Method, apparatus, device and storage medium for data detection

Abstract

According to embodiments of the present disclosure, a method, apparatus, device and storage medium for data detection are provided. The method comprises: determining first packet information of a target data segment intercepted at a first target position and second packet information of the target data segment intercepted at a second target position, the second packet information being packet information obtained by performing target address conversion on the first packet information; and determining a backend server to which the target data segment is forwarded based on the first packet information and the second packet information. In this way, by accurately tracking and recording the forwarding path of the target data segment, the observability and operation and maintenance efficiency of the system are improved.

Description

Technical Field

[0001] The exemplary embodiments disclosed herein generally relate to the field of information technology, and particularly to methods, apparatus, devices and computer-readable storage media for data detection. Background Technology

[0002] In modern cloud computing and distributed systems, load balancing technology is a key component for ensuring efficient resource allocation and system stability. Especially in microservice architectures and containerized environments, load balancing is used to dynamically distribute requests to different computing nodes to improve system responsiveness and availability.

[0003] As application scenarios in distributed systems become more complex and cluster sizes expand, accurately detecting and monitoring data within the cluster has become a significant challenge for optimizing system performance and troubleshooting. Summary of the Invention

[0004] In a first aspect of this disclosure, a method for data detection is provided. The method includes: determining first message information of a target data segment intercepted at a first target location and second message information of a target data segment intercepted at a second target location, wherein the second message information is message information obtained by performing target address translation on the first message information; and determining, based on the first message information and the second message information, the backend server to which the target data segment is forwarded.

[0005] In a second aspect of this disclosure, an apparatus for data detection is provided. The apparatus includes: a message information determination module configured to determine first message information of a target data segment intercepted at a first target location and second message information of a target data segment intercepted at a second target location, wherein the second message information is message information obtained by performing target address translation on the first message information; and a backend server determination module configured to determine, based on the first message information and the second message information, the backend server to which the target data segment is forwarded.

[0006] In a third aspect of this disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the device to perform the method of the first aspect.

[0007] In a fourth aspect of this disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program that can be executed by a processor to implement the method of the first aspect.

[0008] In a fifth aspect of this disclosure, a computer program product is provided, which is tangibly stored in a computer storage medium and includes computer-executable instructions that, when executed by a device, cause the device to perform the method according to a first aspect of this disclosure.

[0009] It should be understood that the content described in this section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0010] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0011] Figure 1 A schematic diagram of an example environment in which embodiments of the present disclosure can be implemented is shown;

[0012] Figure 2 A schematic diagram of a system for data detection according to some embodiments of the present disclosure is shown;

[0013] Figure 3 A schematic diagram illustrating the data detection process of some embodiments of this disclosure is shown;

[0014] Figure 4 A flowchart illustrating a data detection process according to some embodiments of the present disclosure is shown;

[0015] Figure 5 A block diagram of an apparatus for data detection according to some embodiments of the present disclosure is shown; and

[0016] Figure 6 A block diagram of an electronic device capable of implementing one or more embodiments of the present disclosure is shown. Detailed Implementation

[0017] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0018] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0019] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0020] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0021] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0022] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0023] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0024] As briefly mentioned earlier, in modern cloud computing and distributed systems, multiple application components are typically deployed within a cluster, forming numerous application instances to provide various application services. To ensure flexible communication between different services, the cluster service platform provides service discovery functionality, allowing different nodes in the cluster to discover and access other services by, for example, service names rather than specific Internet Protocol (IP) addresses. When an application instance needs to communicate with other applications or services, it can access the target application or service through virtual IPs and virtual ports within the cluster. The actual request is then routed to the real backend server of that application instance.

[0025] Furthermore, to optimize resource utilization and prevent overload of any backend server, clusters typically use load balancing technology to distribute traffic evenly across multiple backend servers. Load balancing is a key component for ensuring efficient resource allocation and system stability. Especially in microservice architectures and containerized environments, load balancing is used to dynamically distribute requests to different compute nodes to improve system responsiveness and availability.

[0026] Load balancing methods in related technologies are typically based on static rules or configurations, lacking sufficient dynamism and the ability to detect the specific backend to which data is forwarded in real time. For example, when multiple application instances exist within a cluster, it is challenging to determine in real time which specific backend server (real IP address and port) a request wrapped in a virtual IP address and port is forwarded to. This is especially problematic when troubleshooting or performance tuning of the cluster, as there is a lack of precise data tracking and detection methods.

[0027] While some tools can provide detection of data traffic, they fail to address how to detect the forwarding process of data traffic in real time and dynamically, and cannot accurately capture the conversion from virtual IPs to real backend IPs during load balancing within a cluster. This problem is particularly challenging in load balancing scenarios, where the complex traffic forwarding within the cluster and the interrelationships between multiple levels of services make the task even more difficult.

[0028] Therefore, in order to solve the above problems, a specific data detection mechanism can be designed to track the forwarding path of the target data stream and provide accurate data traffic analysis, thereby helping to locate potential problems.

[0029] In embodiments of this disclosure, a data detection scheme is provided. According to embodiments of this disclosure, a first message information of a target data segment intercepted at a first target location and a second message information of a target data segment intercepted at a second target location are determined, wherein the second message information is the message information obtained after performing target address translation on the first message information; and based on the first and second message information, the backend server to which the target data segment is forwarded is determined.

[0030] Therefore, by accurately tracking and recording the forwarding path of target data segments, it is possible to clearly understand which specific backend server the data request is forwarded to, thereby helping to optimize service load balancing strategies and dynamically adjust resource allocation. Furthermore, this method enables rapid identification of the source of problems when cluster systems experience failures or performance issues, improving troubleshooting efficiency and reducing the risk of service interruptions.

[0031] Figure 1A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. In environment 100, service platform 120 may include a plurality of application instances 130-1, 130-2, ... 130-N (collectively or individually referred to as application instance 130). Figure 1 The number of application instances shown is merely illustrative and is not intended to be a limitation.

[0032] Service platform 120 is responsible for the scheduling and management of containerized applications. For example, service platform 120 can be a cluster environment composed of several physical servers, virtual machines, or cloud instances. Service platform 120 can use load balancing mechanisms to distribute requests evenly to different application instances 130 according to actual traffic conditions to ensure high availability and stability of the service.

[0033] Application instance 130 refers to a deployable unit in service platform 120, which encapsulates one or more containers of an application, is responsible for running application logic and communicating with other services in or outside the cluster.

[0034] In some embodiments, terminal device 110 may be an application instance or worker node within or outside the service platform 120. Terminal device 110 communicates with service platform 120 to collaboratively complete related tasks. For example, user 140 may exchange data, communicate, or initiate data detection tasks with application instance 130 via terminal device 110 and / or attached devices of terminal device 110. The initiated data detection tasks can be executed and managed at service platform 120.

[0035] In environment 100, terminal device 110 can be any type of computing-capable device, including terminal devices or server devices. Terminal devices can be any type of mobile terminal, fixed terminal, or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio receivers, e-book devices, gaming devices, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. Server devices may include, for example, computing systems / servers, such as mainframes, edge computing nodes, computing devices in cloud environments, etc.

[0036] It should be understood that the structure and function of environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure.

[0037] Figure 2A schematic diagram of a system 200 for data detection according to some embodiments of the present disclosure is shown. Figure 2 System 200, for example, can be made by Figure 1 The service platform 120 is implemented or deployed within the service platform 120. For ease of discussion, references will be made in the following text. Figure 1 To describe system 200.

[0038] like Figure 2 As shown, system 200 may include request forwarding module 210. Request forwarding module 210 can be used to intercept and forward network traffic of containers in the cluster. For example, request forwarding module 210 can intercept socket connections for network requests, capture request traffic, and thus capture network connection information to support subsequent communication and data exchange between application instances 130.

[0039] In some embodiments, terminal device 110 may initiate a communication request and exchange data with application instance 130 in service platform 120. For example, terminal device 110 sends a target data fragment to application instance 130 in service platform 120 and submits a data detection task for the target data fragment.

[0040] In box 211, request forwarding module 210 receives and processes data requests for target data segments. For example, request forwarding module 210 can intercept and capture the socket connection of the data request based on a control group (Cgroup) mechanism to obtain relevant information about the target data segment.

[0041] The control group mechanism is a special management mechanism in the operating system kernel used to limit, prioritize, account for, and monitor system resources (such as processors, memory, and networks). In the embodiments of this disclosure, the request forwarding module 210 can obtain network connection requests from specific groups based on the control group mechanism, such as obtaining network connection requests for Internet Protocol version 4 (IPv4) and IPv6.

[0042] In box 212, the request forwarding module 210 can use the Destination Network Address Translation (DNAT) mechanism to convert the transmission address of the target data fragment from the virtual cluster IP address and port (e.g., ClusterIP:Port) to the IP address and port of the backend server corresponding to the specific application instance 130, thereby completing load balancing distribution.

[0043] In some embodiments, the system 200 further includes a data monitoring module 220 for performing data detection tasks. In some embodiments, the data monitoring module 220 can determine first message information of a target data segment intercepted at a first target location and second message information of a target data segment intercepted at a second target location. The second message information is the message information obtained after performing target address translation on the first message information.

[0044] For example, the data monitoring module 220 can insert interception points at key nodes in the network data flow (e.g., before and after target address translation) to obtain the first and second packet information of the network connection. These two packet information correspond to two stages in the network connection: before address translation (i.e., the original request stage) and after address translation (i.e., the actual routing stage).

[0045] By comparing the corresponding message information of the target data segment before and after the target address translation, it is possible to monitor whether network traffic is routed as expected. In this way, when a backend service malfunctions, the specific target application instance can be quickly located using the second message information, enabling rapid troubleshooting. Furthermore, by comparing the first and second message information, it can be confirmed whether the logical address of the data transmission is correctly mapped to the corresponding backend server, thereby aiding in the verification of cluster load balancing.

[0046] In some embodiments, the data detection module 220 determines the process ID and thread ID associated with the target thread used to intercept the first message information. A process ID (PID) is a unique identifier assigned by the operating system to each running process. A thread ID (TID) is a unique identifier assigned by the operating system to each thread within a process. For multithreaded programs, multiple threads share the same PID, but each thread has an independent TID.

[0047] The processes of forwarding data requests and converting the transmission address of the target data fragment from the virtual cluster IP address to the corresponding backend server IP address typically fall within the context of the same transmission connection and are executed within the same thread. Therefore, in the embodiments of this disclosure, the PID and TID of the target thread used to intercept the first packet information can be used together as a unique identifier (Key) to mark and associate network connections of different threads within the same process, ensuring accurate matching of data streams. Furthermore, if multiple threads within a process simultaneously initiate Transmission Control Protocol (TCP) connections, the data packets of these connections need to be stored and tracked independently. By using the PID and TID as the Key, it can be ensured that the packet information corresponding to each thread can be tracked and stored separately.

[0048] Continue to refer to Figure 2 In the target thread, the data detection module 220 uses the hook function 221 at the first target location to obtain the first message information. The first target location includes the location before the target address translation is performed.

[0049] Hook functions are used to intercept and process the transformation process of data packets. Specifically, hook functions capture and process relevant system calls or network data by dynamically attaching to specific locations in the operating system kernel.

[0050] Hook functions can be implemented based on Extended Berkeley PacketFilter (eBPF) technology. eBPF is a kernel-level technology that allows developers to write small programs and attach them to different locations in the kernel to perform functions such as network packet processing, system call tracing, and performance monitoring. In the embodiments of this disclosure, by utilizing eBPF technology to attach hook functions to the first target location, the first packet information of the target data segment can be intercepted before target address translation is performed. In this way, programs can be dynamically loaded and unloaded in the kernel in an efficient and low-overhead manner without modifying the kernel source code or recompiling the kernel.

[0051] In some embodiments, the first message information includes a first data 5-tuple, and the first data 5-tuple includes at least one of the following: source Internet Protocol (IP) address, source port, virtual IP address, virtual port, and transport layer protocol.

[0052] When terminal device 110 initiates a data transmission request and network connection, it captures initial network connection information. This information is obtained from the original request before the destination address undergoes destination address translation. This information reflects the original destination and source addresses of the data packet, representing the initial state of the network request. The source IP address refers to the IP address of the device or application instance that initiated the network request. The source port refers to the port number used by the device or application instance when initiating the request. The virtual IP address refers to the logical address of the target application instance in the cluster to which the target data segment will be sent. The virtual port refers to the virtual port number corresponding to the target application instance. The transport layer protocol refers to communication protocols used to transmit message information, such as TCP or User Datagram Protocol (UDP).

[0053] In other embodiments, the first message information may also include more, less, or other information.

[0054] As an example, Figure 3 A schematic diagram of a data detection process 300 according to some embodiments of the present disclosure is shown.

[0055] like Figure 3 As shown, process 300 may include a user-mode program 310 and a kernel-mode program 320. User-mode program 310 may run on any suitable application instance, such as terminal device 110 or within a cluster. Kernel-mode program 320 may run on an operating system kernel within the cluster, such as a kernel-level eBPF program running on the operating system kernel of the service platform 120 server, thereby processing network packets in kernel space.

[0056] User-space program 310 includes application 311 for initiating network connection requests. Application 311 can establish network connections for communication or data transmission with other application instances or devices in the cluster through system calls 321 in kernel-space program 320. A system call is an interaction mechanism between a user-space program and the operating system kernel. It includes a series of special function calls that allow user-space applications to request the operating system kernel to perform certain low-level operations. For example, the system connection function 322, one of the functions in the operating system kernel used to handle socket connections, is responsible for receiving connection requests initiated by application 311.

[0057] In some examples, user-space program 310 can monitor the address translation process of data requests for target data segments through data inspection component 312. For example, a hook function 221 can be attached to the first target location before the target address translation is performed using a kernel probe (Kprobe). Attaching refers to the process of binding a hook function to a specific kernel function. When a system call executes the kernel function of system linker function 322, hook function 221 is triggered and runs. In this way, the first message information before the target address translation can be intercepted and obtained, providing a basis for subsequent comparison and analysis.

[0058] Furthermore, network connection is an asynchronous, phased process. The first message information before address translation is captured during the system connection phase, which is typically separate from the communication connection phase in terms of time and logic. Therefore, if the information from the first phase is not stored in a timely manner, it will be impossible to associate it with the previously intercepted message information in the second phase, leading to a context break. In some embodiments, the data detection module 220 can store the first message information in a predetermined data structure based on process identifiers and thread identifiers.

[0059] refer to Figure 3In kernel-mode program 320, the first message information obtained by hook function 221 can be stored in mapping table 324 and managed based on process identifier and thread identifier. Mapping table 324 is a predefined data structure in the kernel (such as an eBPF map). eBPF map is a thread-safe shared data structure in kernel mode that can transfer data between different stages of a communication connection.

[0060] In the embodiments of this disclosure, the first message information is stored in a mapping table, and subsequent stages can directly read this data, thereby avoiding information overwriting or loss and affecting the accuracy of data detection. Furthermore, by combining process identifiers and thread identifiers, it can be ensured that each thread's network request is accurately associated with a unique index, avoiding data overwriting or confusion.

[0061] Return to reference Figure 2 In the target thread, the data detection module 220 uses the hook function 222 at the second target location to obtain the second message information. The second target location includes the location after the target address translation is performed.

[0062] The first message information is obtained through hook function 221 before the target address translation is performed (e.g., when the system connection function is called). The information captured at this time is usually the initial target address when the network connection is initiated, such as the virtual address and virtual port provided by the user-space application. After the first phase, the initial target address is processed by DNAT, which translates the transport address from the virtual IP address and port to the IP address and port of the backend server corresponding to the target application instance 130, thereby completing the load balancing distribution.

[0063] The target address after address translation is the actual destination of the network connection, which is crucial for monitoring and diagnosing network behavior. Therefore, hook function 222 at the second target location can be used to obtain the second packet information. The second packet information records the target address after address translation. Comparing the second packet information with the first packet information allows us to understand which backend service instance the data request was ultimately routed to and verify whether DNAT is working as expected.

[0064] In some embodiments, the second message information includes a second data 5-tuple, and the second data 5-tuple includes at least one of a source IP address, a source port, a destination IP address, a destination port, and a transport layer protocol. The source IP address, source port, and transport layer protocol are consistent with the first message information, representing the IP address, port, and communication protocol of the device or application instance initiating the connection, respectively. The destination IP address refers to the actual destination address after DNAT translation, such as the address of the backend server of a specific application instance. The destination port refers to the actual port number after DNAT translation.

[0065] In other embodiments, the second message information may also include more, less, or other information.

[0066] Return to reference Figure 3 After the target address translation is complete, the virtual address and virtual port are translated into the target address and target port. At this point, the communication connection function 323 is called. The communication connection function 323 uses the target address and target port to attempt to establish an actual communication connection with the target application instance. The communication connection function 323 includes, for example, the tcp_connect function for establishing a TCP connection.

[0067] Therefore, another kernel probe (fentry) can be used to attach hook function 222 to the second target location after the target address translation is performed. When the communication connection function 323 is called and executed, hook function 222 will be triggered and run to obtain the second message data. In this way, the second message information after the target address translation can be intercepted and obtained, providing a basis for subsequent comparison and analysis.

[0068] In some embodiments, in response to obtaining the second message information, the data detection module 220 obtains the first message information from a predetermined data structure based on the process identifier and thread identifier of the target thread, wherein the target thread is used to intercept the first message information and the second message information.

[0069] As an example, after obtaining the second message information, the kernel hook function 222 will use the process identifier and thread identifier of the target thread to extract the corresponding first message information from a predetermined data structure (such as mapping table 324).

[0070] In some embodiments, the data detection module 220 determines the data forwarding event for the target data segment based on the first message information and the second message information. The first message information represents information about the virtual address stage before the target address translation. The second message information represents information about the real address stage after the target address translation. Combining the two forms a complete data chain that describes the entire lifecycle of a network connection from initiation to address translation.

[0071] Continue to refer to Figure 3 In kernel-mode program 320, a data forwarding event 325 can be generated based on the integrated information of the first and second message messages to describe the address change process of this network connection. Data forwarding event 325 can contain information from the first and second quintuples.

[0072] In some embodiments, the data detection module 220 can determine the backend server to which the target data fragment is forwarded based on data forwarding events. By using data forwarding events, the specific backend server to which the request is forwarded can be directly determined, which can then be used to diagnose the accuracy of request routing or the rationality of load balancing strategies.

[0073] As an example, kernel-mode program 320 can report the generated event 325 to data detection component 312 via a circular buffer. Upon receiving event 325, data detection component 312 can filter the data based on preset filtering conditions, extracting network connection information that meets the criteria. Finally, these filtered results can be output to terminal device 110 for maintenance personnel to view and analyze.

[0074] In the embodiments of this disclosure, integrating the first and second message information allows for a clear visualization of the complete lifecycle of a network connection from a virtual address to a physical address. This data integration not only facilitates understanding network behavior but also enables the tracing of forwarding paths for specific requests. Furthermore, the reporting of data forwarding events provides a view of network connection behavior, particularly in complex service cluster environments, clearly demonstrating the address translation and request distribution process. This approach is of great significance for troubleshooting issues such as Domain Name System (DNS) errors, load balancing problems, and traffic routing errors.

[0075] Figure 4 A flowchart of a data detection process 400 according to some embodiments of the present disclosure is shown. Process 400 can be implemented in environment 100, for example, process 400 can be implemented at any suitable application instance 130 in terminal device 110 or service platform 120.

[0076] In box 410, terminal device 110 determines the first message information of the target data segment intercepted at the first target location and the second message information of the target data segment intercepted at the second target location. The second message information is the message information obtained after performing target address translation on the first message information.

[0077] In box 420, terminal device 110 determines the backend server to which the target data segment is forwarded based on the first message information and the second message information.

[0078] In some embodiments, determining the first message information includes determining a process identifier and a thread identifier associated with a target thread for intercepting the first message information; in the target thread, obtaining the first message information using a hook function at a first target location, the first target location including the location before performing target address translation.

[0079] In some embodiments, determining the first message information further includes: storing the first message information into a predetermined data structure based on the process identifier and the thread identifier.

[0080] In some embodiments, determining the second message information includes, in the target thread used to intercept the second message information, obtaining the second message information using a hook function at a second target location, wherein the second target location includes the location after performing target address translation.

[0081] In some embodiments, determining a backend server includes, in response to obtaining second message information, obtaining first message information from a predetermined data structure based on the process identifier and thread identifier of a target thread, wherein the target thread is used to intercept the first message information and the second message information; determining a data forwarding event for a target data segment based on the first message information and the second message information; and determining a backend server based on the data forwarding event.

[0082] In some embodiments, the first message information includes a first data 5-tuple, and the first data 5-tuple includes at least one of a source Internet Protocol (IP) address, a source port, a virtual IP address, a virtual port, and a transport layer protocol.

[0083] In some embodiments, the second message information includes a second data 5-tuple, and the second data 5-tuple includes at least one of the following: source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0084] Figure 5 A block diagram of an apparatus 500 for data detection according to some embodiments of the present disclosure is shown. The apparatus 500 may be implemented as or include a terminal device 110.

[0085] The device 500 includes a message information determination module 510, configured to determine a first message information of a target data segment intercepted at a first target location and a second message information of a target data segment intercepted at a second target location, wherein the second message information is the message information obtained after performing target address translation on the first message information; and a backend server determination module 520, configured to determine the backend server to which the target data segment is forwarded based on the first message information and the second message information.

[0086] In some embodiments, the message information determination module 510 is further configured to determine a process identifier and a thread identifier associated with a target thread used to intercept the first message information; in the target thread, the first message information is obtained using a hook function at a first target location, the first target location including the location before the target address translation is performed.

[0087] In some embodiments, the message information determination module 510 is further configured to store the first message information into a predetermined data structure based on the process identifier and the thread identifier.

[0088] In some embodiments, the message information determination module 510 is further configured to obtain the second message information in the target thread used to intercept the second message information using a hook function at the second target location, the second target location including the location after performing target address translation.

[0089] In some embodiments, the backend server determination module 520 is further configured to, in response to obtaining the second message information, obtain the first message information from a predetermined data structure based on the process identifier and thread identifier of the target thread, wherein the target thread is used to intercept the first message information and the second message information; determine a data forwarding event for the target data segment based on the first message information and the second message information; and determine the backend server based on the data forwarding event.

[0090] In some embodiments, the first message information includes a first data 5-tuple, and the first data 5-tuple includes at least one of a source Internet Protocol (IP) address, a source port, a virtual IP address, a virtual port, and a transport layer protocol.

[0091] In some embodiments, the second message information includes a second data 5-tuple, and the second data 5-tuple includes at least one of the following: source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0092] The modules included in device 500 can be implemented in various ways, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more units can be implemented using software and / or firmware, such as machine-executable instructions stored on a storage medium. In addition to or as an alternative to machine-executable instructions, some or all of the units in device 500 can be implemented at least partially by one or more hardware logic components. By way of example, and not limitation, exemplary types of hardware logic components that can be used include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chips (SoCs), complex programmable logic devices (CPLDs), and so on.

[0093] Figure 6 A block diagram of an electronic device 600 in which one or more embodiments of the present disclosure may be implemented is shown. It should be understood that... Figure 6 The electronic device 600 shown is merely exemplary and should not be construed as limiting the functionality and scope of the embodiments described herein.

[0094] like Figure 6As shown, electronic device 600 is in the form of a general-purpose electronic device. Components of electronic device 600 may include, but are not limited to, one or more processors or processing units 610, memory 620, storage device 630, one or more communication units 640, one or more input devices 650, and one or more output devices 660. Processing unit 610 may be a physical or virtual processor and is capable of performing various processes according to programs stored in memory 620. In a multiprocessor system, multiple processing units execute computer-executable instructions in parallel to improve the parallel processing capability of electronic device 600.

[0095] Electronic device 600 typically includes multiple computer storage media. Such media can be any available media accessible to electronic device 600, including but not limited to volatile and non-volatile media, removable and non-removable media. Memory 620 can be volatile memory (e.g., registers, cache, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. Storage device 630 can be removable or non-removable media and can include machine-readable media, such as flash drives, disks, or any other media capable of storing information and / or data and accessible within electronic device 600.

[0096] Electronic device 600 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not explicitly stated... Figure 6 As shown, disk drives for reading from or writing to removable, non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable, non-volatile optical disks can be provided. In these cases, each drive can be connected to a bus (not shown) via one or more data media interfaces. Memory 620 may include computer program product 625 having one or more program modules configured to perform various methods or actions of various embodiments of this disclosure.

[0097] The communication unit 640 enables communication with other electronic devices via a communication medium. Additionally, the functionality of the components of the electronic device 600 can be implemented using a single computing cluster or multiple computing machines capable of communicating via communication connections. Therefore, the electronic device 600 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network node.

[0098] Input device 650 can be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 560 can be one or more output devices, such as a monitor, speaker, printer, etc. Electronic device 600 can also communicate with one or more external devices (not shown) via communication unit 640 as needed. These external devices include storage devices, display devices, etc., and can communicate with one or more devices that enable user interaction with electronic device 600, or with any device that enables electronic device 600 to communicate with one or more other electronic devices (e.g., network card, modem, etc.). Such communication can be performed via input / output (I / O) interface (not shown).

[0099] According to an exemplary implementation of this disclosure, a computer-readable storage medium is provided that stores one or more computer instructions, wherein the one or more computer instructions are executed by a processor to implement the methods described above. According to an exemplary implementation of this disclosure, a computer program product is also provided, which is tangibly stored on a non-transient computer-readable medium and includes computer-executable instructions that are executed by a processor to implement the methods described above.

[0100] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products implemented according to this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0101] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0102] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions that execute on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0104] Various implementations of this disclosure have been described above. The foregoing description is exemplary and not exhaustive, nor is it limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to technology in the market, or to enable others skilled in the art to understand the implementations disclosed herein.

Claims

1. A method for data detection, comprising: The first message information of the target data segment intercepted at the first target location and the second message information of the target data segment intercepted at the second target location are determined. The second message information is the message information obtained by performing target address translation on the first message information. as well as Based on the first message information and the second message information, the backend server to which the target data fragment is forwarded is determined.

2. The method according to claim 1, wherein determining the first message information includes: Determine the process identifier and thread identifier associated with the target thread used to intercept the first message information; In the target thread, the first message information is obtained using a hook function at the first target location, where the first target location includes the location before the target address translation is performed.

3. The method according to claim 2, further comprising: Based on the process identifier and the thread identifier, the first message information is stored in a predetermined data structure.

4. The method according to claim 1, wherein determining the second message information includes: In the target thread used to intercept the second message information, the second message information is obtained using a hook function at the second target location, which includes the location after the target address translation is performed.

5. The method of claim 1, wherein determining the backend server comprises: In response to obtaining the second message information, the first message information is obtained from a predetermined data structure based on the process identifier and thread identifier of the target thread, and the target thread is used to intercept the first message information and the second message information; Based on the first message information and the second message information, a data forwarding event for the target data segment is determined; as well as The backend server is determined based on the data forwarding event.

6. The method according to claim 1, wherein the first message information includes a first data quintuple, and the first data quintuple includes at least one of a source Internet Protocol (IP) address, a source port, a virtual IP address, a virtual port, and a transport layer protocol.

7. The method according to claim 1, wherein the second message information includes a second data 5-tuple, and the second data 5-tuple includes at least one of source IP address, source port, destination IP address, destination port, and transport layer protocol.

8. A data detection apparatus, comprising: The message information determination module is configured to determine the first message information of the target data segment intercepted at the first target location and the second message information of the target data segment intercepted at the second target location, wherein the second message information is the message information obtained by performing target address translation on the first message information; as well as The backend server determination module is configured to determine the backend server to which the target data fragment is forwarded based on the first message information and the second message information.

9. An electronic device, comprising: At least one processing unit; as well as At least one memory, coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, which, when executed by the at least one processing unit, cause the electronic device to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the method according to any one of claims 1 to 7.

11. A computer program product tangibly stored in a computer storage medium and comprising computer-executable instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 7.

Images