Method and apparatus for operation trace of shared file

Abstract

This application relates to a method and apparatus for tracing the operation of shared files. The method includes obtaining the data packet characteristics corresponding to a first event. The event type of the first event includes a Server Message Block (SMB) request event and an SMB response event. The SMB request event includes information about the initiator of the SMB request and data packet characteristics. The SMB response event includes information about the responder and data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation. The method further includes querying a storage area for a second event that contains data packet characteristics and has a different event type than the first event. If a second event containing data packet characteristics is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of shared files, thereby improving the accuracy of tracing the operation of shared files.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for tracing the operation of shared files. Background Technology

[0002] Server Message Block (SMB) is a communication protocol used to share files, printers, and other resources over computer networks. With SMB, users can store files on one client and allow other clients to access and edit them, thus enabling remote file sharing across devices.

[0003] In related technologies, tracing the origin of SMB shared files can only pinpoint the client that initiated the file operation, without obtaining more information, resulting in low accuracy. For example, a virus can exploit an SMB vulnerability to infect a client device and then spread rapidly within the intranet via SMB sharing, leading to widespread infection. Current methods for tracing SMB shared files can only identify the infected client device, failing to reveal more detailed information such as the virus's propagation path, hindering timely responses and potentially causing significant security losses. Therefore, accurately tracking and tracing SMB shared file operations is crucial. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product that can accurately track and trace the operation of SMB shared files in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for tracing the operation source of shared files, applied on the server side, including:

[0006] Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0007] Query the storage area for a second event that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0008] If no second event containing the characteristics of the data packet is found in the storage area, the first event is stored in the storage area.

[0009] If a second event containing the characteristics of the data packet is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0010] In one embodiment, the initiator information includes the client identifier of the initiator and the process identifier that triggered the SMB request, and the responder information includes the client identifier of the responder and the operation information of the shared file.

[0011] In one embodiment, the method further includes:

[0012] In response to the detection of a virus file, the propagation path of the virus file is determined based on the shared file operation information in the associated events.

[0013] Secondly, this application provides a method for tracing the operation source of shared files, applied to the first client side, including:

[0014] Retrieve the target data packet corresponding to the server message block SMB request;

[0015] Determine the characteristics of the data packet corresponding to the target data packet;

[0016] An SMB request event is sent to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes a client identifier and a process identifier that triggered the SMB request.

[0017] In one embodiment, obtaining the target data packet corresponding to the server message block SMB request includes:

[0018] Listen for SMB requests initiated by local processes;

[0019] If the data packet corresponding to any SMB request is of a specified type, the data packet corresponding to any SMB request shall be determined as the target data packet.

[0020] In one embodiment, determining the data packet characteristics corresponding to the target data packet includes:

[0021] If the target data packet is an encrypted data packet, the data packet characteristics are determined based on the encrypted header field of the target data packet;

[0022] If the target data packet is an unencrypted data packet, the data packet characteristics are determined based on the header field and command field of the target data packet.

[0023] Thirdly, this application provides a method for tracing the operation source of shared files, applied to the second client side, including:

[0024] In response to the detection of an SMB response triggered by a server message block SMB request, the thread identifier of the thread executing the SMB response is obtained, and the SMB response corresponds to the execution of a shared file operation.

[0025] Based on the thread identifier, determine the target data packet of the SMB request associated with the SMB response;

[0026] Determine the characteristics of the data packet corresponding to the target data packet;

[0027] An SMB response event is sent to the server. The SMB response event includes executor information and the characteristics of the target data packet. The executor information includes the client identifier and the operation information of the shared file.

[0028] In one embodiment, determining the target data packet of the SMB request associated with the SMB response based on the thread identifier includes:

[0029] Query the SMB log for the identification information of the SMB request corresponding to the thread identifier, the identification information including the session identifier;

[0030] Based on the session identifier, determine the target data packet of the SMB request associated with the SMB response.

[0031] In one embodiment, determining the target data packet of the SMB request associated with the SMB response based on the session identifier includes:

[0032] If the session corresponding to the session identifier has encryption enabled, the target data packet is determined from the stored SMB data packets based on the session identifier;

[0033] If encryption is not enabled in the session corresponding to the session identifier, the target data packet is determined by matching the session identifier and the message identifier in the identifier information in the stored SMB data packets.

[0034] Fourthly, this application also provides a shared file operation tracing device, set on the server side, including:

[0035] The acquisition module is used to acquire the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0036] The query module is used to query a second event in the storage area that contains the characteristics of the data packet and has a different event type from the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0037] A storage module is configured to store the first event in the storage area if no second event containing the characteristics of the data packet is found in the storage area.

[0038] The generation module is used to associate the first event with the second event when a second event containing the characteristics of the data packet is found in the storage area, thereby generating an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0039] Fifthly, this application also provides a shared file operation tracing device, set on the first client side, including:

[0040] The acquisition module is used to acquire the target data packet corresponding to the server message block SMB request;

[0041] The determination module is used to determine the data packet characteristics corresponding to the target data packet;

[0042] The sending module is used to send an SMB request event to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes a client identifier and a process identifier that triggered the SMB request.

[0043] Sixthly, this application also provides a shared file operation tracing device, set on the second client side, including:

[0044] The acquisition module is used to acquire the thread identifier that executes the SMB response in response to the detection of an SMB response triggered by a server message block SMB request, wherein the SMB response corresponds to the execution of a shared file operation.

[0045] The first determining module is used to determine the target data packet of the SMB request associated with the SMB response based on the thread identifier;

[0046] The second determining module is used to determine the data packet characteristics corresponding to the target data packet;

[0047] The sending module is used to send an SMB response event to the server. The SMB response event includes executor information and the characteristics of the target data packet. The executor information includes the client identifier and the operation information of the shared file.

[0048] In a seventh aspect, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0049] Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0050] Query the storage area for a second event that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0051] If no second event containing the characteristics of the data packet is found in the storage area, the first event is stored in the storage area.

[0052] If a second event containing the characteristics of the data packet is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0053] Eighthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0054] Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0055] Query the storage area for a second event that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0056] If no second event containing the characteristics of the data packet is found in the storage area, the first event is stored in the storage area.

[0057] If a second event containing the characteristics of the data packet is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0058] Ninthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0059] Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0060] Query the storage area for a second event that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0061] If no second event containing the characteristics of the data packet is found in the storage area, the first event is stored in the storage area.

[0062] If a second event containing the characteristics of the data packet is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0063] The aforementioned method, apparatus, computer device, computer-readable storage medium, and computer program product for tracing the operation of shared files can first obtain the data packet characteristics corresponding to a first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes information about the initiator of the SMB request and data packet characteristics. The SMB response event includes information about the responder and data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of shared file operation behavior. Then, a second event containing data packet characteristics and with an event type different from the first event can be queried in the storage area. The storage area stores SMB request events and / or SMB response events reported by each client. If no second event containing data packet characteristics is found in the storage area, the first event is stored in the storage area. If a second event containing data packet characteristics is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of shared files. Therefore, by using data packet characteristics, SMB request events and SMB response events can be linked together, and the full-link information of shared file operations under the SMB protocol can be obtained. This enables the reconstruction and tracing of shared file operations, improves the accuracy of tracing SMB shared file operations, and provides a reliable basis for tracing the spread of virus files in SMB scenarios. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 This is a diagram illustrating the application environment of a shared file operation tracing method in one embodiment.

[0066] Figure 2 This is a flowchart illustrating a method for tracing the operation source of shared files in one embodiment;

[0067] Figure 3 This is a flowchart illustrating the operation tracing method for shared files in another embodiment;

[0068] Figure 4 This is a flowchart illustrating the operation tracing method for shared files in yet another embodiment;

[0069] Figure 5 This is a schematic diagram illustrating the operation tracing process of shared files in one embodiment;

[0070] Figure 6 This is a structural block diagram of a shared file operation tracing device in one embodiment;

[0071] Figure 7 This is a structural block diagram of a file sharing operation tracing device in another embodiment;

[0072] Figure 8 This is a structural block diagram of the shared file operation tracing device in another embodiment;

[0073] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0075] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0076] The shared file operation tracing method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, the first client 102, the second client 104, and the server 106 communicate via a network. The first client 102 can send a Server Message Block (SMB) request event to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes the client identifier and the process identifier that triggered the SMB request. The second client 104 can send an SMB response event to the server. The SMB response event includes executor information and target data packet characteristics. The executor information includes the client identifier and shared file operation information. Server 106 can obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information of the SMB request and the data packet characteristics. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of shared file operation behavior. Then, it can query the storage area for a second event containing data packet characteristics and with an event type different from the first event. If no second event containing data packet characteristics is found in the storage area, the first event is stored in the storage area. If a second event containing data packet characteristics is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information, thereby enabling traceability of shared file operations. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0077] In one exemplary embodiment, such as Figure 2 As shown, a method for tracing the operation source of shared files is provided, which can be applied to... Figure 1 Taking server 106 as an example, the explanation includes the following steps 202 to 208. Wherein:

[0078] Step 202: Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes server message block SMB request event and SMB response event. The SMB request event includes the initiator information of the SMB request and data packet characteristics. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of shared file operation behavior.

[0079] Server Message Block (SMB) is a communication protocol used for sharing files, printers, and other resources on a computer network. Through the SMB protocol, users can store files on a single client and allow other clients to access and edit them, thus enabling remote file sharing across devices. In this embodiment, the server can receive a first event, which can be either an SMB request event sent by a client or an SMB response event sent by a client.

[0080] In addition, if client 1 sends an SMB request to client 2 to request client 2 to perform a shared file operation corresponding to the SMB request, then the SMB request event can be an event generated on the client 1 side that is related to sending the SMB request. This event can be used to indicate the initiator information and data packet characteristics of the SMB request.

[0081] Among them, the data packet feature can be a unique identifier for the data packet. In the same SMB interaction, the initiator and the responder can correspond to the same data packet feature. Therefore, the data packet feature can uniquely associate the SMB request event from the initiator with the SMB response event from the responder.

[0082] Additionally, if client 2 receives an SMB request from client 1 and performs the corresponding shared file operation based on the SMB request, this can be called an SMB response. The SMB response event is an event generated on the client 2 side that is related to the execution of the corresponding operation of the SMB request, that is, an event related to the execution of the shared file operation. Therefore, the SMB response event can also be called a shared file operation event. This event can indicate the responder information that processes the SMB request and the data packet characteristics of the SMB request event associated with the SMB response event.

[0083] Optionally, the initiator information may include the initiator's client identifier and the process identifier that triggered the SMB request, and the responder information may include the responder's client identifier and the operation information of the shared file.

[0084] The client identifier can be used to uniquely identify the client device. It can be a pre-agreed numerical identifier, character identifier, etc. This application does not limit its specific form or style.

[0085] In addition, the process identifier can uniquely identify the process that triggers the SMB request within the client operating system, such as process 1, process A, etc. This application does not limit its specific form.

[0086] In addition, the operation information of the shared file may include the attribute information of the shared file being operated on, such as creation time, size, type and format, and may also include the local storage path of the shared file in the responder's client, the specific operation type to be performed, such as open, write, delete, etc. This application does not limit this.

[0087] Therefore, in this embodiment, the server can receive the first event reported by each client, and then parse the first event, such as parsing it according to the agreed event message format. If the first event is an SMB request event, the server can obtain the initiator information and data packet characteristics of the SMB request; if the first event is an SMB response event, the server can obtain the responder information and data packet characteristics of the SMB response. Thus, by parsing SMB events of different event types, the corresponding identification information and data packet characteristics can be obtained, providing conditions for subsequent tracing of shared file operations.

[0088] Step 204: Query the storage area for a second event that contains data packet characteristics and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0089] The storage area can be the data storage space in the server, which can be used to store SMB request events, SMB response events and related information reported by each client. This storage area can be a database, a cache area, distributed storage, etc., and this application does not limit it.

[0090] It is understood that the events stored in the storage area can be of various types. For example, if only SMB request events are currently stored, it can be assumed that no SMB response events have been received, meaning that no SMB response events have occurred or been reported. Alternatively, if only SMB response events are currently stored, and no SMB request events are stored, or if SMB request events and SMB response events with different data packet characteristics are stored simultaneously, this application does not limit the scope of such storage.

[0091] In this embodiment, after receiving the first event, the server can obtain the corresponding data packet characteristics. Then, based on these characteristics, it can query events of different event types in the storage area. For example, if the first event is an SMB request event with data packet characteristics A1, it can query whether a second event containing A1 exists in the SMB response event. Or, if the first event is an SMB response event with data packet characteristics B1, it can query whether a second event containing B1 exists in the SMB request event, and so on. This application does not limit the scope of the query.

[0092] Step 206: If no second event containing data packet characteristics is found in the storage area, the first event is stored in the storage area.

[0093] Step 208: If a second event containing data packet characteristics is found in the storage area, the first event is associated with the second event to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0094] Among them, the associated event can be an event related to shared file operation information, generated by associating SMB request events and SMB response events with the same data packet characteristics. It can include initiator information and responder information corresponding to the data packet characteristics. For example, it can include the initiator client identifier of the SMB request, the process identifier that triggered the request, the responder client identifier that executed the SMB response, shared files and their operation information, etc. In other words, the associated event can include relevant information about initiating the SMB request and relevant information about performing shared file operations based on the SMB request. This can be used to trace the source of shared files and find out the initiator, executor, operation time, operation type, etc., corresponding to the shared file operation event. This application does not limit this.

[0095] If an SMB request event and an SMB response event share the same data packet characteristics, they can be considered to be communicating via SMB. Therefore, when the server receives a first event, it can parse it to extract data packet characteristics. Then, based on these characteristics, it can perform a matching query within stored second events of different types. For example, if the first event is an SMB request event with data packet characteristic A1, it can search within the stored second events. If no SMB response event containing A1 is found in the storage area, the SMB request event with data packet characteristic A1 can be stored there for later querying and matching. Similarly, if the first event is an SMB response event with data packet characteristic B1, it can search within the SMB request events. If no SMB request event containing B1 is found, the SMB response event can be stored there, and so on.

[0096] Alternatively, if the first event is an SMB request event with a data packet characteristic of auYx46Xk, and an SMB response event containing auYx46Xk is found in the stored second events, then the SMB request event and the SMB response event can be associated to obtain associated event 1. This associated event 1 could be: process 4456 on client 001 sends an SMB request with a data packet characteristic of auYx46Xk, and client 003 performs a write operation on the shared file C:\Share\poc.exe based on this SMB request.

[0097] It should be noted that the above examples are merely illustrative and should not be construed as limiting the generation of associated events in the embodiments of this application.

[0098] Optionally, the initiator of a certain SMB request event may also perform a shared file operation based on the SMB request events received from other clients, and send an SMB response event to the server as an SMB response; or, the responder of a certain SMB response event may also send an SMB request to other clients according to its own needs or actual needs, and send the SMB request event to the server as the initiator of the SMB request event, etc. This application does not limit this.

[0099] Therefore, in this embodiment of the application, based on the characteristics of data packets, the first event and the second event sent by different clients can be associated to generate cross-host associated events. These associated events can contain complete information related to SMB shared file operations, which can be used to reconstruct and trace the shared file operations across hosts. This makes the tracing granularity more refined and accurate, improves the accuracy of tracing SMB shared file operations, and also provides a reliable basis for tracing the spread of viruses and other malicious files in SMB scenarios, greatly improving the analysis and response speed of network security incidents.

[0100] Optionally, in response to the detection of a virus file, the propagation chain of the virus file can be determined based on the shared file operation information in the associated events.

[0101] The virus file can be a shared file that has been compromised by a virus. If the server receives virus information reported by a client or detects a virus intrusion, it can first determine the relevant information of the virus file, such as the file name and storage path. Then, it can search the generated associated events to obtain associated events containing information about the operation of the virus file, and extract the complete operation chain information from the associated events. From this, it can obtain the client identifier that initiated the virus file operation, the process identifier that triggered the operation, the time of initiation of the operation, the client identifier that executed the virus file operation, the local storage path of the virus file on the responder, the specific operation type, the data packet characteristics corresponding to this operation, the timestamps of the SMB request and SMB response, the source IP, source port, destination IP and destination port of the communication, etc. Thus, it is possible to determine the initial propagation source of the virus file, such as the client that first initiated the SMB request to operate on the file, trace the propagation path of the virus file, determine from the initial source client to one or more responder clients through the SMB protocol, and the specific operation behavior of each client on the virus file, thus determining the virus file propagation chain. The propagation chain of the virus file may include the identifiers of each client, operation behavior, operation time, etc., which are not limited in this application.

[0102] Therefore, in this embodiment of the application, when a virus file is detected, the shared file operation information in the associated event can be analyzed and processed to determine the propagation link of the virus file. This allows for timely knowledge of the entire process of the virus file's cross-host propagation and enables corresponding measures to be taken in a timely manner, thereby improving network security, reducing security risks, providing a reliable basis for tracing the propagation of virus files in SMB scenarios, and greatly improving the analysis and response speed of network security incidents.

[0103] Optionally, if any second event stored in the storage area fails to be matched with a first event after a preset time period, that second event can be cleared. Therefore, by promptly clearing second events in the storage area that have not been matched after the preset time period, the storage overhead occupied by invalid events can be reduced, and the amount of data retrieved during subsequent event matching processes can also be reduced, improving event matching efficiency and further enhancing the efficiency of tracing the source of shared file operations.

[0104] The above-mentioned method for tracing the operation of shared files can first obtain the data packet characteristics corresponding to the first event. The event type of the first event includes server message block SMB request events and SMB response events. The SMB request event includes the initiator information of the SMB request and data packet characteristics. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of shared file operation behavior. Then, a second event containing data packet characteristics and different from the event type of the first event can be queried in the storage area. The storage area stores the SMB request events and / or SMB response events reported by each client. If no second event containing data packet characteristics is found in the storage area, the first event is stored in the storage area. If a second event containing data packet characteristics is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of shared files. Therefore, based on the characteristics of data packets, the first and second events sent by different clients can be associated to generate associated events. Based on the complete information related to SMB shared file operations contained in the associated events, the shared file operations can be restored and traced, making the tracing granularity more refined and accurate, improving the accuracy of SMB shared file operation tracing, and providing a reliable basis for tracing the propagation of malicious files in SMB scenarios, which greatly improves the analysis and response speed of network security incidents.

[0105] In one exemplary embodiment, such as Figure 3 As shown, a method for tracing the operation source of shared files is provided, which can be applied to... Figure 1Taking the first client 102 as an example, the explanation includes the following steps 302 to 306. Wherein:

[0106] Step 302: Obtain the target data packet corresponding to the server message block SMB request.

[0107] In this context, the target data packet can be understood as a data packet carrying a specific file operation type SMB command, such as file creation or data writing, which can directly change the file status. For other non-file operation types of data packets, such as protocol negotiation or session establishment, since they do not involve file operations, there is no need to identify them as target data packets.

[0108] Optionally, it can listen for SMB requests initiated by local processes, and if the data packet corresponding to any SMB request is of a specified type, determine the data packet corresponding to any SMB request as the target data packet.

[0109] The specified type can be a file operation type, such as the Create command type for creating or opening a file, the Write command type for writing data, etc. However, for data packets that are not file operation types, such as session establishment, heartbeat packets, etc., they are not included in the specified type, and this application does not limit them.

[0110] Therefore, in this embodiment, SMB requests initiated by local processes can be monitored. For each monitored SMB request, its corresponding network data packet can be parsed, and then it can be further determined whether the SMB command type carried by the data packet is a specified type related to file operations. If so, the data packet is identified as the target data packet; otherwise, it can be discarded. Thus, this embodiment only acquires target data packets of the specified type, thereby avoiding the resource overhead caused by collecting irrelevant data packets and ensuring that subsequent processes only target data packets, providing conditions for improving subsequent tracing efficiency.

[0111] Step 304: Determine the characteristics of the data packet corresponding to the target data packet.

[0112] Among them, the data packet feature can be a unique identifier for the data packet. In the same SMB interaction, the initiator and the responder can correspond to the same data packet feature. Therefore, the data packet feature can uniquely associate the SMB request event from the initiator with the SMB response event from the responder.

[0113] Optionally, if the target data packet is an encrypted data packet, the data packet characteristics can be determined based on the encrypted header field of the target data packet; if the target data packet is an unencrypted data packet, the data packet characteristics can be determined based on the header field and command field of the target data packet.

[0114] It is understandable that the encrypted header fields of an encrypted data packet can be plaintext and parsable, while other content, such as command fields, is encrypted and cannot be directly parsed. For example, the header of an encrypted data packet could use SMB2 TRANSFORM_HEADER, while the rest of the content is encrypted. For unencrypted data packets, since both their header and command fields are plaintext, the characteristics of the data packet can be determined based on these header and command fields. This can be achieved by identifying protocol identifiers or other methods; this application does not limit the specific methods used.

[0115] In addition, various methods can be used to calculate the characteristics of encrypted data packets based on the encrypted header fields, or to determine the characteristics of data packets based on the header fields and command fields.

[0116] For example, the encrypted header field can be used directly as a data packet feature, or the encrypted header field can be looped and concatenated to serve as a data packet feature; or the encrypted header field can be processed using a hash function, message authentication code, or other methods agreed upon by both parties in advance to determine the data packet feature, etc. This application does not limit this.

[0117] Alternatively, for unencrypted data packets, the header and command fields of the target data packet can be concatenated and used as the data packet characteristics; or a hash function, message authentication code, or other methods agreed upon by both parties in advance can be used to process the header and command fields to determine the data packet characteristics, etc. This application does not limit this.

[0118] Therefore, in this embodiment of the application, for encrypted and unencrypted data packets, the characteristics of the data packets can be determined according to their corresponding parsable fields, thereby effectively ensuring the uniqueness and accuracy of the data packet characteristics.

[0119] Step 306: Send an SMB request event to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes the client identifier and the process identifier that triggered the SMB request.

[0120] Understandably, during the SMB request listening process, the target data packet initiated by the local process can be obtained. The characteristics of this target data packet can then be determined, and information related to the SMB request, such as the client identifier, the process identifier that triggered the SMB request, and the data packet characteristics, can be sent to the server as an SMB request event. Upon receiving this SMB request event, the server can identify the client and specific process that initiated the SMB request, as well as the unique data packet characteristics used for association. The server can then use these data packet characteristics to query the stored events to determine the SMB response event corresponding to the SMB request event and associate the SMB request with the shared file operation corresponding to the SMB response, providing a complete data foundation for subsequent file operation tracing.

[0121] In this embodiment, the target data packet corresponding to the SMB request of the server message block can be obtained first. Then, the data packet characteristics corresponding to the target data packet can be determined, and an SMB request event can be sent to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes the client identifier and the process identifier that triggered the SMB request. This allows the server to associate the SMB request with the shared file operation corresponding to the SMB response based on the data packet characteristics in the SMB request event. If there is an SMB response event corresponding to the SMB request event in the stored events, the server can associate the SMB request with the SMB response. This provides a complete data foundation for subsequent file operation tracing.

[0122] In one exemplary embodiment, such as Figure 4 As shown, a method for tracing the operation source of shared files is provided, which can be applied to... Figure 1 Taking the second client 104 as an example, the explanation includes the following steps 402 to 408. Wherein:

[0123] Step 402: In response to the detection of an SMB response triggered by a server message block SMB request, obtain the thread identifier that executes the SMB response. The SMB response corresponds to the execution of shared file operation behavior.

[0124] Clients can communicate with each other through Server Message Blocks (SMBs). If client 1 wants to perform remote file sharing operations on client 2, it can send an SMB request to client 2. After receiving the SMB request, client 2 can perform the corresponding file sharing operation based on the SMB request. For ease of description, the execution of the file sharing operation triggered by client 2 based on the SMB request can be called an SMB response.

[0125] Typically, SMB command requests sent by the same client session can be processed serially, meaning the same thread parses the command and performs file operations sequentially. For SMB command requests from different client sessions, different threads can be assigned to process them in parallel, but each thread still independently completes the parsing of the corresponding command, file operations, etc. Therefore, in this embodiment, if the current client receives any SMB command request, it can record the thread identifier, corresponding session identifier, message identifier, file operations, etc., that processed the SMB request. For example, it can record them in the SMB log, or it can record and store them in other ways; this application does not limit this.

[0126] Step 404: Determine the target data packet of the SMB request associated with the SMB response based on the thread identifier.

[0127] It is understandable that the thread executing file operations in an SMB command is usually the same thread as the thread processing the SMB command request. Upon detecting an SMB response triggered by an SMB request, the thread identifier executing the SMB response can be obtained. Then, based on this thread identifier, a search can be performed in the records to retrieve the record information corresponding to that thread identifier, thereby identifying the corresponding target data packet.

[0128] Optionally, you can query the SMB log for the identification information of the SMB request corresponding to the thread identifier. The identification information includes the session identifier. Then, based on the session identifier, you can determine the target data packet of the SMB request associated with the SMB response.

[0129] The session identifier can be used to characterize the session used for communication between the initiator of the SMB request and the executor of the SMB response. Different sessions correspond to different session identifiers, and each SMB data packet belongs to a unique SMB session.

[0130] Understandably, upon receiving any SMB command request, the client records the thread identifier processing the SMB request, the session identifier, and the message identifier in the SMB log. Typically, the thread processing the SMB request and the thread executing the SMB response are the same thread. Therefore, when an SMB response triggered by an SMB request is detected, the session identifier of the SMB request that triggered the file operation can be obtained by searching and matching the SMB log based on the thread identifier currently executing the SMB response. Then, based on the session corresponding to this session identifier, the target data packet of the SMB request associated with the SMB response can be further determined.

[0131] Optionally, if the session corresponding to the session identifier has enabled encryption, the target data packet is determined from the stored SMB data packets based on the session identifier. If the session corresponding to the session identifier has not enabled encryption, the target data packet is determined by matching the stored SMB data packets based on the session identifier and the message identifier in the identifier information.

[0132] The message identifier can be an identifier for an SMB request or SMB response in an SMB session, and can be used to distinguish different SMB requests or SMB responses within the same session. For example, it can be message 1, message a, message1, etc. This application does not limit its style or specific presentation form.

[0133] Understandably, for SMB sessions with encryption enabled, since SMB data packets use an encrypted format, only the session identifier in the packet header is in plaintext, while the message identifier is encrypted and cannot be obtained. Therefore, the target data packet can be filtered out from the SMB data packets stored in the corresponding session based on the session identifier.

[0134] For example, based on the session identifier, all data packets belonging to the encrypted session can be filtered out from the stored SMB data packets. Since requests within the same SMB session are processed serially, the SMB request that triggers the current shared file operation, i.e., the SMB response, can be considered as the request with the most recent timestamp in the session. Therefore, the last data packet in the session corresponding to the session identifier can be identified as the target data packet, and so on.

[0135] It should be noted that the above is only an illustrative description, and any reasonable method can be used to determine the target data packet. It should not be regarded as a limitation on the method of determining the target data packet in the encrypted session in the embodiments of this application.

[0136] In addition, for SMB sessions without encryption, the session identifier and message identifier in the SMB data packet are visible in plaintext. Therefore, the target data packet that matches the session identifier and message identifier can be matched and searched in the stored SMB data packets based on the session identifier and message identifier.

[0137] Therefore, in this embodiment of the application, the characteristics of data packets in encrypted and unencrypted sessions are fully considered, and different methods are selected to determine the corresponding target data packets, thereby improving the accuracy and reliability of target data packet determination.

[0138] Step 406: Determine the characteristics of the data packet corresponding to the target data packet.

[0139] Optionally, if the target data packet is an encrypted data packet, the data packet characteristics can be determined based on the encrypted header field of the target data packet; if the target data packet is an unencrypted data packet, the data packet characteristics can be determined based on the header field and command field of the target data packet.

[0140] It is understood that the encrypted header field of an encrypted data packet can be plaintext and parsable, while the remaining content, such as command fields, is encrypted and cannot be directly parsed. For unencrypted data packets, since their header and command fields are in plaintext, the characteristics of the data packet can be determined based on these header and command fields. Methods such as identifying protocol identifiers can be used to distinguish between encrypted and unencrypted data packets, but this application does not limit this approach.

[0141] In addition, various methods can be used to calculate the characteristics of encrypted data packets based on the encrypted header fields, or to determine the characteristics of data packets based on the header fields and command fields.

[0142] For example, for encrypted data packets, the encrypted header field of the target data packet can be directly used as the data packet feature, or the encrypted header field can be determined by looping and concatenating the fields; or the encrypted header field can be processed using a hash function, message authentication code, or other methods agreed upon by both parties in advance to determine the data packet feature, etc. This application does not limit this.

[0143] Alternatively, for unencrypted data packets, the header and command fields of the target data packet can be concatenated and used as the data packet characteristics; or a hash function, message authentication code, or other methods agreed upon by both parties in advance can be used to process the header and command fields to determine the data packet characteristics, etc. This application does not limit this.

[0144] Therefore, in this embodiment of the application, for encrypted and unencrypted data packets, the characteristics of the data packets can be determined according to their corresponding parsable fields, thereby effectively ensuring the uniqueness and accuracy of the data packet characteristics.

[0145] It is understood that in this embodiment of the application, packet feature calculation is performed only on the data packets corresponding to the SMB requests that actually trigger the SMB response association. That is, the packet feature of the specific data packet that triggers the operation is located and calculated only when a shared file operation event occurs and cross-host operation and association are required. For data packets that do not trigger the SMB response, there is no need to calculate the packet feature, thereby reducing unnecessary computational overhead and improving resource utilization.

[0146] Step 408: Send an SMB response event to the server. The SMB response event includes executor information and target data packet characteristics. The executor information includes client identifier and shared file operation information.

[0147] The operation information for shared files may include information such as the path of the shared file stored locally, the operation type, and the operation time, but this application does not limit this information.

[0148] Understandably, after determining the characteristics of the target data packet, the client identifier, shared file operation information, etc., can be sent to the server as an SMB response event. This allows the server to obtain the client identifier that executed the SMB response event, the unique data packet characteristics used for association, and the shared file operation information upon receiving the SMB event. The server can then use these data packet characteristics to search and match in the stored events to identify the SMB request event corresponding to the SMB response event. It can then associate the SMB request with the shared file operation corresponding to the SMB response, generating an associated event containing information about the entire shared file operation chain, providing a complete data foundation for subsequent file operation tracing.

[0149] In this embodiment, in response to the detection of an SMB response triggered by a server message block SMB request, the thread identifier of the executing SMB response can be obtained. The SMB response corresponds to the execution of a shared file operation. Then, based on the thread identifier, the target data packet of the SMB request associated with the SMB response can be determined, and the data packet characteristics corresponding to the target data packet can be determined. Subsequently, an SMB response event can be sent to the server. The SMB response event may include executor information and target data packet characteristics. The executor information includes the client identifier and the operation information of the shared file, so that the server can search and match in the stored events based on the data packet characteristics in the SMB response event. If an SMB request event corresponding to the SMB response event exists, the SMB request and the shared file operation corresponding to the SMB response can be associated to generate an associated event containing the full-link operation information of the shared file, providing a complete data foundation for subsequent file operation tracing.

[0150] The shared file operation tracing method provided in this application can be applied to any shared file operation tracing scenario. The following section combines... Figure 5 This application describes the process of tracing the operation of the shared files provided.

[0151] In this context, host A is the first client, which is the initiator of the SMB request, or the SMB client. Host B is the second client, which is the responder that performs shared file operations based on the SMB request, or the SMB server.

[0152] For example, the P1 process python.exe on host A (process ID: 4456, thread ID: 9528, process path: C:\python38\python.exe) actively initiates an SMB file creation request through the SMB client protocol stack. This request can be transmitted via TCP protocol, with the source address being 192.168.2.3:46782 and the destination address being 192.168.2.2:445. The request may contain a session ID of 12, a message ID of 88, and a filename of poc.exe.

[0153] During the process of listening for SMB requests initiated by a local process, host A identifies the SMB request as a file operation type. It then identifies the data packet corresponding to the SMB file creation request as the target data packet and calculates its characteristics: auYx460Xk. Subsequently, the host identifier, process ID, thread ID, process path, etc., are used as initiator information, combined with the data packet characteristics to form an SMB request event, which is then sent to the server.

[0154] After receiving an SMB request, host B can assign a worker thread (ID: 1234) to handle the SMB request. This thread can be used to perform specific file creation operations to create the file C:\Share\poc.exe in the local file system. Host B can record the thread identifier (1234) that handles the SMB command request, the session identifier (12) of the request, the message identifier (88), etc., in the SMB log.

[0155] When host B detects an SMB response triggered by an SMB request, such as when it captures a file creation operation executed by thread 1234, it can determine the target data packet of the SMB request associated with the SMB response based on the thread identifier and SMB logs, and identify the target data packet and its corresponding characteristics.

[0156] Specifically, based on the thread identifier 1234 that executed the SMB response event, the corresponding SMB command request can be matched in the SMB log to obtain the session ID (12) and message ID (88). Then, based on the session ID and message ID, the corresponding target data packet can be determined from the stored SMB data packets, and the data packet characteristics: auYx460Xk can be further calculated.

[0157] Host B can use the host identifier, the thread identifier that performed the shared file operation, the file name, and the file path as executor information, and combine them with the data packet characteristics to form an SMB response event, which is then sent to the server.

[0158] Upon receiving any SMB request event, the server can search and match it within the stored SMB response events based on the characteristics of the corresponding data packet. If no SMB response event with the same data packet characteristics is found, the SMB request event can be stored in the storage area. Similarly, upon receiving any SMB response event, the server can search and match it within the stored SMB request events based on the characteristics of the corresponding data packet. If no SMB request event with the same data packet characteristics is found, the SMB response event can be stored in the storage area.

[0159] If the server matches an SMB request event with the same data packet characteristics in the stored second event based on the received SMB response event, it can associate the SMB request event with the SMB response event to generate an associated event containing information about the shared file operation. This associated event includes information such as the operation source (process python.exe on host A), the operation action (creating a file), the operation target (file C:\Share\poc.exe on host B), and a specific timestamp, which can be used to trace the source of cross-host file sharing operations.

[0160] The associated events generated using the above method, which are also the source records of shared file operations, can be further used for network security analysis. For example, when a virus file is detected on host B, the source host A and its processes spreading the virus can be located based on the shared file operation information in the associated events, thereby quickly determining the propagation chain of the virus file.

[0161] Optionally, host A can also act as an SMB server, performing corresponding shared file operations based on SMB requests received from other hosts, and sending the corresponding SMB response events to the server; host B can also act as an SMB client, sending SMB requests to other hosts as needed, and sending the corresponding SMB request events to the server. Therefore, host A and host B are just designations, and this application does not limit them.

[0162] Therefore, in this embodiment of the application, by using data packet characteristics, SMB request events and SMB response events can be associated, and the full-link information of shared file operations under the SMB protocol can be obtained, realizing the restoration and tracing of shared file operations, improving the accuracy of tracing the source of SMB shared file operations, and providing a reliable basis for tracing the spread of virus files in SMB scenarios.

[0163] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0164] Based on the same inventive concept, this application also provides a shared file operation tracing device for implementing the shared file operation tracing method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more shared file operation tracing device embodiments provided below can be found in the limitations of the shared file operation tracing method described above, and will not be repeated here.

[0165] In one exemplary embodiment, such as Figure 6 As shown, a shared file operation tracing device 600 is provided, set on the server side, including: an acquisition module 610, a query module 620, a storage module 630, and a generation module 640, wherein:

[0166] The acquisition module 610 is used to acquire the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information of the SMB request and the data packet characteristics. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation.

[0167] The query module 620 is used to query a second event in a storage area that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client.

[0168] Storage module 630 is configured to store the first event in the storage area if no second event containing the characteristics of the data packet is found in the storage area.

[0169] The generation module 640 is used to associate the first event with the second event when a second event containing the characteristics of the data packet is found in the storage area, thereby generating an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

[0170] In one embodiment, the initiator information includes the client identifier of the initiator and the process identifier that triggered the SMB request, and the responder information includes the client identifier of the responder and the operation information of the shared file.

[0171] In one embodiment, the apparatus further includes a determining module, configured to determine the propagation chain of the virus file based on shared file operation information in the associated event in response to the detection of the virus file.

[0172] In one exemplary embodiment, such as Figure 7 As shown, a shared file operation tracing device 700 is provided, set on the first client side, including: an acquisition module 710, a determination module 720, and a sending module 730, wherein:

[0173] The acquisition module 710 is used to acquire the target data packet corresponding to the server message block SMB request.

[0174] The determination module 720 is used to determine the data packet characteristics corresponding to the target data packet.

[0175] The sending module 730 is used to send an SMB request event to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes a client identifier and a process identifier that triggered the SMB request.

[0176] In one embodiment, the acquisition module 710 is specifically used to: listen for SMB requests initiated by a local process; and determine the data packet corresponding to any SMB request as the target data packet if the data packet corresponding to any SMB request is of a specified type.

[0177] In one embodiment, the determining module 720 is specifically used to: determine the data packet characteristics based on the encrypted header field of the target data packet when the target data packet is an encrypted data packet; and determine the data packet characteristics based on the header field and command field of the target data packet when the target data packet is an unencrypted data packet.

[0178] In one exemplary embodiment, such as Figure 8As shown, a shared file operation tracing device 800 is provided, set on the second client side, including: an acquisition module 810, a first determination module 820, a second determination module 830, and a sending module 840, wherein:

[0179] The acquisition module 810 is used to acquire the thread identifier of the thread executing the SMB response in response to the detection of an SMB response triggered by a server message block SMB request, wherein the SMB response corresponds to the execution of a shared file operation.

[0180] The first determining module 820 is used to determine the target data packet of the SMB request associated with the SMB response based on the thread identifier.

[0181] The second determining module 830 is used to determine the data packet characteristics corresponding to the target data packet.

[0182] The sending module 840 is used to send an SMB response event to the server. The SMB response event includes executor information and the characteristics of the target data packet. The executor information includes the client identifier and the operation information of the shared file.

[0183] In one embodiment, the first determining module 820 includes: a query unit, configured to query the identification information of the SMB request corresponding to the thread identifier in the SMB log, the identification information including a session identifier; and a determining unit, configured to determine the target data packet of the SMB request associated with the SMB response based on the session identifier.

[0184] In one embodiment, the determining unit is specifically configured to: determine a target data packet from stored SMB data packets based on the session identifier when the session corresponding to the session identifier has enabled encryption; and determine the target data packet by matching the session identifier and the message identifier in the stored SMB data packets based on the session identifier and the identifier information when the session corresponding to the session identifier has not enabled encryption.

[0185] The modules in the aforementioned shared file operation tracing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0186] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data required for tracing the operation of shared files. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for tracing the operation of shared files.

[0187] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0188] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0189] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0190] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0191] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0192] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0193] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0194] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for tracing the operation source of shared files, characterized in that, Applied to the server side, the method includes: Obtain the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation. Query the storage area for a second event that contains the characteristics of the data packet and has a different event type than the first event. The storage area stores SMB request events and / or SMB response events reported by each client. If no second event containing the characteristics of the data packet is found in the storage area, the first event is stored in the storage area. If a second event containing the characteristics of the data packet is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

2. The method according to claim 1, characterized in that, The initiator information includes the client identifier of the initiator and the process identifier that triggered the SMB request, and the responder information includes the client identifier of the responder and the operation information of the shared file.

3. The method according to claim 1, characterized in that, The method further includes: In response to the detection of a virus file, the propagation path of the virus file is determined based on the shared file operation information in the associated events.

4. A method for tracing the operation source of shared files, characterized in that, Applied to the first client side, the method includes: Retrieve the target data packet corresponding to the server message block SMB request; Determine the characteristics of the data packet corresponding to the target data packet; An SMB request event is sent to the server. The SMB request event includes initiator information and data packet characteristics. The initiator information includes a client identifier and a process identifier that triggered the SMB request.

5. The method according to claim 4, characterized in that, The step of obtaining the target data packet corresponding to the server message block SMB request includes: Listen for SMB requests initiated by local processes; If the data packet corresponding to any SMB request is of a specified type, the data packet corresponding to any SMB request shall be determined as the target data packet.

6. The method according to claim 4, characterized in that, Determining the data packet characteristics corresponding to the target data packet includes: If the target data packet is an encrypted data packet, the data packet characteristics are determined based on the encrypted header field of the target data packet; If the target data packet is an unencrypted data packet, the data packet characteristics are determined based on the header field and command field of the target data packet.

7. A method for tracing the operation source of shared files, characterized in that, Applied to the second client side, the method includes: In response to the detection of an SMB response triggered by a server message block SMB request, the thread identifier of the thread executing the SMB response is obtained, and the SMB response corresponds to the execution of a shared file operation. Based on the thread identifier, determine the target data packet of the SMB request associated with the SMB response; Determine the characteristics of the data packet corresponding to the target data packet; An SMB response event is sent to the server. The SMB response event includes executor information and the characteristics of the target data packet. The executor information includes the client identifier and the operation information of the shared file.

8. The method according to claim 7, characterized in that, The step of determining the target data packet of the SMB request associated with the SMB response based on the thread identifier includes: Query the SMB log for the identification information of the SMB request corresponding to the thread identifier, the identification information including the session identifier; Based on the session identifier, determine the target data packet of the SMB request associated with the SMB response.

9. The method according to claim 8, characterized in that, The step of determining the target data packet of the SMB request associated with the SMB response based on the session identifier includes: If the session corresponding to the session identifier has encryption enabled, the target data packet is determined from the stored SMB data packets based on the session identifier; If encryption is not enabled in the session corresponding to the session identifier, the target data packet is determined by matching the session identifier and the message identifier in the identifier information in the stored SMB data packets.

10. A device for tracing the operation of shared files, characterized in that, The device, located on the server side, includes: The acquisition module is used to acquire the data packet characteristics corresponding to the first event. The event type of the first event includes a server message block SMB request event and an SMB response event. The SMB request event includes the initiator information and data packet characteristics of the SMB request. The SMB response event includes the responder information and the data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation. The query module is used to query a second event in the storage area that contains the characteristics of the data packet and has a different event type from the first event. The storage area stores SMB request events and / or SMB response events reported by each client. A storage module is configured to store the first event in the storage area if no second event containing the characteristics of the data packet is found in the storage area. The generation module is used to associate the first event with the second event when a second event containing the characteristics of the data packet is found in the storage area, thereby generating an associated event containing shared file operation information. The associated event is used to trace the operation of the shared file.

Images