Detection method, device, equipment, medium and product

Abstract

The invention discloses a detection method, device and equipment, a medium and a product. The method comprises the steps that a target host application class is loaded through an agent plug-in class loader, and the agent plug-in class loader follows double-parent delegation and is used for isolation class loading; performing merging processing on the target host application classes to obtain a host application; executing the host application; according to the technical scheme, the host application is detected through the proxy plug-in interceptor, the detection result corresponding to the host application is obtained, through the technical scheme, the host application can be detected under the condition that the host application is not perceived, and performance loss and resource occupation of application detection can be reduced.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a detection method, apparatus, device, medium, and product. Background Art

[0002] As applications become increasingly complex and their scale expands, issues such as application monitoring and security have gradually become prominent. Therefore, there is an urgent need to test applications.

[0003] Existing application detection solutions include: aspect solutions and sidecar solutions. Aspect solutions use a modular mechanism to separate the aforementioned issues from the business logic and handle them in a unified manner. Sidecar solutions implement application monitoring and security protection by introducing a sidecar program independent of the application.

[0004] Although the above two solutions can meet the requirements of enterprise application management to a certain extent, the aspect solution has problems such as high coupling between the aspect code and the main business code of the application, high application development complexity, and difficult debugging; the sidecar solution has problems such as large performance loss, high resource consumption, and complex online operation and maintenance. Summary of the Invention

[0005] Embodiments of the present invention provide a detection method, apparatus, device, medium, and product that can solve at least one of the above-mentioned problems.

[0006] According to one aspect of the present invention, a detection method is provided, comprising:

[0007] Loading the target host application class through a proxy plug-in class loader, wherein the proxy plug-in class loader follows parent delegation for isolating class loading;

[0008] Merging the target host application classes to obtain a host application;

[0009] executing the host application;

[0010] The host application is detected through the proxy plug-in interceptor to obtain the detection result corresponding to the host application.

[0011] According to another aspect of the present invention, a detection device is provided, comprising:

[0012] a target host application class loading module, configured to load the target host application class through a proxy plug-in class loader, wherein the proxy plug-in class loader follows parent delegation and is configured to isolate class loading;

[0013] A merging processing module, configured to merge the target host application class to obtain a host application;

[0014] A host application execution module, configured to execute the host application;

[0015] The detection module is used to detect the host application through the proxy plug-in interceptor and obtain the detection result corresponding to the host application.

[0016] According to another aspect of the present invention, an electronic device is provided, comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the detection method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the detection method according to any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided. When the computer program is executed by a processor, the computer program implements the detection method as described in any one of the embodiments of the present invention.

[0022] In an embodiment of the present invention, the target host application class is first loaded through a proxy plug-in class loader, and the proxy plug-in class loader follows parent delegation and is used to isolate class loading; then the target host application class is merged to obtain a host application, and the host application is executed; finally, the host application is detected through a proxy plug-in interceptor to obtain a detection result corresponding to the host application. Since the proxy plug-in class loader follows parent delegation and is used to isolate class loading, loading the target host application class through a proxy plug-in class loader can solve the application class conflict problem when using Agent technology. By detecting the host application through a proxy plug-in interceptor and obtaining a detection result corresponding to the host application, the host application can be enhanced after development is completed, and the host application can be detected without the host application being aware of it, and the performance loss and resource usage of application detection can be reduced.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 is a flow chart of a detection method in an embodiment of the present invention;

[0026] Figure 2 is a schematic diagram of a class isolation loader in an embodiment of the present invention;

[0027] Figure 3 This is a diagram of the proxy plug-in architecture in an embodiment of the present invention;

[0028] Figure 4 is a flow chart of another detection method in an embodiment of the present invention;

[0029] Figure 5 is a schematic diagram of scheduling logic in an embodiment of the present invention;

[0030] Figure 6 is a timing diagram of the class loading process in an embodiment of the present invention;

[0031] Figure 7 is a schematic structural diagram of a detection device in an embodiment of the present invention;

[0032] Figure 8 It is a structural diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0036] Example 1

[0037] Figure 1 This is a flow chart of a detection method provided in an embodiment of the present invention. This embodiment is applicable to the case of detecting an application. The method can be executed by a detection device in an embodiment of the present invention. The device can be implemented in software and / or hardware. Figure 1 As shown, the method specifically includes the following steps:

[0038] S110 , loading the target host application class through the proxy plug-in class loader.

[0039] In this embodiment, the proxy plug-in class loader follows parent delegation and is mainly used to isolate the class loading of the proxy plug-in to avoid class conflicts between different plug-ins.

[0040] In this embodiment, the target host application class is loaded by the proxy plug-in class loader in the following manner: the proxy plug-in class loader delegates the local class loader to obtain the host application class loader; the host application class loader searches for the target host application class and loads the target host application class.

[0041] Optionally, load the target host application class through the proxy plugin class loader, including:

[0042] The proxy plug-in class loader delegates the local class loader to obtain the host application class loader.

[0043] In this embodiment, the local class loader can be a local loader, which is used to load classes from a specific path or context. The host application class loader can be a user class loader, which typically refers to a user-defined class loader rather than the standard class loader built into the JVM. This type of loader inherits from java.lang.ClassLoader and is used to implement specific class loading logic, such as loading classes from non-standard paths, encrypting / decrypting classes, or implementing hot deployment.

[0044] The target host application class is searched for through the host application class loader, and the target host application class is loaded.

[0045] In this embodiment, searching for the target host application class through the host application class loader and loading the target host application class may be performed by: reading the identification information of the target host application class in the configuration file through the SPI interface; searching for the target host application class corresponding to the identification information of the target host application class through the host application class loader; and loading the target host application class. Searching for the target host application class through the host application class loader and loading the target host application class may also be performed by: writing the identification information of the target host application class to be searched into the host application class loader, directly searching for the target host application class through the identification information of the target host application class in the host application class loader, and loading the target host application class.

[0046] Searching for a target host application class through the host application class loader and loading the target host application class includes:

[0047] The identification information of the target host application class in the configuration file is read through the SPI interface.

[0048] In this embodiment, the identification information of the target host application class may be the name of the target host application class.

[0049] Searching for the target host application class corresponding to the identification information of the target host application class through the host application class loader;

[0050] Load the target host application class.

[0051] In this embodiment, the target host application class is obtained based on Java programming.

[0052] In this embodiment, an embodiment of the present invention provides a proxy module, and the proxy module includes: a core framework layer and a proxy plug-in layer. The core framework layer provides the basic framework function of the proxy, and the core function is plug-in loading. At the same time, in order to ensure the class isolation between the core framework and the host application, the core framework and the proxy plug-in, and the proxy plug-in, a set of class isolation mechanisms are provided to solve the class conflict problem. The proxy plug-in layer is a set of specific plug-in collections that provide specific proxy capabilities for the host application. For example, application monitoring and security detection capabilities are realized through a plug-in approach. The proxy plug-in layer includes performance monitoring plug-ins, full-link monitoring plug-ins, security detection plug-ins, etc. The performance monitoring plug-in provides application monitoring indicators such as application servers, response time, and error rates. The security detection plug-in provides sensitive information detection in application transactions. The proxy plug-in layer sinks application monitoring, security detection and other capabilities to the proxy module in a non-invasive, extensible, and lightweight manner, and implements an out-of-the-box product with a plug-in approach. The proxy module consumes little application resources, has good isolation capabilities, low operation and maintenance complexity, and is easy to use. This allows application business developers to focus on the development and innovation of core business capabilities without having to worry about application monitoring and security capability development, thereby improving high-quality R&D efficiency.

[0053] In a specific example, TCPluginClassLoader is used to load the host application class: TCPluginClassLoader delegates localloader to obtain the host application class loader User Class Loader, and searches through UserClassLoader; UserClassLoader loads the class after finding it.

[0054] In this embodiment, the main function of the core framework layer is to design a set of custom class loaders to implement the loading and isolation mechanism of the proxy plug-in. Figure 2As shown, it mainly includes: TCAgentClassLoader: The core framework class loader, which violates parent delegation and is used to load the core framework logic to avoid being affected by the complex class loading structure of the host application itself. TCAgentLibClassLoader: The core framework dependency class loader, which violates parent delegation and is mainly used to load third-party dependencies introduced by the core framework to avoid class conflicts between the core framework, proxy plug-ins, and host applications. TCPluginClassLoader: The proxy plug-in class loader, which follows parent delegation and is mainly used to isolate the class loading of proxy plug-ins to avoid class conflicts between different plug-ins. TCPluginLibClassLoader: The proxy plug-in dependency class loader, which violates parent delegation and is mainly used to load third-party dependencies introduced by proxy plug-ins. Proxy plug-ins can arbitrarily introduce third-party dependencies without causing class conflicts for the proxy plug-ins themselves. JVM class loaders include: Applicationclassloader, Extendclassloader, and Bootstrapclassloader. The host application class loader UserClassLoader can point to either Bootstrapclassloader or Applicationclassloader.

[0055] The proxy plugin layer is designed based on the SPI (Service Provider Interface) mechanism. SPI is a service discovery mechanism that allows the runtime to dynamically load classes that implement a specific interface without explicitly specifying the class in the code, thereby achieving decoupling and flexibility. Figure 3 As shown in the figure, the abstract interface of the proxy plug-in layer is defined in the core framework layer, which is mainly used to define the interface elements of the plug-in implementation. Each plug-in is a specific implementation of the plug-in abstract interface. The plug-in startup configuration file is created by adding the META-INF / services directory to the resources and creating an SPI file in it. The file specifies the class name of the specific implementation of the plug-in. The core framework layer can complete the dynamic loading of the plug-in through SPI.

[0056] S120: Merge the target host application class to obtain a host application.

[0057] S130: Execute the host application.

[0058] In this embodiment, the host application is an application implemented based on Java programming.

[0059] S140: Detect the host application through the proxy plug-in interceptor to obtain a detection result corresponding to the host application.

[0060] Optionally, the host application is detected through a proxy plug-in interceptor to obtain detection results corresponding to the host application, including:

[0061] Get the target weaving point corresponding to the proxy plug-in interceptor.

[0062] In this embodiment, the target weaving point includes at least one of a weaving point before the host application executes, a weaving point after the host application executes, and a weaving point during the host application executes. It should be noted that the target weaving point is pre-configured and can include multiple types of weaving points, and there can be multiple target weaving points.

[0063] The host application is detected through the target weaving point to obtain a detection result corresponding to the host application.

[0064] In this embodiment, the host application is detected through the target weaving point, and the detection result corresponding to the host application is obtained in the following manner: if the target weaving point includes a weaving point before the host application is executed, then any one of skipping the host application to be executed, obtaining request parameters and modifying request parameters is executed; if the target weaving point includes a weaving point after the host application is executed, then obtaining return parameters is executed, or modifying return parameters; if the target weaving point includes a weaving point during the execution of the host application, and the host application throws exception information, then the interceptor is triggered to process based on the exception information.

[0065] The host application is detected through the target weaving point to obtain a detection result corresponding to the host application, including:

[0066] If the target weaving point includes a weaving point before the host application is executed, performing any one of skipping the host application to be executed, obtaining request parameters, and modifying request parameters;

[0067] If the target weaving point includes a post-host application execution weaving point, obtaining a return parameter, or modifying the return parameter;

[0068] If the target weaving point includes a weaving point in the execution of the host application, and the host application throws exception information, the interceptor is triggered to perform processing based on the exception information.

[0069] In this embodiment, the main function of the proxy plug-in interceptor is to enhance the host application class. The enhancement method adopts the AOP interceptor mechanism. The interceptor provides three key weaving points: Before weaving point before host application execution, After weaving point after host application execution, and Throw weaving point during host application execution. It also provides general capabilities such as skipping method execution, modifying method parameters, modifying method return, and modifying exception throwing. The Before weaving point is scheduled by the proxy aspect scheduler before the host application method is executed. The logic of the Before weaving point is generally skipping execution, obtaining request parameters, modifying request parameters, etc. The host application method can be skipped or enhanced before execution through the Before weaving point. After: The After weaving point is scheduled by the proxy aspect scheduler after the host application method is executed. The logic of the After weaving point is generally obtaining return parameters, modifying return parameters, etc. The host application method can be enhanced after execution through the After weaving point. Throw: The Throw weaving point is scheduled by the proxy aspect scheduler after the host application method executes an exception. Only when a method throws an exception can the proxy trigger the interceptor to handle the Throw logic. If the exception is caught in the method (the program terminates or is handled autonomously), the Throw interceptor processing logic cannot be triggered. If the exception is modified to null in the Throw logic, the method will no longer throw an exception.

[0070] Optionally, get the target weaving point corresponding to the proxy plug-in interceptor, including:

[0071] Gets the weaving point type.

[0072] In this embodiment, the weaving point types include: weaving points before the host application is executed, weaving points after the host application is executed, and weaving points during the host application execution.

[0073] The configuration content is read through the plug-in configuration class, where the plug-in configuration class inherits the plug-in configuration interface.

[0074] In this embodiment, custom configuration monitoring indicator data is supported. Add configuration content in the config.yaml file under the plugin project\config directory. Define a plugin configuration class under the plugin project\plugin module, which needs to inherit the PluginConfig plugin configuration interface, and modify the class through ConfigTypeKey to specify that the configuration class can read the prefix of the configuration item name, and modify the variable in the class through ConfigFieldKey (if not modified, the configuration item with the same name as the variable name is read), and specify the name of the configuration item corresponding to the variable. The proxy customized indicator configuration format is as follows:

[0075] Performance monitoring configuration:

[0076] Monitoring server IP address: xxx

[0077] Monitoring server port: xxx

[0078] Monitor elements:

[0079] Monitoring indicators:

[0080] Monitor element value location: request header

[0081] The data types supported by the plugin configuration include: basic types of Boolean and numeric classes; string types; enumeration types; complex object types; arrays of the above types; lists composed of the first four types; and maps composed of the first four types.

[0082] Based on the configuration content and the weaving point type, a target weaving point corresponding to the proxy plug-in interceptor is determined.

[0083] It should be noted that the performance monitoring plug-in provides metrics such as server address, Pod address, response time, and error rate by default, and also supports custom metric collection through configuration. The proxy module obtains relevant information by intercepting the transaction entry class.

[0084] In a specific example, Figure 4 As shown, transaction data can be obtained through the Before weaving point and the After weaving point to detect the transaction data.

[0085] The technical solution provided in this embodiment supports multiple monitoring indicator information such as application server address, Pod address, response time, error rate, etc., and also supports custom monitoring indicator elements through configuration.

[0086] Optionally, the host application is detected through a proxy plug-in interceptor to obtain detection results corresponding to the host application, including:

[0087] If there are multiple proxy plug-in interceptors, before executing the method in the host application, the host application is detected in the order in which the proxy plug-in interceptors are recorded to obtain the detection results corresponding to the host application. After executing the method in the host application, the host application is detected in the reverse order in which the multiple proxy plug-in interceptors are loaded to obtain the detection results corresponding to the host application.

[0088] In this embodiment, there may be multiple interceptors to ensure that the same target host application class does not perform duplicate capability enhancements, and to ensure that the execution logic of methods in the same target host application class by different plug-ins complies with the logic of the method call stack and the execution style of the aspect program. Figure 5As shown, the proxy core framework maintains an interceptor scheduler, which caches the interceptors in an ordered list. When the target method is executed, the scheduler executes in the order in which the interceptors are loaded, thus ensuring that the execution order of the interceptors conforms to the interceptor entry order. When the target method is executed, the scheduler executes the interceptors in the reverse order in which the interceptors are loaded.

[0089] The technical solution provided in this embodiment ensures the normal execution order of plug-ins by designing dynamic loading of plug-ins, a plug-in interceptor, and a plug-in scheduler.

[0090] Optionally, also include:

[0091] Get the proxy app.

[0092] In this embodiment, the proxy application includes: a proxy plug-in dependent class and the proxy plug-in own class, and the proxy plug-in dependent class and the proxy plug-in own class are loaded by a proxy plug-in dependent class loader.

[0093] Executing the proxy application to obtain a log file corresponding to the proxy application;

[0094] Determining the running status of the proxy application based on the log file corresponding to the proxy application;

[0095] The proxy plug-in dependency classes are loaded through the proxy plug-in dependency class loader, including:

[0096] Delegate the JVM class loader to find the target agent plug-in dependency class by delegating the core framework class loader;

[0097] If the target proxy plug-in dependency class is found, then the target proxy plug-in dependency class is loaded;

[0098] If the target proxy plug-in dependency class is not found, searching for the target proxy plug-in dependency class through the proxy plug-in class loader and loading the target proxy plug-in dependency class;

[0099] The proxy plug-in itself is loaded through the proxy plug-in dependency class loader, including:

[0100] Delegate the JVM class loader to find the target proxy plug-in class by delegating the core framework class loader;

[0101] If the target proxy plug-in class is found, then the target proxy plug-in class is loaded;

[0102] If the target proxy plug-in class itself is not found, the target proxy plug-in class itself is searched for through the proxy plug-in class loader, and the target proxy plug-in class itself is loaded.

[0103] In this embodiment, the JVM class loader is one of the core components of the Java runtime environment and is responsible for dynamically loading Java classes into memory.

[0104] In a specific example, Figure 6 As shown, the class loading process is divided into two scenarios: agent plug-in class loading, implemented using a custom class loader; and host application class loading, implemented by introducing the host class loader. This class loading isolation mechanism prevents class conflicts between the agent and host applications. This resolves the class conflict issue in agent applications, ensuring correct plug-in loading and execution order through dynamic plug-in loading, plug-in interceptors, and a plug-in scheduler.

[0105] The proxy plug-in class is loaded, and the loading process is as follows:

[0106] Use TCPluginLibClassLoader to load the proxy plug-in dependent class (after the core framework is started), that is, TCPluginLibClassLoader delegates loading layer by layer, that is, it delegates TCAgentClassLoader and TCPluginClassLoader to search and load respectively. The specific loading process is as follows:

[0107] During the delegated search process, TCAgentClassLoader does not use the host application's UserClassLoader, but directly delegates the search and loading to the JVM class loader, thus avoiding conflicts between classes used by the agent plug-in and classes of the same name in the host. During the delegated search process, if a class is found based on the JVM class loader, TCPluginbClassLoader searches and loads it.

[0108] The process of loading the proxy plug-in class itself is the same as that of the dependent class, so I will not go into details here.

[0109] The host application class is loaded, and the loading process is as follows:

[0110] The proxy uses TCPluginClassLoader to load the host application class: TCPluginClassLoader delegates localloader to obtain the host application class loader UserClassLoader, and searches through UserClassLoader; UserClassLoader loads the class after finding it.

[0111] The technical solution provided in this embodiment implements the loading and isolation mechanism of the agent plug-in by designing a set of custom class loaders, thereby solving the application class conflict problem when using the Agent technology.

[0112] Embodiments of the present invention utilize Agent technology to implement a non-intrusive agent module to enhance application monitoring and security capabilities. Agent technology features dynamic modification and non-intrusive features, enabling dynamic enhancement and monitoring of target applications without modifying their code. This allows developers to perform performance analysis, feature enhancements, and security checks and protection on applications at runtime. The core of Agent technology is based on the Instrumentation API provided by the JVM, extending JVM capabilities and providing strong support for application performance optimization, feature expansion, and security assurance. Agent technology is loaded when the Java Virtual Machine (JVM) is started or during runtime. The Instrumentation API is implemented based on the Java Virtual Machine Tool Interface (JVMTI), a virtual machine-provided agent mechanism that enables third-party tools to connect to and access the JVM in a proxy manner. JVMTI offers a rich set of capabilities, including virtual machine thread, memory / heap / stack, class / method / variable, event / timer processing, and more. The Agent uses the class transformation functionality provided by the Instrumentation API to modify or enhance the bytecode of the target class. The modified bytecode is then reloaded into the JVM, enabling dynamic changes to application behavior. The implementation of the Agent is usually contained in a separate JAR package. When starting the application, you can specify the Agent JAR package path by adding the -agent parameter. The JVM will load this JAR package when it starts and call the startup method in the Agent class. The startup method is divided into two methods: static (premain) and dynamic (agentmain). Static startup mainly refers to specifying a specific JAR package through the -javaagent command to start the premain() method of the Instrumentation in the Agent when the JVM starts. The JVM will load this method first to implement static startup of the Agent. Dynamic startup is mainly through the JVM's Attach mechanism. Attach is not a standard API, but a set of extended APIs provided by Sun for attaching (Attach) agent tool programs to the target JVM. With it, developers can easily monitor a JVM and run an additional agent program.The core component of the Attach mechanism is Attach Listener, which is a thread inside the JVM. The main task of this thread is to monitor and receive client processes. It injects the Agent's JAR package into the corresponding process through the attach(pid) method provided by Attach. The corresponding process then calls the AgentMain method of the agent, thereby dynamically loading the agent program.

[0113] The proxy detects sensitive information such as the server version and IP address in the application response header; obtains the database SQL execution time (the execution time of the database SQL can be determined based on the difference between the request time obtained at the Before weaving point and the return time obtained at the After weaving point); and queries the number of rows of data in the result to provide a slow database query prompt (if the number of rows exceeds the row count threshold, a slow database query prompt is issued). Sensitive information in application responses is a key item in security penetration testing. The proxy detects information such as the server version and IP address in the application response header during the after phase of application method execution. If the application response header contains abnormal information, a prompt is issued, including sensitive information such as the IP address.

[0114] To ensure the security of the original request data, the proxy copies and reads it. After obtaining the complete HTTP data, it analyzes each header to detect any sensitive information leaks. The following headers are supported for sensitive information detection: they should not contain version numbers of server middleware, operating system, etc.; cookies should have the http-only attribute enabled; they should not contain sensitive information such as IP addresses; and they should not contain carriage return and line feed characters.

[0115] In this embodiment, sensitive information such as the server version and IP address in the application response header can be detected.

[0116] Compared with the slice solution and the sidecar solution, the solution provided in this embodiment has the following advantages:

[0117] 1) Lightweight: Compared with the sidecar solution, the solution provided by this embodiment has a smaller performance overhead for the application (less CPU and memory usage). In common Web transaction scenarios, the performance loss of the sidecar solution (CPU, memory, and network latency, etc.) is over 10%, while the performance loss of the solution provided by this embodiment does not exceed 5%. 2) Non-intrusive: The aspect code of the aspect solution is highly coupled with the main business code of the application, while the solution provided by this embodiment is enhanced after the host application is developed, and is started without the host application's awareness, ready for use out of the box, achieving decoupling of enhanced capabilities from business code, reducing the impact on the application and the complexity of application debugging. 3) Ease of use: Common application monitoring and security detection solutions use aspect solutions, but aspect solutions require developers to write code in the application, while the solution provided by this embodiment sinks some non-functional features (application monitoring, security detection, etc.) and provides them as middleware for business R&D personnel to use on demand. Business R&D focuses on business function development and innovation, reducing the effort developers put into non-functional code. Compared to the sidecar solution, this embodiment provides an agent module and application in the same process, which does not increase the complexity of the deployment architecture and helps simplify application maintenance. 4) Pluginization: To address the class conflicts that may arise when multiple agents are enabled simultaneously, this embodiment provides a plug-in design to avoid complex class conflicts for developers. This embodiment also supports enabling specific plug-ins on demand, reducing the impact on the host application.

[0118] The technical solution of this embodiment is to first load the target host application class through the proxy plug-in class loader; then merge the target host application class to obtain the host application, and execute the host application; finally, detect the host application through the proxy plug-in interceptor to obtain the detection result corresponding to the host application. After the host application is developed, it can be enhanced, and the host application can be detected without the host application being aware of it, and the performance loss and resource usage of application detection can be reduced.

[0119] Example 2

[0120] Figure 7 This is a schematic diagram of the structure of a detection device provided by an embodiment of the present invention. This embodiment is applicable to the case of detecting an application. The device can be implemented in software and / or hardware. The device can be integrated into any device that provides a detection function, such as Figure 7 As shown, the detection device specifically includes: a target host application class loading module 710 , a merging processing module 720 , a host application execution module 730 and a detection module 740 .

[0121] The target host application class loading module is used to load the target host application class through the proxy plug-in class loader, wherein the proxy plug-in class loader follows parent delegation and is used to isolate class loading;

[0122] A merging processing module, configured to merge the target host application class to obtain a host application;

[0123] A host application execution module, configured to execute the host application;

[0124] The detection module is used to detect the host application through the proxy plug-in interceptor and obtain the detection result corresponding to the host application.

[0125] The above-mentioned product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0126] Example 3

[0127] Figure 8 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0128] like Figure 8 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0129] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0130] The processor 11 may be any general-purpose and / or specialized processing component with processing and computing capabilities. Examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors for running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the detection method.

[0131] In some embodiments, the detection method can be implemented as a computer program that is tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the detection method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the detection method in any other appropriate manner (e.g., by means of firmware).

[0132] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0133] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0134] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0135] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0136] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0137] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0138] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0139] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the detection method according to any embodiment of the present invention when executed by a processor.

[0140] The computer program product may be implemented by writing computer program code for performing the operations of the present invention in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0141] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A detection method, characterized in that: include: Loading the target host application class through a proxy plug-in class loader, wherein the proxy plug-in class loader follows parent delegation for isolating class loading; Merging the target host application classes to obtain a host application; executing the host application; The host application is detected through the proxy plug-in interceptor to obtain the detection result corresponding to the host application.

2. The method according to claim 1, characterized in that Load the target host application class through the proxy plug-in class loader, including: Obtain the host application class loader by delegating the local class loader through the proxy plug-in class loader; Searching for a target host application class through a host application class loader and loading the target host application class; Searching for a target host application class through the host application class loader and loading the target host application class includes: Read the identification information of the target host application class in the configuration file through the SPI interface; Searching for the target host application class corresponding to the identification information of the target host application class through the host application class loader; Load the target host application class.

3. The method according to claim 1, characterized in that The host application is detected through the proxy plug-in interceptor to obtain the corresponding detection results of the host application, including: Obtaining a target weaving point corresponding to the proxy plug-in interceptor, wherein the target weaving point includes at least one of a weaving point before the host application is executed, a weaving point after the host application is executed, and a weaving point during the host application execution; Detecting the host application through the target weaving point to obtain a detection result corresponding to the host application; The host application is detected through the target weaving point to obtain a detection result corresponding to the host application, including: If the target weaving point includes a weaving point before the host application is executed, performing any one of skipping the host application to be executed, obtaining request parameters, and modifying request parameters; If the target weaving point includes a post-host application execution weaving point, obtaining a return parameter, or modifying the return parameter; If the target weaving point includes a weaving point in the execution of the host application, and the host application throws exception information, the interceptor is triggered to perform processing based on the exception information.

4. The method according to claim 3, characterized in that Get the target weaving point corresponding to the proxy plug-in interceptor, including: Get the weaving point type; Read the configuration content through the plug-in configuration class, where the plug-in configuration class inherits the plug-in configuration interface; Based on the configuration content and the weaving point type, a target weaving point corresponding to the proxy plug-in interceptor is determined.

5. The method according to claim 1, wherein The host application is detected through the proxy plug-in interceptor to obtain the corresponding detection results of the host application, including: If there are multiple proxy plug-in interceptors, before executing the method in the host application, the host application is detected in the order in which the proxy plug-in interceptors are recorded to obtain the detection results corresponding to the host application. After executing the method in the host application, the host application is detected in the reverse order in which the multiple proxy plug-in interceptors are loaded to obtain the detection results corresponding to the host application.

6. The method according to claim 1, characterized in that Also includes: Obtaining a proxy application, wherein the proxy application includes: a proxy plug-in dependent class and the proxy plug-in own class, wherein the proxy plug-in dependent class and the proxy plug-in own class are loaded by a proxy plug-in dependent class loader; Executing the proxy application to obtain a log file corresponding to the proxy application; Determining the running status of the proxy application based on the log file corresponding to the proxy application; The proxy plug-in dependency class is loaded through the proxy plug-in dependency class loader, including: Delegate the JVM class loader to find the target agent plug-in dependency class by delegating the core framework class loader; If the target proxy plug-in dependency class is found, then the target proxy plug-in dependency class is loaded; If the target proxy plug-in dependency class is not found, searching for the target proxy plug-in dependency class through the proxy plug-in class loader and loading the target proxy plug-in dependency class; The proxy plug-in itself is loaded through the proxy plug-in dependency class loader, including: Delegate the JVM class loader to find the target proxy plug-in class by delegating the core framework class loader; If the target proxy plug-in class is found, then the target proxy plug-in class is loaded; If the target proxy plug-in class itself is not found, the target proxy plug-in class itself is searched for through the proxy plug-in class loader, and the target proxy plug-in class itself is loaded.

7. A detection device, characterized in that: include: a target host application class loading module, configured to load the target host application class through a proxy plug-in class loader, wherein the proxy plug-in class loader follows parent delegation and is configured to isolate class loading; A merging processing module, configured to merge the target host application class to obtain a host application; A host application execution module, configured to execute the host application; The detection module is used to detect the host application through the proxy plug-in interceptor and obtain the detection result corresponding to the host application.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images