of the present application provides a data processing device in a container, comprising:

[0011] a response unit, configured to respond to a service execution request initiated by a service object of a target service, and run a service process in a service container, wherein the service process is used to execute the target service, and a detection process is run in the service container;

[0012] a calling unit, configured to call the detection process in the business container to monitor the file directory of the business container during the operation of the business process;

[0013] an acquiring unit, configured to acquire a code file of the business process when a crash file of the business process is detected in the file directory, wherein the crash file is generated when the business process is interrupted;

[0014] The calling unit is further configured to call the detection process to store the crash file and the code file in a storage space outside the business container, and the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0015] In another aspect, an embodiment of the present application further provides a data processing device, comprising:

[0016] a processor adapted to execute one or more computer programs;

[0017] A storage medium storing one or more computer programs, wherein the one or more computer programs are suitable for being loaded by the processor and executing the in-container data processing method according to the first aspect.

[0018] On the other hand, an embodiment of the present application further provides a storage medium, which stores one or more computer programs, and the one or more computer programs are suitable for being loaded by a processor and executed by the container data processing method of the first aspect.

[0019] On the other hand, an embodiment of the present application further provides a program product, which includes a computer program, and the computer program is suitable for being loaded by a processor and executing the in-container data processing method as described in the first aspect.

[0020] In an embodiment of the present application, a business process and a detection process are included in the business container, and the detection process is used to transfer the code files and crash files of the business process stored in the business container to outside the business container when the business process crashes, so that when the business container is destroyed, the running process and running logic of the process crash can still be replayed, effectively reducing the impact of the life cycle of the business container on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process. In addition, the embodiment of the present application collects crash files in the process of responding to the business execution request of a specific service object, which can benefit from the diversity of business needs of different service objects, so that the business process responding to the business execution request of different service objects can be operated according to different running logics. In this case, applying the embodiment of the present application to multiple business containers of the target business can easily detect the execution process of different business execution logics, thereby collecting the process crash data generated under different running logics, thereby realizing comprehensive business vulnerability analysis and efficiently obtaining various business vulnerabilities existing in the target business. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0022] Figure 1 This is a schematic diagram of a vulnerability analysis system for in-container services provided by an embodiment of the present application;

[0023] Figure 2 This is a schematic diagram of a containerized deployment method for a target business provided in an embodiment of the present application;

[0024] Figure 3 This is a schematic flow chart of a method for processing data in a container provided by an embodiment of the present application;

[0025] Figure 4 This is a schematic flow chart of another method for processing data in a container provided by an embodiment of the present application;

[0026] Figure 5a is a schematic diagram of the logical structure of a data processing system provided in an embodiment of the present application;

[0027] Figure 5b This is a schematic diagram of a business vulnerability analysis process provided by an embodiment of the present application;

[0028] Figure 6 This is a schematic structural diagram of a data processing device in a container provided by an embodiment of the present application;

[0029] Figure 7 It is a structural diagram of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] It should be noted in advance that, in order to enable those skilled in the art to better understand the technical solutions proposed in the embodiments of the present application, the embodiments of the present application will be combined with one or more drawings to clearly and completely describe the implementation of the technical solutions proposed in the embodiments of the present application. In addition, the various drawings shown in the embodiments of the present application are only exemplary illustrations. For example, the execution order of the various steps in the drawings can be adaptively adjusted according to the actual application scenario. In addition, in the embodiments of the present application, the block diagrams, modules and units shown in the drawings are merely functional entities and do not necessarily correspond to physically independent entities, and each module or unit can be part of an overall module or unit that contains the function of the module or unit. In other words, the term "module" or "unit" mentioned in the embodiments of the present application refers to a computer program or a part of a computer program with a predetermined function, which can work together with other related parts to achieve a predetermined goal, and can also be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof, or implemented in different networks and / or processor devices and / or microcontroller devices. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units.

[0031] The embodiment of the present application specifically proposes a method for processing data within a container. The core principle of this method is to create a business process and a detection process within a business container in which a target business is deployed, and use the business process to respond to business execution requests initiated by a service object for the target business, and use the detection process to monitor the file directory of the business container. When a crash file of the business process is detected in the file directory, the crash file and the code file of the business process are stored in a storage space outside the business container, so that business vulnerabilities existing in the target business can be analyzed based on the crash file and code files stored in the storage space.

[0032] Among them, the crash file is usually generated when the process is interrupted, and mainly contains one or more process information when the process is interrupted (or crashed), such as interruption time, process ID, memory status, register status, etc. The code file mainly contains the program code used to create the business process, which is used to indicate the business execution logic corresponding to the business process. Exemplarily, the code file may include binary code obtained by compiling the program language code. In actual applications, based on the collected code files and crash files, the running process of the business process that crashed this time can be reviewed, so as to locate and analyze the cause of the crash. Since the process crash is usually caused by loopholes or defects in the business logic, the loopholes in the target business can be determined by locating and analyzing the cause of the crash, thereby realizing the business vulnerability analysis of the target business.

[0033] In the above principle, by creating a business container that includes a business process and a detection process, when a business process in the business container crashes, the detection process can transfer the code file of the business process and the crash file generated in the business container to outside the business container, so that the crash file and the code file can be retained when the business container is destroyed. After the business container is destroyed, the corresponding process operation process and operation logic can still be reviewed, reducing or even eliminating the impact of the business container's life cycle on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process.

[0034] Furthermore, by using a detection process to collect crash files during the business process's response to a service object's business execution request, the business process's operational logic during the detection process is closely aligned with the service object's actual business needs. Consequently, the business vulnerabilities analyzed based on the collected crash files can largely reflect business pain points and thus possess high reference value. In other words, employing the above principle allows for the precise identification of business vulnerabilities with high reference value. Optimizing the target business based on these vulnerabilities can rapidly improve the user experience and increase user stickiness for the target business, thereby achieving efficient optimization of the target business. Furthermore, in real life, the business requirements indicated by different service objects in their business execution requests often differ, resulting in a rich variety of operational logic for business processes responding to different service objects' business execution requests. In this case, business vulnerability analysis based on the crash files collected by the detection process within each business container can fully identify the actual business vulnerabilities of the target business.

[0035] In summary, it can be seen that the adoption of the method principles proposed above in the embodiment of the present application can, on the one hand, reduce or even eliminate the impact of the life cycle of the business container on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process; on the other hand, it can also provide process crash data collected under a variety of business needs, so that the business vulnerability analysis stage can fully detect the various business vulnerabilities that actually exist in the target business based on the collected process crash data, which is conducive to achieving efficient optimization of the target business.

[0036] In one implementation, a data processing device can be used to implement the principles of the above-described method and execute the in-container data processing method proposed based on the principles of the above-described method. The data processing device can include one or both of a terminal device and a server, and the number of each device can be one or more. It is worth mentioning that when the data processing device is a composite device consisting of a terminal device and a server, the division of labor of each device in the corresponding method can be set according to the performance of the device, and this is not limited here.

[0037] Specifically, terminal devices may include, but are not limited to, smartphones, tablet computers, laptop computers, desktop computers, in-vehicle terminals, wearable smart terminals (such as smart watches and smart bracelets), etc. Servers may include, but are not limited to, independent physical servers, server clusters or distributed systems consisting of multiple physical servers, and one or more cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0038] In another implementation, the above principle or the method for processing data in a container based on the above principle can also be applied to Figure 1 The vulnerability analysis system for container services shown in the figure is implemented collaboratively by the various modules included in the system. Figure 1 The lines with double-headed arrows in the figure are used to indicate that there is a communication connection between the corresponding two modules, but do not limit the direction and connection method of the communication connection. Figure 1 The direction of the communication connection between each module can be a unidirectional connection or a bidirectional connection, and the communication connection method can include a wired connection or a wireless connection (such as WiFi connection, Bluetooth connection, near-field communication connection, infrared connection, etc.), as well as an indirect connection or a direct connection. The specific method can be determined according to the system deployment requirements and is not limited here.

[0039] like Figure 1As shown, the modules included in the system provided in the embodiment of the present application can be specifically a first client marked by 10, a service cluster marked by 11, and a second client marked by 12, and there is a communication connection between the service cluster and the first client and the second client respectively. Among them, the service cluster includes N (N is a positive integer) service nodes, each service node is used to containerize and deploy the target business, or in other words, each service node can at least deploy a business container for implementing the target business.

[0040] As an example, the target business can be as follows Figure 2 The method shown is deployed on a service node. That is, each service node can run one or more container groups (i.e., pods), and each container group must contain at least one business container that contains both the business process and the detection process. Generally, a pod consists of one or more business containers, each of which independently executes its target business.

[0041] In addition, in actual applications, a service node can be a server, and each service node can contain one or more service modules to collaboratively implement containerized processing of the target business. Figure 1 Taking service node N in Figure 1 as an example, service node N may contain a business container marked by 111, a storage module marked by 112, and an analysis module marked by 113. The business container may specifically include a business process and a detection process, and the business and detection processes share container space. Specifically, the business process is used to respond to business execution requests from business objects, and the detection process is used to monitor the file directory of the business container during the operation of the business process.

[0042] In addition, the detection process is in communication with the storage module, and the storage module is used to provide the detection process with storage resources (or storage space) outside the business container, so that the detection process can store the acquired crash files and code files in the storage space outside the business container. The detection process is also in communication with the analysis module, so that after the storage module successfully stores the relevant files, it sends a vulnerability analysis instruction to the analysis module, instructing the analysis module to perform the corresponding business vulnerability analysis in response to the instruction. In other words, the analysis module can be used to obtain crash files and code files from the storage space for business vulnerability analysis. In addition, the analysis module can be in communication with the storage module to implement business vulnerability analysis of the target business based on the crash files and code files stored in the storage module.

[0043] exist Figure 1In the system shown, the target business is mainly provided by the first client to the business object (i.e., the service object). Specifically, the first client is mainly used to provide the service entry of the target business to the service object, so that the service object can initiate a business execution request for the target business to the service node through the first client, thereby receiving the relevant business services of the target business. As an example, the first client can run in the terminal device held by the business object. The second client is mainly used to provide the technical staff with the optimization entry of the target business, so that the technical staff can determine the business loopholes of the target business through the second client, and thus optimize the business based on the business loopholes. As an example, the second client can run in the terminal device held by the technical staff.

[0044] It should be noted that in Figure 1 The terminal devices mentioned in the relevant descriptions can still include but are not limited to smart phones, tablets, laptops, desktop computers, vehicle-mounted terminals, wearable smart terminals (such as smart watches, smart bracelets), etc., and the servers mentioned can still include but are not limited to independent physical servers, server clusters or distributed systems composed of multiple physical servers, and cloud servers that provide one or more cloud services, etc., and there is no restriction here.

[0045] See Figure 3 , Figure 3 This is a method for processing data in a container specifically proposed based on the principle of the above method, so this method can still be used by the above data processing equipment or Figure 1 However, for the sake of convenience, the following description will be made by taking the method being independently executed by a data processing device as an example. Figure 3 As shown, the method may include steps S301-S304:

[0046] S301 : In response to a service execution request initiated by a service object of a target service, a service process is run in a service container. The service process is used to execute the target service. A detection process is run in the service container.

[0047] In a specific embodiment, the target business refers to a data processing business that is deployed based on container technology in the computer field. Such a business can be called a containerized business. The target business is containerized so that the concurrency of the target business can be flexibly controlled by starting (or creating) or stopping (or deleting) one or more business containers, thereby improving the operation and maintenance efficiency of the target business to a certain extent. In addition, the business container can be deployed in a cloud environment in combination with cloud technology, and then with the help of the characteristics of cloud services, the service scope of the target business can be expanded. The embodiment of the present application does not limit the specific method of containerized deployment of the target business.

[0048] Among them, the essence of a container is a process running in a logical space isolated from the operating system. In an embodiment of the present application, the business container mainly includes a business process and a detection process. Specifically, the business process is created based on the program code corresponding to the target business, and is mainly used to execute relevant business processing of the target business in the process of responding to the business execution request. The detection process is created based on the program code containing the process detection function, and is mainly used to implement relevant detection of the business process (such as memory leak detection, crash detection, risk detection, etc.).

[0049] For example, a data processing device can create a business process and a detection process when creating a business container. The business process within the business container can be started when needed to respond to a business execution request, while the detection process can continue to run after the business container is created, ensuring that detection can be performed at all stages of the business process. Alternatively, the detection process can be started after detecting that a business process is running, minimizing the computing resources of the data processing device.

[0050] Furthermore, it is understood that, in actual applications, a business process can create one or more business sub-processes in response to a business execution request, based on the execution requirements of the target business, and a detection process can also create one or more detection sub-processes in accordance with the process detection requirements during the operation of the business process. Therefore, the embodiments of this application do not limit the number of business processes and detection processes mentioned herein.

[0051] S302: During the operation of the business process, call the detection process in the business container to monitor the file directory of the business container.

[0052] In a specific embodiment, when a business process runs, it generates a series of process operation data within the business container. This process operation data can be used to restore the process operation process. Therefore, the process operation data generated during the business process's operation can be effectively utilized for business vulnerability analysis. Furthermore, since process operation data is typically stored in a file directory within the business container, the data processing device can invoke a detection process to monitor the file directory within the business container to obtain relevant process operation data in a timely manner.

[0053] For example, the detection process can monitor the file directory of a business container permanently or temporarily. That is, the detection process can monitor the file directory continuously after the business container is created, or it can be triggered by detecting relevant detection instructions. This is not limited here.

[0054] S303: If a crash file of the business process is detected in the file directory, the code file of the business process is obtained. The crash file is generated when the business process is interrupted.

[0055] In a specific embodiment, a crash file is generated by the operating system of a data processing device when a business process is abnormally interrupted. An abnormal interruption refers to an operational interruption that occurs outside the expected business execution logic. In this embodiment, an interruption of a business process caused by intervention by a detection process can also be considered an abnormal interruption.

[0056] Among them, the crash file generated corresponding to the abnormal interruption can specifically include a core dump file (i.e., a CoreDump file). A core dump file is a file obtained by packaging and storing the current memory status of a process by the operating system of a data processing device when an abnormality occurs during the operation of a business process, causing the process to exit abnormally (or be interrupted). It is mainly used to record process information such as the stack pointer, memory status, and register status when the process crashes. Therefore, based on the crash file, the crash process of the business process can be traced back to locate the cause of the crash of the business process, and further analysis can be performed to obtain the business defects or logical loopholes in the target business.

[0057] Additionally, the code file for a business process may include code for creating the business process. This code may be specifically programming language code used to write the business program, or binary code compiled from the programming language code, without limitation. The business program is used to implement the target business, and running the business program generates the business process. Programming language code refers to code written in a programming language, such as C++ or Java.

[0058] S304: Call the detection process to store the crash file and the code file in a storage space outside the business container. The crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0059] In a specific embodiment, when a detection process detects a business process crash, the data processing device can promptly store the relevant crash files and code files outside the business container. In this case, vulnerability analysis of the target business can be performed outside the business container, preventing the impact of the business container's lifecycle on the vulnerability analysis process and effectively ensuring the stability of the vulnerability analysis process. Furthermore, by promptly saving the crash files and code files outside the container when a business process crash is detected, the cause of each crash can be analyzed to the greatest extent possible, thereby fully detecting business vulnerabilities in the target business.

[0060] The storage space outside the business container can be provided by a storage module within the data processing device or by a device other than the data processing device, without limitation. Furthermore, vulnerability analysis of the target business can be performed by the data processing device or by another computer device with access rights to the aforementioned storage space, also without limitation.

[0061] In an embodiment of the present application, a business process and a detection process are included in the business container, and the detection process is used to transfer the code files and crash files of the business process stored in the business container to outside the business container when the business process crashes, so that when the business container is destroyed, the running process and running logic of the process crash can still be replayed, effectively reducing the impact of the life cycle of the business container on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process. In addition, the embodiment of the present application collects crash files in the process of responding to the business execution request of a specific service object, which can benefit from the diversity of business needs of different service objects, so that the business process responding to the business execution request of different service objects can be operated according to different running logics. In this case, applying the embodiment of the present application to multiple business containers of the target business can easily detect the execution process of different business execution logics, thereby collecting the process crash data generated under different running logics, thereby realizing comprehensive business vulnerability analysis and efficiently obtaining various business vulnerabilities existing in the target business.

[0062] See Figure 4 , Figure 4 is based on Figure 3 The method shown is a schematic flow chart of a method for processing data in a container, so that the method can continue to be performed by the aforementioned data processing device or Figure 1 Similarly, for the sake of convenience, the following description will still be based on the example of the method being independently executed by a data processing device. Figure 4 As shown, the method may include steps S401-S406:

[0063] S401 : In response to a service execution request initiated by a service object of a target service, a service process is run in a service container. The service process is used to execute the target service. A detection process is run in the service container.

[0064] In a specific embodiment, the relevant implementation principles of step S401 can be found in the various implementations of the above-mentioned step S301, and will not be repeated here.

[0065] S402: During the operation of the business process, call the detection process in the business container to monitor the file directory of the business container.

[0066] In a specific embodiment, based on the relevant embodiments of the aforementioned step S302, it can be seen that the detection process can be used to detect crash files of the business process from the file directory to detect abnormal interruptions of the business process. It should be noted that in the actual application of this application, the detection process can also be used to perform memory detection, risk detection (or risk assessment), etc. on the business process within the business container, and can further intervene in the operation of the business process based on the detection results, thereby preventing the operation of the business process from causing security risks to the target business or data processing equipment.

[0067] Since both memory detection and risk detection of business processes generally require the use of the business process's process information, this application stipulates that the detection process and the business process share the process space within the business container to facilitate the detection process's acquisition of the business process's process information. The process space may include, but is not limited to, namespace, storage space, and process address space. In this case, the data processing device may call the detection process to perform risk prediction on the business process as follows:

[0068] During the operation of a business process, a detection process is called to perform a risk assessment on the business process to determine its current risk level. If the risk level is greater than or equal to a preset level, the process ID of the business process is obtained from the process space of the business container. Based on the obtained process ID, a process interrupt instruction for the business process is generated in the operating system, allowing the operating system to interrupt the operation of the business process and trigger the generation of a crash file for the business process. In this case, the risk factor of the business process can be analyzed based on the crash file. By eliminating this risk factor in the target business, the security of the target business can be effectively improved.

[0069] That is to say, the embodiment of the present application can provide data reference for the safe operation and maintenance of the target business by calling the detection process to perform risk assessment on the business process, thereby facilitating the security maintenance and improvement of the target business.

[0070] In actual application scenarios, this risk detection method can also be used to detect risks in business sub-processes created by a business process. For ease of understanding, it can be assumed that the above risk detection method applies to multiple business processes, but each business process belongs to the same process tree, and therefore each business process has a corresponding parent process or child process identity.

[0071] In this case, if the business process with a risk level greater than or equal to the preset level corresponds to a child process in the process tree, the detection process can further obtain the process running data corresponding to the associated processes of the business process in the process tree and store the process running data corresponding to the associated processes in a storage space outside the business container. This allows vulnerability analysis or risk analysis of the business process to comprehensively refer to the process running data of the associated processes, the crash files, and the code files of the business processes, enriching the reference data during analysis and thus improving the accuracy of the analysis results. The associated processes may include but are not limited to the parent process and / or one or more sibling processes.

[0072] Furthermore, in one feasible implementation, when the risk level of a business process assessed is lower than a preset level, but the risk level indicates that the business process is risky, the data processing device can add a risk tag to the business process to facilitate subsequent focus on the business process and timely identification of related risks. In actual applications, sub-processes generated by a process with potential risks may also have significant risks, and therefore, these sub-processes also need to be monitored during business execution.

[0073] In order to prevent the child process from tampering with the process inheritance relationship, which makes it difficult for the data processing device to accurately monitor the risky child process, the embodiment of the present application proposes to add a risk label in the inheritance field of the process descriptor of the business process, and the inheritance field refers to the description field that the child process must inherit from the business process when the business process creates the child process. Through the field inheritance method, it is difficult for the child process to confuse its parent process by tampering with the field used to describe the process inheritance relationship, ensuring that the data processing device can accurately determine the child process generated by the business process with the risk label. Among them, the process descriptor of the business process refers to a structure that encapsulates one or more description fields of the business process, and each description field is used to indicate a descriptive information of the business process, such as the process ID, the process creation time, the process inheritance relationship (such as the parent process ID), etc.

[0074] In general, the data processing device can add a risk tag to the inheritance field contained in the process description information of the business process, and when it is detected that the business process creates a child process, it generates process description information containing the inheritance field for the child process, so that the child process carries the risk tag of the business process. When the data processing device performs a risk assessment on any process with the risk tag in the process description information and the risk level obtained is greater than or equal to the preset level, the risk control strategy associated with the preset level can be used to perform risk control processing on each process with the risk tag in the process description information, thereby improving the overall efficiency of risk control.

[0075] S403: If a crash file of the business process is detected in the file directory, the code file of the business process is obtained. The crash file is generated when the business process is interrupted.

[0076] In a specific embodiment, the relevant implementation principle of step S403 can be found in the various implementations of the above step S303, and will not be repeated here.

[0077] S404: Call the detection process to store the crash file and the code file in a storage space outside the business container. The crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0078] In a specific embodiment, the relevant implementation principle of step S404 can be found in the various implementations of the above-mentioned step S304, and will not be repeated here.

[0079] S405: Analyze the stack call relationship of the business process when it is interrupted based on the crash file and the code file in the storage space.

[0080] In a specific embodiment, the stack call relationship can be used to indicate information such as the data processing sequence, data flow, and function call sequence within a business process. For example, a data processing device can initiate an analysis request to an analysis device, instructing the analysis device to perform stack call relationship analysis. Since crash files and code files can be analyzed to identify business vulnerabilities of the target business, the data processing device can store the crash files and code files in a hidden manner to minimize malicious exploitation of these vulnerabilities and thereby enhance the security of the target business during the business vulnerability analysis process.

[0081] The so-called hidden storage can be understood as: first storing the crash file and code file in a storage space, and then storing the storage address of the crash file and code file in the storage space in another storage space. Among them, the other storage space needs to provide data access rights to the outside in a targeted manner. Based on this, the analysis device can be required to undergo multiple identity verifications before reading the crash file and code file, thereby fully ensuring the legitimacy of the analysis device. In addition, by increasing the number of nodes in the data reading route, more complex verification algorithms can be applied in the identity verification process, thereby ensuring sufficient data security.

[0082] In conjunction with the present application, after storing the crash file and the code file, the data processing device can obtain the storage address of each file in the storage space, and store the storage address in other storage spaces outside the storage space, wherein the other storage spaces are still located outside the business container. Furthermore, when the storage address is successfully stored, the data processing device can generate task instruction information to prompt the crash file and the code file to be obtained from the storage space based on the storage address in the other storage space, and perform vulnerability analysis based on the obtained files. Optionally, the data processing device can send the generated task instruction information to the aforementioned analysis device to enable the analysis device to perform vulnerability analysis.

[0083] S406 : When the stack call relationship is different from the stack call relationships corresponding to the historical crash files of the business process, predict a business vulnerability existing in the target business based on the stack call relationship.

[0084] In a specific embodiment, when a target business is applied in multiple business containers, a logical defect in the target business may cause the business processes in multiple business containers to crash, so that the data processing device may obtain multiple crash files indicating the same logical defect of the target business. Since the stack call relationship corresponding to the same logical defect is usually the same, in order to avoid repeated analysis and storage of crash files indicating the same logical defect, the embodiment of the present application will deduplicate the crash files based on the stack call relationship of each crash file before formally performing business vulnerability analysis on the target business, so that each crash file that ultimately needs to undergo business vulnerability analysis indicates a different logical defect, thereby eliminating data redundancy as much as possible and improving the effectiveness of business vulnerability analysis.

[0085] In a further embodiment, after analyzing the business vulnerabilities, the data processing device can also combine artificial intelligence technology and big data technology to formulate an optimization strategy for the target business based on the business vulnerabilities, so that technical personnel can refer to the optimization strategy to optimize the target business process.

[0086] Specifically, after analyzing and identifying a business vulnerability, the data processing device can obtain the business tag of the target business and the stack description information of each stack associated with the stack call relationship. The data processing device can then use the stack analysis model to predict an optimization strategy for the target business based on the business tag, business vulnerability, and stack description information. Stacks are primarily used to store data, and the stacks associated with a stack call relationship specifically refer to the stacks used to construct the stack call relationship. The stack description information can be used to describe the source and data type of data in the stack.

[0087] Furthermore, the stack analysis model is built using artificial intelligence technology, and the training data used for model optimization is collected using big data technology. By leveraging the large amount of training data collected using big data technology to optimize the stack analysis model, the stack analysis model can be used to predict business optimization strategies for a wide range of business scenarios. This overcomes the knowledge limitations of technicians when manually formulating optimization strategies, effectively improving the quality of optimization strategies used for target businesses.

[0088] In an embodiment of the present application, when a business process in a business container crashes, the detection process in the business container is used to transfer the code file and crash file of the business process to outside the business container, so that the business vulnerability analysis of the target business can be performed outside the container, thereby reducing the impact of the life cycle of the business container on the business vulnerability analysis process, and thus improving the stability of the business vulnerability analysis process to a certain extent. In addition, the embodiment of the present application also uses the detection process to perform risk detection on the business process in the business container, and further intervenes in the operation process of the business process based on the detection results, which can reduce the security risks caused by the operation of the business process to the target business or data processing equipment. At the same time, in the business container, allowing the detection process to share the container space with the business process can enable the detection process to more conveniently obtain the process information of the business process, thereby improving the detection efficiency of related detections.

[0089] It is important to note that in the above Figure 3 and Figure 4 In the method shown, the processes used by the data processing device when executing each step are all illustrative. Specifically, in actual application, in addition to the need to call a business process to respond to the business execution request of the target business, other data processing unrelated to the implementation of the target business (such as various process detection processes) can be implemented by the data processing device with the help of the detection process. Among them, "implemented with the help of the detection process" can specifically be directly calling the detection process for execution, or calling the detection process to execute in collaboration with one or more other processes, which is not limited here.

[0090] In order to facilitate the rapid application of the embodiment of the present application, the following will be combined with a specific data processing system and examples to explain in detail an application method of the embodiment of the present application. Figure 5a and Figure 5b .

[0091] Figure 5a The figure shows the logical structure of a data processing system, in which the method for processing data in a container proposed in the embodiment of the present application can be applied. Figure 5aAs shown, the data processing system can illustratively include an interaction layer, a service layer, a container layer, and a storage layer. The interaction layer primarily consists of a database, a service end, and a detection control end. The database stores event information reported by the service layer, allowing technical personnel to analyze specific program events. The service end provides human-computer interaction, triggering the generation of service execution requests when detecting relevant operations on service objects. The detection control end generates process detection instructions for the detection process, controlling the detection process to execute relevant process detection on the business process in response to these instructions.

[0092] The service layer primarily consists of an event reporting interface, a container management module, and a task dispatching module. The event reporting interface is primarily used to report abnormal events detected by the container layer to the interaction layer. The container management module is primarily used to implement container orchestration and task management. Container orchestration can include the creation, startup, termination, and destruction of business containers. Task management can include determining the business container that responds to a business execution request upon receipt. The task dispatching module is primarily used to forward process detection instructions generated by the detection control end so that the detection process can receive the process detection instructions.

[0093] The container layer is mainly composed of one or more detection modules (such as long-term detection modules, temporary detection modules) and request response modules. Among them, the long-term detection module can be used to run the detection process for long-term detection of the business process to perform continuous detection tasks on the business process, such as: the task of CoreDump scanning the file directory of the business container. The temporary detection module can be used to create and run the detection process that responds to the detection instruction when receiving the detection instruction, so as to perform the task of temporary detection of the business process, such as the detection task of memory detection of the business process. The request response module is mainly used to run the business process to respond to the business execution request to perform the corresponding business processing.

[0094] The storage layer is primarily composed of one or more storage modules, each of which is used to store data transmitted from the container layer. For example, it is used to store crash files and code files transmitted by the detection process in the container layer.

[0095] Figure 5b The figure shows a business vulnerability analysis process based on a logical structure, which is mainly used to indicate the way to analyze the CoreDump file. Figure 5b It is not difficult to see that in actual application, the analysis of CoreDump files can include the following steps 1-13:

[0096] Step 1. Start CoreDump file detection at the interaction layer.

[0097] Specifically, when the interaction layer detects that the business container is successfully created, it can start the CoreDump file detection by running a detection process for detecting the Coredump file (ie, the aforementioned crash file) in the business container.

[0098] Step 2: Check the file directory of the process monitoring service container.

[0099] Specifically, the detection process may determine whether a CoreDump file of the service process exists in the service container by continuously detecting the file directory of the service container.

[0100] Step 3. The detection process collects core files and related information and performs core file deduplication.

[0101] Specifically, a core file is short for a CoreDump file. The relevant information of the core file may include a code file (or process file) of a business process and a process log corresponding to the business process when the core file is generated.

[0102] Step 4. The detection process stores core files, process files, and process logs in the COS module.

[0103] Specifically, the COS module is located in the storage layer and is mainly used to provide storage space outside the business container mentioned in the above step S304 or step S404 to store core files, process files and process logs.

[0104] Step 5. The COS module feeds back the storage result.

[0105] Specifically, the storage result may include whether the storage is successful, and the corresponding storage address when the storage is successful.

[0106] Step 6. The detection process records the task information of the analysis task through the DAO module.

[0107] Specifically, the DAO module is located in the storage layer and is mainly used to provide an access interface to other storage spaces outside the business container mentioned in the aforementioned step S405, so that the other storage spaces can be accessed through the DAO module (such as data storage, data reading, etc.). Other storage spaces are mainly used to store task information of analysis tasks. Analysis tasks refer to tasks that perform business vulnerability analysis on target businesses based on relevant files in the storage space. Task information can specifically include task content and the storage address of each file in the storage space.

[0108] Step 7. The DAO module feeds back the recording results.

[0109] Specifically, the recording result is used to indicate whether the task information of the analysis task is successfully recorded.

[0110] Step 8. The detection process generates a task notification and sends it to the Kafka module.

[0111] Specifically, task notifications are used to prompt the vulnerability analysis module to perform business vulnerability analysis, and the Kafka module is used to implement message push. In this case, the detection process can be understood as a message producer, and the vulnerability analysis module can be understood as a message consumer.

[0112] Step 9. The Kafka module pushes notifications to the vulnerability analysis module.

[0113] Specifically, the Kafka module can push the task notification generated by the detection process to the vulnerability analysis module to trigger the vulnerability analysis module to perform business vulnerability analysis.

[0114] Step 10. The Kafka module feeds back the push results.

[0115] Specifically, the push result is used to indicate whether the task notification is successfully sent to the vulnerability analysis module. If the sending fails, a corresponding alarm message can be generated and sent to the operation and maintenance client so that the operation and maintenance client can respond.

[0116] Step 11. The vulnerability analysis module obtains the task information of the analysis task through the DAO module.

[0117] Specifically, the vulnerability analysis module can obtain the storage address of the core file, process file and process log through the DAO module, and then obtain the core file, process file and process log from the storage space based on the storage address.

[0118] Step 12. The vulnerability analysis module performs stack analysis.

[0119] Specifically, the vulnerability analysis module will perform stack analysis after obtaining the core file, process file and process log to obtain the stack call relationship corresponding to the process crash, and can further determine the business vulnerabilities or logical defects currently existing in the target business based on the stack call relationship.

[0120] Step 13. The vulnerability analysis module stores the analysis results through the DAO module.

[0121] Specifically, the analysis results can be used to indicate the stack call relationship obtained in step 12. Furthermore, in actual applications, the vulnerability analysis module can trigger the storage of the analyzed stack call relationship when it differs from the stack call relationships analyzed within a historical time period, thereby minimizing the repeated reporting of the same business vulnerability. For example, the vulnerability analysis module can store the analysis results in the aforementioned other storage space via the DAO module.

[0122] By adopting the analysis process provided in the embodiment of the present application, the code files and crash files of the business process can be transferred outside the business container, so that the business vulnerability analysis of the target business can be performed outside the container, thereby reducing the impact of the life cycle of the business container on the business vulnerability analysis process, and can also improve the stability of the business vulnerability analysis process to a certain extent.

[0123] Based on the above Figure 3 and Figure 4 The present application also discloses a data processing device in a container, which is used to perform the following steps: Figure 3 as well as Figure 4 The data processing device in the container can be a computer program (including program code) running on the server. Figure 6 , the data processing in the container may at least include Figure 6 The response unit 601, the calling unit 602, the obtaining unit 603 and the analyzing unit 604 in FIG.

[0124] A response unit 601 is configured to respond to a service execution request initiated by a service object of a target service and run a service process in a service container, wherein the service process is used to execute the target service and a detection process is run in the service container;

[0125] The calling unit 602 is configured to call the detection process in the business container to monitor the file directory of the business container during the operation of the business process;

[0126] An acquiring unit 603 is configured to acquire a code file of the business process when a crash file of the business process is detected in the file directory, where the crash file is generated when the business process is interrupted.

[0127] The calling unit 602 is further configured to call the detection process to store the crash file and the code file in a storage space outside the business container, where the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0128] In one embodiment, the data processing device in the container may further include an analysis unit 604, which is mainly used to perform:

[0129] Analyzing the stack call relationship of the business process when it is interrupted based on the crash file and the code file in the storage space;

[0130] When the stack call relationship is different from stack call relationships corresponding to each historical crash file of the business process, a business vulnerability existing in the target business is predicted based on the stack call relationship.

[0131] In yet another embodiment, the analysis unit 604 may be further configured to perform:

[0132] Obtaining a service tag of the target service, and obtaining stack description information of each stack associated with the stack call relationship;

[0133] The call stack analysis model predicts an optimization strategy for the target business based on the business tag, the business vulnerability, and the stack description information of each stack. The optimization strategy is used to optimize the target business.

[0134] In yet another embodiment, the calling unit 602 may also be configured to execute:

[0135] Calling the detection process to obtain storage addresses of the crash file and the code file in the storage space;

[0136] Storing the storage address in another storage space other than the storage space, where the other storage space is outside the business container;

[0137] If the storage is successful, task instruction information is generated, and the task instruction information is used to prompt a vulnerability analysis based on the crash file and the code file in the storage space, and the crash file in the storage space is obtained based on the storage address in the other storage space.

[0138] In another embodiment, the business process and the detection process share the process space in the business container; the calling unit 602 may also be configured to execute:

[0139] During the operation of the business process, calling the detection process to perform risk assessment on the business process to obtain the risk level of the business process;

[0140] When the risk level is greater than or equal to a preset level, calling the detection process to obtain the process identifier of the business process from the process space;

[0141] A process interruption instruction is generated based on the acquired process identifier, and the operation of the business process is interrupted by using the process interruption instruction to trigger generation of a crash file of the business process in the file directory.

[0142] In another embodiment, there are multiple business processes, and each business process belongs to the same process tree. The calling unit 602 may further execute:

[0143] When the risk level of any business process is greater than or equal to the preset level, and the business process is a child process in the process tree, the detection process obtains process running data of an associated process of the business process, where the associated process refers to a business process in the process tree that interacts with the business process;

[0144] The acquired process running data is stored in the storage space, and the business vulnerability analysis is performed based on the process running data, crash files and code files in the storage space to obtain the business vulnerabilities existing in the target business.

[0145] In yet another embodiment, the calling unit 602 may further execute:

[0146] When the risk level is lower than the preset level and the risk level indicates that the business process is risky, adding a risk tag to an inheritance field included in the process description information of the business process;

[0147] If it is detected that the business process creates a child process, generating process description information including the inheritance field for the child process, so that the risk label exists in the process description information of the child process;

[0148] When the risk level obtained by risk assessment of any process with the risk label in the process description information is greater than or equal to the preset level, the risk control strategy associated with the preset level is adopted to perform risk control processing on each process with the risk label in the process description information.

[0149] It should be noted that Figure 6 The various units in the illustrated in-container data processing device are divided based on logical functions. Each of the above units can be individually or collectively combined into one or more other units to form a structure, or one or more of the units can be further divided into multiple functionally smaller units to form a structure, which can achieve the same operation without affecting the technical effects of the embodiments of the present application. In other embodiments of the present application, the in-container data processing device can also include other units. In actual applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units.

[0150] In an embodiment of the present application, a business process and a detection process are included in the business container, and the detection process is used to transfer the code files and crash files of the business process stored in the business container to outside the business container when the business process crashes, so that when the business container is destroyed, the running process and running logic of the process crash can still be replayed, effectively reducing the impact of the life cycle of the business container on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process. In addition, the embodiment of the present application collects crash files in the process of responding to the business execution request of a specific service object, which can benefit from the diversity of business needs of different service objects, so that the business process responding to the business execution request of different service objects can be operated according to different running logics. In this case, applying the embodiment of the present application to multiple business containers of the target business can easily detect the execution process of different business execution logics, thereby collecting the process crash data generated under different running logics, thereby realizing comprehensive business vulnerability analysis and efficiently obtaining various business vulnerabilities existing in the target business.

[0151] Based on the above description of the data processing method and device in the container, the embodiment of the present application also provides a data processing device, which can be used to perform Figure 3 and Figure 4 Specifically, see Figure 7 The data processing device includes at least a processor 701 and a storage medium 702, and the processor 701 and the storage medium 702 can be connected via a bus or other means.

[0152] Storage medium 702 is a memory device within a data processing device, used to store programs and data. It is understood that storage medium 702 herein may include both built-in storage media within the data processing device and, of course, extended storage media supported by the data processing device. Storage medium 702 provides storage space, which stores the operating system of the data processing device. Furthermore, this storage space also stores one or more computer programs suitable for loading and execution by processor 701. These computer programs may be one or more program codes.

[0153] Specifically, the storage medium may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage; optionally, it may be at least one storage medium located remote from the aforementioned processor. The processor (or CPU (Central Processing Unit)) corresponds to the computing core and control core of the data processing device, which is suitable for implementing one or more computer programs, and is specifically suitable for loading and executing one or more computer programs to implement the corresponding method flow or corresponding function.

[0154] In one embodiment, the processor 701 may load and execute one or more computer programs stored in the storage medium 702 to implement the above-mentioned Figure 3 and Figure 4 The corresponding method steps in the method embodiment shown. In a specific implementation, one or more computer programs in the storage medium 702 are loaded by the processor 701 and execute the following steps:

[0155] In response to a service execution request initiated by a service object of a target service, running a service process in a service container, wherein the service process is used to execute the target service, and a detection process is running in the service container;

[0156] During the operation of the business process, calling the detection process in the business container to monitor the file directory of the business container;

[0157] If a crash file of the business process is detected in the file directory, obtaining a code file of the business process, wherein the crash file is generated when the business process is interrupted;

[0158] The detection process is called to store the crash file and the code file in a storage space outside the business container, and the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

[0159] In one embodiment, the processor 701 may also be configured to load and execute:

[0160] Analyzing the stack call relationship of the business process when it is interrupted based on the crash file and the code file in the storage space;

[0161] When the stack call relationship is different from stack call relationships corresponding to each historical crash file of the business process, a business vulnerability existing in the target business is predicted based on the stack call relationship.

[0162] In yet another embodiment, the processor 701 may also be configured to load and execute:

[0163] Obtaining a service tag of the target service, and obtaining stack description information of each stack associated with the stack call relationship;

[0164] The call stack analysis model predicts an optimization strategy for the target business based on the business tag, the business vulnerability, and the stack description information of each stack. The optimization strategy is used to optimize the target business.

[0165] In yet another embodiment, the processor 701 may also be configured to load and execute:

[0166] Calling the detection process to obtain storage addresses of the crash file and the code file in the storage space;

[0167] Storing the storage address in another storage space other than the storage space, where the other storage space is outside the business container;

[0168] If the storage is successful, task instruction information is generated, and the task instruction information is used to prompt a vulnerability analysis based on the crash file and the code file in the storage space, and the crash file in the storage space is obtained based on the storage address in the other storage space.

[0169] In another embodiment, the business process and the detection process share the process space in the business container; the processor 701 may also be configured to load and execute:

[0170] During the operation of the business process, calling the detection process to perform risk assessment on the business process to obtain the risk level of the business process;

[0171] When the risk level is greater than or equal to a preset level, calling the detection process to obtain the process identifier of the business process from the process space;

[0172] A process interruption instruction is generated based on the acquired process identifier, and the operation of the business process is interrupted by using the process interruption instruction to trigger generation of a crash file of the business process in the file directory.

[0173] In another embodiment, there are multiple business processes, and each business process belongs to the same process tree. The processor 701 can also be used to load and execute:

[0174] When the risk level of any business process is greater than or equal to the preset level, and the business process is a child process in the process tree, the detection process obtains process running data of an associated process of the business process, where the associated process refers to a business process in the process tree that interacts with the business process;

[0175] The acquired process running data is stored in the storage space, and the business vulnerability analysis is performed based on the process running data, crash files and code files in the storage space to obtain the business vulnerabilities existing in the target business.

[0176] In yet another embodiment, the processor 701 may also be configured to load and execute:

[0177] When the risk level is lower than the preset level and the risk level indicates that the business process is risky, adding a risk tag to an inheritance field included in the process description information of the business process;

[0178] If it is detected that the business process creates a child process, generating process description information including the inheritance field for the child process, so that the risk label exists in the process description information of the child process;

[0179] When the risk level obtained by risk assessment of any process with the risk label in the process description information is greater than or equal to the preset level, the risk control strategy associated with the preset level is adopted to perform risk control processing on each process with the risk label in the process description information.

[0180] In an embodiment of the present application, a business process and a detection process are included in the business container, and the detection process is used to transfer the code files and crash files of the business process stored in the business container to outside the business container when the business process crashes, so that when the business container is destroyed, the running process and running logic of the process crash can still be replayed, effectively reducing the impact of the life cycle of the business container on the business vulnerability analysis process of the target business, thereby improving the stability of the business vulnerability analysis process. In addition, the embodiment of the present application collects crash files in the process of responding to the business execution request of a specific service object, which can benefit from the diversity of business needs of different service objects, so that the business process responding to the business execution request of different service objects can be operated according to different running logics. In this case, applying the embodiment of the present application to multiple business containers of the target business can easily detect the execution process of different business execution logics, thereby collecting the process crash data generated under different running logics, thereby realizing comprehensive business vulnerability analysis and efficiently obtaining various business vulnerabilities existing in the target business.

[0181] The present application also provides a storage medium that stores one or more computer programs corresponding to the aforementioned in-container data processing method. When one or more processors load and execute these one or more computer programs, the in-container data processing method described in the embodiments can be implemented, which will not be further described here. It is understood that the computer program can be deployed and executed on one or more devices that can communicate with each other.

[0182] An embodiment of the present application also provides a program product or computer program, which includes computer instructions stored in a storage medium. The processor of a data processing device can read the computer instructions from the storage medium and execute the computer instructions, so that the data processing device can execute the in-container data processing method provided in the above-mentioned embodiments.

[0183] It is understood that the beneficial effects of the same method in the storage medium and program product in this application are the same as those in the Figure 3 and Figure 4 The proposed method for processing data within a container has the same beneficial effects, so it will not be described in detail here. Furthermore, the various embodiments disclosed above are merely partial examples of the present application and are not intended to limit the scope of the present application. Persons skilled in the art will understand that equivalent variations made by implementing all or part of the above-described embodiments in accordance with the claims of this application are still within the scope of the present invention.

Claims

1. A method for processing data in a container, characterized in that: include: In response to a service execution request initiated by a service object of a target service, running a service process in a service container, wherein the service process is used to execute the target service, and a detection process is running in the service container; During the operation of the business process, calling the detection process in the business container to monitor the file directory of the business container; If a crash file of the business process is detected in the file directory, obtaining a code file of the business process, wherein the crash file is generated when the business process is interrupted; The detection process is called to store the crash file and the code file in a storage space outside the business container, and the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

2. The method according to claim 1, characterized in that The method further comprises: Analyzing the stack call relationship of the business process when it is interrupted based on the crash file and the code file in the storage space; When the stack call relationship is different from stack call relationships corresponding to each historical crash file of the business process, a business vulnerability existing in the target business is predicted based on the stack call relationship.

3. The method according to claim 2, characterized in that The method further comprises: Obtaining a service tag of the target service, and obtaining stack description information of each stack associated with the stack call relationship; The call stack analysis model predicts an optimization strategy for the target business based on the business tag, the business vulnerability, and the stack description information of each stack. The optimization strategy is used to optimize the target business.

4. The method according to claim 2 or 3, characterized in that The method further comprises: Calling the detection process to obtain storage addresses of the crash file and the code file in the storage space; Storing the storage address in another storage space other than the storage space, where the other storage space is outside the business container; If the storage is successful, task instruction information is generated, and the task instruction information is used to prompt a vulnerability analysis based on the crash file and the code file in the storage space, and the crash file in the storage space is obtained based on the storage address in the other storage space.

5. The method according to claim 1, wherein The business process and the detection process share the process space in the business container; the method further includes: During the operation of the business process, calling the detection process to perform risk assessment on the business process to obtain the risk level of the business process; When the risk level is greater than or equal to a preset level, calling the detection process to obtain the process identifier of the business process from the process space; A process interruption instruction is generated based on the acquired process identifier, and the operation of the business process is interrupted by using the process interruption instruction to trigger generation of a crash file of the business process in the file directory.

6. The method according to claim 5, characterized in that There are multiple business processes, and each business process belongs to the same process tree. The method further includes: When the risk level of any business process is greater than or equal to the preset level, and the business process is a child process in the process tree, the detection process obtains process running data of an associated process of the business process, where the associated process refers to a business process in the process tree that interacts with the business process; The acquired process running data is stored in the storage space, so as to perform vulnerability analysis based on the process running data, crash files and code files in the storage space to obtain business vulnerabilities existing in the target business.

7. The method according to claim 5, characterized in that The method further comprises: When the risk level is lower than the preset level and the risk level indicates that the business process is risky, adding a risk tag to an inheritance field included in the process description information of the business process; If it is detected that the business process creates a child process, generating process description information including the inheritance field for the child process, so that the risk label exists in the process description information of the child process; When the risk level obtained by risk assessment of any process with the risk label in the process description information is greater than or equal to the preset level, the risk control strategy associated with the preset level is adopted to perform risk control processing on each process with the risk label in the process description information.

8. A data processing device in a container, characterized in that: include: a response unit, configured to respond to a service execution request initiated by a service object of a target service, and run a service process in a service container, wherein the service process is used to execute the target service, and a detection process is run in the service container; a calling unit, configured to call the detection process in the business container to monitor the file directory of the business container during the operation of the business process; an acquiring unit, configured to acquire a code file of the business process when a crash file of the business process is detected in the file directory, wherein the crash file is generated when the business process is interrupted; The calling unit is further configured to call the detection process to store the crash file and the code file in a storage space outside the business container, and the crash file and the code file in the storage space are used to analyze vulnerabilities of the target business.

9. A data processing device, characterized in that: include: a processor adapted to execute one or more computer programs; A storage medium storing one or more computer programs, wherein the one or more computer programs are suitable for being loaded by the processor and executing the method for processing data in a container according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more computer programs, and the one or more computer programs are suitable for being loaded by a processor and executing the method for processing data in a container according to any one of claims 1 to 7.

Images