Method and system for event collection and traceability graph compression of no-service computing system

Abstract

The invention discloses a service computing system event acquisition and traceability graph compression method and system, and relates to the field of non-service computing and traceability graphs. The problems that in the prior art, system event collection performance is low in a service-free computing environment, and service quality is affected are solved; the method solves the problems that a large traceability graph is large in storage space occupation and large in storage overhead and the like in the prior art, system events of service-free calculation instances are collected and transmitted through the advanced technology, and meanwhile the traceability graph is constructed based on the collected system events to be compressed. According to the scheme, the method comprises the steps that 1, system events of service-free computing instances are collected in real time at a system event inlet and a system event outlet in a kernel based on the eBPF non-intrusive kernel technology; and step 2, transmitting the system event data of the non-service computing instance collected in the step 1 to a traceability graph storage center node through an RDMA technology. And step 3, receiving and processing the system event at the traceability graph storage center node, and completing construction, compression and query of the traceability graph. The method is suitable for non-service calculation and traceability graph compression.

Description

Technical Field

[0001] The present invention relates to the field of serverless computing and traceability graphs, and in particular to a serverless computing system event collection and traceability graph compression scheme and system. Background Art

[0002] In recent years, serverless computing has become one of the fastest-growing technologies in cloud computing. With its advantages of simplified operations and maintenance, cost optimization, and elastic scalability, it has been widely adopted by companies such as Netflix, T-Mobile, and Zillow, becoming a key computing solution. Despite its high convenience, serverless computing still faces significant security threats. Serverless computing is based on container technology. Weak security policies and improper configuration can exacerbate container reuse, enabling attackers to move laterally within function workflows. Serverless computing also faces risks such as container-related security issues, denial of service (DoS) attacks, and advanced persistent threat (APT) attacks. Furthermore, systems are still vulnerable to data injection attacks during the deployment phase. Therefore, effectively detecting potential security threats to ensure the security of serverless computing has become a pressing issue. To detect potential security threats, building traceability graphs based on system events has become a mainstream approach. Some complex security threats exhibit persistent characteristics, making them difficult to effectively identify through short-term detection. Therefore, storing traceability graphs is necessary for ongoing security analysis. Therefore, system event collection and traceability graph storage have become important links in serverless computing security testing.

[0003] When collecting system events, the impact on services should be minimized to ensure service quality. There are two main methods for collecting system events: using system event collection tools (such as strace) and modifying the Linux kernel source code. Strace collects system events through the ptrace system call, but this triggers context switches and results in performance overhead. Modifying the kernel source code can reduce overhead, but requires re-modification during kernel updates, which is complex and can affect system stability. Therefore, neither method can simultaneously meet the requirements of low overhead and stability.

[0004] In the storage of provenance graphs, ensuring the integrity of provenance graphs has a critical impact on the accuracy of security detection. Due to the complexity of serverless computing programs and the large scale of serverless computing, the amount of system event data collected has increased significantly, resulting in the construction of large-scale provenance graphs. As security threats become increasingly complex, security detection applications take a long time to identify threats, so provenance graphs need to be stored for a long time. The long-term storage of large-scale provenance graphs will incur significant storage overhead. To reduce the storage cost of provenance graphs, some studies have attempted to reduce storage space by deleting some events and entities in the provenance graphs. However, these methods will destroy the data integrity of the provenance graphs, which in turn affects the accuracy of upper-layer security detection applications.

[0005] In the current technological environment, the problems that need to be solved urgently are: the system event collection performance in a serverless computing environment is low, affecting the service quality; large traceability graphs take up a lot of storage space and have high storage overhead. Summary of the Invention

[0006] The present invention designs a serverless computing system event collection and traceability graph compression scheme and system, which solves the problems of low system event collection performance in a serverless computing environment, affecting service quality; large traceability graphs occupy a large storage space and have high storage overhead.

[0007] To achieve the above object, the present invention provides the following technical solutions: Solution 1: The present invention provides a method for collecting and compressing traceability graphs of serverless computing system events, the method comprising the following steps: Step 1: Collect system events of serverless computing instances to provide data for the subsequent traceability graph built based on system events; Step 2: System event data transmission: The system event data of the serverless computing instance collected on the serverless computing node is transmitted to the provenance graph storage center node; Step 3: Provenance graph construction and compression: The provenance graph storage center node receives and processes system events of the serverless computing instance, and completes the construction, compression, and query of the provenance graph.

[0008] Furthermore, a preferred embodiment is provided, in step 1, the system event collection scheme for the serverless computing instance is: Step 101: Modify the Watchdog component of the serverless computing instance to obtain its PID namespace, which is used by the extended Berkeley Packet Filter (eBPF) kernel collection program to distinguish different serverless computing instances. Step 102, according to the non-invasive kernel characteristics of eBPF, the Tracepoints tracking points are selected to collect system events of the serviceless computing instance at the entrance and exit of system events, which improves the collection performance while ensuring the stability of the system; Step 103, the system event data of the serviceless computing instance collected in the kernel is transmitted to the user space, facilitating data transmission.

[0009] Further, there is a preferred embodiment, the collected system events include: execve, fork, clone, socket, bind, listen, accept4, connect, sendto, recvfrom, open, chmod, chown, access, unlink and unlinkat. The collected system event information mainly includes: process PID namespace, process Id, system event name, part of system event parameter list, system event return value and system event start time, etc.

[0010] Further, a preferred embodiment is provided, and the data transmission scheme in step 2 is: Step 201, according to the collected system event data in step 1, using Remote Direct Memory Access (RDMA) for data transmission, using RDMA READ operation, sending data in micro-batch, avoiding frequent data transmission, and reducing CPU resource consumption; Step 202, in order to facilitate data transmission, the data sending buffer is designed as a lock-free ring buffer, realizing the reuse of the buffer; Further, there is a preferred embodiment, in the above data process, the trace graph storage center node is the active end of the RDMA READ operation, and the serviceless computing node is the passive end of the RDMA READ operation.

[0011] Further, a preferred embodiment is provided, and the trace graph construction and compression scheme in step 3 is: Step 301, pre-processing the collected system event data of the serviceless computing instance to unify the data format; Step 302, constructing a trace graph for the pre-processed system event, facilitating data organization and management; Step 303, design a provenance graph compression scheme (Provenance Graph Compression for Multiple Query Patterns, PGC-MQP) supporting multiple provenance graph query patterns. PGC-MQP simplifies monotonic values and redundant strings in the provenance graph, converts the entities and events of the simplified provenance graph into numerical vectors, stores them using a deep neural network (Deep Neural Networks, DNN) model, and realizes lossless compression of the provenance graph by introducing a calibration table.

[0012] Step 304, after compressing the provenance graph, PGC-MQP provides provenance graph query APIs for three security detection applications to meet the data needs of security detection applications based on provenance graphs.

[0013] Further, in another preferred embodiment, each system event data in step 3 is preprocessed into the form of subject, event and object; the ontology model of the constructed provenance graph contains three types of entities and 16 types of association relationships between them.

[0014] Further, in another preferred embodiment, in the numerical vector of entities and events in step 3, 1 is used to separate different attributes, and 0 is used to separate entities or events. The Id is used to predict the corresponding attribute value, and the sliding window method is used to process the numerical vector, with a window size of 16 and a step size of 1, i.e. the window slides one position to the right each time. The data in the sliding window is used as the model input, and the data immediately after the window is used as the model prediction target. A deep neural network model containing four fully connected layers is used to train the numerical vector data of entities and events, and ReLU activation function is used in each layer (except the output layer).

[0015] Further, in another preferred embodiment, after lossless compression of the provenance graph, there are four storage components: edge index table, reference table, DNN model and calibration table.

[0016] Scheme two, the service computing system event collection and provenance graph compression method proposed in the above scheme one can be realized by computer software, therefore, correspondingly, the present application also provides a service computing system event collection and provenance graph compression system, the system comprises: The eBPF-based system event collection module collects system events of the service computing instance in real time in the kernel, improves the collection performance while ensuring system stability, and reduces the impact of the collection process on the service.

[0017] The RDMA-based data transmission module reduces the data transmission frequency by sending data in micro-batches through the RDMA READ single-sided operation, and designs the registered memory as a lock-free ring buffer, thereby realizing the reuse of the registered memory, reducing resource overhead, and ensuring data consistency.

[0018] The provenance graph construction and compression module constructs provenance to facilitate data organization and management, further converts entities and events of the provenance graph into numerical vectors, and then adopts a DNN model for compression, and records data of model prediction errors through a calibration table, thereby reducing storage overhead of the provenance graph while ensuring data integrity; in addition, the provenance graph query API is provided to provide data support for security detection applications.

[0019] In scheme three, the application further provides a computer readable storage medium, which stores a computer program, and the computer program is run by a processor to execute the service-free computing system event collection and provenance graph compression method of any one of the above.

[0020] In scheme four, the application further provides a computer device, which includes a memory and a processor, and the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the service-free computing system event collection and provenance graph compression method of any one of the above.

[0021] The application has the following beneficial effects: The application proposes a service-free computing system event collection and provenance graph compression method to solve the problems of low event collection performance and large storage space occupation of a large provenance graph in the prior art. The application collects system events of a service-free computing instance based on the eBPF non-invasive kernel technology to improve the collection performance while ensuring system stability. The RDMA READ operation is used to reduce the occupation of system resources of the service-free computing node by data transmission and reduce the influence of the data transmission process on the service-free computing instance, thereby ensuring service quality. The DNN model is used for lossless compression of the provenance graph to reduce storage overhead of the provenance graph while ensuring data integrity; in addition, the provenance graph query API is provided to provide data support for security detection applications.

[0022] Further, compared with the prior art, the application can more efficiently collect events of a service-free computing instance in real time by using the eBPF technology to reduce the influence of system event collection on services; and the lossless compression of provenance by using the DNN model can reduce the storage space occupation of the provenance graph.

[0023] The application is suitable for the field of service-free computing and provenance graphs. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0025] Figure 1 Flow chart of event collection and trace graph compression scheme of the service-free computing system described in the present application; Figure 2 Entity graph of the overall framework of the event collection and trace graph compression scheme of the service-free computing system described in the present application; Figure 3 System event collection framework graph based on eBPF described in the present application; Figure 4 RDMA-based data micro-batch transmission framework graph described in the present application; Figure 5 Trace graph entity and event value vector representation graph described in the present application; Figure 6 Trace graph value vector sliding window processing representation graph described in the present application; Figure 7 Trace graph compression step schematic diagram described in the present application; Figure 8 Access delay experiment comparison graph of the service-free computing instance described in the present application; Figure 9 Storage space experiment comparison graph of different storage schemes described in the present application. DETAILED DESCRIPTION

[0026] The specific embodiments of the present application will be further described in detail below in conjunction with the drawings. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of changes and improvements can be made, which are within the scope of protection of the present application.

[0027] Embodiment one, see Figure 1 and Figure 2 This embodiment describes a service-free computing system event collection and trace graph compression method, which is used to solve the problems of low system event collection performance, affecting service quality, and large storage space occupation of trace graph in the existing service-free computing environment.

[0028] The method, as shown in Figure 1 , includes the following steps: Step 1, collect system events of serviceless computing instances to provide data for subsequent construction of a trace graph based on system events; Step 2, system event data transmission, transmit system event data of serviceless computing instances collected on serviceless computing nodes to a trace graph storage center node; Step 3, trace graph construction and compression, receive and process system events of serviceless computing instances at the trace graph storage center node, and complete construction, compression, and query of the trace graph.

[0029] In actual application, according to Figure 2 The serviceless computing system event collection and trace graph compression method shown in the overall framework solves the problems of low system event collection performance and large storage space occupation of large trace graphs in existing serviceless computing environments. The embodiment collects system events of serviceless computing instances based on eBPF technology, which can ensure system stability while improving collection performance. At the same time, the RDMA READ operation is used to reduce resource consumption of serviceless computing nodes during data transmission. Finally, the trace graph is simplified and converted into a numerical vector, and a DNN model is used for storage, reducing the storage overhead of the trace graph. In addition, a trace graph query API is provided to provide data support for security detection applications.

[0030] Embodiment two, the embodiment is a specific description of the serviceless computing system event collection and trace graph compression method described in embodiment one; Step 1, collect system events of serviceless computing instances to provide data for subsequent construction of a trace graph based on system events; Specifically, Step 101, modify the Watchdog component of the serviceless computing instance to obtain its PID namespace, which is used by the eBPF kernel collection program to distinguish different serviceless computing instances; Step 102, use the non-invasive kernel feature of eBPF to select Tracepoints tracking points to collect system events of serviceless computing instances at the entrance and exit of the system event, which can improve the collection performance while ensuring the stability of the system; Step 103, transmit system event data of serviceless computing instances collected in the kernel to the user space for convenient data transmission.

[0031] Further, there is a preferred embodiment, the system events collected above include: execve, fork, clone, socket, bind, listen, accept4, connect, sendto, recvfrom, open, chmod, chown, access, unlink and unlinkat. The collected system event information mainly includes: process PID namespace, process ID, system event name, partial system event parameter list, system event return value and system event start time, etc.

[0032] Step 2, system event data transmission, the system event data of the serverless computing instance collected on the serverless computing node is transmitted to the provenance graph storage center node; Specifically, Step 201, according to the collected system event collection data in step 1, using RDMA READ operation, the data is sent in micro-batch to avoid frequent data transmission and reduce CPU resource consumption; Step 202, for the convenience of data transmission, the data sending buffer is designed as a lock-free ring buffer to realize the reuse of the buffer; Further, there is a preferred embodiment, in the above data process, the provenance graph storage center node is the active end of the RDMA READ operation, and the serverless computing node is the passive end of the RDMA READ operation.

[0033] Step 3, provenance graph construction and compression, the system event of the serverless computing instance is received and processed on the provenance graph storage center node, and the construction, compression and query of the provenance graph are completed.

[0034] Specifically, Step 301, the collected system event data of the serverless computing instance is preprocessed to unify the data format; Step 302, the preprocessed system event is used to construct the provenance graph for the organization and management of data; Step 303, a provenance graph lossless compression scheme PGC-MQP is designed. PGC-MQP simplifies the monotonic values and redundant strings in the provenance graph, converts the entities and events of the simplified provenance graph into numerical vectors, stores them by using a deep neural network (DNN) model, and realizes lossless compression of the provenance graph by introducing a calibration table.

[0035] Step 304, after the provenance graph is compressed, PGC-MQP provides provenance graph query API for three security detection applications to meet the data requirements of security detection applications based on the provenance graph.

[0036] Further, there is a preferred embodiment that each piece of system event data in step 3 is preprocessed into the form of subject, event and object; the constructed provenance graph ontology model contains three types of entities and 16 types of association relationships between them.

[0037] Further, in the numerical vector of entities and events in step 3, 1 is used to separate different attributes, and 0 is used to separate entities or events. The corresponding attribute value is predicted by Id, and the numerical vector is processed by using a sliding window method, the size of the sliding window is set to 16, and the step is 1, that is, the window slides one position to the right each time. The data in the sliding window is used as the model input, and the data immediately after the window is used as the model prediction target. A deep neural network model containing four fully connected layers is used to train the numerical vector data of entities and events, and ReLU activation function is used in each layer (except the output layer).

[0038] Further, after lossless compression of the provenance graph, there are four storage components: edge index table, reference table, DNN model and calibration table.

[0039] Embodiment three, the system event collection and provenance graph compression method proposed in any one of the above embodiments can be fully implemented by computer software, therefore, the present embodiment provides a system event collection and provenance graph compression system, the system comprises: The system event collection module based on eBPF collects system events of the service-free computing instance in real time in the kernel, improves the collection performance while ensuring system stability, and reduces the impact of the collection process on the service.

[0040] The data transmission module based on RDMA reduces the data transmission frequency by using RDMA READ single-sided operation micro-batch data transmission, and realizes registration memory reuse while ensuring data consistency by designing the registration memory as a lock-free ring buffer, thereby reducing resource overhead.

[0041] The provenance graph construction and compression module constructs the provenance to facilitate data organization and management, further converts the entities and events of the provenance graph into numerical vectors and compresses them by using a DNN model, and records the data of model prediction errors by using a calibration table, thereby reducing the storage overhead of the provenance graph while ensuring data integrity; in addition, the provenance graph query API is provided to provide data support for security detection applications.

[0042] Embodiment four, the present embodiment proposes a computer device comprising a memory and a processor, the memory stores a computer program, when the processor runs the computer program stored in the memory, the processor executes the method and steps in any one of the above embodiments.

[0043] Embodiment five, the embodiment proposes a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor The method and steps of any one of the above embodiments.

[0044] Embodiment six, the embodiment proposes a specific embodiment for explaining the above-mentioned embodiments, which is specifically: See Figures 1 to 9 The method of the embodiment includes the following steps: The embodiment can collect system events of serverless computing instances, transmit the collected system events across nodes, and losslessly compress the provenance graph.

[0045] First, use eBPF non-invasive kernel technology to collect system events of serverless computing instances, improve system event collection performance; transmit data across nodes through RDMA to reduce data transmission overhead; finally, construct a provenance graph based on the collected system event data and perform lossless compression processing to reduce storage space occupation.

[0046] The serverless computing system event collection and provenance graph compression scheme of the embodiment introduces eBPF non-invasive kernel technology, RDMA data transmission technology and DNN model, realizes real-time collection of system events in the kernel, transmits data using the RDMAREAD operation characteristics, reduces the system resource overhead of serverless computing nodes, converts the provenance graph into a numerical vector, and uses the DNN model for lossless compression processing to reduce storage resource overhead.

[0047] In combination Figures 1 to 2 , the embodiment proposes a serverless computing system event collection and provenance graph compression method, which includes the following steps: Step 1: Collect system events of serverless computing instances to provide data for the subsequent provenance graph constructed based on system events.

[0048] The collected system events of serverless computing instances are specifically: Step 101, modify the source code of the Watchdog component of the serverless computing instance, and pass the PID namespace of the serverless computing instance to the eBPF kernel collection program after initialization, which is used to distinguish different serverless computing instances in the kernel.

[0049] Step 102, using the non-invasive kernel feature of eBPF, the system event can be collected by eBPF kernel collection program without modifying the kernel, and the Tracepoints tracking points are selected to collect the system events of the serverless computing instance at the entrance and exit of the system event, which improves the collection performance while ensuring the stability of the system. The system event collection framework based on eBPF is shown in Figure 3 The collected system events include: execve, fork, clone, socket, bind, listen, accept4, connect, sendto, recvfrom, open, chmod, chown, access, unlink, and unlinkat. The collected system event information mainly includes: process PID namespace, process Id, system event name, part of system event parameter list, system event return value, and system event start time, etc.

[0050] Step 103, using eBPF ring buffer in the kernel to store the collected system events, and transmitting them to the user space through shared memory, which is convenient for subsequent data transmission.

[0051] Step 2: System event data transmission, transmitting the system event data of the serverless computing instance collected on the serverless computing node to the provenance graph storage center node.

[0052] The system event data transmission is specifically: Step 201, according to the collected system event collection data in step 1, using RDMA READ operation to send data, in order to avoid frequent data transmission, using micro-batch transmission to reduce CPU resource consumption; the provenance graph storage center node is the active end of the RDMA READ operation, and the serverless computing node is the passive end of the RDMA READ operation, as shown in Figure 4 .

[0053] Step 202, for the convenience of data transmission, the data sending buffer is designed as a lock-free ring buffer, realizing the reuse of the buffer; CAS atomic operation is used to update the information of the ring buffer, ensuring the consistency of the ring buffer data, reducing the performance loss caused by lock competition, and avoiding thread from falling into deadlock.

[0054] Step 3: Provenance graph construction and compression, receiving and processing the system events of the serverless computing instance on the provenance graph storage center node, and completing the construction, compression and query of the provenance graph.

[0055] The provenance graph construction and compression are specifically: Step 301, preprocessing the collected system event data of the serviceless computing instance to unify the data format. Each piece of system event data is preprocessed into the form of subject, event and object.

[0056] Step 302, constructing a provenance graph for the preprocessed system event, facilitating the organization and management of data; the ontology model of the constructed provenance graph contains three types of entities and 16 types of association relationships between them.

[0057] Step 303, designing a provenance graph lossless compression scheme PGC-MQP. PGC-MQP simplifies the monotonic values and redundant strings in the provenance graph, converts the entities and events of the simplified provenance graph into numerical vectors, uses 1 to separate different attributes, and uses 0 to separate entities or events, as shown in Figure 5 The corresponding attribute value is predicted using Id, and a sliding window method is used to process the numerical vector, with a window size of 16 and a step size of 1, i.e. the window slides one position to the right each time, as shown in Figure 6 The data in the sliding window is used as the model input, and the data immediately after the window is used as the model prediction target. A DNN model containing four fully connected layers is used for storage, and a calibration table is introduced to realize lossless compression of the provenance graph. After lossless compression of the provenance graph, there are four storage components: edge index table, reference table, DNN model and calibration table, as shown in Figure 7

[0058] Step 304, after compressing the provenance graph, PGC-MQP analyzes the requirements of existing security detection applications based on the provenance graph; combined with the compression process, it provides provenance graph query API for three security detection applications and provides data support.

[0059] The specific implementation is as follows: (I) Implementation method.

[0060] According to the serviceless computing system event collection and provenance graph compression process shown in Figure 1 The serviceless computing system event collection and provenance graph compression process shown in

[0061] In step 101, the Watchdog source code is modified to read / proc / self / ns / pid_for_children at the start of the serviceless computing instance to obtain its PID namespace, which is transmitted to the eBPF collection program in the kernel for distinguishing different serviceless computing instances.

[0062] ​In step 102, the system events of the service-free computing instance are collected according to the entry and exit of the kernel Tracepoints tracking point system event according to the PID namespace of the service-free computing instance.

[0063] In step 103, the collected system events are stored using the eBPF ring buffer in the kernel, and are transmitted to the user space through shared memory, facilitating subsequent data transmission.

[0064] In step 201, the collected system event data is transmitted in micro-batches through the RDMA READ operation, avoiding frequent data transmission; the trace graph storage center node acts as the active end of the RDMA READ operation, and the service-free computing node acts as the passive end of the RDMA READ operation.

[0065] In step 202, the data transmission buffer is designed as a lock-free ring buffer, realizing the reuse of the buffer and facilitating data transmission; the CAS atomic operation is used to update the information of the ring buffer, ensuring the consistency of the ring buffer data, reducing the performance loss caused by lock competition, and avoiding thread from falling into deadlock.

[0066] In step 301, the collected system event data of the service-free computing instance is preprocessed to unify the data format. Each system event data is preprocessed into the form of subject, event and object.

[0067] In step 302, the preprocessed system event is used to construct a trace graph, facilitating the organization and management of data; the constructed trace graph ontology model contains three types of entities and 16 types of association relationships between them.

[0068] In step 303, the PGC-MQP compression scheme simplifies the monotonic values and redundant strings in the trace graph, converts the simplified trace graph entities and events into numerical vectors, and processes the numerical vectors using a sliding window method. The size of the sliding window is set to 16, and the step is 1, i.e. the window moves one position to the right each time. The data in the sliding window is used as the model input, and the data immediately after the window is used as the model prediction target. A DNN model containing four fully connected layers is used for storage, and a calibration table is introduced to realize lossless compression of the trace graph. After lossless compression of the trace graph, there are four storage components: edge index table, reference table, DNN model and calibration table.

[0069] In step 304, after compressing the trace graph, the PGC-MQP analyzes the requirements of existing security detection applications based on the trace graph; combined with the compression process, the trace graph query API is provided for three security detection applications, providing data support.

[0070] (II) Experimental verification.

[0071] In this embodiment, the proposed event collection and provenance graph compression method and system are mainly focused on comprehensive verification and effectiveness evaluation. In order to verify the effectiveness of the present application, the present application is compared with the existing event collection scheme of serverless computing system (ALASTOR) and the existing provenance graph compression scheme (LEONARD).

[0072] The event collection and provenance graph compression method and system of serverless computing system are deployed in Hello Retail! to test the serverless application. In order to test the influence of different collection schemes on the performance of serverless computing, the present application tests the access delay of serverless computing instances under the native serverless (OpenFaas), the system event collection scheme based on eBPF of the present application and the ALASTOR scheme. The access delay refers to the time from sending a request to receiving a response, which can directly reflect the influence of system event collection on the performance of serverless computing instances. In order to evaluate the influence of different methods on the access delay of serverless computing instances, this embodiment compares and analyzes the access delay of different serverless computing instances in Hello Retail!. Compared with ALASTOR, eBPF collection has less influence on the performance of serverless computing instances, as shown in FIG. 8. Specifically, the average access delay time of serverless computing instances using eBPF collection increases by only 2.91%, while the average increase of ALASTOR collection is 27.10%, indicating that eBPF collection has lower performance overhead on serverless computing instances. In order to verify the effectiveness of the PGC-MQP storage scheme of the present application, this embodiment uses the DARPA public dataset (this embodiment is named T1-T3) and the system event data collected based on eBPF of the present application (this embodiment is named eBPF1-eBPF3) to conduct provenance graph compression experiments. This embodiment compares the storage space of PGC-MQP, LEONARD and Neo4j, as shown in FIGS. Figure 9 Figure 9 (a) and Figure 9 (c) respectively; the storage space of each part of PGC-MQP on different datasets is shown in FIGS. Figure 9 (b) and Figure 9 ​(d) as shown. The experimental results show that the storage space overhead of PGC-MQP is much lower than Neo4j. On the DARPA dataset, the storage space of PGC-MQP is 93.24%, 99.13% and 99.46% of LEONARD, respectively; on the eBPF dataset, the storage space of PGC-MQP is 94.98%, 91.78% and 93.42% of LEONARD, respectively.

[0073] Figure 1 Any processes or methods described in the flowcharts or otherwise described herein can be understood as representing code modules, segments, or portions of code which include one or more executable instructions for implementing specific logic functions (or steps) of the application, and / or that the various embodiments of the application can include other implementations of hardware or software performing the same functions or steps (e.g., where steps are not performed in sequence, terms such as "before" and "after" used herein refer to relative timing, not absolute timing, unless otherwise specified, and it is understood that various steps can be performed in different orders by different embodiments of the application, as will be appreciated by those skilled in the art). The description of a flowchart or other description herein should not be interpreted as implying a fixed order in which functions or steps must be performed, unless otherwise specifically stated. The logic of a flowchart or other description can be implemented by variable sequences of code segments, which need not be contiguous. In this respect, embodiments of the application include the use of functions, programs, routines, subroutines, objects, components, data structures, modules, etc., which can perform one or more steps or portions of steps in the processes described herein. The various embodiments of the application can also include structures or components that can not be explicitly shown or described herein, but which nonetheless can be used in the various embodiments of the application. The description herein of any process or method can be understood as representing one or more modules, segments, or portions of code that include executable instructions for implementing the specified logical function (or step), and the scope of the preferred embodiments of the application includes additional implementations in which the functions can be performed in different orders, in different ways, or not at all, as will be understood by those skilled in the art. The logic and / or steps represented in the flowcharts or otherwise described herein illustrate possible architectures, functions, and operations for apparatuses, methods, and / or procedures in accordance with various embodiments of the present disclosure. In this regard, each block in the flowcharts or other description herein can represent a module, segment, or portion of code that comprises one or more executable instructions for implementing the specified logical function ("application specific" or "AS). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or in the reverse order, depending on the functionality involved. It will also be noted that each block of the flowchart or other description herein, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and

[0074] The computer device provided in the embodiment includes a hardware device of a general type, which is not represented in the form of a diagram. The system includes a processor and a memory, wherein the processor and the memory can be connected through a bus or other manners. The memory is a non-transitory computer readable storage medium, which can be used to store a non-transitory software program, a non-transitory computer executable program and a module, and corresponding program instructions / modules. The processor executes various function applications and data processing of the processor by running the non-transitory software program, instructions and modules stored in the memory, so as to implement the no-service computing system event collection and trace graph compression method and steps in the above method embodiment.

[0075] The memory can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged with respect to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, an extranet, a mobile communication network, and a combination thereof.

[0076] One or more modules are stored in the memory, and when the processor executes, the method steps in the embodiment are executed. Thus, the inventive purpose of the present application can be achieved through the method and device, and the flow of the present application. The above computer device specific details can be understood by referring to the corresponding related description and effects in the embodiment, which will not be described here.

[0077] Those skilled in the art can understand that all or part of the above-mentioned embodiment method can be completed by a computer program instructing related hardware. The program can be stored in a computer readable storage medium. When the program is executed, it can include the flow of the above-mentioned embodiment method. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid state disk (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0078] The technical solutions of the present application are described in further detail through several specific embodiments above, in order to highlight the advantages and benefits of the technical solutions provided by the present application. However, the above several specific embodiments are not used as a limitation to the present application, and any reasonable changes and improvements, reasonable combinations and equivalent replacements of the embodiments, etc. based on the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for collecting and compressing event traceability graphs in a serverless computing system, characterized in that: The method is: Step 1: Collect system events of serverless computing instances; Step 2: The system event data of the serverless computing instance collected on the serverless computing node is transmitted to the provenance graph storage center node; Step 3: Receive and process system events at the provenance graph storage center node, and complete the construction, compression, and query of the provenance graph.

2. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 1, characterized in that: Step 1 is as follows: Step 101: Modify the Watchdog component of the serverless computing instance to obtain its PID namespace, and extend the kernel collection program of the Berkeley packet filter according to the PID namespace to distinguish different serverless computing instances; Step 102: Based on the non-intrusive kernel feature of eBPF, select Tracepoints to collect system events of the serverless computing instance at the entry and exit of system events; Step 103: The system event data of the serverless computing instance collected in the kernel is transmitted to the user space.

3. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 2, characterized in that: Step 2 is as follows: Step 201: Collect data based on the collected system events and transmit the data using RDMA READ operations; Step 202: Design the data buffer as a lock-free ring buffer, and use CAS atomic operations to update the information of the ring buffer.

4. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 3, characterized in that: The provenance graph storage center node acts as the active end of the RDMA READ operation, and the serverless computing node acts as the passive end of the RDMA READ operation.

5. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 4, characterized in that: Data is transmitted in micro-batch mode.

6. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 1, characterized in that: Step 3 is as follows: Step 301: Pre-process the received system event data without service instances; Step 302: Construct a traceability graph for the pre-processed system events; Step 303: Construct a provenance graph compression method that can support multiple provenance graph query modes. Use the provenance graph compression method to simplify monotonic values ​​and redundant strings in the provenance graph. Then, convert the entities and events of the simplified provenance graph into numerical vectors, store them using a deep neural network model, and achieve lossless compression of the provenance graph by introducing a calibration table. Step 304: After the traceability graph is compressed, a traceability graph compression method is used to provide a traceability graph query API for the three security detection applications.

7. The method for collecting and compressing serverless computing system events and traceability graphs according to claim 1, characterized in that: Each piece of system event data is preprocessed into the form of subject, event and object; the constructed traceability graph ontology model contains three types of entities and 16 types of association relationships between them.

8. Serverless computing system event collection and traceability graph compression system, characterized by: The system includes a storage device, which is used to execute the method and steps described in claim 1.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the method for event collection and traceability graph compression of a serverless computing system according to any one of claims 1 to 7.

10. A computer device, characterized in that: The device includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the method for event collection and traceability graph compression of a serverless computing system as described in any one of claims 1 to 7.

Images