Data processing method, device and equipment

Abstract

The embodiment of the invention discloses a data processing method, device and equipment, and the method comprises the steps: detecting whether a class loaded by a virtual machine is a preset class or not under the condition that a callback request triggered when the virtual machine executes a class loading event is received; when it is detected that the class loaded by the virtual machine is a preset class, registering a local method in the virtual machine, injecting a traffic recording strategy in the local method, and hijacking a preset original method corresponding to the local method; under the condition that a target application generates a communication request, executing the local method through the virtual machine based on the communication request, and obtaining data of the communication request and a corresponding data identifier; and if it is determined that the communication request is a request of a preset communication protocol, recording and storing data of the communication request through the traffic recording strategy based on the data identifier.

Description

TECHNICAL FIELD

[0001] The present document relates to the technical field of computers, and particularly relates to a data processing method, device and equipment. BACKGROUND

[0002] Generally, in the data flow recording technology, the business side usually realizes flow capture in a self-defined manner. For example, for a security aspect with privacy protection and the like, a bytecode enhancement technology Hook WEB server input flow reading related points is usually based on a proxy (such as a Java Agent) of a programming application, byte copying is performed when the flow is read, but this method needs to add different points for different WEB containers (such as Tomcat, Jetty, Undertow and the like), which leads to the divergence of the points. On the other hand, the bytecode enhancement method is to inject a self-defined program code into a related function of a business layer, and due to the characteristics of the programming language level, the virtual machine is affected (such as being affected by the STW (Stop-The-World) of the virtual machine). Therefore, a flow recording mechanism needs to be provided to identify a general point, realize the convergence of the points of the WEB containers such as Tomcat, Jetty and Undertow, and support seamless docking with the current security aspect capability, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency. SUMMARY

[0003] The purpose of the embodiments of the present specification is to provide a flow recording mechanism to identify a general point, realize the convergence of the points of the WEB containers such as Tomcat, Jetty and Undertow, and support seamless docking with the existing security aspect capability, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency.

[0004] In order to achieve the above technical solutions, the embodiments of the present specification are implemented as follows: The data processing method provided by the embodiments of the present specification comprises the following steps: in the case that a callback request triggered by a class loading event of a virtual machine is received, it is detected whether the class loaded by the virtual machine is a preset class; in the case that it is detected that the class loaded by the virtual machine is a preset class, a local method is registered in the virtual machine and a flow recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked; in the case that a communication request is generated by a target application, based on the communication request, the local method is executed by the virtual machine, and data of the communication request and a corresponding data identifier are acquired; if it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the flow recording strategy.

[0005] The embodiment of the present specification provides a data processing device, the device comprises a local agent, a virtual machine and a target application, wherein: the virtual machine is configured to load a class corresponding to the target service and send a callback request to the local agent when the target service is triggered to be executed; the local agent is configured to detect whether the class loaded by the virtual machine is a preset class, and in the case that it is detected that the class loaded by the virtual machine is a preset class, register a local method in the virtual machine and inject a traffic recording strategy therein, and hijack a preset original method corresponding to the local method; the target application is configured to obtain a communication request; the virtual machine is configured to execute the local method based on the communication request, and obtain data of the communication request and a corresponding data identifier; and the local agent is configured to record and store the data of the communication request through the traffic recording strategy based on the data identifier if it is determined that the communication request is a request of a preset communication protocol.

[0006] The embodiment of the present specification provides a data processing device, the device comprises a local agent, a virtual machine and a target application, wherein: the virtual machine is configured to load a class corresponding to the target service and send a callback request to the local agent when the target service is triggered to be executed; the local agent is configured to detect whether the class loaded by the virtual machine is a preset class, and in the case that it is detected that the class loaded by the virtual machine is a preset class, register a local method in the virtual machine and inject a traffic recording strategy therein, and hijack a preset original method corresponding to the local method; the target application is configured to obtain a communication request; the virtual machine is configured to execute the local method based on the communication request, and obtain data of the communication request and a corresponding data identifier; and the local agent is configured to record and store the data of the communication request through the traffic recording strategy based on the data identifier if it is determined that the communication request is a request of a preset communication protocol.

[0007] The embodiment of the present specification also provides a storage medium for storing computer executable instructions, which, when executed by a processor, implement the following processes: in the case that a callback request triggered by a class loading event of a virtual machine is received, detecting whether a class loaded by the virtual machine is a preset class; in the case that it is detected that the class loaded by the virtual machine is a preset class, registering a local method in the virtual machine and injecting a traffic recording strategy therein, and hijacking a preset original method corresponding to the local method; in the case that a target application generates a communication request, executing the local method through the virtual machine based on the communication request, and obtaining data of the communication request and a corresponding data identifier; and recording and storing the data of the communication request through the traffic recording strategy based on the data identifier if it is determined that the communication request is a request of a preset communication protocol.

[0008] The embodiment of the present specification further provides a computer program product comprising a computer program which, when executed by a processor, implements the following process: in the case of receiving a callback request triggered by a virtual machine executing a class loading event, detecting whether the class loaded by the virtual machine is a preset class; in the case of detecting that the class loaded by the virtual machine is a preset class, registering a native method in the virtual machine and injecting a traffic recording strategy therein, and hijacking a preset original method corresponding to the native method; in the case of a target application generating a communication request, based on the communication request, executing the native method through the virtual machine, and acquiring data of the communication request and a corresponding data identifier; if it is determined that the communication request is a request of a preset communication protocol, recording and storing the data of the communication request through the traffic recording strategy based on the data identifier. BRIEF DESCRIPTION OF DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present specification, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings; Figure 1 It is a structural schematic diagram of a terminal device or a server of the present specification; Figure 2 It is a structural schematic diagram of a data processing device of the present specification; Figure 3 It is a structural schematic diagram of another data processing device of the present specification; Figure 4 It is a schematic diagram of a data processing process of the present specification; Figure 5 It is a structural schematic diagram of another data processing device of the present specification; Figure 6 It is a schematic diagram of another data processing process of the present specification; Figure 7 It is a schematic diagram of another data processing process of the present specification; Figure 8 It is a schematic diagram of another data processing process of the present specification; Figure 9 It is a schematic diagram of another data processing device of the present specification; Figure 10 It is a schematic diagram of another data processing process of the present specification; Figure 11 It is a schematic diagram of a data processing device of the present specification. DETAILED DESCRIPTION

[0010] The embodiment of the present specification provides a data processing method, device and equipment.

[0011] In order to enable those skilled in the art to better understand the technical solutions in the present specification, the technical solutions in the present specification will be clearly and completely described below in conjunction with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present specification.

[0012] The embodiment of the present specification provides a data flow recording mechanism based on local agent. Generally, in the data flow recording technology, the business side usually realizes flow capture in a custom way. For example, for the recording of HTTP request data flow, flow capture can be realized through custom HttpServletRequestWrapper. The above-mentioned way has high coupling degree with business logic, which leads to high conflict probability of custom encapsulation (Wrapper) and business components, and easily causes encapsulation failure or request parameter analysis exception. For security aspects, the byte code enhancement technology of agent (such as Java Agent) based on programming application is usually used to hook the WEB server input flow reading related points, and byte copy is performed when flow reading. However, this way needs to add different points for different WEB containers (such as Tomcat, Jetty, Undertow, etc.), which leads to the divergence of points. On the other hand, the byte code enhancement way is to inject custom program code into the related functions of the business layer. Due to the characteristics of the programming language level, it will be affected by the virtual machine (such as the influence of the virtual machine STW (Stop-The-World)). Therefore, the embodiment of the present specification proposes a flow recording architecture based on local agent. The architecture can identify general points, realize the convergence of Tomcat, Jetty, Undertow and other WEB container points, and use local interface programming (such as JNI) to sink the enhanced method logic to the native code layer. In addition, bypass cache is constructed, and flow extraction is realized through preset strategy, which supports seamless docking with existing security aspect capabilities, thereby effectively avoiding the technical defects of middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency. For specific processing, please refer to the specific content in the following embodiments.

[0013] The data processing method provided by one or more embodiments of the present specification can be applied to the implementation environment of data processing. Referring to Figure 1 , the implementation environment at least includes: The local agent 100, the virtual machine 200 and the target application 300 can call each other through JVM TI, JNI and the like. The local agent 100, the virtual machine 200 and the target application 300 can run on a terminal device or a server. The terminal device can be a mobile phone, a personal computer, a tablet computer, an e-book reader, a wearable device, an AR (Augmented Reality) device, a VR (Virtual Reality) device, a laptop computer and the like. The server can be one or more servers, a server cluster composed of several servers, a cloud server of a cloud computing platform or the like.

[0014] The target application 300 can be any application program, a browser or a subprogram loaded in the application program.

[0015] In the implementation environment, when the target service is triggered to be executed, the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent. The local agent detects whether the class loaded by the virtual machine is a preset class. If the class loaded by the virtual machine is the preset class, the local agent registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method. The target application obtains a communication request. The virtual machine executes the local method based on the communication request, and obtains data of the communication request and a corresponding data identifier. If it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request based on the data identifier through the traffic recording strategy. In this way, the enhanced method logic is sunk to the local code layer by using a local interface program (such as JNI), and the traffic extraction is implemented through a preset strategy, which supports seamless docking with existing security aspect capabilities, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency.

[0016] For example, the target application 300 can be a browser, and the target service can be a webpage loading request. Figure 2As shown, the embodiment of the present specification provides a data processing apparatus, which can be a terminal device or a server, or can be arranged in a terminal device or a server, or can be independent of a terminal device or a server, wherein the terminal device can be a mobile terminal device such as a mobile phone, a tablet computer, a computer device such as a notebook computer or a desktop computer, or an IoT device (specifically, a smart watch, a vehicle-mounted device, etc.), and the server can be a single server or a server cluster composed of multiple servers, and the server can be a background server of a financial service or an online shopping service, or a background server of an application program. The apparatus can include a local agent 100, a virtual machine 200, and a target application 300, and the local agent 100, the virtual machine 200, and the target application 300 can run in a system environment constructed by various programming languages, such as a system environment of a Java programming language, a system environment of a Swift programming language, a system environment of a C language, a system environment of a C++ language, etc., wherein: The local agent 100 (i.e., Native Agent) is a probe technology for native methods (i.e., Native methods), which uses a native programming interface (such as JVM TI (JVM Tool Interface)) of a virtual machine and a local interface (such as JNI (Java Native Interface)) of a programming platform as a programming interface, and provides more underlying, more basic, and more comprehensive security capabilities compared with a native agent. The local agent 100 can be written based on a specified programming language, for example, can be written based on a Java programming language, or can be written based on a C language, or can be written based on a C++ language, etc., which can be set according to actual conditions. In addition, the local agent 100 can be implemented in the form of a dynamic link library (such as libnative_agent.so), and can be dynamically injected into a local cut point or a buried point through a virtual machine startup parameter-agentlib / agentpath. The native agent (such as a native agent Java Agent of a Java programming language) is an application-independent agent program written by a specified programming language, which can operate on bytecode without modifying the original source code, and realizes monitoring or enhancement of program behavior. The native programming interface (such as JVM TI) is used for developing debugging, monitoring, performance analysis, etc., and can realize deep intervention on a virtual machine through an event callback mechanism (such as class loading, thread starting, garbage collection, etc.) and a function function (such as memory analysis, thread control). The local interface of the programming platform is a standard interface provided by the programming platform, which allows the specified programming language code and the local code written by other programming languages (such as local code written by a C / C++ language, etc.) to interact.

[0017] The virtual machine is an abstract computer, which is realized by simulating various computer functions on an actual computer. The virtual machine has a perfect hardware architecture, such as a processor, a stack, a register, and the like, and has a corresponding instruction system. The virtual machine shields information related to a specific operating system platform, so that an application program only needs to generate code (i.e., bytecode) running on the virtual machine, and can run on multiple platforms without modification.

[0018] The target application can be any application program. In actual applications, the target application can be an application program for sending a communication request. The target application can be, for example, a payment application or an instant messaging application. The target application can be set according to actual conditions.

[0019] The local agent 100, the virtual machine 200, and the target application 300 in the above device interact with each other, and the following data traffic recording and storage processing can be implemented. For details, refer to the following content.

[0020] The virtual machine 200 is configured to load a class corresponding to the target service and send a callback request to the local agent 100 when the target service is triggered to be executed.

[0021] The target service can be any service, for example, a payment service or an instant messaging service. The target service can be set according to actual conditions. A class (i.e., Class) is the basis for information encapsulation in object-oriented programming (OOP, Object-Oriented Programming). A class is a user-defined reference data type, also known as a class type. Each class contains data descriptions and a set of functions that operate on data or pass messages. An instance of a class is called an object.

[0022] In implementation, a specified application program (i.e., a target application) can be installed in a terminal device of a user. The target application can be used to process a target service. Currently, network models (such as neural network models and large language models) have been applied to many different fields. The construction of a network model requires a large amount of sample data. Therefore, sample data can be collected through traffic recording to train a network model. For some fields related to user data security, data can be collected through traffic recording to analyze the security of the collected data. For example, for a security slice, data traffic in the security slice can be collected through traffic recording. Subsequently, a related model can be trained or the security slice can be analyzed using the collected data traffic. The security slice is a new generation of security infrastructure, which is deeply integrated into each level of the business architecture while being decoupled from the business main logic, realizes the rapid implantation and flexible arrangement of security capabilities, provides a standardized security function access interface, supports the efficient construction and dynamic evolution of the security defense system, and can effectively cope with high-intensity confrontation scenarios such as vulnerability containment, emergency response, and data security.

[0023] The trigger points of flow recording and various trigger mechanisms can be set in advance according to actual conditions. When the target application 300 is started by the user, the virtual machine 200 corresponding to the target application 300 can be started. In the virtual machine 200 startup stage, the local agent 100 can be loaded in priority, and the initialization process can be completed through the local interface of the programming platform. At the same time, the capability item corresponding to the native programming interface of the virtual machine can be registered, and the event monitor can be configured to enable the state. Taking the system environment of the Java programming language as an example, in the virtual machine 200 startup stage, the local agent 100 can be loaded in priority, and the initialization process can be completed through the JNI_OnLoad interface. At the same time, the JVM TI capability item (such as JVMTI_CAPABILITY_can_generate_all_class_hook_events) can be registered, and the event monitor (such as JVMTI_EVENT_VM_INIT, JVMTI_EVENT_CLASS_PREPARE) can be configured to enable the state. The virtual machine 200 can load the corresponding running file and running program. When the class (i.e., the class corresponding to the target business) is started to be loaded, the callback request can be generated according to the pre-set trigger point, and the callback request can be sent to the local agent 100.

[0024] The local agent 100 is configured to detect whether the class loaded by the virtual machine 200 is a preset class, and in the case where it is detected that the class loaded by the virtual machine 200 is a preset class, to register a local method in the virtual machine 200 and inject a flow recording strategy therein, and to hijack a preset original method corresponding to the local method.

[0025] The traffic recording strategy can be a strategy for indicating how to record data traffic, which types of data to record, recording duration, recording time, etc. The traffic recording strategy can include multiple types, for example, the traffic recording strategy can include recording data traffic including specified data identifiers and / or preset communication protocols, etc. The local method allows the virtual machine function to be extended by non-native code, and the method body is omitted when declared and cannot be shared, but can be used with identifiers. Its implementation is loaded through a dynamic link library (DLL), and the details are automatically handled by the virtual machine and transparent to the caller when called. The preset original method can be a method of preset native code. The method in the preset original method is a named sequence of statements in computer programming, used to perform specific tasks or implement specific functions, composed of method name and method body. The method name usually uses descriptive English naming (such as CalculateIncomeTax), and the method body is an executable code block encapsulated in curly braces. In object-oriented programming (such as C# programming language), a method represents the behavior characteristics of an object. For example, a window form implements display and hide functions through show and hide methods. This design binds functions and object properties, which is different from the concept of process-oriented functions.

[0026] In implementation, the local agent 100 detects whether the class loaded by the virtual machine 200 is a preset class. When it is detected that the class loaded by the virtual machine 200 is a preset class, a custom local method can be registered in the virtual machine 200 through a native programming interface (such as JVM TI), and a preset original method corresponding to the local method can be found and hijacked, while the processing logic of the preset original method is retained, so that the virtual machine can execute the registered local method. In addition, in order not to affect the normal data processing of the target application, the preset original method can be continuously called for corresponding processing to respond to the request of the target application. Specifically, taking the system environment of the Java programming language as an example, the preset original method address can be obtained through the JVMTI_EVENT_VM_INIT event, that is, the addresses of key methods (or key functions) such as JNI_Files_fd in libnio.so can be dynamically resolved by using dlopen / dlsym, and then a preset original method address mapping table can be constructed for subsequent calling. The preset original method interception can be performed in the JVMTI_EVENT_CLASS_PREPARE event, that is, a custom local method can be registered through the JVM TI interface, and the code of the traffic collection strategy can be injected on the basis of retaining the logic of the preset original method, so as to hijack the preset original method, but the processing logic of the preset original method is retained. The preset original method can be continuously called for corresponding processing to respond to the request of the target application.

[0027] The target application 300 is configured to obtain a communication request.

[0028] In implementation, when a user needs to process certain data (such as needs to query certain data, needs to verify certain data of the user or a business request of a specified business, etc.), a corresponding communication request can be generated by the target application 300, which can be a request of a specified communication protocol, such as an HTTP request, an FTP request, etc., which can be set according to actual conditions.

[0029] The virtual machine 200 is configured to execute the local method based on the communication request, and obtain the data of the communication request and the corresponding data identifier.

[0030] In implementation, the virtual machine 200 can analyze the communication request, and can execute the registered local method, and can read the communication request, obtain the data of the communication request and the corresponding data identifier.

[0031] The local agent 100 is configured to, if it is determined that the communication request is a request of a preset communication protocol, record and store the data of the communication request based on the data identifier through a traffic recording strategy.

[0032] The preset communication protocol can be any communication protocol, such as an HTTP communication protocol, an FTP communication protocol, etc., which can be set according to actual conditions.

[0033] In implementation, it can be judged whether the communication request is a request of a preset communication protocol, if yes, it indicates that the data traffic corresponding to the communication request is the data traffic that needs to be recorded, at this time, the data of the communication request can be recorded based on the data identifier through the pre-injected traffic recording strategy, and the recorded data of the communication request can be stored in a specified storage component corresponding to the data identifier.

[0034] The embodiment of the present specification provides a data processing apparatus, comprising a local agent, a virtual machine and a target application, wherein: the virtual machine loads a class corresponding to the target service when the target service is triggered to execute and sends a callback request to the local agent; the local agent detects whether the class loaded by the virtual machine is a preset class, and in the case where it is detected that the class loaded by the virtual machine is the preset class, registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method; the target application acquires a communication request; the virtual machine executes the local method based on the communication request, and acquires data of the communication request and a corresponding data identifier; and if it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request based on the data identifier through the traffic recording strategy. In this way, the enhanced method logic is sunk to the local code layer by using a local interface program (such as JNI), and the traffic extraction is realized through a preset strategy, the seamless docking with the existing security aspect capability is supported, and therefore the technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency are effectively avoided.

[0035] On the basis of all functional components of the resource management system as shown in Figure 2 Further improvements can be made on the basis of all functional components of the resource management system as shown in In actual application, the local agent 100 is configured to acquire environment information of a current operating system and related information of a software development kit in the target application; based on the environment information of the current operating system and the related information of the software development kit in the target application, a preset original method to be hijacked and a local method to be registered are determined.

[0036] The related information of the software development kit in the target application can include various information, for example, version information, compiler version information, etc., which can be set according to actual conditions.

[0037] In implementation, the local agent 100 can collect the environment information of the current operating system and the related information of the software development kit in the target application when it is initialized, and can determine a local method point matched therewith according to the collected information, so as to determine the preset original method to be hijacked and the local method to be registered. The local agent 100 has started the monitoring of the class loading related events, and can complete the registration of the local method and the hijacking operation (retaining the implementation of the preset original method) of the preset original method at the determined local method point in the subsequent class loading process of the virtual machine.

[0038] In actual application, the virtual machine 200 is configured to find a local method from a dynamic link library based on the above communication request and a corresponding rule, and execute the found local method.

[0039] In implementation, when the WEB container in the target application 300 reads the communication request, the target application 300 calls the native read method (read() Native method, only method declaration, which can be implemented in C file, etc.), the virtual machine 200 can find the native method from the dynamic link library according to the corresponding rules, and execute the found native method, because the local agent 100 performs the pointcut injection (that is, the registration of the native method is completed at the determined native method pointcut, and the preset original method is hijacked), therefore, the enhanced native method will be called subsequently and the traffic recording strategy is executed.

[0040] In actual application, as shown in Figure 3 The local agent 100 is configured to find whether the above data identifier exists in the pre-set bypass cache 110 in the off-heap memory based on the data identifier; if it exists, and the data volume of the data of the communication request does not exceed the preset threshold, the data of the communication request is recorded by the traffic recording strategy, and the recorded data of the communication request is added in the cache item corresponding to the data identifier; if it does not exist, the data of the communication request is recorded by the traffic recording strategy, and the data identifier is stored in the cache 110 corresponding to the recorded data of the communication request.

[0041] In implementation, as shown in Figure 3 The local agent 100 can set the cache 110 in the off-heap memory (not affected by the virtual machine), and the threshold of the number of cache items and the size of the cache item can be configured by the configuration file. As shown in Figure 4As shown, after obtaining the data identifier, the local agent 100 can search the bypass cache 110 pre-set in the off-heap memory based on the data identifier to determine whether the data identifier exists. If the data identifier exists, the local agent 100 can attempt to parse the communication request. If the parsing fails, the local agent 100 does not perform the cache processing. If the parsing succeeds, the local agent 100 can determine whether the data volume of the data of the communication request exceeds a preset threshold. If the data volume does not exceed the preset threshold, the local agent 100 records the data of the communication request by using the traffic recording strategy and increases the recorded data of the communication request in the cache item corresponding to the data identifier. If the data volume exceeds the preset threshold, the local agent 100 can directly discard the data of the communication request. If the data identifier does not exist, the local agent 100 records the data of the communication request by using the traffic recording strategy and stores the data identifier and the recorded data of the communication request in the cache 110. The processing of recording the data of the communication request by using the traffic recording strategy can be, for example, as follows: taking a system environment of a Java programming language as an example, when an InputStream reading operation is initiated by a Web container, the following processing flow is triggered: a native read method (which has been enhanced by the agent) is called in the Java layer, and a traffic collection strategy is inserted in the native read method, that is, data identifier filtering (for example, only the data of the communication request corresponding to a Socket FD is retained) and communication request filtering (only the data of the communication request in a preset communication protocol format is retained) are performed. Then, the cache processing of the communication request (the data is saved in the off-heap memory or the data of the communication request exceeding a preset threshold is deleted) can be performed, and the Socket lifecycle can be synchronized, that is, the cache item is generated in the first read() event, and the cache release mechanism is triggered in the close() event.

[0042] In actual application, the local agent 100 is configured to determine whether the cache 110 can store the recorded data of the communication request. If the cache 110 can store the recorded data of the communication request, the local agent 100 stores the data identifier and the recorded data of the communication request in the cache 110. If the cache 110 cannot store the recorded data of the communication request, the local agent 100 deletes the least frequently used cache item from the stored data in the cache 110 based on a preset memory eviction algorithm and stores the data identifier and the recorded data of the communication request in the cache 110.

[0043] In implementation, as shown in Figure 4 If the cache 110 can store the recorded data of the communication request, the local agent 100 stores the data identifier and the recorded data of the communication request in the cache 110. If the cache 110 cannot store the recorded data of the communication request, the local agent 100 deletes the least frequently used cache item from the stored data in the cache 110 based on a preset memory eviction algorithm and stores the data identifier and the recorded data of the communication request in the cache 110. Through the above processing strategy, the cache is controllable, and the business is not affected by excessive memory occupation.

[0044] In actual application, as shown inFigure 4 As shown in the figure, the target application 300 is configured to generate a communication request and read the communication request through a web container.

[0045] In actual application, the target application 300 is configured to generate a communication request and obtain the communication request through the agent corresponding to the target application. The virtual machine 200 is configured to, based on the communication request, call a pre-registered native method for obtaining the communication request, and execute the native method for obtaining the communication request to obtain data of the communication request and a corresponding data identifier. The native agent 100 is configured to, based on the data identifier, search the pre-set cache 110 in the off-heap memory for whether the data identifier exists; if it exists, parse the communication request, and return request object information corresponding to the communication request based on the parsing result.

[0046] In implementation, as shown in the figure, in addition to that the target application 300 can generate a communication request, the web container can read the communication request, and subsequent traffic recording processing can be performed, the target application 300 can also generate a communication request and obtain the communication request through the agent corresponding to the target application, then the virtual machine 200 can, based on the communication request, call a pre-registered native method for obtaining the communication request, and execute the native method for obtaining the communication request to obtain data of the communication request and a corresponding data identifier. Figure 4 The native agent 100 can also be provided with a communication request parsing mechanism, based on which, if the data identifier exists, the communication request can be parsed through the communication request parsing mechanism, and request object information corresponding to the communication request can be returned based on the parsing result. Figure 5 The native agent 100 can also be provided with a communication request parsing mechanism, based on which, if the data identifier exists, the communication request can be parsed through the communication request parsing mechanism, and request object information corresponding to the communication request can be returned based on the parsing result.

[0047] In actual application, the native agent 100 detects that the class loaded by the virtual machine 200 is not a preset class, and in the case that the target application 300 generates a communication request and the agent corresponding to the target application 300 obtains the communication request, the virtual machine 200 calls a pre-registered native method for obtaining the communication request based on the communication request.

[0048] The embodiment of the present specification provides a data processing apparatus, comprising a local agent, a virtual machine and a target application, wherein: when a target service is triggered to execute, the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent; the local agent detects whether the class loaded by the virtual machine is a preset class, and in the case where it is detected that the class loaded by the virtual machine is the preset class, registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method; the target application acquires a communication request; the virtual machine executes the local method based on the communication request, and acquires data of the communication request and a corresponding data identifier; if it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request based on the data identifier through the traffic recording strategy. In this way, the enhanced method logic is sunk to the local code layer by using a local interface program (such as JNI), and the traffic extraction is realized through a preset strategy, which supports seamless docking with existing security aspect capabilities, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency.

[0049] As shown in Figure 6 The embodiment of the present specification provides a data processing method, and the execution subject of the method can be the above-mentioned data processing apparatus. The apparatus can be a terminal device or a server, or can be arranged in a terminal device or a server, or can be independent of a terminal device or a server. The terminal device can be a mobile terminal device such as a mobile phone or a tablet computer, or a computer device such as a notebook computer or a desktop computer, or an IoT device (such as a smart watch, a vehicle-mounted device, etc.). The server can be a single server or a server cluster composed of multiple servers. The server can be a background server of a financial service or an online shopping service, or a background server of an application program. The apparatus can comprise a local agent, a virtual machine and a target application. The local agent, the virtual machine and the target application can run in a system environment constructed by various programming languages, such as a system environment of a Java programming language, a system environment of a Swift programming language, a system environment of a C language, a system environment of a C++ language, etc. The specific structure among the local agent, the virtual machine and the target application, and the specific functions of the local agent, the virtual machine and the target application can be referred to the foregoing related content, and will not be described here. The method can specifically comprise the following steps: In step S602, in the case where a callback request triggered by a class loading event of a virtual machine is received, it is detected whether the class loaded by the virtual machine is a preset class.

[0050] In step S604, in a case where it is detected that the class loaded by the virtual machine is the preset class, a local method is registered in the virtual machine and a traffic recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked.

[0051] In step S606, in a case where the target application generates a communication request, based on the communication request, the local method is executed by the virtual machine, and data of the communication request and a corresponding data identifier are acquired.

[0052] In step S608, if it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the traffic recording strategy.

[0053] The specific processing procedures of steps S602 to S608 can be referred to the foregoing related content, and will not be described here again.

[0054] The method provided by the embodiments of the present specification is a data processing method applied to a data processing device including a local agent, a virtual machine and a target application, wherein: the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent when the target service is triggered to be executed; the local agent detects whether the class loaded by the virtual machine is a preset class, and in a case where it is detected that the class loaded by the virtual machine is the preset class, registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method; the target application acquires a communication request; the virtual machine executes the local method based on the communication request, and acquires data of the communication request and a corresponding data identifier; and if it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request by the traffic recording strategy based on the data identifier. In this way, a program (such as JNI) written by a local interface is used to sink enhanced method logic to a local code layer, and traffic extraction is achieved by a preset strategy, seamless docking with existing security aspect capabilities is supported, and thus technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency are effectively avoided.

[0055] In actual application, the preset original method to be hijacked and the local method to be registered can be determined in the following manner, and the specific processes can be referred to steps A2 and A4.

[0056] In step A2, environment information of a current operating system and related information of a software development kit in the target application are acquired.

[0057] In step A4, based on the environment information of the current operating system and the related information of the software development kit in the target application, a preset original method corresponding to the local method to be hijacked and the local method to be registered are determined.

[0058] The specific processing procedures for steps A2 and A4 above can be found in the aforementioned related content, and will not be repeated here.

[0059] In practical applications, the specific processing method for executing the native method through the virtual machine based on the communication request in step S604 can be varied. Here is another optional processing method, which may include the following: based on the communication request and the corresponding rules, search for the native method in the dynamic link library and execute the native method through the virtual machine.

[0060] The specific processing steps for the above content can be found in the aforementioned related content, and will not be repeated here.

[0061] In practical applications, the specific processing method for recording and storing the communication request data based on the aforementioned data identifier and traffic recording strategy in step S608 can vary. The following provides another optional processing method, which may specifically include the processing steps S6082 to S6086. Based on this, in the above... Figure 6 Based on this, the specific steps included in this method can be as follows: Figure 7 As shown.

[0062] In step S6082, based on the aforementioned data identifier, the system searches for the existence of the data identifier in a pre-set cache in off-heap memory.

[0063] In step S6084, if the data of the communication request does not exceed a preset threshold, the data of the communication request is recorded using a traffic recording strategy, and the recorded data of the communication request is added to the cache item corresponding to the data identifier.

[0064] In step S6086, if the data of the above communication request is not present, the data is recorded using the traffic recording strategy, and the data identifier is stored in the cache corresponding to the recorded communication request data.

[0065] The specific processing procedures for steps S6082 to S6086 can be found in the aforementioned related content, and will not be repeated here.

[0066] In practical applications, the specific processing method for storing the data identifier and the recorded communication request data in the cache in step S6086 can vary. The following provides another optional processing method, which may specifically include the processing steps S60862 to S60866. Based on this, in the above... Figure 7 Based on this, the specific steps included in this method can be as follows: Figure 8 As shown.

[0067] In step S60862, it is determined whether the cache can store the recorded communication request data.

[0068] In step S60864, if yes, the data identifier corresponding to the data of the recorded communication request is stored in the cache.

[0069] In step S60866, if no, the data stored in the cache is deleted based on a preset memory eviction algorithm, and the data identifier corresponding to the data of the recorded communication request is stored in the cache.

[0070] The specific processing procedures of steps S60862-S60866 can be referred to the foregoing related content, which will not be repeated here.

[0071] In actual application, the specific processing mode of step S606 can be various, and an optional processing mode is provided as follows, which can include the following content: in the case that the target application generates a communication request and reads the communication request through a web container, based on the communication request, a local method is executed through a virtual machine, and the data of the communication request and the corresponding data identifier are obtained.

[0072] In actual application, in addition to generating a communication request through a target application and reading the communication request through a web container, and then performing subsequent traffic recording processing, the following steps B2-B6 can also be used for processing.

[0073] In step B2, in the case that the target application generates a communication request and the communication request is obtained through a proxy corresponding to the target application, based on the communication request, a pre-registered local method for obtaining the communication request is called, and the local method for obtaining the communication request is executed through a virtual machine to obtain the data of the communication request and the corresponding data identifier.

[0074] In step B4, based on the data identifier, it is checked whether the data identifier exists in the cache pre-set in the off-heap memory.

[0075] In step B6, if yes, the communication request is parsed, and the request object information corresponding to the communication request is returned based on the parsing result.

[0076] The specific processing procedures of steps B2-B6 can be referred to the foregoing related content, which will not be repeated here.

[0077] In actual applications, in the case that the target application generates a communication request and the communication request is obtained through the corresponding agent of the target application in step B2, the specific processing manner of calling the pre-registered local method for obtaining the communication request based on the communication request can be various. The following provides an optional processing manner, which can include the following content: in the case that the class loaded by the virtual machine is not the preset class and the target application generates a communication request and the communication request is obtained through the corresponding agent of the target application, the pre-registered local method for obtaining the communication request is called based on the communication request.

[0078] The embodiment of the present specification provides a data processing method, which is applied to a data processing device including a local agent, a virtual machine and a target application. When a target service is triggered to be executed, the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent. The local agent detects whether the class loaded by the virtual machine is a preset class. If it is detected that the class loaded by the virtual machine is the preset class, the local agent registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method. The target application obtains a communication request. The virtual machine executes the local method based on the communication request, and obtains data of the communication request and a corresponding data identifier. If it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request based on the data identifier through the traffic recording strategy. In this way, the enhanced method logic is sunk to the local code layer by using a local interface programming (such as JNI), and the traffic extraction is realized through the preset strategy, which supports seamless docking with the existing security aspect capability, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency.

[0079] The following describes in detail a data processing method provided by the embodiment of the present specification in combination with a specific application scenario. The local agent, the virtual machine and the target application can run in a system environment of a Java programming language. The local agent is a Native Agent. The communication request can be an HTTP request. The data identifier can be a Socket FD. The virtual machine is a JVM. The target application can be a Java application. The corresponding system architecture diagram can be referred to as Figure 9 .

[0080] As Figure 10As shown, the embodiment of the present specification provides a data processing method, the execution subject of the method can be the above-mentioned data processing device, which can be a terminal device or a server, etc., or can also be arranged in a terminal device or a server, or can also be independent of a terminal device or a server, wherein the terminal device can be a mobile terminal device such as a mobile phone, a tablet computer, etc., can also be a computer device such as a notebook computer or a desktop computer, etc., or can also be an IoT device (specifically, a smart watch, a vehicle-mounted device, etc.), etc., wherein the server can be an independent server, can also be a server cluster composed of multiple servers, etc., the server can be a background server of a financial service or a network shopping service, etc., can also be a background server of an application program, etc. The method can specifically include the following steps: In step C02, the native agent is started, a configuration file is read, and a class monitoring event is started.

[0081] In step C04, the virtual machine triggers a callback request based on a class loading event.

[0082] In step C06, the native agent determines whether the loaded class is a preset class, if yes, registers a local method in the virtual machine, hijacks a preset original method (or original function), and injects the code of the traffic recording logic corresponding to the traffic recording strategy, if no, waits for the Java application to generate an HTTP request.

[0083] In step C08, the Java application generates an HTTP request, and reads the HTTP request through a WEB container.

[0084] In step C10, the virtual machine calls the read() native method, and can execute the enhanced local method, and can also call the preset original method to obtain the HTTP request data and the Socket FD.

[0085] In step C12, the native agent determines whether the message is in HTTP format, if no, discards the HTTP request, if yes, determines whether the Socket FD already exists in the cache.

[0086] In step C14, if yes, determines whether the size of the HTTP request exceeds a threshold, if yes, discards the HTTP request, if no, appends data to the original cache item.

[0087] In step C16, if no, it is judged whether the cache capacity is exceeded, if yes, a memory eviction LRU algorithm is executed to delete the stored data in the cache, then the Socket FD and the HTTP request data are stored correspondingly, if no, the Socket FD and the HTTP request data are stored correspondingly.

[0088] In step C18, the Java Agent acquires the HTTP traffic, calls the registered getRequest() native method of the local agent Native Agent, and acquires the HTTP request data through the Socket FD.

[0089] In step C20, it is judged whether the Socket FD already exists in the cache, if no, the HTTP request is discarded, if yes, an HTTP request parsing mechanism is executed, and a Java Request object is returned.

[0090] The embodiment of the present specification provides a data processing method, which is applied to a data processing device, including a local agent, a virtual machine and a target application, wherein: the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent when the target service is triggered to execute, the local agent detects whether the class loaded by the virtual machine is a preset class, and in the case where it is detected that the class loaded by the virtual machine is the preset class, registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method, the target application acquires a communication request, the virtual machine executes the local method based on the communication request, and acquires data of the communication request and a corresponding data identifier, and if it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request based on the data identifier through the traffic recording strategy, in this way, a program (such as JNI) written by a local interface is used to sink the enhanced method logic to a local code layer, and the traffic extraction is realized through a preset strategy, the seamless docking with the existing security aspect capability is supported, and thus technical defects such as middleware adaptation difficulty, virtual machine performance loss and low security capability reuse efficiency are effectively avoided.

[0091] The above is the data processing method provided by the embodiment of the present specification, based on the same idea, the embodiment of the present specification also provides a data processing device, as shown in Figure 11

[0092] The data processing device can be a terminal device or a server and the like provided by the above embodiment.

[0093] ​The data processing apparatus can vary, and other apparatuses can be used. Such variations are not to affect the applicability of the systems and methods described herein. By way of example, the data processing apparatus can be a conventional general- purpose or a designated computer system. It can also include a processor formed from one or more processors, as well as a system bus. The system bus can be any of several types of bus structures including a memory bus, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory can also include nonvolatile memory, for example, read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, or a different memory technology. A basic input / output system (BIOS), containing the basic routines that help to transfer information between elements within the data processing apparatus, such as during start-up, can be stored in the nonvolatile memory. The data processing apparatus further can include a storage device, such as a magnetic disk, optical disk, or tape. The storage device can also comprise an external storage device or other commonly associated storage media. The data processing apparatus can also have input device(s) such as keyboard, mouse, pen, voice input device, a touch input device, etc. Furthermore, the data processing apparatus and / or storage device can employ any one or combination of several commercially available operating systems or combinations of operating systems.

[0094] The user interface 1104 includes input and output devices. Input devices can include, for example, a keyboard, mouse, touch input device, etc. Output devices can include, for example, a display screen (which can be combined with a touch input device), speakers, a printer, etc. The user interface 1104 can also include software components for controlling the input and output devices. The data processing apparatus 1100 can also include a communication interface 1102, which can be used to transmit and receive data from other devices, such as a wireless access point or a base station. The communication interface 1102 can include, for example, a chipset and antenna for wireless communication, a wired interface such as an Ethernet, Token Ring, or USB port, or a wireless interface such as a Wi-Fi, Bluetooth, Global Positioning System (GPS), or wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 1102 can support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 1102 can also include multiple physical communication interfaces, such as a Wi-Fi interface, a Bluetooth interface, and a wide-area wireless interface.

[0095] The processor 1106 can include one or more general processors and / or one or more specialized processors.

[0096] The data storage 1108 can include one or more volatile and / or nonvolatile storage components, and can be integrated in whole or in part with the processor 1106. The data storage 1108 can include removable and / or non-removable storage components.

[0097] The processor 1106 is capable of executing program instructions 1118 (e.g., compiled or interpreted program logic and / or machine code) stored in the data storage 1108 to implement various functionality described herein. The data storage 1108 can include a non-transitory computer-readable medium having stored thereon program instructions that, when executed by the data processing device 1100, enable the data processing device 1100 to perform any of the methods, processes, or functions disclosed in the specification and / or drawings. Execution of the program instructions 1118 by the processor 1106 can cause the processor 1106 to utilize the data 1112.

[0098] For example, the program instructions 1118 can include an operating system 1122 (e.g., an operating system kernel, device drivers, and / or other modules) installed on the data processing device 1100 as well as one or more application programs 1120 (e.g., a browser, a social application, or a gaming application). Similarly, the data 1112 can include operating system data 1116 and application data 1114. The operating system data 1116 is primarily accessible to the operating system 1122, while the application data 1114 is primarily accessible to the one or more application programs 1120. The application data 1114 can be located in a file system that is visible or hidden to a user of the data processing device 1100.

[0099] The application programs 1120 can communicate with the operating system 1122 through one or more application programming interfaces (APIs). These APIs facilitate the application programs 1120 reading and / or writing to the application data 1114, communicating or receiving information via the communication interface 1102, receiving or displaying information on the user interface 1104, and the like.

[0100] In some terminology, the application programs 1120 can be referred to simply as "apps." Furthermore, the application programs 1120 can be downloaded to the data processing device 1100 through one or more online application stores or application markets. However, the application programs can also be installed on the data processing device 1100 through other means, such as through a web browser or a physical interface (e.g., a USB port) on the data processing device 1100.

[0101] In particular embodiments, the data processing device 1100 includes the data storage 1108, and one or more program instructions 1118 stored in the data storage 1108, and the one or more program instructions 1118 configured to be executed by the one or more processors include computer-executable instructions for performing: In a case where a callback request triggered by a virtual machine performing a class loading event is received, it is detected whether a class loaded by the virtual machine is a preset class; register a local method in the virtual machine and inject a traffic recording strategy therein, and hijack a preset original method corresponding to the local method; In a case where the target application generates a communication request, based on the communication request, execute the local method through the virtual machine, and acquire data of the communication request and a corresponding data identifier; If it is determined that the communication request is a request of a preset communication protocol, record and store the data of the communication request through the traffic recording strategy based on the data identifier.

[0102] Each of the embodiments in the specification is described in a progressive manner, and the same and similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the data processing device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0103] The embodiment of the specification provides a data processing device, which comprises a local agent, a virtual machine and a target application, wherein: the virtual machine loads a class corresponding to the target service and sends a callback request to the local agent when the target service is triggered to be executed, the local agent detects whether the class loaded by the virtual machine is a preset class, and in a case where it is detected that the class loaded by the virtual machine is the preset class, registers a local method in the virtual machine and injects a traffic recording strategy therein, and hijacks a preset original method corresponding to the local method, the target application acquires a communication request, the virtual machine executes the local method based on the communication request, and acquires data of the communication request and a corresponding data identifier, and if it is determined that the communication request is a request of a preset communication protocol, the local agent records and stores the data of the communication request through the traffic recording strategy based on the data identifier. In this way, the enhanced method logic is sunk to the local code layer by using the local interface programming (such as JNI), and the traffic extraction is realized through the preset strategy, the seamless docking with the existing security aspect capability is supported, and thus the technical defects such as the difficulty of middleware adaptation, the performance loss of the virtual machine and the low efficiency of security capability reuse are effectively avoided.

[0104] Further, based on the above Figures 6 to 10 One or more embodiments of the specification further provide a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium can be a U disk, an optical disk, a hard disk or the like. The computer executable instruction information stored in the storage medium can realize the following process when executed by a processor. In a case where a callback request triggered by a class loading event of a virtual machine is received, detect whether a class loaded by the virtual machine is a preset class; In a case where it is detected that the class loaded by the virtual machine is a preset class, a local method is registered in the virtual machine and a traffic recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked; In a case where a target application generates a communication request, based on the communication request, the local method is executed by the virtual machine, and data of the communication request and a corresponding data identifier are acquired; If it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the traffic recording strategy.

[0105] Each of the embodiments in the specification is described in a progressive manner, and the same and similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the above-mentioned storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts can be referred to the part of the method embodiment.

[0106] The embodiment of the specification provides a storage medium. When a target service is triggered to be executed, a class corresponding to the target service is loaded, and a callback request is sent to a local agent. It is detected whether the class loaded by a virtual machine is a preset class. In a case where it is detected that the class loaded by the virtual machine is the preset class, a local method is registered in the virtual machine and a traffic recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked. A target application acquires a communication request. Based on the communication request, the local method is executed, and data of the communication request and a corresponding data identifier are acquired. If it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the traffic recording strategy. In this way, a program (such as JNI) written by a local interface is used to sink enhanced method logic to a local code layer, and traffic extraction is implemented by a preset strategy, seamless docking with existing security aspect capabilities is supported, and therefore technical defects such as middleware adaptation difficulty, virtual machine performance loss, and low security capability reuse efficiency are effectively avoided.

[0107] Further, based on the above Figures 6 to 10 One or more embodiments of the specification also provide a computer program product, which includes a computer program. The computer program in the computer program product can implement the following flow when executed by a processor: In a case where a callback request triggered by a class loading event of a virtual machine is received, it is detected whether a class loaded by the virtual machine is a preset class; In a case where it is detected that the class loaded by the virtual machine is the preset class, a local method is registered in the virtual machine and a traffic recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked; In a case where a communication request is generated by a target application, based on the communication request, the local method is executed by the virtual machine, and data of the communication request and a corresponding data identifier are acquired; If it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the traffic recording strategy.

[0108] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the above-mentioned computer program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0109] The embodiment of the specification provides a computer program product, when a target service is triggered to execute, a class corresponding to the target service is loaded, and a callback request is sent to a local agent. It is detected whether the class loaded by the virtual machine is a preset class. In a case where it is detected that the class loaded by the virtual machine is the preset class, a local method is registered in the virtual machine and a traffic recording strategy is injected therein, and a preset original method corresponding to the local method is hijacked. A target application acquires a communication request, based on the communication request, executes the local method, and acquires data of the communication request and a corresponding data identifier. If it is determined that the communication request is a request of a preset communication protocol, based on the data identifier, the data of the communication request is recorded and stored by the traffic recording strategy. In this way, the enhanced method logic is sunk to the local code layer by using the local interface programming (such as JNI), and the traffic extraction is realized by the preset strategy, which supports seamless docking with the existing security aspect capability, thereby effectively avoiding technical defects such as middleware adaptation difficulty, virtual machine performance loss, and low security capability reuse efficiency.

[0110] The above describes specific embodiments of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be executed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous. Also, while one or more embodiments of the specification provide method steps in an exemplary order as described in the embodiments or flowcharts, it is understood that the order of the steps recited in the embodiments or flowcharts is merely one of many possible orders of execution of the steps, and the variation adjustment of the order of the steps or the parallel between the steps is also within the scope of protection of the claims.

[0111] In the 1990s, it was possible to distinguish whether an improvement in a technology was a hardware improvement (e.g., an improvement in the circuit structure of a diode, transistor, switch, etc.) or a software improvement (an improvement in a method flow). However, as technology has advanced, many improvements in method flows today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into a hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by the user programming the device. A digital system is "integrated" on a PLD by the designer programming it himself, without having to ask a chip manufacturer to design and manufacture a special integrated circuit chip. Moreover, instead of manually manufacturing an integrated circuit chip, this programming is now mostly implemented using "logic compiler" software, which is similar to the software compiler used when developing a program, and the original code before compilation must also be written in a specific programming language, which is called a hardware description language (HDL), and there are many types of HDL, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also be aware that it is only necessary to logically program the method flow using the above-mentioned hardware description languages and program it into an integrated circuit to easily obtain a hardware circuit that implements the logical method flow.

[0112] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the microprocessor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to implementing the controller in pure computer readable program code, it is possible to implement the controller in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers, etc. to perform the same functions by logically programming the method steps. Such a controller can therefore be considered to be a hardware component, and the means included therein for performing various functions can also be considered to be structures within the hardware component. Alternatively, the means for performing various functions can even be considered to be both a software module implementing the method and a structure within the hardware component.

[0113] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0114] For the sake of description, the above apparatuses are described in functional division and are described respectively. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware when implementing one or more embodiments of the present specification.

[0115] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of the present specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] The embodiments of the present specification are described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present specification. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable electronic devices to produce a machine, so that the instructions executed by the computer or other programmable electronic devices generate a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus.

[0117] These computer program instructions can also be stored in a computer readable memory that can direct the computer or other programmable electronic devices to work in a specific manner, so that the instructions stored in the computer readable memory produce a product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus.

[0118] These computer program instructions can also be loaded into a computer or other programmable electronic devices, so that a series of operation steps are performed on the computer or other programmable electronic devices to produce a computer implemented process, so that the instructions executed on the computer or other programmable electronic devices provide steps for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus. Figure 1 The functions of one or more flows and / or blocks in the flowcharts and / or block diagrams can be implemented by an apparatus.

[0119] In a typical configuration, the computing device includes one or more processors (CPU), input / output interface, network interface and memory.

[0120] The memory can include non-persistent memory in the computer readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of computer readable media.

[0121] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0122] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical or equivalent elements in the process, method, article or device comprising the element. In addition, "one", "a" and "the" do not necessarily refer to the singular, but also include the plural. The ordinal numbers first, second, etc. do not necessarily indicate the order, but are often used for the purpose of distinguishing objects. For example, the first server and the second server usually refer to two servers, which are expressed as the first server and the second server in order to distinguish the two servers. However, the two servers may also be the same server at times. Moreover, in the present specification, unless otherwise specified, "receiving and sending of data" is not necessarily direct receiving and sending, but can be indirect receiving and sending (i.e. indirect receiving and sending through one or more subjects). Similarly, in the present specification, unless otherwise specified, the association relationship between structures can be a direct association relationship or an indirect association relationship.

[0123] In addition, as used in the specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a" entity includes reference to one or more of such entities. In addition, as used in this specification and the appended claims, the term "or" is generally employed in its sense of "and / or" unless the context clearly dictates otherwise.

[0124] As will be appreciated by one skilled in the art, embodiments of the present specification can be embodied as a method, system, or computer program product. Accordingly, one or more embodiments of the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of the present specification can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, magnetic disks, CD-ROMs, optical storage media such as DVD s, etc.) embodying computer readable program code.

[0125] One or more embodiments of the present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0126] Embodiments of the present specification are described with reference to the attached drawings, wherein like numerals indicate like elements throughout the several figures. The embodiments of the present specification are described more fully by reference to the figures.

[0127] The above description is embodied only by way of example of the present specification, and is not intended to limit the present specification. The present specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A method for processing data, the method comprising: detecting whether a class loaded by a virtual machine is a preset class in a case where a callback request triggered by a class loading event of the virtual machine is received; registering a native method in the virtual machine and injecting a traffic recording strategy therein, and hijacking a preset original method corresponding to the native method in a case where it is detected that the class loaded by the virtual machine is the preset class; executing the native method through the virtual machine based on a communication request in a case where a target application generates the communication request, and obtaining data of the communication request and a corresponding data identifier; and recording and storing the data of the communication request through the traffic recording strategy based on the data identifier in a case where it is determined that the communication request is a request of a preset communication protocol.

2. The method of claim 1, further comprising: obtaining environment information of a current operating system and related information of a software development kit in the target application; and determining a preset original method corresponding to the native method that needs to be hijacked and the native method that needs to be registered based on the environment information of the current operating system and the related information of the software development kit in the target application.

3. The method of claim 2, wherein the executing the native method through the virtual machine based on the communication request comprises: searching for the native method from a dynamic link library based on the communication request and a corresponding rule, and executing the native method through the virtual machine.

4. The method of claim 3, wherein the recording and storing the data of the communication request through the traffic recording strategy based on the data identifier comprises: searching for whether the data identifier exists in a cache pre-set in off-heap memory based on the data identifier; recording the data of the communication request through the traffic recording strategy and increasing the recorded data of the communication request in a cache item corresponding to the data identifier in a case where the data identifier exists and a data volume of the data of the communication request does not exceed a preset threshold; and recording the data of the communication request through the traffic recording strategy and storing the data identifier and the recorded data of the communication request corresponding to each other in the cache in a case where the data identifier does not exist.

5. The method of claim 4, wherein the storing the data identifier and the recorded data of the communication request corresponding to each other in the cache comprises: judging whether the cache can store the recorded data of the communication request; storing the data identifier and the recorded data of the communication request corresponding to each other in the cache in a case where the cache can store the recorded data of the communication request; and performing deletion processing on data already stored in the cache based on a preset memory eviction algorithm and storing the data identifier and the recorded data of the communication request corresponding to each other in the cache in a case where the cache cannot store the recorded data of the communication request.

6. The method of claim 5, wherein the executing the native method through the virtual machine based on the communication request in a case where a target application generates the communication request, and obtaining data of the communication request and a corresponding data identifier comprises: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ In a case where the target application generates a communication request and the communication request is read by a web container, based on the communication request, the native method is executed by the virtual machine, and data of the communication request and a corresponding data identifier are obtained.

7. The method of claim 1, further comprising: In a case where the target application generates a communication request and the communication request is obtained by a proxy corresponding to the target application, based on the communication request, a pre-registered native method for obtaining the communication request is invoked, and the native method for obtaining the communication request is executed by the virtual machine to obtain data of the communication request and a corresponding data identifier; Based on the data identifier, it is determined whether the data identifier exists in a cache pre-set in off-heap memory; If so, the communication request is parsed, and request object information corresponding to the communication request is returned based on a parsing result.

8. The method of claim 7, wherein in the case where the target application generates a communication request and the communication request is obtained by a proxy corresponding to the target application, based on the communication request, a pre-registered native method for obtaining the communication request is invoked, comprising: In a case where it is detected that the class loaded by the virtual machine is not a preset class, and the target application generates a communication request and the communication request is obtained by a proxy corresponding to the target application, based on the communication request, a pre-registered native method for obtaining the communication request is invoked.

9. A data processing apparatus, comprising a native proxy, a virtual machine and a target application, wherein: The virtual machine is configured to load a class corresponding to a target service and send a callback request to the native proxy when the target service is triggered to be executed; The native proxy is configured to detect whether the class loaded by the virtual machine is a preset class, and in a case where it is detected that the class loaded by the virtual machine is a preset class, register a native method in the virtual machine and inject a traffic recording strategy therein, and hijack a preset original method corresponding to the native method; The target application is configured to obtain a communication request; The virtual machine is configured to execute the native method based on the communication request, and obtain data of the communication request and a corresponding data identifier; The native proxy is configured to, if it is determined that the communication request is a request of a preset communication protocol, record and store the data of the communication request by the traffic recording strategy based on the data identifier.

10. The apparatus of claim 9, wherein the local agent is configured to look up whether the data identifier exists in a pre-set bypass cache in off-heap memory based on the data identifier. If so, and in a case where a data amount of the data of the communication request does not exceed a preset threshold, record the data of the communication request by the traffic recording strategy, and add the recorded data of the communication request in a cache item corresponding to the data identifier; If not, record the data of the communication request by the traffic recording strategy, and store the data identifier and the recorded data of the communication request in the cache.

11. The apparatus of claim 9, wherein the target application is configured to generate a communication request and obtain the communication request by a proxy corresponding to the target application. The virtual machine is configured to invoke a pre-registered local method for obtaining the communication request based on the communication request, and execute the local method for obtaining the communication request to obtain data of the communication request and a corresponding data identifier; The local agent is configured to search the pre-set cache in the off-heap memory based on the data identifier to determine whether the data identifier exists; if the data identifier exists, the communication request is parsed, and request object information corresponding to the communication request is returned based on a parsing result.

12. A data processing device, comprising: a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to: in a case where a callback request triggered by a virtual machine execution class loading event is received, detect whether a class loaded by the virtual machine is a preset class; in a case where it is detected that the class loaded by the virtual machine is the preset class, register a local method in the virtual machine and inject a traffic recording strategy therein, and hijack a preset original method corresponding to the local method; in a case where a target application generates a communication request, execute the local method through the virtual machine based on the communication request, and obtain data of the communication request and a corresponding data identifier; if it is determined that the communication request is a request of a preset communication protocol, record and store the data of the communication request through the traffic recording strategy based on the data identifier.

Images