Method and device for determining network traffic source process, equipment, storage medium and program product

Abstract

The invention relates to the technical field of computer network security, and provides a method, a device and equipment for determining a network traffic source process, a storage medium and a program product, which can realize accurate tracing of the traffic source process in the face of a system service agent process. When a filtering flow instance formed based on intercepted network flow packaging is received, if a network request initiating process is determined to be a system service agent process according to information carried by the filtering flow instance, a file list opened by the network request initiating process is acquired; when a target file path is determined in the file paths corresponding to the file list, determining a root path segment used for identifying an application container and a sub-path segment used for positioning an application component data storage area in the target file path; obtaining a first application identifier according to a path segment between the root path segment and the sub-path segment in the target file path; and if the process matched with the first application identifier exists, taking the process as a flow source process of the network flow.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for determining network traffic source processes. Background Technology

[0002] In computer systems, network traffic monitoring is crucial for network security, performance optimization, and application behavior analysis. In some operating system environments, with the increasing complexity of network applications, the need for precise monitoring and analysis of process-level network traffic is becoming increasingly urgent. Some operating systems provide network extension frameworks that allow developers to intercept and analyze network traffic. In the working mechanism of these frameworks, intercepted network traffic is encapsulated as a FilterFlow instance. Information about the network request initiating the traffic can be obtained from the FilterFlow instance, such as the process identifier (PID, a unique identifier for a process), process name, and application identifier (a unique identifier for an application).

[0003] However, the traffic interception scheme based on this network extension framework has certain limitations. When the network traffic corresponds to network requests originating from certain special system service processes, since these system service processes usually act as proxies for other processes to perform network operations, it is difficult to accurately trace the true initiator of the network traffic (i.e., the traffic source process) by filtering the information carried by the flow instance. This results in a significant limitation on the monitoring performance in such scenarios. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, storage medium, and computer program product for determining network traffic source processes to address the aforementioned technical problems.

[0005] This application provides a method for determining the source process of network traffic, the method comprising:

[0006] When a filtered stream instance formed by encapsulating intercepted network traffic is received, the system determines whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filtered stream instance.

[0007] If the network request initiating process is a system service agent process, then obtain the list of files opened by the network request initiating process;

[0008] When the target file path is determined from the file paths corresponding to the file list based on the preset file path characteristics, the root path segment used to identify the application container and the sub-path segment used to locate the data storage area of ​​the application components are determined in the target file path.

[0009] The first application identifier is obtained based on the path segment located between the root path segment and the sub-path segment in the target file path;

[0010] If a process exists that matches the first application identifier, then that process is used as the traffic source process for the network traffic.

[0011] This application provides a device for determining the source process of network traffic, the device comprising:

[0012] The proxy process determination module is used to determine, when a filter stream instance formed by encapsulating intercepted network traffic is received, whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filter stream instance.

[0013] The file list acquisition module is used to acquire the file list opened by the network request initiating process if the network request initiating process is a system service agent process.

[0014] The path processing module is used to determine the root path segment used to identify the application container and the sub-path segment used to locate the application component data storage area in the target file path when the target file path is determined from the file paths corresponding to the file list according to the preset file path characteristics.

[0015] An application identifier determination module is used to obtain a first application identifier based on a path segment located between the root path segment and the sub-path segment in the target file path;

[0016] The traffic source process determination module is used to identify a process that matches the first application identifier as the traffic source process of the network traffic.

[0017] This application provides a computer device, including a memory and a processor, wherein the memory stores a computer program and the processor executes the above-described method.

[0018] This application provides a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor using the methods described above.

[0019] This application provides a computer program product having a computer program stored thereon, the computer program being executed by a processor using the above-described method.

[0020] The aforementioned method, apparatus, computer equipment, storage medium, and computer program product for determining the source process of network traffic, when receiving a filtered stream instance formed by encapsulating intercepted network traffic, determines whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filtered stream instance. If the network request initiating process is a system service proxy process, it indicates that the network request initiating process may access relevant files when providing services to the application. Therefore, the file list becomes a tracing clue, and correspondingly, the list of files opened by the network request initiating process can be obtained. After obtaining the file list, when determining the target file path in the file path corresponding to the file list based on preset file path characteristics, the root path segment used to identify the application container and the sub-path segment used to locate the data storage area of ​​the application component are determined in the target file path. Based on the path segment located between the root path segment and the sub-path segment in the target file path, the first application identifier is obtained, indicating that the network request initiating process is highly likely to provide services to the application corresponding to the first application identifier. If a process matching the first application identifier exists, the process can be regarded as the source process of the network traffic, thereby successfully determining the true initiator of the network traffic and realizing accurate tracing of the source process and accurate monitoring of network traffic. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is an application environment diagram of a method for determining the network traffic source process in one embodiment;

[0023] Figure 2 This is a flowchart illustrating a method for determining the network traffic source process in one embodiment;

[0024] Figure 3 This is another flowchart illustrating a method for determining the network traffic source process in one embodiment;

[0025] Figure 4 This is a structural block diagram of a device for determining the network traffic source process in one embodiment;

[0026] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0028] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various objects, but these objects are not limited by these terms. These terms are only used to distinguish the first object from the second object. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the solutions, or any combination of multiple solutions.

[0029] The method for determining the network traffic source process provided in this application can be applied to, for example, Figure 1 In the application environment shown, the terminal and server communicate via a network. The terminal can run an operating system, which can be an operating system that provides a network extension framework. The terminal can perform the following steps: When it receives a filtered stream instance formed by encapsulating intercepted network traffic, it determines whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filtered stream instance; if the network request initiating process is a system service proxy process, it obtains a list of files opened by the network request initiating process; when the target file path is determined from the file paths corresponding to the file list based on preset file path characteristics, it determines the root path segment used to identify the application container and the sub-path segment used to locate the application component data storage area in the target file path; based on the path segment located between the root path segment and the sub-path segment in the target file path, it obtains a first application identifier; if a process matching the first application identifier exists, it is used as the traffic source process of the network traffic.

[0030] The terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can include virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Servers can store data in a data storage system. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing cloud computing services.

[0031] Traffic interception schemes based on the network extension framework provided by the operating system have certain limitations. Operating systems have special system service processes that typically run as proxies, handling network requests from other processes; these processes can be called system service proxy processes. For example, in some operating systems, when a traffic source process uses frameworks like Webkit to open a webpage, the socket connection is not created by the traffic source process itself, but rather initiated by a system service proxy process. These system service proxy processes have no parent-child relationship with the traffic source process, and the operating system does not provide an API to determine the traffic source process.

[0032] Due to the proxy nature of system service proxy processes, when network traffic from such processes is intercepted by a network extension framework, information about the source process (which can be considered the original requesting process) cannot be obtained from the filtered flow instance. This is because the system service proxy process itself is not the process that actually initiates the network request, but rather performs network operations on behalf of other processes. In this situation, related monitoring solutions cannot accurately identify the source process, leading to inaccurate monitoring and missing information. Furthermore, methods such as matching by parent process ID or process group to obtain source process information are also ineffective, because the parent-child process relationship and process group structure of the system service proxy process cannot directly reflect the association between the source process information and the system service proxy process.

[0033] In some operating system environments, monitoring solutions for network traffic of system service agent processes often fall short of the requirement for accurate tracing of traffic source processes. This inadequacy in monitoring capabilities can lead to inaccurate network behavior analysis, affecting a comprehensive understanding of network application performance, security risks, and user behavior. For example, in the field of network security, the inability to accurately identify the traffic source process may result in misjudgments or omissions of security threats; in performance optimization, the inability to accurately locate the source of network traffic makes it difficult to implement optimization measures precisely.

[0034] Based on this, this application provides a solution for network management scenarios involving zero-trust process granularity, in order to solve the problems faced by related monitoring solutions when dealing with system service proxy processes, so as to achieve accurate tracing of traffic source processes, thereby improving the overall efficiency and accuracy of network traffic monitoring under certain operating system environments.

[0035] The solution provided in this application achieves precise source tracing of traffic origin processes by analyzing the files opened by system service agent processes and their data exchange characteristics. Unlike related technologies that directly obtain process information or match process relationships, the solution provided in this application can delve into the file operation and data exchange levels of processes, mining the correlation information between traffic origin processes and system service agent processes from these underlying behavioral characteristics. This enables accurate identification of network traffic initiators, effectively solving the problem that related monitoring methods cannot obtain traffic origin process information when dealing with system service agent processes. It provides more accurate and comprehensive technical support for network security, performance optimization, and application behavior analysis, improves the overall efficiency and accuracy of network traffic monitoring in certain operating system environments, and provides a new technical solution for network traffic monitoring in certain operating system environments.

[0036] The operating system can be a desktop operating system. The operating system can provide a network extension framework, which can perform traffic capture; accordingly, the network extension framework can also be called a traffic capture framework.

[0037] FilterFlow: A network extension framework that encapsulates traffic connections and can include process identifier information that initiates the traffic.

[0038] PID: Process Identifier, a process ID assigned by the operating system.

[0039] Application Identifier: The ID of an application software package. In the operating system platform, the application software binary file has its own ID, which belongs to the application identifier.

[0040] com.platform.WebKit.Networking: The application identifier for the system service agent process that handles web page requests on the operating system platform.

[0041] In one embodiment, such as Figure 2 As shown, a method for determining the source process of network traffic is provided, which can be applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps:

[0042] Step S201: When a filter stream instance formed by encapsulating intercepted network traffic is received, determine whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filter stream instance.

[0043] The network extension framework provided by the operating system can be activated to enable network traffic interception. This network extension framework can then enter a waiting state, ready to receive network traffic events and encapsulate the intercepted network traffic to form a filtered stream instance. This network traffic can be generated by the network request initiating process based on the corresponding network request.

[0044] When a filtered stream instance is received, the system service proxy process can be determined based on the information carried by the filtered stream instance (such as the application identifier).

[0045] If the process initiating the network request is not a system service proxy process, then the process initiating the network request can be used as the traffic source process to obtain the target process and participate in the subsequent business processing flow.

[0046] Step S202: If the network request initiating process is a system service agent process, then obtain the list of files opened by the network request initiating process.

[0047] If the process initiating the network request belongs to a system service agent process, then the list of files opened by the process initiating the network request can be obtained.

[0048] Step S203: When determining the target file path in the file path corresponding to the file list based on the preset file path characteristics, determine the root path segment used to identify the application container and the sub-path segment used to locate the data storage area of ​​the application components in the target file path.

[0049] After determining the list of files opened by the process initiating the network request, the paths of each file in the list can be obtained, resulting in several file paths. These file paths can then be analyzed one by one based on preset file path characteristics to obtain the target file path. For example, the preset file path characteristics could be " / Library / Containers / com.xxxx.xxxx / Data / Library / WebKit". It can be determined whether a file path matching these characteristics exists, and the matching file path is taken as the target file path. After determining the target file path, a root path segment (e.g., " / Library / Containers / ") for identifying the application container and a sub-path segment (e.g., " / Data" or " / Data / Library / WebKit") for locating the application component data storage area can be determined within the target file path.

[0050] Step S204: Obtain the first application identifier based on the path segment located between the root path segment and the sub-path segment in the target file path.

[0051] The path segment located between the root path segment and the sub-path segment in the target file path can be identified. This path segment can be used as the application identifier, and for distinction, it is referred to as the first application identifier. For example, if the target file path is " / Library / Containers / com.mail / Data / Library / WebKit", and the path segment located between the root path segment (" / Library / Containers / ") and the sub-path segment (such as " / Data" or " / Data / Library / WebKit") is "com.mail", then "com.mail" can be used as the first application identifier.

[0052] Step S205: If a process exists that matches the first application identifier, then the process is used as the traffic source process for network traffic.

[0053] After obtaining the first application identifier, it can be determined whether there is a process that matches the first application identifier; if there is, the process can be used as the traffic source process of the network traffic, the target process can be obtained, and it can participate in the subsequent business processing flow, thereby enabling accurate tracing of the traffic source process and accurate monitoring of network traffic.

[0054] In the above method for determining the source process of network traffic, when a filtered stream instance formed by encapsulating intercepted network traffic is received, the information carried by the filtered stream instance is used to determine whether the network request initiating process corresponding to the network traffic is a system service proxy process. If the network request initiating process is a system service proxy process, it indicates that the network request initiating process may access relevant files when providing services to the application. Therefore, the file list becomes a tracing clue, and correspondingly, the file list opened by the network request initiating process can be obtained. After obtaining the file list, the target file path can be determined in the file path corresponding to the file list based on the preset file path characteristics. The root path segment used to identify the application container and the sub-path segment used to locate the data storage area of ​​the application component are determined in the target file path. Based on the path segment located between the root path segment and the sub-path segment in the target file path, the first application identifier is obtained, indicating that the network request initiating process is likely to provide services to the application corresponding to the first application identifier. If a process matching the first application identifier exists, the process can be regarded as the source process of the network traffic, thereby successfully determining the true initiator of the network traffic and realizing accurate tracing of the source process and accurate monitoring of network traffic.

[0055] In one embodiment, determining whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filter stream instance includes:

[0056] Extract the application identifier of the network request initiating process corresponding to the network traffic from the filtered stream instance to obtain the second application identifier; perform a consistency comparison between the second application identifier and the application identifier of the stored system service proxy process; determine whether the network request initiating process is the system service proxy process based on the consistency comparison result.

[0057] Filtered stream instances, formed by encapsulating network traffic, can carry information such as process identifiers, process names, and application identifiers. By parsing these instances, the application identifier can be extracted; this identifier belongs to the application identifier of the process that initiated the network request corresponding to the network traffic. The application identifier extracted from the filtered stream instance can be called the second application identifier.

[0058] It can store the application identifier of a known system service agent process. It can compare the second application identifier with the stored application identifier of the system service agent process to obtain the consistency comparison result, thereby determining whether the network request initiating process belongs to the system service agent process.

[0059] This embodiment can clearly distinguish the system service agent process from other processes by extracting and comparing the chain logic, providing a reliable decision basis for subsequent source tracing.

[0060] In one embodiment, determining whether the network request initiating process is a system service proxy process based on the consistency comparison result includes:

[0061] If the consistency comparison result indicates that the second application identifier is consistent with the application identifier of the stored system service agent process, then the network request initiating process is determined to be the system service agent process; if the consistency comparison result indicates that the second application identifier is inconsistent with the application identifier of the stored system service agent process, then the network request initiating process is determined not to be the system service agent process.

[0062] If the consistency comparison result indicates that the second application identifier is consistent with the application identifier of the stored system service agent process (such as com.platform.WebKit.Networking), it can be determined that the network request initiating process belongs to the system service agent process. Then, source tracing can be performed to determine the source process of the network traffic, thereby enabling accurate source tracing of the traffic source process and accurate monitoring of network traffic.

[0063] If the consistency comparison result indicates that the second application identifier is inconsistent with the application identifier of the stored system service agent process, it is determined that the network request initiating process does not belong to the system service agent process. In this case, the network request initiating process can be used as the traffic source process and participate in the subsequent business processing flow.

[0064] In one embodiment, the method provided in this application further includes:

[0065] Obtain information features from the preset file path features; the information features include root path segment information features and sub-path segment information features; determine candidate file paths from the file paths corresponding to the file list based on whether the file path includes the path segment corresponding to the root path segment information features and the path segment corresponding to the sub-path segment information features; determine whether the path structure of the candidate file path conforms to the structural features in the file path features based on the relative positional relationship between the path segment corresponding to the root path segment information features and the path segment corresponding to the sub-path segment information features in the candidate file path, so as to obtain the target file path.

[0066] For example, the preset file path signature can be " / Library / Containers / com.xxxx.xxxx / Data / Library / WebKit".

[0067] In this example, the information features in the file path feature may include " / Library / Containers / " and " / Data / Library / WebKit", where " / Library / Containers / " belongs to the root path segment information feature and " / Data / Library / WebKit" belongs to the sub-path segment information feature. The structural feature in the file path feature may be that " / Library / Containers / " precedes " / Data / Library / WebKit".

[0068] After determining the list of files opened by the process that initiated the network request, the path of each file in the list can be obtained, resulting in several file paths. These file paths can then be analyzed one by one based on preset file path characteristics.

[0069] During the analysis, if a file path includes both the path segment " / Library / Containers / " and the path segment " / Data / Library / WebKit", then that file path can be considered as a candidate file path.

[0070] If the path segment " / Library / Containers / " precedes the path segment " / Data / Library / WebKit" in the candidate file path, then the path structure of the candidate file path conforms to the structural characteristics of the file path, and the candidate file path can be used as the target file path.

[0071] In this embodiment, initial screening is performed by dual matching of root path segment information features and sub-path segment information features. This can efficiently eliminate irrelevant file paths and quickly focus on valid file paths, thereby improving search efficiency. By verifying the relative positional relationship between path segments, it can be ensured that the final target file path has structural file path features. This can effectively avoid misjudgments caused by matching similar but invalid paths, and ensure the accuracy of subsequent application identifier extraction and the robustness of the solution.

[0072] In one embodiment, the path structure of the candidate file path is determined to conform to the structural features in the file path features based on the relative positional relationship between the path segment corresponding to the root path segment information feature and the path segment corresponding to the sub-path segment information feature in the candidate file path, so as to obtain the target file path, including:

[0073] If the path segment corresponding to the root path segment information feature in the candidate file path precedes the path segment corresponding to the sub-path segment information feature, then the path structure of the candidate file path is determined to conform to the structural feature in the file path feature; the candidate file path is determined as the target file path.

[0074] For example, the preset file path signature can be " / Library / Containers / com.xxxx.xxxx / Data / Library / WebKit".

[0075] In this example, the information features in the file path feature may include " / Library / Containers / " and " / Data / Library / WebKit", where " / Library / Containers / " belongs to the root path segment information feature and " / Data / Library / WebKit" belongs to the sub-path segment information feature. The structural feature in the file path feature may be that " / Library / Containers / " precedes " / Data / Library / WebKit".

[0076] After determining the candidate file path, it can be determined whether the path segment " / Library / Containers / " in the candidate file path comes before the path segment " / Data / Library / WebKit". If so, it can be determined that the path structure of the candidate file path conforms to the structural characteristics in the file path characteristics, and the candidate file path can be used as the target file path.

[0077] In this embodiment, if the path segment corresponding to the root path segment information feature in the candidate file path is before the path segment corresponding to the sub-path segment information feature, it can be determined that the candidate file path structurally conforms to the file path feature. This can effectively avoid misjudgment caused by matching similar but invalid paths, and ensure the accuracy of subsequent application identifier extraction and the robustness of the scheme.

[0078] In one embodiment, the method provided in this application may further include:

[0079] Obtain the set of active processes; determine within the set of active processes whether a process matching the first application identifier exists.

[0080] The set of active processes can be obtained through the operating system's task manager list; the task manager list can be a real-time list provided by the operating system that contains all currently running graphical interface applications.

[0081] It is possible to determine whether there is a process in the active process set that matches the first application identifier (such as "com.mail"). If so, the process can be used as the traffic source process and participate in the subsequent business processing flow, thereby enabling accurate tracing of the traffic source process and accurate monitoring of network traffic.

[0082] To better understand the above method, the following details an application example of the method for determining the network traffic source process of this application. This application example may include... Figure 3 The steps shown are as follows:

[0083] Step S301: Wait for network traffic.

[0084] The network extension framework provided by the operating system can be activated to enable network traffic interception. The network extension framework can then enter a waiting state, ready to receive network traffic events.

[0085] Step S302: Determine whether a filtered flow instance based on network traffic encapsulation has been received; if not, return to step S301 and continue waiting for traffic; if yes, proceed to step S303.

[0086] Step S303: Obtain the second application identifier based on the application identifier extracted from the filter stream instance.

[0087] Step S304: Determine whether the second application identifier is consistent with the application identifier of the stored system service agent process.

[0088] If there is a discrepancy, the process that initiated the network request can be taken as the traffic source process to obtain the target process, and then proceed to step S305 to carry out the subsequent business processing flow.

[0089] If they match, proceed to step S306 to obtain the list of files opened by the network request initiating process.

[0090] Step S307: Determine whether the first application identifier located between " / Library / Containers / " and " / Data" has been extracted.

[0091] If the data is not retrieved, proceed to step S305 for further business processing.

[0092] If the traffic is extracted, proceed to step S308, determine the traffic source process based on the first application identifier, and then proceed to step S305 for subsequent business processing.

[0093] This application example provides a proxy process identification and special handling mechanism: it identifies the application identifier of system service proxy processes (such as com.platform.WebKit.Networking), and instead of directly using the system service proxy process information, it further analyzes its file path.

[0094] This application example provides a file path analysis and tracing mechanism: by analyzing the file paths opened by the system service agent process and extracting the application identifiers under specific paths, the source of the traffic can be accurately traced.

[0095] This application example provides a business processing mechanism based on the traffic source process: the traced traffic source process is used for subsequent business processing, which can ensure the accuracy and completeness of monitoring.

[0096] If monitoring solutions using related technologies are insufficient to effectively identify the source process of traffic generated by system service proxy processes, for example, a webpage request that was originally initiated by a browser may only show that com.platform.WebKit.Networking initiated the request under the monitoring solutions of related technologies, thus making it impossible to accurately control the browser; however, the solution provided in this application example can identify the source process of network traffic as the browser, and can identify the correspondence between network requests and the browser.

[0097] This application example solves the challenge of monitoring system service proxy processes, overcoming the limitations of related technologies in monitoring system service proxy processes on some operating systems, and can accurately identify the source process of traffic. This application example improves monitoring accuracy by achieving precise source tracing through file path analysis, avoiding inaccurate monitoring information caused by the characteristics of system service proxy processes. This application example also enhances applicability, being suitable for complex network applications in some operating system environments, and has broad practicality.

[0098] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0099] Based on the same inventive concept, this application also provides a device for determining network traffic source processes to implement the method for determining network traffic source processes described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the device for determining network traffic source processes provided below can be found in the limitations of the method for determining network traffic source processes described above, and will not be repeated here.

[0100] In one embodiment, such as Figure 4 As shown, a device for determining the source process of network traffic is provided, comprising:

[0101] The proxy process determination module 401 is used to determine, when receiving a filter stream instance formed by encapsulating intercepted network traffic, whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filter stream instance.

[0102] The file list acquisition module 402 is used to acquire the file list opened by the network request initiating process if the network request initiating process is a system service agent process.

[0103] The path processing module 403 is used to determine the root path segment used to identify the application container and the sub-path segment used to locate the application component data storage area in the target file path when the target file path is determined in the file path corresponding to the file list according to the preset file path characteristics.

[0104] Application identifier determination module 404 is used to obtain a first application identifier based on the path segment located between the root path segment and the sub-path segment in the target file path;

[0105] The traffic source process determination module 405 is used to identify a process that matches the first application identifier as the traffic source process of the network traffic.

[0106] In one embodiment, the agent process determination module 401 is used to:

[0107] The application identifier of the network request initiating process corresponding to the network traffic is extracted from the filtered stream instance to obtain the second application identifier; the second application identifier is compared with the application identifier of the stored system service proxy process; based on the consistency comparison result, it is determined whether the network request initiating process is a system service proxy process.

[0108] In one embodiment, the agent process determination module 401 is used to:

[0109] If the consistency comparison result indicates that the second application identifier is consistent with the application identifier of the stored system service agent process, then the network request initiating process is determined to be a system service agent process; if the consistency comparison result indicates that the second application identifier is inconsistent with the application identifier of the stored system service agent process, then the network request initiating process is determined not to be a system service agent process.

[0110] In one embodiment, the apparatus further includes a target file path determination module, configured to:

[0111] Obtain information features from the preset file path features; the information features include root path segment information features and sub-path segment information features; determine candidate file paths from the file paths corresponding to the file list based on whether the file path includes path segments corresponding to the root path segment information features and path segments corresponding to the sub-path segment information features; determine whether the path structure of the candidate file path conforms to the structural features in the file path features based on the relative positional relationship between the path segments corresponding to the root path segment information features and the path segments corresponding to the sub-path segment information features in the candidate file path, so as to obtain the target file path.

[0112] In one embodiment, the target file path determination module is used for:

[0113] If the path segment corresponding to the root path segment information feature in the candidate file path precedes the path segment corresponding to the sub-path segment information feature, then the path structure of the candidate file path is determined to conform to the structural feature in the file path feature; and the candidate file path is determined as the target file path.

[0114] In one embodiment, the apparatus further includes a process matching module, configured to:

[0115] Obtain the set of active processes; determine whether there is a process in the set of active processes that matches the first application identifier.

[0116] Each module in the aforementioned device for determining network traffic source processes can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0117] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for determining network traffic source processes. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0118] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0119] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the various method embodiments described above.

[0120] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the various method embodiments described above.

[0121] In one embodiment, a computer program product is provided having a computer program stored thereon, the computer program being executed by a processor of the steps described in the various method embodiments above.

[0122] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0125] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for determining the source process of network traffic, characterized in that, The method includes: When a filtered stream instance formed by encapsulating intercepted network traffic is received, the system determines whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filtered stream instance. If the network request initiating process is a system service agent process, then obtain the list of files opened by the network request initiating process; When the target file path is determined from the file paths corresponding to the file list based on the preset file path characteristics, the root path segment used to identify the application container and the sub-path segment used to locate the data storage area of ​​the application components are determined in the target file path. The first application identifier is obtained based on the path segment located between the root path segment and the sub-path segment in the target file path; If a process exists that matches the first application identifier, then that process is used as the traffic source process for the network traffic.

2. The method according to claim 1, characterized in that, Based on the information carried by the filtered stream instance, determine whether the network request initiating process corresponding to the network traffic is a system service proxy process, including: The application identifier of the network request initiating process corresponding to the network traffic is extracted from the filtered stream instance to obtain the second application identifier; Perform a consistency comparison between the second application identifier and the application identifier of the stored system service agent process; Based on the consistency comparison results, it is determined whether the network request initiating process is a system service proxy process.

3. The method according to claim 2, characterized in that, Based on the consistency comparison results, determining whether the network request initiating process is a system service proxy process includes: If the consistency comparison result indicates that the second application identifier is consistent with the application identifier of the stored system service agent process, then the network request initiating process is determined to be the system service agent process. If the consistency comparison result indicates that the second application identifier is inconsistent with the application identifier of the stored system service agent process, then it is determined that the network request initiating process is not a system service agent process.

4. The method according to claim 1, characterized in that, The method further includes: Obtain information features from the preset file path features; the information features include root path segment information features and sub-path segment information features; Candidate file paths are determined from the file paths corresponding to the file list based on whether the file path includes the path segment corresponding to the root path segment information feature and the path segment corresponding to the sub-path segment information feature. Based on the relative positional relationship between the path segment corresponding to the root path segment information feature and the path segment corresponding to the sub-path segment information feature in the candidate file path, determine whether the path structure of the candidate file path conforms to the structural features in the file path features, so as to obtain the target file path.

5. The method according to claim 4, characterized in that, Based on the relative positional relationship between the path segment corresponding to the root path segment information feature and the path segment corresponding to the sub-path segment information feature in the candidate file path, determine whether the path structure of the candidate file path conforms to the structural features in the file path features, so as to obtain the target file path, including: If the path segment corresponding to the root path segment information feature in the candidate file path is before the path segment corresponding to the sub-path segment information feature, then the path structure of the candidate file path is determined to conform to the structural feature in the file path feature. The candidate file path is determined as the target file path.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Get the active process set; Determine whether a process matching the first application identifier exists in the set of active processes.

7. A device for determining the source process of network traffic, characterized in that, The device includes: The proxy process determination module is used to determine, when a filter stream instance formed by encapsulating intercepted network traffic is received, whether the network request initiating process corresponding to the network traffic is a system service proxy process based on the information carried by the filter stream instance. The file list acquisition module is used to acquire the file list opened by the network request initiating process if the network request initiating process is a system service agent process. The path processing module is used to determine the root path segment used to identify the application container and the sub-path segment used to locate the application component data storage area in the target file path when the target file path is determined from the file paths corresponding to the file list according to the preset file path characteristics. An application identifier determination module is used to obtain a first application identifier based on a path segment located between the root path segment and the sub-path segment in the target file path; The traffic source process determination module is used to identify a process that matches the first application identifier as the traffic source process of the network traffic.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images