Network behavior tracking method and device, computer equipment and readable storage medium

Abstract

The invention relates to a network behavior tracking method and device, computer equipment and a computer readable storage medium. The method comprises the steps that after an operating system starting instruction is received, a mapping file comprising the mapping relation between process names and process identifiers of all processes currently running in an operating system is generated; obtaining a target network event through the event tracking service, and querying a corresponding target process name in the mapping file according to a target process identifier carried in the target network event; and generating a network behavior log according to the network event data carried in the target network event and the target process name. By adopting the method, network events such as TCP / UDP (Transmission Control Protocol / User Datagram Protocol) and DNS (Domain Name Server) can be captured by utilizing the event tracking service of the operating system, the network behavior log which can be directly exported is generated, the self-starting is realized, more process network data can be monitored, the monitoring blind area is greatly reduced, and the process monitoring effect is improved.

Description

Network behavior tracking methods, devices, computer equipment, and readable storage media Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, computer device, and computer-readable storage medium for tracking network behavior. Background Technology

[0002] While the native process monitor software provided by the operating system can monitor network requests initiated by certain processes, current process monitors cannot export specific process network access data and rely on native software, making it impossible to automatically start the system and monitor process network data generated before startup. This results in limited process monitoring capabilities, as detailed process network access data is unavailable and blind spots exist. Summary of the Invention

[0003] Therefore, it is necessary to provide a network behavior tracking method, apparatus, computer device, and computer-readable storage medium that can improve the effectiveness of process monitoring in response to the above-mentioned technical problems.

[0004] Firstly, this application provides a method for tracking online behavior, including:

[0005] Upon receiving the operating system boot command, a mapping file is generated; the mapping file includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system;

[0006] Obtain target network events through event tracing service, and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event;

[0007] Network behavior logs are generated based on the network event data carried in the target network events and the target process name.

[0008] In one embodiment, obtaining target network events through an event tracing service includes:

[0009] The events to be inspected are obtained through the operating system's domain name resolution service and kernel network behavior monitoring service;

[0010] Identify whether the event to be checked is a DNS request query result or a network event;

[0011] If the event to be checked is a DNS request query result, confirm that the network event type of the event to be checked is a DNS event; if the event to be checked is a network event, confirm that the network event type of the event to be checked is a TCP event or a UDP event.

[0012] The network event to be inspected is a network event of type TCP, UDP, or DNS.

[0013] In one embodiment, when the event to be checked is a DNS request query result, confirming that the network event type of the event to be checked is a DNS event includes:

[0014] If the event to be checked is a DNS request query result, and the process identifier of the event to be checked matches the preset standard process identifier, then the network event type of the event to be checked is confirmed to be a DNS event.

[0015] In one embodiment, a network behavior log is generated based on network event data carried in the target network event and the target process name, including:

[0016] Store the network event data and the target process name carried in the target network event into the buffer;

[0017] At preset time intervals, the data in the buffer is written to disk to generate network behavior logs.

[0018] In one embodiment, the method further includes:

[0019] If the target process name is not found, an asynchronous task is executed based on the target process identifier. The asynchronous task is used to repeatedly query the process name in the mapping file based on the target process identifier within a preset time period until a process name that has a mapping relationship with the target process identifier is found or the preset number of queries is reached.

[0020] Before the asynchronous task ends, if a process name that has a mapping relationship with the target process identifier is found, the network event data carried in the target network event and the target process name are stored in the buffer.

[0021] In one embodiment, the method further includes:

[0022] Analyze the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event;

[0023] The geographic location information corresponding to each network event is compared with the preset expected geographic location to obtain abnormal network events in the network behavior log where the geographic location information does not match the expected geographic location.

[0024] In the network behavior log, add IP access tags to abnormal network events; IP access tags are used to characterize network events that involve access behavior from unexpected geographical locations.

[0025] Secondly, this application also provides a network behavior tracking device, comprising:

[0026] The startup module is used to generate a mapping file after receiving the operating system startup command; the mapping file includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system;

[0027] The query module is used to obtain target network events through the event tracing service and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event.

[0028] The generation module is used to generate network behavior logs based on the network event data carried in the target network event and the target process name.

[0029] In one embodiment, the query module is further configured to:

[0030] The system obtains the events to be inspected through the operating system's domain name resolution service and kernel network behavior monitoring service; identifies whether the events to be inspected are DNS request query results or network events; if the events to be inspected are DNS request query results, confirms that the network event type of the events to be inspected is a DNS event; if the events to be inspected are network events, confirms that the network event type of the events to be inspected is a TCP event or a UDP event; and takes the events to be inspected that are of the TCP event, UDP event, or DNS event type as the target network events.

[0031] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0032] Upon receiving the operating system boot command, a mapping file is generated; the mapping file includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system;

[0033] Obtain target network events through event tracing service, and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event;

[0034] Network behavior logs are generated based on the network event data carried in the target network events and the target process name.

[0035] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0036] Upon receiving the operating system boot command, a mapping file is generated; the mapping file includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system;

[0037] Obtain target network events through event tracing service, and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event;

[0038] Network behavior logs are generated based on the network event data carried in the target network events and the target process name.

[0039] The aforementioned network behavior tracking method, apparatus, computer device, and computer-readable storage medium, upon receiving the operating system startup command, generate a mapping file containing the mapping relationship between process names and process identifiers of all currently running processes in the operating system; acquire target network events through event tracing services; query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event; and generate a network behavior log based on the network event data carried in the target network event and the target process name. By utilizing the operating system's event tracing services to capture network events such as TCP / UDP and DNS, specific process network access data is obtained, and a network behavior log that can be directly exported is generated. This makes the tracking results of each process's network behavior more intuitive, achieves automatic startup upon system boot, enables monitoring of more process network data, significantly reduces monitoring blind spots, and improves the effectiveness of process monitoring. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 is an application environment diagram of a network behavior tracking method in one embodiment;

[0042] Figure 2 is a flowchart illustrating a network behavior tracking method in one embodiment;

[0043] Figure 3 is a schematic diagram of the program flow of a network behavior tracking method in one embodiment;

[0044] Figure 4 is a schematic diagram of the execution module of a network behavior tracking method in one embodiment;

[0045] Figure 5 is a structural block diagram of a network behavior tracking device in one embodiment;

[0046] Figure 6 is an internal structure diagram of a computer device in one embodiment. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] Process Monitor is an advanced monitoring tool for operating systems that displays real-time file system, registry, and process / thread activity. It combines the functionality of two legacy Sysinternals utilities (Filemon and Regmon) and adds a wide list of enhancements, including rich non-destructive filtering, comprehensive event attributes such as session, identity, and username, reliable process information, full-thread stacks with integrated symbol support for each operation, simultaneous logging to files, and more. Its unique and powerful features make Process Monitor a core utility in system troubleshooting and malware detection toolkits. It is specifically designed to monitor any file operations within the system, and Used for monitoring The process monitor tracks and records the read and write operations of files and the registry. With a process monitor, users can simultaneously monitor and record any file and registry operations within the system. Changes in registry and file read / write operations are extremely useful for diagnosing system failures or detecting malware, viruses, or Trojans.

[0049] However, current process monitors cannot export specific process network access data and cannot track certain IP domains. Furthermore, relying on native software, they cannot achieve automatic startup and therefore cannot monitor process network data generated before startup. This results in the inability to obtain detailed process network access data and the existence of monitoring blind spots when using this software for system process monitoring, thus the effectiveness of process monitoring needs improvement.

[0050] The network behavior tracking method provided in this application embodiment can be applied to the application environment shown in Figure 1. The terminal 102 communicates with the server 104 via a network. A data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104 or placed on the cloud or other network servers. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, smart interactive whiteboards, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0051] In an exemplary embodiment, as shown in FIG2, a network behavior tracking method is provided. Taking the application of this method to terminal 102 in FIG1 as an example, the method includes the following steps 202 to 206. Wherein:

[0052] Step 202: After receiving the operating system startup command, generate a mapping file; the mapping file includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system.

[0053] A process is an independent unit for resource allocation and scheduling by the operating system. It is an execution of a program, including the program's code, data, state, and resources. All currently running processes can include, but are not limited to, the operating system's own processes and the processes of all software applications running on the operating system.

[0054] Optionally, the operating system runs on the terminal's hardware, providing software support and services to the terminal. During the terminal's startup process, the operating system will start based on the operating system startup instructions. The operating system may be, but is not limited to, a Windows operating system; the mapping file may be, but is not limited to, a map data structure; and the process identifier refers to the process ID.

[0055] Optionally, as shown in Figure 3, upon receiving the operating system startup command, the operating system will start and simultaneously establish a mapping relationship between the process names and process identifiers of all currently running processes based on the startup service. This mapping relationship will be stored in a map data structure for easy subsequent querying. The mapping relationship includes both the mapping relationships of processes during the operation of the operating system and the mapping relationships of processes in the events to be detected that are subsequently tracked.

[0056] In one feasible implementation, to ensure automatic startup, the C# application of this embodiment can be set as a startup service. The process of setting up a startup service is as follows:

[0057] Step 2021, Create a Windows Service Project: In Visual Studio, create a Windows Service Project. Visual Studio is a comprehensive development toolset that includes most of the tools needed throughout the software lifecycle.

[0058] Step 2022: Implement the service logic: Inherit the ServiceBase base class and implement the corresponding interface for controlling service start and stop. In the service project, write C# code to implement the service logic. Write the operations to be executed when starting the service in the `OnStart` method, and the operations to be executed when stopping the service in the `OnStop` method. Here, ServiceBase is an abstract base class used to create Windows services, and the `OnStart` and `OnStop` methods are virtual methods in the ServiceBase base class.

[0059] Step 2023, Set Service Properties: In the service project, open the `ProjectInstaller.cs` file. Set the `StartType` property of the `ServiceInstaller` component to `Automatic` and the `Account` to `LocalSystem` to specify that the service should start automatically when the system starts. Also, modify the service name and description. Here, `ProjectInstaller.cs` is a C# source file used in the .NET Framework project to create a Windows service installer. `ServiceInstaller` is a class in the .NET Framework project used to install and manage Windows services. `StartType` is a property of the `ServiceInstaller` class in the .NET Framework project, used to specify the startup mode of the Windows service. `Automatic` refers to the service startup type, indicating that the service should start automatically when the system starts. `Account` specifies the user account settings used by the service at runtime; `LocalSystem` is a specific user account with the highest system privileges.

[0060] Step 2024, Install the service: Use the installation tool `InstallUtil.exe` to install the service onto the system. `InstallUtil.exe` is a command-line tool used to install, uninstall, or update Windows installer files.

[0061] Step 204: Obtain the target network event through the event tracing service, and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event.

[0062] Event tracing service is a service used to monitor, record, and analyze events that occur in a network. Event tracing service can be, but is not limited to, ETW, which stands for Event Tracing for Windows. It is a native event tracing and logging system provided by the Windows operating system. A network event must include at least one network process.

[0063] Optionally, initialize the ETW event tracing service to ensure it starts automatically at system boot. As shown in Figure 3, after the operating system starts, a thread is started to listen for ETW event data in various processes through the ETW event tracing service, including TCP / UDP and DNS events, as target network events, and to obtain the network event data carried by the target network events. Based on the process ID in the captured event, the corresponding process name in the map is queried. TCP is short for Transmission Control Protocol, a connection-oriented, reliable, byte-stream-based transport layer communication protocol; UDP is short for User Datagram Protocol, a connectionless, unreliable, datagram-based transport layer communication protocol; and DNS is short for Domain Name System, a distributed database that translates domain names and IP addresses.

[0064] Step 206: Generate a network behavior log based on the network event data carried in the target network event and the target process name.

[0065] The target process name corresponds to the network process in the target network event corresponding to the network event data; the network behavior log may include, but is not limited to, the process name, network event type, event timestamp, and IP address of the target network event; the network event type may be, but is not limited to, TCP event, UDP event, or DNS event.

[0066] Optionally, as shown in Figure 3, if the target process name can be found in the map, the network event data carried in the target network event and the target process name are saved together to obtain the network behavior log.

[0067] In the aforementioned network behavior tracing method, upon receiving the operating system startup command, a mapping file is generated, containing a mapping relationship between process names and process identifiers of all currently running processes in the operating system. Target network events are acquired through an event tracing service, and the corresponding target process name is queried in the mapping file based on the target process identifier carried in the target network event. A network behavior log is generated based on the network event data carried in the target network event and the target process name. By utilizing the operating system's event tracing service to capture network events such as TCP / UDP and DNS, specific process network access data is obtained, and a network behavior log that can be directly exported is generated. This makes the tracing results of each process's network behavior more intuitive, and it achieves automatic startup upon system boot, enabling the monitoring of more process network data, greatly reducing monitoring blind spots, and improving the effectiveness of process monitoring.

[0068] In one embodiment, obtaining a target network event through an event tracing service includes: obtaining the event to be inspected and its corresponding event data through the operating system's domain name resolution service and kernel network behavior monitoring service; identifying whether the event to be inspected is a DNS request query result or a network event; if the event to be inspected is a DNS request query result, confirming that the network event type of the event to be inspected is a DNS event; if the event to be inspected is a network event, confirming that the network event type of the event to be inspected is a TCP event or a UDP event; and taking the event to be inspected with a network event type of TCP event, UDP event, or DNS event as the target network event.

[0069] The domain name resolution service refers to the service that implements the function of converting domain names to IP addresses. The kernel network behavior monitoring service refers to the service that listens for and analyzes network packets at the operating system kernel level. The domain name resolution service can be, but is not limited to, Microsoft-Windows-DNS-Client, and the kernel network behavior monitoring service can be, but is not limited to, Microsoft-Windows-Kernel-Network. Both Microsoft-Windows-DNS-Client and Microsoft-Windows-Kernel-Network are Windows event loggers and are components of the Windows operating system. Microsoft-Windows-DNS-Client is specifically used to record activities and events related to DNS clients, and Microsoft-Windows-Kernel-Network is specifically used to record network-related activities and events. The events to be inspected can include, but are not limited to, network events, DNS events, memory events, and network processes. Network events include TCP events and UDP events. DNS events refer to events related to the domain name resolution process, UDP events refer to events that occur in network communication using the UDP protocol, and TCP events refer to events that occur in network communication using the TCP protocol.

[0070] Since this application tracks network behavior, and all network events corresponding to network requests are one of TCP events, UDP events, or DNS events, the target network events in this embodiment only need to include TCP events, UDP events, and DNS events from the events to be detected.

[0071] Optionally, as shown in Figure 3, a thread is started to listen for the Microsoft-Windows-DNS-Client and Microsoft-Windows-Kernel-Network events. Upon capturing an event, it is first checked whether it is a DNS request query result or a network event. If the event to be checked is a DNS request query result, the network event type of the event to be checked is confirmed to be a DNS event; if the event to be checked is a network event, the network event type of the event to be checked is confirmed to be a TCP event or a UDP event. The TCP event, UDP event, and DNS event are used as target network events, and the target network events are listened to to obtain the network event data carried within them.

[0072] In this embodiment, the operating system's event tracing service is used to capture events such as TCP / UDP and DNS, obtain specific process network access data, and generate network behavior logs that can be directly exported, making the tracking results of each process's network behavior more intuitive and improving the monitoring effect of process network behavior.

[0073] In one embodiment, the method further includes: if the event to be checked is a DNS request query result and the process identifier of the event to be checked matches a preset standard process identifier, confirming that the network event type of the event to be checked is a target DNS event; and taking the event to be checked with a network event type of TCP event, UDP event or target DNS event as the target network event.

[0074] Optionally, as shown in Figure 3, if the event to be checked is a DNS request query result, the DNS request query result can be filtered. By pre-setting a standard process ID, the process ID of the monitored DNS request query result is matched with the standard process ID, and the DNS request query results that do not match are filtered out. The matched DNS request query results are taken as the target DNS event. Then, the TCP event, UDP event and the target DNS event are taken as the target network event, and the target network event is monitored and the network event data carried in the target network event is obtained.

[0075] In this embodiment, the operating system's event tracing service is used to capture network events such as TCP / UDP and DNS. At the same time, the monitored DNS network events can be filtered to obtain specific process network access data and generate network behavior logs that can be directly exported, making the tracking results of each process's network behavior more intuitive and improving the monitoring effect of process network behavior.

[0076] In one embodiment, generating a network behavior log based on network event data carried in a target network event and the target process name includes: if the target process name is found, storing the network event data carried in the target network event and the target process name in a buffer; and writing the data in the buffer to disk at preset time intervals to generate a network behavior log.

[0077] Data write-to-disk refers to the process of writing data from the computer system's memory or other temporary storage locations to permanent storage devices (such as hard disk drives, solid-state drives, etc.).

[0078] Optionally, as shown in Figure 3, if the target process name can be found in the map, i.e. the query is successful, the network event data carried in the target network event and the target process name are stored together in the buffer, and the data in the buffer is written to disk every 2 seconds to form a network behavior log file.

[0079] In this embodiment, the operating system's event tracing service is used to capture network events such as TCP / UDP and DNS, obtain specific process network access data, and generate network behavior logs that can be directly exported, making the tracking results of each process's network behavior more intuitive and improving the monitoring effect of process network behavior.

[0080] In one embodiment, the method further includes: if the target process name is not found, performing an asynchronous task for the target process identifier; the asynchronous task is used to repeatedly query the process name in the mapping file according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or a preset number of queries is reached; if a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, storing the network event data carried in the target network event and the target process name in a buffer.

[0081] Optionally, as shown in Figure 3, if the target process name cannot be found in the map (i.e., the query fails), an asynchronous task is executed to retry, which can be limited to a maximum of 5 retries within 500ms. If the target process name can be found before the asynchronous task ends, the network event data carried in the target network event and the target process name are stored together in a buffer. The data in the buffer is written to disk every 2 seconds to form a network behavior log file.

[0082] In this embodiment, the operating system's event tracing service is used to capture network events such as TCP / UDP and DNS, obtain specific process network access data, and generate network behavior logs that can be directly exported, making the tracking results of each process's network behavior more intuitive. At the same time, an asynchronous task mechanism is configured to perform multiple queries for network events for which the target process name could not be found on the first query, thereby improving query accuracy and enhancing the monitoring effect of process network behavior.

[0083] In one embodiment, the method further includes: analyzing the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event; comparing the geographical location information corresponding to each network event with a preset expected geographical location to obtain abnormal network events in the network behavior log where the geographical location information does not match the expected geographical location; adding an IP access tag to the abnormal network events in the network behavior log; the IP access tag is used to characterize the network event having access behavior outside the expected geographical location.

[0084] Among them, geolocation information refers to the network address of the organization or individual to which the network event response software belongs.

[0085] Optionally, after the data is written to disk and a network behavior log file is obtained, the IP addresses in the network behavior log are analyzed to query their corresponding geographical location information. By pre-setting expected geographical locations, the IP addresses in the network behavior log are compared with the expected geographical locations, thereby recording and marking IP access events from unexpected geographical locations.

[0086] In this embodiment, the operating system's event tracing service is used to capture network events such as TCP / UDP and DNS, obtain specific process access network data behavior, and generate network behavior logs that can be directly exported, making the tracking results of each process's network behavior more intuitive. At the same time, it supports the analysis of the geographical location information corresponding to the process's network behavior IP, avoiding access from unexpected geographical location IPs and improving the monitoring effect of process network behavior.

[0087] In an exemplary embodiment, a network behavior tracking method, as shown in Figures 3 and 4, includes:

[0088] After receiving the operating system startup command, the core processing module generates a map; the map includes the mapping relationship between the process names and process identifiers of all currently running processes in the operating system.

[0089] The core processing module monitors the Microsoft-Windows-DNS-Client and Microsoft-Windows-Kernel-Network of the operating system ETW to capture the events to be inspected and the corresponding event data; it identifies whether the events to be inspected are DNS request query results or network events; if the events to be inspected are DNS request query results and the process identifier of the events to be inspected matches the preset standard process identifier, it confirms that the network event type of the events to be inspected is a target DNS event; it treats the events to be inspected with network event types of TCP events, UDP events, or target DNS events as target network events, listens to the target network events, and obtains the network event data carried in the target network events.

[0090] The core processing module queries the map for the corresponding target process name based on the target process identifier carried in the target network event.

[0091] When the core processing module finds the target process name, it stores the network event data carried in the target network event and the target process name in the buffer; according to the preset time interval, it writes the data in the buffer to disk and generates a network behavior log.

[0092] If the target process name is not found, the core processing module executes an asynchronous task based on the target process identifier. The asynchronous task is used to repeatedly query the process name in the map according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or the preset number of queries is reached. If a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, the network event data carried in the target network event and the target process name are stored in the buffer.

[0093] The log analysis module periodically reads network behavior logs, analyzes the IP addresses of each network event in the logs, and obtains the geographical location information corresponding to each network event. It then compares the geographical location information of each network event with the preset expected geographical location to identify abnormal network events where the geographical location information in the network behavior logs does not match the expected geographical location. Finally, it adds an IP access tag to the abnormal network events in the network behavior logs. The IP access tag is used to indicate that the network event has access behavior outside the expected geographical location.

[0094] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0095] Based on the same inventive concept, this application also provides a network behavior tracking device for implementing the network behavior tracking method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more network behavior tracking device embodiments provided below can be found in the limitations of the network behavior tracking method described above, and will not be repeated here.

[0096] In an exemplary embodiment, as shown in FIG5, a network behavior tracking device 500 is provided, including: a startup module 501, a query module 502, and a generation module 503, wherein:

[0097] The startup module 501 is used to generate a mapping file after receiving the operating system startup command; the mapping file includes the mapping relationship between the process names and process identifiers of all processes currently running in the operating system.

[0098] The query module 502 is used to obtain target network events through the event tracing service and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event.

[0099] The generation module 503 is used to generate network behavior logs based on the network event data carried in the target network event and the target process name.

[0100] In one embodiment, the query module 502 is further configured to obtain the event to be checked and the corresponding event data through the domain name resolution service and kernel network behavior monitoring service of the operating system; identify whether the event to be checked is a DNS request query result or a network event; if the event to be checked is a DNS request query result, confirm that the network event type of the event to be checked is a DNS event; if the event to be checked is a network event, confirm that the network event type of the event to be checked is a TCP event or a UDP event; and take the event to be checked with a network event type of TCP event, UDP event or DNS event as the target network event.

[0101] In one embodiment, the query module 502 is further configured to confirm that the network event type of the event to be checked is a DNS event when the event to be checked is a DNS request query result and the process identifier of the event to be checked matches a preset standard process identifier.

[0102] In one embodiment, the generation module 503 is further configured to store the network event data and the target process name carried in the target network event into a buffer; and to write the data in the buffer to disk at preset time intervals to generate a network behavior log.

[0103] In one embodiment, the query module 502 is further configured to perform an asynchronous task for the target process identifier if the target process name is not found; the asynchronous task is configured to repeatedly query the process name in the mapping file according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or the preset number of queries is reached; if a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, the network event data carried in the target network event and the target process name are stored in the buffer.

[0104] In one embodiment, the generation module 503 is further configured to analyze the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event; compare the geographical location information corresponding to each network event with the preset expected geographical location to obtain abnormal network events in the network behavior log that do not match the expected geographical location; add an IP access tag to the abnormal network events in the network behavior log; the IP access tag is used to characterize the network event having access behavior outside the expected geographical location.

[0105] Each module in the aforementioned network behavior tracking device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0106] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 6. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device stores network event data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a network behavior tracking method.

[0107] Those skilled in the art will understand that the structure shown in Figure 6 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0108] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: after receiving an operating system startup instruction, generating a mapping file; the mapping file includes a mapping relationship between process names and process identifiers of all currently running processes in the operating system; obtaining a target network event through an event tracing service, and querying the corresponding target process name in the mapping file based on the target process identifier carried in the target network event; and generating a network behavior log based on the network event data carried in the target network event and the target process name.

[0109] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining the event to be inspected and the corresponding event data through the domain name resolution service and kernel network behavior monitoring service of the operating system; identifying whether the event to be inspected is a DNS request query result or a network event; if the event to be inspected is a DNS request query result, confirming that the network event type of the event to be inspected is a DNS event; if the event to be inspected is a network event, confirming that the network event type of the event to be inspected is a TCP event or a UDP event; and taking the event to be inspected with a network event type of TCP event, UDP event or DNS event as the target network event.

[0110] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the event to be checked is a DNS request query result and the process identifier of the event to be checked matches a preset standard process identifier, it confirms that the network event type of the event to be checked is a DNS event.

[0111] In one embodiment, when the processor executes the computer program, it also performs the following steps: storing the network event data and the target process name carried in the target network event into a buffer; and writing the data in the buffer to disk at preset time intervals to generate a network behavior log.

[0112] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the target process name is not found, an asynchronous task is executed for the target process identifier; the asynchronous task is used to repeatedly query the process name in the mapping file according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or a preset number of queries is reached; if a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, the network event data carried in the target network event and the target process name are stored in a buffer.

[0113] In one embodiment, when the processor executes the computer program, it further performs the following steps: analyzing the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event; comparing the geographical location information corresponding to each network event with a preset expected geographical location to obtain abnormal network events in the network behavior log that do not match the expected geographical location; adding an IP access tag to the abnormal network events in the network behavior log; the IP access tag is used to characterize the network event having access behavior outside the expected geographical location.

[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: after receiving an operating system startup instruction, generating a mapping file; the mapping file includes a mapping relationship between process names and process identifiers of all currently running processes in the operating system; obtaining a target network event through an event tracing service, and querying the corresponding target process name in the mapping file based on the target process identifier carried in the target network event; generating a network behavior log based on the network event data carried in the target network event and the target process name.

[0115] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the event to be inspected and the corresponding event data through the domain name resolution service and kernel network behavior monitoring service of the operating system; identifying whether the event to be inspected is a DNS request query result or a network event; if the event to be inspected is a DNS request query result, confirming that the network event type of the event to be inspected is a DNS event; if the event to be inspected is a network event, confirming that the network event type of the event to be inspected is a TCP event or a UDP event; and taking the event to be inspected with a network event type of TCP event, UDP event or DNS event as the target network event.

[0116] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the event to be checked is a DNS request query result and the process identifier of the event to be checked matches a preset standard process identifier, confirm that the network event type of the event to be checked is a DNS event.

[0117] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: storing the network event data carried in the target network event and the target process name in a buffer; and writing the data in the buffer to disk at preset time intervals to generate a network behavior log.

[0118] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the target process name is not found, an asynchronous task is executed for the target process identifier; the asynchronous task is used to repeatedly query the process name in the mapping file according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or a preset number of queries is reached; if a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, the network event data carried in the target network event and the target process name are stored in the buffer.

[0119] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: analyzing the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event; comparing the geographical location information corresponding to each network event with a preset expected geographical location to obtain abnormal network events in the network behavior log that do not match the expected geographical location; adding an IP access tag to the abnormal network events in the network behavior log; the IP access tag is used to characterize the network event having access behavior outside the expected geographical location.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0121] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0123] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for tracking network behavior, characterized in that, The method includes: after receiving an operating system startup command, generating a mapping file; the mapping file includes a mapping relationship between process names and process identifiers of all currently running processes in the operating system; obtaining target network events through an event tracing service, querying the corresponding target process name in the mapping file based on the target process identifier carried in the target network event; and generating a network behavior log based on the network event data carried in the target network event and the target process name.

2. The method according to claim 1, characterized in that, The step of obtaining the target network event through the event tracing service includes: obtaining the event to be inspected through the domain name resolution service and kernel network behavior monitoring service of the operating system; identifying whether the event to be inspected is a DNS request query result or a network event; if the event to be inspected is a DNS request query result, confirming that the network event type of the event to be inspected is a DNS event; if the event to be inspected is a network event, confirming that the network event type of the event to be inspected is a TCP event or a UDP event; and taking the event to be inspected with a network event type of TCP event, UDP event or DNS event as the target network event.

3. The method according to claim 2, characterized in that, In the case that the event to be checked is a DNS request query result, confirming that the network event type of the event to be checked is a DNS event includes: when the event to be checked is a DNS request query result and the process identifier of the event to be checked matches a preset standard process identifier, confirming that the network event type of the event to be checked is a DNS event.

4. The method according to claim 1, characterized in that, The step of generating a network behavior log based on the network event data carried in the target network event and the target process name includes: storing the network event data carried in the target network event and the target process name in a buffer; and writing the data in the buffer to disk at preset time intervals to generate the network behavior log.

5. The method according to claim 1, characterized in that, The method further includes: if the target process name is not found, performing an asynchronous task for the target process identifier; the asynchronous task is used to repeatedly query the process name in the mapping file according to the target process identifier within a preset time period until a process name with a mapping relationship with the target process identifier is found or a preset number of queries is reached; if a process name with a mapping relationship with the target process identifier is found before the asynchronous task ends, storing the network event data carried in the target network event and the target process name in a buffer.

6. The method according to claim 1, characterized in that, The method further includes: analyzing the IP addresses of each network event in the network behavior log to obtain the geographical location information corresponding to each network event; comparing the geographical location information corresponding to each network event with a preset expected geographical location to obtain abnormal network events in the network behavior log that do not match the expected geographical location; adding an IP access tag to the abnormal network event in the network behavior log; the IP access tag is used to characterize the network event having access behavior outside the expected geographical location.

7. A network behavior tracking device, characterized in that, The device includes: a startup module, used to generate a mapping file after receiving an operating system startup command; the mapping file includes a mapping relationship between process names and process identifiers of all currently running processes in the operating system; a query module, used to obtain target network events through an event tracking service, and query the corresponding target process name in the mapping file based on the target process identifier carried in the target network event; and a generation module, used to generate a network behavior log based on the network event data carried in the target network event and the target process name.

8. The apparatus according to claim 7, characterized in that, The query module is further configured to: obtain the event to be checked through the domain name resolution service and kernel network behavior monitoring service of the operating system; and identify whether the event to be checked is a DNS request query result or a network event. If the event to be checked is a DNS request query result, the network event type of the event to be checked is confirmed to be a DNS event; if the event to be checked is a network event, the network event type of the event to be checked is confirmed to be a TCP event or a UDP event. The network event to be inspected, which is of type TCP, UDP, or DNS, is taken as the target network event.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images