Flow monitoring method and device, electronic equipment, medium and product

Abstract

The embodiment of the invention provides a flow monitoring method and device, electronic equipment, a medium and a product. The method comprises the following steps: monitoring a domain name resolution request and a response, analyzing according to the domain name resolution request and the response to obtain a mapping relationship between a domain name and an IP address of a remote server, and determining a software package name, a UID and a process number of an application initiating the domain name resolution request so as to establish a mapping table, the mapping table comprises a mapping relation among an IP address, a domain name, a UID, a process number and a software package name of the remote server; collecting traffic data, wherein each piece of traffic data comprises a UID, a remote server IP address and a data volume; and according to the UID in each piece of flow data and the IP address of the remote server, querying in the mapping table to obtain a corresponding software package name and a domain name, and determining the software package name and the domain name to which the flow data belongs. According to the method, the flow sources can be accurately counted.

Description

Technical Field

[0001] This application relates to vehicle infotainment system technology, and more particularly to a traffic monitoring method, device, electronic equipment, medium, and product. Background Technology

[0002] With the increasing popularity of new energy vehicles, in-vehicle infotainment systems are becoming increasingly intelligent, and many vehicles are equipped with 4G / 5G network capabilities. These network functions support drivers in performing online navigation, entertainment, and remote control operations, but the resulting network traffic consumption problem is also becoming more prominent. Therefore, it is necessary to accurately monitor the network traffic of in-vehicle infotainment systems to avoid economic losses to users due to unauthorized or abnormal data usage.

[0003] In existing technologies, traffic data is often monitored through the native interface of the vehicle system, but the granularity is relatively coarse. It only supports traffic statistics based on UID or network type (such as WiFi, 4G). When multiple applications share the same UID, it is not possible to further refine the traffic source. Summary of the Invention

[0004] This application provides a traffic monitoring method, device, electronic device, medium, and product for accurately counting traffic sources.

[0005] In a first aspect, embodiments of this application provide a traffic monitoring method, including:

[0006] Listen for domain name resolution requests and responses, resolve the mapping relationship between the domain name and the remote server IP address based on the domain name resolution requests and responses, and determine the package name, UID and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table, which includes the mapping relationship between the remote server IP address, domain name, UID, process ID and package name;

[0007] Collect traffic data; each traffic data entry includes the UID, remote server IP address, and data volume.

[0008] Based on the UID and the remote server IP address in each traffic data entry, the corresponding software package name and domain name are retrieved from the mapping table to determine the software package name and domain name to which the traffic data belongs.

[0009] Optionally, each piece of traffic data may also include the vehicle's local IP address, the vehicle's local port, and the remote server port;

[0010] Based on the UID and remote server IP address in each traffic data entry, the corresponding software package name and domain name are retrieved from the mapping table to determine the software package name and domain name to which the traffic data belongs, including:

[0011] Use the UID and the remote server IP address to query the mapping table;

[0012] If only one mapping relationship is found in the mapping table, the software package name and the domain name to which the traffic data belongs are determined based on the mapping relationship;

[0013] If multiple mapping relationships are found in the mapping table, the corresponding process ID is determined based on the vehicle's local IP address, the vehicle's local port, the remote server's IP address, and the remote server's port. Then, the mapping table is queried based on the UID, the process ID, and the remote server's IP address to determine the software package name and the domain name to which the traffic data belongs.

[0014] Optionally, the mapping table also includes a record time and a TTL validity period, and the mapping table is updated after the TTL validity period expires.

[0015] Optionally, each traffic data entry also includes a timestamp; the method further includes:

[0016] The mapping table is determined based on the timestamp of each traffic data, the record time, and the TTL validity period, and the traffic data consumed by the software package name when accessing the domain name within a preset statistical period is aggregated.

[0017] Optionally, the method further includes:

[0018] According to the statistical period, the aggregated data is pushed to the user terminal through the cloud server.

[0019] Optionally, the monitoring of domain name resolution requests and responses, resolving the mapping relationship between the domain name and the remote server IP address based on the domain name resolution requests and responses, and determining the package name, UID, and process ID of the application that initiated the domain name resolution request, including:

[0020] In user space, the Netd network daemon listens for domain name resolution requests and responses, obtains the UID, domain name, remote server IP address, and process ID from the domain name resolution requests and responses, and determines the corresponding application's package name based on the process ID.

[0021] Optionally, the collected traffic data includes:

[0022] In the kernel space, the eBPF program is mounted on the mount point of the flow control filter; the eBPF program counts traffic data in key-value pairs and caches the results in a hash table.

[0023] In user space, the traffic data is obtained by reading the hash table from the kernel space by calling the bpf() system interface.

[0024] Secondly, embodiments of this application provide a traffic monitoring device, comprising:

[0025] A listening process is used to listen for domain name resolution requests and responses in user space, resolve the mapping relationship between domain names and remote server IP addresses based on the domain name resolution requests and responses, and determine the package name, UID, and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table. The mapping table includes the mapping relationship between remote server IP address, domain name, UID, process ID, and package name.

[0026] The acquisition process is used to collect traffic data in kernel space and build a traffic data table. Each traffic data entry includes a UID, a remote server IP address, and the amount of data.

[0027] The traffic acquisition module is used to read the traffic data table from the kernel space, and based on the UID and the remote server IP address in each traffic data entry, query the mapping table to obtain the corresponding software package name and domain name, and determine the software package name and domain name to which the traffic data belongs.

[0028] Thirdly, embodiments of this application provide an electronic device, including:

[0029] A processor, and a memory communicatively connected to the processor;

[0030] The memory stores computer-executed instructions;

[0031] The processor executes computer execution instructions stored in the memory to implement the method described above.

[0032] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method described above.

[0033] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0034] The traffic monitoring method, apparatus, electronic device, medium, and product provided in this application's embodiments monitor domain name resolution requests and responses, resolve the mapping relationship between domain names and remote server IP addresses based on the domain name resolution requests and responses, and determine the software package name, UID, and process ID of the application that initiated the domain name resolution request. This allows the establishment of a mapping table representing the mapping relationship between remote server IP addresses, domain names, UIDs, process IDs, and software package names. Traffic data is collected, with each traffic data entry including a UID, a remote server IP address, and the amount of data. Using the remote server IP address and UID from the traffic data, the corresponding software package name and domain name can be retrieved from the mapping table, thereby accurately resolving the attribution of traffic consumption, refining the traffic source, and enabling users to understand the traffic generated by each application accessing each domain name. This helps detect traffic leakage or abnormal traffic consumption, reduce economic losses, and effectively improve traffic monitoring results. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0036] Figure 1 This is a flowchart illustrating a traffic monitoring method provided in an embodiment of this application.

[0037] Figure 2 This is a flowchart illustrating another traffic monitoring method provided in an embodiment of this application.

[0038] Figure 3 This is a schematic diagram of the structure of a traffic monitoring device provided in an embodiment of this application.

[0039] Figure 4 This is a schematic diagram of another flow monitoring device provided in an embodiment of this application.

[0040] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0041] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0042] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0043] First, let me explain the terms used in this application:

[0044] A UID (User ID) is a user identifier assigned to each process or application in a Linux / Android system. Android is based on the Linux kernel, and each application runs in an independent Linux user space. Each application is assigned a UID upon installation.

[0045] `netstat -apn` is a Linux network diagnostic command used to view all current network connections, listening ports, and corresponding process information on the system.

[0046] With the increasing popularity of new energy vehicles, in-vehicle infotainment systems are becoming increasingly intelligent, and many vehicles are equipped with 4G / 5G network capabilities. These network functions support online navigation, entertainment, and remote control for car owners, but the resulting network traffic consumption problem is also becoming more prominent. Network traffic costs are usually borne by the car manufacturer or the car owner; therefore, precise monitoring of in-vehicle network traffic is necessary to avoid financial losses for users due to unauthorized or abnormal data usage.

[0047] In existing technologies, traffic data is often monitored through the native interfaces of the vehicle's infotainment system. Taking the Android system as an example, the system provides a native interface, the NetworkStats API, which can be used for traffic monitoring. However, the granularity of the native interface is relatively coarse, only supporting traffic statistics based on UID or network type (such as WiFi, 4G). When multiple applications share the same UID, it is impossible to further refine the source of traffic. For example, in the Android system, the system interface application SystemUI, the system-level map application MapApp, and the system framework service Android Framework share the system UID 1000. Only identifying the UID of the application consuming traffic as 1000 cannot uniquely identify that application.

[0048] The traffic monitoring methods, devices, electronic equipment, media, and products provided in this application are intended to solve the aforementioned technical problems.

[0049] The technical solutions of this application will be described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0050] Figure 1 This is a flowchart illustrating a traffic monitoring method provided in an embodiment of this application. Figure 1 As shown, the method includes:

[0051] S101. Listen to domain name resolution requests and responses, resolve the mapping relationship between domain name and remote server IP address based on the domain name resolution requests and responses, and determine the package name, UID and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table, which includes the mapping relationship between remote server IP address, domain name, UID, process ID and package name;

[0052] S102. Collect traffic data. Each traffic data entry includes the UID, remote server IP address, and data volume.

[0053] S103. Based on the UID and remote server IP address in each traffic data, query the mapping table to obtain the corresponding software package name and domain name, and determine the software package name and domain name to which the traffic data belongs.

[0054] In practical implementations, the native interface of the vehicle system can only count traffic at the UID level, which is relatively coarse. This application's embodiment can insert a fine-grained traffic data collection program into the kernel space or user space to collect traffic data, thereby determining the UID of the application consuming traffic and which remote server IP address was accessing that consumed the traffic.

[0055] However, traffic data collection programs cannot directly collect the application's package name and the domain names accessed by the application to consume traffic. Further analysis using a mapping table can retrieve the corresponding package name and domain name, thus determining the source of the traffic. The mapping table should at least include the mapping relationship between remote server IP addresses, domain names, UIDs, and package names.

[0056] Optionally, the mapping table is established by listening for domain name resolution requests and responses in user space. Based on the listened-for domain name resolution requests, the domain name can be resolved; based on the listened-for domain name resolution responses, the remote server IP address corresponding to that domain name can be resolved. By determining the source of the domain name resolution request, the package name, UID, and process ID of the application that initiated the request can be obtained, thereby establishing a mapping relationship between the remote server IP address, domain name, UID, process ID, and package name.

[0057] In this embodiment, domain name resolution requests and responses are monitored. The mapping relationship between domain names and remote server IP addresses is obtained based on the domain name resolution requests and responses. The software package name, UID, and process ID of the application initiating the domain name resolution request are determined, thereby establishing a mapping table representing the mapping relationship between remote server IP addresses, domain names, UIDs, process IDs, and software package names. Traffic data is collected, with each traffic data entry including a UID, a remote server IP address, and the amount of data. Using the remote server IP address and UID from the traffic data, the corresponding software package name and domain name can be retrieved from the mapping table, accurately resolving the attribution of traffic consumption, refining the traffic source, and enabling users to understand the traffic generated by each application accessing each domain name. This helps detect traffic theft or abnormal traffic consumption, reducing economic losses and effectively improving traffic monitoring performance.

[0058] Figure 2 This is a flowchart illustrating another traffic monitoring method provided in an embodiment of this application. Figure 2 As shown, in some embodiments, the method further includes:

[0059] S201. Listen to domain name resolution requests and responses, resolve the mapping relationship between domain name and remote server IP address based on the domain name resolution requests and responses, and determine the package name, UID and process of the application that initiated the domain name resolution request, thereby establishing a mapping table, which includes the mapping relationship between remote server IP address, domain name, UID, process ID and package name.

[0060] S202. Collect traffic data. Each piece of traffic data includes at least one of the following: UID, vehicle local port, remote server IP address, remote server port, and data volume.

[0061] S203. Use the UID and remote server IP address to query the mapping table;

[0062] S204. If only one mapping relationship is found in the mapping table, the package name and domain name to which the traffic data belongs are determined based on the mapping relationship.

[0063] S205. If multiple mapping relationships are found in the mapping table, the corresponding process ID is determined based on the vehicle's local IP address, vehicle's local port, remote server IP address, and remote server port. Then, the software package name and domain name to which the traffic data belongs are determined by querying the mapping table based on the UID, process ID, and remote server IP address.

[0064] In specific implementations, based on the correspondence between domain names and remote server IP addresses, and UIDs and package names, the following scenarios can be identified: one domain name corresponds to one or more remote server IP addresses and one UID corresponds to one package name; one domain name corresponds to one or more remote server IP addresses and one UID corresponds to multiple package names; multiple domain names correspond to one remote server IP address and one UID corresponds to one package name; multiple domain names correspond to one remote server IP address and one UID corresponds to multiple package names.

[0065] It is understandable that when a domain name corresponds to one or more remote server IP addresses, the remote server IP address in the traffic data uniquely corresponds to one domain name; when a UID corresponds to one software package name, the UID in the traffic data uniquely corresponds to one software package name.

[0066] Therefore, in scenarios where a domain name corresponds to one or more remote server IP addresses and a UID corresponds to a package name, traffic data corresponds to only one mapping relationship in the mapping table.

[0067] In the vehicle infotainment system architecture, different applications will not access the same domain name. Therefore, when multiple domain names use the same remote server IP address, if the UID in the traffic data uniquely corresponds to a software package name, meaning the UID is not shared by multiple applications, then a unique set of corresponding domain names and software package names can be determined in the mapping table based on the UID and remote server IP address in the traffic data.

[0068] For example, suppose the in-vehicle infotainment system uses news and music services provided by manufacturer A. Both news and music services are hosted on the same remote server IP address, 00.156.00.46. However, the news application in the in-vehicle system accesses the domain name news.com, while the music application accesses the domain name music.com. The domain names accessed by the news and music applications are different. Assume the UID of the news application is UID1 and the UID of the music application is UID2. If the UID in the traffic data is UID1 and the remote server IP address is 00.156.00.46, then it can be determined that the application consuming the traffic data is the news application. Furthermore, the domain name corresponding to the remote server IP address 00.156.00.46 accessed by the news application is news.com. Therefore, a unique set of package names and domain names can be found in the mapping table.

[0069] Furthermore, when a domain name corresponds to one or more remote server IP addresses and a UID corresponds to multiple package names, since different applications will not access the same domain name, a unique set of corresponding domain names and package names can be determined in the mapping table based on the UID and remote server IP address in the traffic data.

[0070] For example, suppose the news application in the vehicle's infotainment system accesses the domain name news.com, and the music application accesses the domain name music.com. The domain name news.com is deployed on a remote server with IP address 00.156.00.46, and the domain name music.com is deployed on a remote server with IP address 00.156.00.45. Both the news and music applications share the same UID, UID1. If the traffic data shows UID1 and the remote server IP address is 00.156.00.45, then it can be determined that the traffic is consumed by accessing the domain name music.com. Therefore, it can be identified that the application consuming the traffic is the music application, and a unique set of package name and domain name can be found in the mapping table.

[0071] However, when the same UID corresponds to multiple package names and multiple domains use the same IP address, using the UID and remote server IP address from traffic data cannot uniquely determine a set of corresponding domain names and package names based solely on the mapping relationship between the remote server IP address, domain name, UID, and package name.

[0072] Based on the above example, assuming that the UID of both the news app and the music app is UID1, if the UID in the traffic data is UID1 and the remote server IP address is 00.156.00.46, it is impossible to determine whether the app consuming the traffic data is the news app or the music app, nor is it possible to determine whether the domain name accessed by the app is news.com or music.com.

[0073] Therefore, when a single UID corresponds to multiple package names and multiple domains use the same IP address, it's impossible to determine the package name and domain name corresponding to traffic data solely based on the mapping relationship between remote server IP address, domain name, UID, and package name. An additional data item, the process ID, can be introduced. The mapping table includes the mapping relationship between remote server IP address, domain name, UID, process ID, and package name. Since a process ID belongs to only one application at a time, querying the mapping table using the process ID, remote server IP address, and UID of the traffic data can uniquely determine the corresponding domain name and package name.

[0074] In this embodiment, the UID and remote server IP address can be used to query the mapping table. If only one corresponding mapping relationship is found, the corresponding software package name and domain name can be directly determined without additional process ID location, enabling efficient and convenient traffic monitoring. If multiple corresponding mapping relationships are found, the process ID can be located, and the process ID, remote server IP address, and UID can be used to query the mapping table to accurately determine the corresponding software package name and domain name.

[0075] Optionally, each traffic data entry includes at least one of the following: UID, vehicle infotainment system local port, remote server IP address, and remote server port, as well as the data volume. The process ID corresponding to the traffic data can be located using at least one of the following: vehicle infotainment system local port, remote server IP address, and remote server port.

[0076] Optionally, you can use netstat –apn to locate the process ID using the vehicle's local port and the remote server's IP address / port.

[0077] Taking Markdown as an example, the following example shows how to locate the process ID of a program using netstat –apn, with the vehicle's local port and the remote server's IP address / port:

[0078] xxx: / # netstat -anp

[0079] Active Internet connections (established and servers)

[0080] Proto Recv-Q Send-Q Local Address Foreign Address State PID / Program Name

[0081] tcp 0 0 10.0.0.5:21343 180.101.83.218:3221 ESTABLISHED 32100 / baiduMap

[0082] tcp 0 0 10.0.0.5:21341 47.115.42.73:443 ESTABLISHED 2000 / Android

[0083] tcp 0 0 10.0.0.5:21345 180.101.49.160:4567 ESTABLISHED 2200 / SystemUI

[0084] Optionally, traffic data may also include protocol type, protocol family, vehicle-mounted system local IP address, etc., which are not restricted here.

[0085] Optionally, the data volume includes the total number of bytes received, the total number of packets received, the total number of bytes sent, and the total number of packets sent.

[0086] Optionally, after determining the corresponding UID, timestamp, vehicle local port, remote server port, data volume, software package name, domain name, and remote server IP address based on the mapping table, the data can be written to disk and recorded in the log of persistent storage (such as a disk).

[0087] In this embodiment, domain name resolution requests and responses are monitored. The mapping relationship between domain names and remote server IP addresses is obtained based on the domain name resolution requests and responses. The software package name, UID, and process ID of the application initiating the domain name resolution request are determined, thereby establishing a mapping table representing the mapping relationship between remote server IP addresses, domain names, UIDs, process IDs, and software package names. Traffic data is collected; each traffic data entry includes at least one of the following: UID, vehicle-mounted local port, remote server IP address, and remote server port, and the data volume. At least one of the following three items from the traffic data (vehicle-mounted local port, remote server IP address, and remote server port) is used to locate the corresponding process ID. Based on the process ID, remote server IP address, and UID from the traffic data, even when the same UID corresponds to multiple software package names and multiple domain names use the same IP address, by introducing the process ID as a query item, a unique set of corresponding software package names and domain names can be retrieved from the mapping table. This accurately resolves the attribution of traffic consumption, refines the traffic source, and allows users to understand the traffic generated by each application accessing each domain name, thus detecting traffic theft or abnormal traffic consumption, reducing economic losses, and effectively improving traffic monitoring performance.

[0088] In some embodiments, the mapping table also includes a record time and a TTL validity period, and the mapping table is updated after the TTL validity period expires.

[0089] In practical implementation, when the same domain name corresponds to multiple remote server IP addresses, the vehicle's Domain Name System (DNS) employs a cache mechanism. Specifically, when a vehicle application requests a domain name for the first time, the system sends a resolution request to a designated DNS server to obtain the remote server IP address corresponding to that domain name. This mapping between the domain name and the remote server IP address is then stored in the local DNS cache, valid for a time-to-live (TTL). Within the TTL, if the vehicle application requests the same domain name again, the system directly retrieves the previously recorded remote server IP address from the local DNS cache and returns it to the application, without sending another request to the remote DNS server. However, after the TTL expires, if the vehicle application requests the same domain name again, the system will send another request to the remote DNS server. The remote server IP address obtained this time may be different from the previously obtained one.

[0090] In other words, in scenarios where the same domain name corresponds to multiple remote server IP addresses, the mapping relationships in the mapping table are time-sensitive. Therefore, the mapping table includes the mapping relationships between remote server IP addresses, domain names, UIDs, process IDs, package names, record times, and validity periods. The validity period of each mapping relationship is the record time plus the validity period. Within this period, the mapping relationship between this remote server IP address and the domain name is valid; after this period, the domain name may correspond to other remote server IP addresses.

[0091] As can be seen, based on the cache mechanism, within the TTL, one domain name corresponds to one remote server IP address, or multiple domain names correspond to the same remote server IP address; there is no situation where multiple remote server IP addresses correspond to the same domain name.

[0092] Accordingly, if the current time is greater than the record time plus the validity period, the mapping relationship needs to be updated.

[0093] Optionally, the recording time is extracted from the DNS request sent by the vehicle system, and the validity period is extracted from the DNS response returned by the DNS server.

[0094] In this embodiment, the mapping table includes the mapping relationship between remote server IP address, domain name, UID, process ID, package name, record time and validity period. After the mapping table is generated, the mapping relationship will be updated in a timely manner according to the record time and validity period in the mapping relationship, so that the timestamp of the traffic data is within the valid time of the queried mapping relationship, which can effectively improve the accuracy and reliability of traffic source resolution.

[0095] In some embodiments, each traffic data entry also includes a timestamp; the method further includes:

[0096] Based on the timestamp, record time, and TTL validity period of each traffic data entry, a corresponding mapping table is determined, and the traffic data consumed by the package name accessing the domain name within the preset statistical period is aggregated.

[0097] Optionally, after determining the UID, timestamp, vehicle local port, remote server port, data volume, software package name, domain name, and remote server IP address corresponding to each piece of traffic data, it can be aggregated according to a preset statistical period. This allows the total amount of traffic consumed by each application accessing each domain name within the statistical period to be determined, making it easier for users to clearly and intuitively understand the traffic consumption situation. This enables timely detection of traffic leakage or abnormal traffic consumption, thereby improving the effectiveness of traffic monitoring.

[0098] Optionally, the traffic acquisition module can retrieve traffic data according to a statistical period. Specifically, the traffic acquisition module retrieves traffic data whose timestamps fall within the current statistical period. For example, if the statistical period is one hour, the traffic acquisition module will retrieve traffic data periodically every hour. After retrieving the traffic data according to the statistical period, it determines the corresponding UID, timestamp, vehicle-mounted local port, remote server port, data volume, software package name, domain name, and remote server IP address for each piece of traffic data based on a mapping table. This data is then aggregated, and the aggregated data must be labeled with the current statistical period, for example, 18:00:00-18:59:59.

[0099] In one possible implementation, the method also includes:

[0100] According to the statistical period, the aggregated data is pushed to the user terminal through the cloud server.

[0101] In practice, data tracking can be used to upload aggregated traffic data for a given statistical period to a cloud server. The cloud server can then automatically push the aggregated data to the user's terminal. Alternatively, users can actively view their traffic consumption in real time on the cloud server.

[0102] Optionally, the cloud server can be a self-built or proprietary cloud service platform (OEM cloud) of the automaker.

[0103] In this embodiment, traffic data is aggregated according to a statistical period, which makes it easier for users to understand traffic consumption clearly and intuitively. The aggregated data is pushed to the user terminal through the cloud server, so that users can detect traffic leakage or abnormal traffic consumption in a timely manner, reduce economic losses, and effectively improve the traffic monitoring effect.

[0104] In some embodiments, the system listens for domain name resolution requests and responses, resolves the mapping relationship between the domain name and the remote server IP address based on the domain name resolution requests and responses, and determines the package name, UID, and process of the application that initiated the domain name resolution request, including:

[0105] In user space, the Netd network daemon listens for domain name resolution requests and responses, obtains the UID, domain name, remote server IP address and process ID from the domain name resolution requests and responses, and determines the corresponding application's package name based on the process ID;

[0106] Optionally, the UID and domain name are extracted from the DNS request sent by the vehicle system, and the remote server IP address is extracted from the DNS response returned by the DNS server.

[0107] Optionally, the process ID initiating the domain name resolution request can be determined by monitoring DNS requests. For example, Netstats-apn can be used to determine the process ID initiating the domain name resolution request.

[0108] Optionally, you can use the command `cat / proc / <process ID> / cmdline` to obtain the complete command line string used to start the process, thus allowing you to determine the corresponding package name based on the process ID.

[0109] For example, when browser.apk attempts to access the www.baidu.com domain, it listens to DNS domain name resolution requests and responses and learns that www.baidu.com is deployed on a remote server with IP address 39.156.70.46. The process ID attempting to access this domain is 53453, and the UID is 10045. Since this process ID is not shared by multiple applications, the package name can be obtained through the package name-UID mapping table maintained in the system.

[0110] The Android Framework attempts to access the Beijing time server (domain name www.beijing-time.org). By listening to DNS domain name resolution requests and responses, it detects that www.beijing-time.org is deployed on a remote server with IP address 47.115.42.73. The process ID attempting to access this domain is 2000, and the UID is 1000, which is shared by multiple applications. The package name is obtained by using `cat / proc / 2000(process ID) / cmdline`.

[0111] MapApp attempts to access the map server (domain name map.baidu.com). By listening to DNS domain name resolution requests and responses, it detects that map.baidu.com is deployed on a remote server with IP address 180.101.83.218. The process ID attempting to access this domain is 32100, and the UID is 1000, which is shared by multiple applications. The package name is obtained by using cat / proc / 32100 / cmdline.

[0112] SystemUI attempts to access the weather server (domain name weathernew.pae.baidu.com). By listening to DNS domain name resolution requests and responses, it detects that weathernew.pae.baidu.com is deployed on a remote server with IP address 180.101.49.160. The process ID attempting to access this domain is 2200, and the UID is 1000, which is shared by multiple applications. The package name is obtained by using `cat / proc / 2200 / cmdline`.

[0113] In this embodiment, the Netd network daemon listens to domain name resolution requests and responses, obtains the UID, domain name, and remote server IP address from the domain name resolution requests and responses, determines the process ID that initiated the domain name resolution request through the DNS request, and determines the corresponding application's package name based on the process ID. Thus, the mapping relationship between UID, domain name, remote server IP address, process ID, and package name can be determined, and a mapping table can be established.

[0114] In some embodiments, collecting traffic data includes:

[0115] In kernel space, the eBPF program is mounted on the mount point of the flow control filter; the eBPF program counts traffic data in key-value pairs and caches the results in a hash table.

[0116] In user space, traffic data is obtained by calling the bpf() system interface to read the hash table from the kernel space.

[0117] Optionally, TC (Traffic Control) is the traffic control system within the Linux kernel, responsible for managing the queuing, scheduling, and shaping of network packets. The Ethernet driver handles the transmission and reception of traffic data between the TC and the onboard telematics control unit (TBox) / telecommunications antenna module (TCAM). The TC filter is a classifier within the traffic control system, used to sort traffic packets based on IP address / port. A TC filterhook is a mount point where custom code can be attached. Whenever a traffic packet passes through this mount point, the kernel space automatically executes an eBPF program to collect traffic statistics.

[0118] Optionally, the TC filter hook can be set at the TC packet ingress point (tc ingress) or the TC packet egress point (tc egress), so that the eBPF program can inspect the passing packets.

[0119] Optionally, traffic data can be counted in key-value pairs, and the results can be stored in kernel space in a hash table (HashMap) structure in key-value pair form to obtain an eBPF Map.

[0120] For example, using the C++ language, the Key design is as follows:

[0121] struct FlowStatsKey {

[0122] __u32 uid; / / Application UID

[0123] __u8 proto; / / Protocol (IPPROTO_TCP / IPPROTO_UDP)

[0124] __u8 family; / / Protocol family (AF_INET / AF_INET6)

[0125] __u16 sport; / / Source port

[0126] __u16 dport; / / Destination port

[0127] union {

[0128] __u32 saddr4; / / IPv4 source address

[0129] __u8 saddr6

[16] ; / / IPv6 source address

[0130] };

[0131] union {

[0132] __u32 daddr4; / / IPv4 destination address

[0133] __u8 daddr6

[16] ; / / IPv6 destination address

[0134] };

[0135] };

[0136] Taking Markdown as an example, the Value is designed as follows:

[0137] struct FlowStatsValue {

[0138] __u64 rx_bytes;

[0139] __u64 rx_packets;

[0140] __u64 tx_bytes;

[0141] __u64 tx_packets;

[0142] };

[0143] Optionally, the kernel space is the necessary path for traffic data, so traffic data needs to be collected in the kernel space. However, analyzing the source of the traffic data needs to be done in user space. Therefore, it is necessary to call the bpf() system interface to read the hash table from the kernel space and copy the traffic data to user space. The bpf() system interface is provided by the Linux kernel and serves as the official entry point between user space and the kernel eBPF subsystem.

[0144] Optionally, traffic data can be retrieved from the kernel space by calling the bpf() system interface through the traffic acquisition module in user space.

[0145] In this embodiment, traffic data is collected along the necessary path of traffic in the kernel space and stored in a hash table in the kernel space in the form of key-value pairs. This enables accurate collection of traffic data and avoids packet loss. By calling the bpf() system interface, the traffic data can be pulled to the user space, thereby enabling accurate parsing of the source of the traffic data.

[0146] The above is the traffic monitoring method provided in the embodiments of this application.

[0147] Figure 3 This is a schematic diagram of a traffic monitoring device provided in an embodiment of this application. Figure 3 As shown, the device includes:

[0148] The listening process listens for domain name resolution requests and responses in user space. Based on the domain name resolution requests and responses, it resolves the mapping relationship between domain names and remote server IP addresses, and determines the package name, UID, and process ID of the application that initiated the domain name resolution request. In this way, it establishes a mapping table, which includes the mapping relationship between remote server IP address, domain name, UID, process ID, and package name.

[0149] For example, the listening process could be the Netd network daemon.

[0150] The acquisition process is used to collect traffic data in kernel space and build a traffic data table. Each traffic data entry includes a UID, the remote server IP address, and the amount of data.

[0151] For example, the acquisition process can be implemented by an eBPF program mounted on the TC filter hook.

[0152] For example, the mounting point of the flow control filter can be set at the packet ingress point (tc ingress) or packet egress point (tc egress) of the TC, so that the collection process can check the passing packets and build a flow data table in the form of eBPF maps.

[0153] For example, the collection process collects traffic data in the form of key-value pairs and caches the statistics in a hash table.

[0154] The traffic acquisition module is used to read the traffic data table from the kernel space. Based on the UID and remote server IP address in each traffic data, it queries the mapping table to obtain the corresponding package name and domain name, and determines the package name and domain name to which the traffic data belongs.

[0155] For example, the traffic acquisition module can read the traffic data table from the kernel space by calling the bpf() system interface, thereby obtaining traffic data.

[0156] Optionally, the traffic acquisition module can write the traffic data to disk and into a persistent storage log after determining the ownership of the traffic data.

[0157] Optionally, the traffic collection module can also upload the aggregated traffic data for the statistical period to the cloud server through data tracking. The cloud server can automatically push the aggregated data to the user terminal, or the user can actively view the traffic consumption in real time on the cloud server.

[0158] Figure 4This is a schematic diagram of another flow monitoring device provided in an embodiment of this application. Figure 4 As shown, the device includes:

[0159] The listening module 41 is used to listen to domain name resolution requests and responses, resolve the mapping relationship between domain name and remote server IP address based on the domain name resolution requests and responses, and determine the package name, UID and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table. The mapping table includes the mapping relationship between remote server IP address, domain name, UID, process ID and package name.

[0160] The acquisition module 42 is used to collect traffic data. Each piece of traffic data includes UID, remote server IP address and data volume.

[0161] The query module 43 is used to query the mapping table based on the UID and remote server IP address in each traffic data to obtain the corresponding software package name and domain name, and to determine the software package name and domain name to which the traffic data belongs.

[0162] It should be noted that the traffic monitoring device is used to perform the traffic monitoring provided in the embodiments of this application, and its specific implementation method is as described above, and will not be repeated here.

[0163] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 5 As shown, the electronic device includes:

[0164] The electronic device includes a processor 291 and a memory 292; it may also include a communication interface 293 and a bus 294. The processor 291, memory 292, and communication interface 293 can communicate with each other via the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke logical instructions stored in the memory 292 to execute the methods of the above embodiments.

[0165] Furthermore, the logic instructions in the aforementioned memory 292 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0166] The memory 292, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, thereby implementing the methods in the above-described method embodiments.

[0167] The memory 292 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 292 may include high-speed random access memory and may also include non-volatile memory.

[0168] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0169] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0170] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0171] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0172] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0173] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0174] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0175] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0176] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0177] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A traffic monitoring method, characterized in that, include: Listen for domain name resolution requests and responses, resolve the mapping relationship between the domain name and the remote server IP address based on the domain name resolution requests and responses, and determine the package name, UID and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table, which includes the mapping relationship between the remote server IP address, domain name, UID, process ID and package name; Collect traffic data; each traffic data entry includes the UID, remote server IP address, and data volume. Based on the UID and the remote server IP address in each traffic data entry, the corresponding software package name and domain name are retrieved from the mapping table to determine the software package name and domain name to which the traffic data belongs.

2. The method according to claim 1, characterized in that, Each piece of traffic data also includes the vehicle's local IP address, the vehicle's local port, and the remote server port; Based on the UID and remote server IP address in each traffic data entry, the corresponding software package name and domain name are retrieved from the mapping table to determine the software package name and domain name to which the traffic data belongs, including: Use the UID and the remote server IP address to query the mapping table; If only one mapping relationship is found in the mapping table, the software package name and the domain name to which the traffic data belongs are determined based on the mapping relationship; If multiple mapping relationships are found in the mapping table, the corresponding process ID is determined based on the vehicle's local IP address, the vehicle's local port, the remote server's IP address, and the remote server's port. Then, the mapping table is queried based on the UID, the process ID, and the remote server's IP address to determine the software package name and the domain name to which the traffic data belongs.

3. The method according to claim 1, characterized in that, The mapping table also includes the recording time and TTL validity period, and the mapping table is updated after the TTL validity period expires.

4. The method according to claim 3, characterized in that, Each data entry also includes a timestamp; the method further includes: The mapping table is determined based on the timestamp of each traffic data, the record time, and the TTL validity period, and the traffic data consumed by the software package name when accessing the domain name within a preset statistical period is aggregated.

5. The method according to claim 4, characterized in that, The method further includes: According to the statistical period, the aggregated data is pushed to the user terminal through the cloud server.

6. The method according to claim 1, characterized in that, The process of monitoring domain name resolution requests and responses, resolving the domain name to the mapping relationship between the domain name and the remote server IP address based on the domain name resolution requests and responses, and determining the package name, UID, and process ID of the application that initiated the domain name resolution request, including: In user space, the Netd network daemon listens for domain name resolution requests and responses, obtains the UID, domain name, remote server IP address, and process ID from the domain name resolution requests and responses, and determines the corresponding application's package name based on the process ID.

7. The method according to any one of claims 1-6, characterized in that, The collected traffic data includes: In the kernel space, the eBPF program is mounted on the mount point of the flow control filter; the eBPF program counts traffic data in key-value pairs and caches the results in a hash table. In user space, the traffic data is obtained by reading the hash table from the kernel space by calling the bpf() system interface.

8. A flow monitoring device, characterized in that, include: A listening process is used to listen for domain name resolution requests and responses in user space, resolve the mapping relationship between domain names and remote server IP addresses based on the domain name resolution requests and responses, and determine the package name, UID, and process ID of the application that initiated the domain name resolution request, thereby establishing a mapping table. The mapping table includes the mapping relationship between remote server IP address, domain name, UID, process ID, and package name. The acquisition process is used to collect traffic data in kernel space and build a traffic data table. Each traffic data entry includes a UID, a remote server IP address, and the amount of data. The traffic acquisition module is used to read the traffic data table from the kernel space, and based on the UID and the remote server IP address in each traffic data entry, query the mapping table to obtain the corresponding software package name and domain name, and determine the software package name and domain name to which the traffic data belongs.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

Images