Code operation behavior detection method and apparatus, medium, and electronic device

Abstract

Embodiments of the present invention provide a code operation behavior detection method and apparatus, a storage medium, and an electronic device. The method comprises: in response to a recording operation on a remote code repository operation log, obtaining log information corresponding to the recording operation; on the basis of the log information, determining whether an operation of pushing a code file to a remote code repository exists; when it is determined that the operation of pushing the code file to the remote code repository exists, obtaining an address of the remote code repository to which the code file is pushed; and on the basis of the address of the remote code repository and a pre-configured platform identification strategy, determining whether the operation of pushing the code file to the remote code repository is a secure operation. The method of the present invention is a new method for detecting the code operation behavior.

Description

Code operation behavior detection method, device, medium and electronic equipment

[0001] This application claims priority to Chinese Patent Application No. 202311086114.8 filed on August 25, 2023, and the contents of the above-mentioned Chinese patent application disclosure are hereby cited in their entirety as a part of this application. Technical Field

[0002] The embodiments of the present disclosure relate to a method, device, medium, and electronic device for detecting code operation behavior. Background Art

[0003] Enterprise R&D code is a core company asset. During the R&D process, code is typically managed using code versioning tools like Git (an open-source distributed version control system). Internal R&D often involves pushing enterprise code to code repositories hosted on public code hosting platforms, potentially creating leaks. Therefore, it's crucial to monitor code pushes to code repositories.

[0004] However, the methods for detecting the operation behavior of pushing code to the code repository in related technologies have certain limitations and need to be improved.

[0005] Summary of the Invention

[0006] This summary is provided to briefly introduce concepts that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0007] In a first aspect, the present disclosure provides a method for detecting code operation behavior, the method comprising:

[0008] In response to a recording operation of a remote code repository operation log, obtaining log information corresponding to the recording operation;

[0009] Determine whether there is an operation of pushing a code file to a remote code repository based on the log information;

[0010] When it is determined that there is an operation of pushing a code file to the remote code repository, obtaining an address of the remote code repository to which the code file is pushed;

[0011] Determine whether an operation pushed to the remote code repository complies with a security operation based on the address of the remote code repository and a pre-configured platform identification policy, wherein the pre-configured platform identification policy is used to indicate a security scope of the operation pushed to the remote code repository.

[0012] In a second aspect, the present disclosure provides a device for detecting code operation behavior, the device comprising:

[0013] A first acquisition module is configured to, in response to a recording operation of a remote code repository operation log, obtain log information corresponding to the recording operation;

[0014] A first determining module is configured to determine whether there is an operation of pushing a code file to a remote code repository based on the log information;

[0015] A second acquisition module is configured to, when determining that there is an operation of pushing a code file to the remote code repository, acquire an address of the remote code repository to which the code file is pushed;

[0016] The second determination module is configured to determine whether the operation pushed to the remote code repository complies with a safe operation based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation pushed to the remote code repository.

[0017] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of the method described in the first aspect when executed by a processing device.

[0018] In a fourth aspect, the present disclosure provides an electronic device, comprising:

[0019] a storage device having a computer program stored thereon;

[0020] A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the first aspect.

[0021] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other features, advantages and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale. In the drawings:

[0023] FIG1 is a flowchart showing a method for detecting code operation behavior according to an exemplary embodiment of the present disclosure.

[0024] FIG2 is a flowchart showing a method for detecting code operation behavior according to an exemplary embodiment of the present disclosure.

[0025] FIG3 is a block diagram showing a device for detecting code operation behavior according to an exemplary embodiment of the present disclosure.

[0026] FIG4 is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0028] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0029] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0030] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0033] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, monitoring or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions, and shall be acquired, monitored or used with the user's authorization.

[0034] In the related art, there are three solutions to prevent code leakage.

[0035] The first solution is "traffic auditing," which involves auditing the computer's network traffic. This type of solution first detects the Internet traffic of the terminal device, identifies code snippets from the http (Hypertext Transfer Protocol) and https (Hypertext Transfer Protocol Secure, a security-oriented http channel) traffic, detects push requests, and then extracts the remote code repository address from the push hosting platform. Based on the remote code repository address, the code push operation is audited to determine whether the code push operation is compliant. This solution has low coverage and can only audit the http / https protocols. The ssh (Secure Shell) protocol cannot be audited. In addition, user request traffic must pass through the auditing device, and can only detect corporate network environments. It cannot detect when using a private home network or hotspot.

[0036] The second approach is "hosting platform detection," which involves regularly scanning public code hosting platforms like GitHub. If a code leak is detected, it's considered a code leak. However, these detection tools are often ineffective and lack comprehensive coverage across various hosting platforms or remote code repositories, making it impossible to determine whether code was pushed by company employees.

[0037] The third solution is "git hooks," a feature built into the Git tool. Git comes with many built-in hook scripts, which are triggered when a user performs a push operation. This solution defines a push audit hook script that is automatically triggered when a user performs a push operation. This script retrieves the code file pushed by the user and the remote code repository address, and uses the remote code repository address to determine compliance with the code push operation. This solution is quite intrusive in the user's R&D process and may conflict with the user's own R&D management software.

[0038] It can be seen that the detection methods of code push operations in the above-mentioned related technologies have shortcomings, and the detection methods of code push operations need to be improved.

[0039] Therefore, the embodiment of the present disclosure proposes a code operation behavior detection method, which detects the recording operation of the remote code repository operation log, obtains the log information corresponding to the recording operation in response to the recording operation of the remote code repository operation log, determines whether there is an operation of pushing the code file to the remote code repository based on the log information, and when it is determined that there is an operation of pushing the code file to the remote code repository, further obtains the address of the remote code repository to which the code file is pushed, and then determines whether the operation of pushing the code file to the remote code repository complies with the security operation based on the address of the remote code repository and the pre-configured platform identification policy. Considering that no matter which tools or protocols are used to push code files to each remote code repository, the remote code repository operation log will be recorded locally, therefore, by detecting the recording operation of the remote code repository operation log, the code operation behavior completed for different tools, different transmission protocols, different remote code repositories and different network environments can be obtained, thereby improving the detection coverage, and because the recording operation of the remote code repository operation log is detected, it will not intrude into the user's R&D process.

[0040] FIG1 is a flow chart of a method for detecting code operation behavior according to an exemplary embodiment of the present disclosure. The method for detecting code operation behavior can be applied to electronic devices. Referring to FIG1 , the method for detecting code operation behavior includes the following steps:

[0041] S110 , in response to a recording operation of a remote code repository operation log, obtaining log information corresponding to the recording operation.

[0042] S120: Determine, based on the log information, whether there is an operation of pushing a code file to a remote code repository.

[0043] S130: When it is determined that there is an operation of pushing a code file to a remote code repository, an address of the remote code repository to which the code file is pushed is obtained.

[0044] S140: Determine whether the operation of pushing to the remote code repository complies with a safe operation based on the address of the remote code repository and a pre-configured platform identification policy.

[0045] In some embodiments, a pre-configured platform identification policy can be used to indicate the security scope of operations pushed to a remote code repository. That is, the pre-configured platform identification policy is used to indicate within which ranges the remote code repository address is considered a safe operation to push to the remote code repository, and within which ranges the remote code repository address is considered unsafe.

[0046] Considering that code operations are completed on a remote code repository located on a remote hosting platform through code version management tools such as git, for example, after completing a code push or code pull operation, a remote code repository operation log will be recorded, that is, an operation record will be written to the remote code repository operation log file. Therefore, based on this situation, in the embodiment of the present disclosure, it is possible to detect whether there is a recording operation in the remote code repository operation log. If a recording operation in the remote code repository operation log is detected, the log information corresponding to the recording operation can be obtained in response to the recording operation in the remote code repository operation log.

[0047] Furthermore, after obtaining the log information, it is possible to determine whether there is an operation of pushing code files to the remote code repository based on the log information. If it is determined that there is an operation of pushing code files to the remote code repository, the address of the remote code repository to which the code files are pushed can be further obtained.

[0048] Furthermore, after obtaining the address of the remote code repository, it can be determined whether the operation of pushing to the remote code repository complies with security operations based on the address of the remote code repository and the pre-configured platform identification policy.

[0049] The method of the embodiment of the present disclosure is adopted, by detecting the recording operation of the remote code repository operation log, in response to the recording operation of the remote code repository operation log, obtaining the log information corresponding to the recording operation, determining whether there is an operation of pushing the code file to the remote code repository based on the log information, and when it is determined that there is an operation of pushing the code file to the remote code repository, further obtaining the address of the remote code repository to which the code file is pushed, and then determining whether the operation of pushing to the remote code repository complies with the safety operation based on the address of the remote code repository and the pre-configured platform identification policy. Considering that no matter which tools and protocols are used to push code files to each remote code repository, the remote code repository operation log will be recorded locally, therefore, by detecting the recording operation of the remote code repository operation log, the code operation behavior completed for different tools, different transmission protocols, different remote code repositories and different network environments can be obtained, thereby improving the detection coverage, and because the recording operation of the remote code repository operation log is detected, it will not intrude into the user's R&D process.

[0050] In some implementations, in order to improve the accuracy of code operation behavior detection, the latest recorded log information corresponding to the recorded operation may be obtained.

[0051] In addition, considering that newer log information is written to a later position in the remote code repository operation log file, in some implementations, the latest log information corresponding to the recording operation can be obtained by reading the content of the last line of record in the remote code repository operation log file.

[0052] There are multiple methods for determining whether a remote code repository operation log has been recorded.

[0053] Considering that recording remote code repository operation logs may involve operating system file writing operations, based on this situation, in some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0054] When a file write operation is detected on the operating system, the file write path associated with the file write operation is obtained; when the file write path includes a preset specified path, it is determined that a recording operation of the remote code repository operation log has occurred, wherein the preset specified path represents the storage path characteristics of the remote code repository operation log.

[0055] Recording the remote code repository operation log must involve a file write operation, and the storage location of the remote code repository operation log conforms to certain path characteristics. Based on this characteristic, in the embodiment of the present disclosure, the file write operation in the operating system can be monitored first. If a file write operation is detected on the operating system, it indicates that there may be a recording operation of the remote code repository operation log. Therefore, the file write path associated with the file write operation can be further obtained, and it can be determined whether the file write path includes the characteristics of the storage path corresponding to the remote code repository operation log, that is, whether it includes the preset specified path. If the file write path includes the preset specified path, it can be determined that a recording operation of the remote code repository operation log has occurred.

[0056] For example, the storage path corresponding to the remote code repository operation log may include "git / logs / refs / remotes / ". Therefore, if the obtained file write path includes "git / logs / refs / remotes / ", it can be determined that a recording operation of the remote code repository operation log has occurred.

[0057] Among them, monitoring the file writing operation generated on the operating system can be achieved by calling relevant interfaces or functions, which will not be described in detail here.

[0058] In some embodiments, after determining that a recording operation of a remote code repository operation log has occurred, it can be determined that the file writing path corresponding to the file writing operation is the storage path corresponding to the remote code repository operation log. Therefore, the log information corresponding to the recording operation can be obtained from the remote code repository operation log under the file writing path.

[0059] In some implementations, obtaining the address of a remote code repository to which a code file is pushed may include the following steps:

[0060] Determine the local code repository based on the file write path; determine the address of the remote code repository based on the configuration file in the local code repository.

[0061] Taking into account that there are rules for path directories, for example, corresponding to different files under the same git project, the first several path directories are the same, only the specific file contents are different, and the latter several path directories are different. Therefore, in the embodiment of the present disclosure, after determining the file writing path, the local code repository can be further determined based on the file writing path, and then, the address of the remote code repository can be further determined based on the configuration file in the local code repository.

[0062] In some implementations, the operations of searching for a configuration file from a local code repository and further determining the address of a remote code repository from the configuration file may be performed using keyword recognition.

[0063] In some embodiments, determining whether an operation of pushing a code file to a remote code repository occurs based on log information can also be done through keyword recognition. For example, when characters representing a push operation are identified from the log information, such as when the keyword "push" is present, it is determined that an operation of pushing a code file to a remote code repository occurs.

[0064] In other implementations, the storage paths for remote code repository operation logs corresponding to all projects can be pre-determined. Then, each remote code repository operation log storage path can be monitored separately. When a file stored in a remote code repository operation log storage path changes, a code repository operation log recording operation is determined. Furthermore, log information in the remote code repository operation log that has changed can be obtained.

[0065] In the disclosed embodiment, the local code repository can be determined based on the storage path of the remote code repository operation log where the file has changed, and the address of the remote code repository can be further determined based on the configuration file in the local code repository.

[0066] In addition, considering that there may be a delay in the monitoring results of the file write operation or the monitoring results of the storage paths of each remote code repository operation log, for example, the monitoring result of the operating system recording the file write operation is obtained one minute after the file write operation. In this case, the obtained remote code repository operation log may not be the latest, and the timeliness of the detection result is low. Therefore, in order to improve the timeliness of the detection result, in some embodiments, when it is determined that there is an operation of pushing a code file to the remote code repository, obtaining the address of the remote code repository to which the code file is pushed may include the following steps:

[0067] When it is determined that there is an operation to push a code file to the code repository, the operation time corresponding to the operation behavior is obtained according to the log information; if the difference between the operation time and the current time is less than the preset duration, the address of the remote code repository to which the code file is pushed is obtained.

[0068] The log information can record the operation time corresponding to the operation of pushing the code file to the remote code repository. Therefore, in the embodiment of the present disclosure, when it is determined based on the log information that there is an operation of pushing the code file to the remote code repository, the operation time corresponding to the operation behavior can be further obtained based on the log information, and when the difference between the operation time and the current time is less than the preset duration, the step of obtaining the address of the remote code repository to which the code file is pushed is further executed, otherwise the subsequent steps will no longer be executed, thereby improving the timeliness of the detection results.

[0069] Furthermore, considering that the delay in the monitoring results may be caused by performance, by further executing the step of obtaining the address of the remote code repository to which the code file is pushed when the difference between the operation time and the current time is less than the preset duration, and otherwise not executing the subsequent steps, processing resources can be saved and further deterioration of processing performance can be avoided.

[0070] In combination with the foregoing, it can be seen that the pre-configured platform identification policy can be used to indicate the security scope of operations pushed to a remote code repository. In this case, in some embodiments, the pre-configured platform identification policy includes a code hosting platform whitelist address, and the code hosting platform whitelist address is used to indicate that operations pushed to code hosting platform addresses outside the whitelist address do not comply with security operations; or; the pre-configured platform identification policy includes a code hosting platform blacklist address, and the code hosting platform blacklist address is used to indicate that operations pushed to code hosting platform addresses on the blacklist address do not comply with security operations.

[0071] In the embodiments of the present disclosure, when the pre-configured platform identification policy includes a whitelist address for the code hosting platform, if the address of the remote code repository is a code hosting platform address outside the whitelist address, then the push operation to the remote code repository does not comply with security requirements. When the pre-configured platform identification policy includes a blacklist address for the code hosting platform, if the address of the remote code repository is a code hosting platform address on the blacklist address, then the push operation to the remote code repository does not comply with security requirements.

[0072] In the embodiment of the present disclosure, the user may know certain illegal addresses. In this case, the user can set a blacklist address, and the addresses in the blacklist are all addresses that do not comply with the corresponding security operations.

[0073] In addition, in the embodiment of the present disclosure, considering that Internet website addresses are added quickly, diverse and rich, users may not be able to list all blacklist addresses. In this case, users can set whitelist addresses, where the whitelist addresses are code file push addresses that comply with security operations. Other addresses outside the whitelist addresses can be determined as addresses that do not comply with security operations.

[0074] In some implementations, the code hosting platform whitelist address and the code hosting platform blacklist address may be configured by a server-side person and sent to each electronic device that executes the code operation behavior detection method.

[0075] In some embodiments, after determining whether the operation of pushing to the remote code repository complies with a safe operation based on the address of the remote code repository and a pre-configured platform identification policy, a result may be obtained that the operation of pushing to the remote code repository does not comply with a safe operation. In this case, the method of the embodiment of the present disclosure may further include the following steps:

[0076] When it is determined that the operation of pushing code files to the remote code repository does not comply with security operations, a violation operation record is generated. The violation operation record is used to record the unsafe behavior of pushing code files to the remote code repository.

[0077] In an embodiment of the present disclosure, if it is determined that the operation of pushing code files to a remote code repository does not comply with a safe operation, a violation operation record is generated. The violation operation record is used to record the unsafe behavior of pushing code files to the remote code repository. Therefore, when the violation operation record is obtained, it can be determined that there is an unsafe behavior of pushing code files to the remote code repository.

[0078] In some embodiments, after determining whether the operation of pushing to the remote code repository complies with a safe operation based on the address of the remote code repository and a pre-configured platform identification policy, a result may be obtained that the operation of pushing to the remote code repository does not comply with a safe operation. In this case, the method of the embodiment of the present disclosure may further include the following steps:

[0079] According to the file attribute information of the code file and the pre-configured file identification policy, it is determined whether the code file belongs to the designated protected code file; when it is determined that the code file belongs to the designated protected code file, information indicating that there is a risk of externally sending the designated protected code file is generated.

[0080] In some cases, even if files are pushed to a public code hosting platform, if these pushed code files are not sensitive files, they do not need to be defined as violations, and there is not necessarily a risk of data leakage. Therefore, in the embodiment of the present disclosure, after determining that the operation of pushing to a remote code repository does not comply with security operations, it is possible to further determine whether the code file belongs to a designated protected code file based on the file attribute information of the code file and a pre-configured file identification policy. If it is determined that the code file belongs to a designated protected code file, information is generated to indicate that there is a risk of sending the designated protected code file externally.

[0081] In some implementations, the pre-configured file identification policy includes at least one attribute information of the specified file to be protected: content, file type, file name, and file size.

[0082] In the embodiment of the present disclosure, when the file attribute information of the code file matches the attribute information included in the pre-configured file identification policy, it is determined that the code file belongs to the designated protected code file.

[0083] In some implementations, the generated illegal operation record or the generated information indicating the risk of outsourcing the designated protection code file may be further sent to the server for further audit or analysis by the server personnel.

[0084] In some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0085] Determine the target submission hash value corresponding to the operation according to the log information; and determine the code file corresponding to the target submission hash value according to the correspondence between the submission hash value and the code file.

[0086] In the disclosed embodiment, the correspondence between the commit hash value and the code file is recorded locally, and the target commit hash value corresponding to the operation behavior can be recorded in the log information in the remote code repository operation log. Thus, the target code file corresponding to this operation behavior can be found through the target commit hash value.

[0087] FIG2 is a flow chart of a method for detecting code operation behavior according to an exemplary embodiment of the present disclosure. The method for detecting code operation behavior can be applied to electronic devices. Referring to FIG2 , the method for detecting code operation behavior includes the following steps:

[0088] S201, monitoring the occurrence of file write operations on the operating system.

[0089] S202: When a file write operation is detected on the operating system, a file write path associated with the file write operation is obtained.

[0090] S203: Determine whether the file writing path includes a preset designated path.

[0091] S204: If the file writing path includes the preset designated path, obtain the latest recorded log information from the remote code repository operation log under the file writing path. Otherwise, continue to return to step S201.

[0092] S205 , determining whether the log information includes a push character, and whether the difference between the operation time corresponding to the log information and the current time is less than a preset time length.

[0093] In step S206, if the log information contains a "push" character and the difference between the operation time corresponding to the log information and the current time is less than a preset time interval, the local code repository is determined based on the file write path, and the address of the remote code repository is determined based on the configuration file in the local code repository. Otherwise, the process returns to step S201.

[0094] S207: Determine a target submission hash value corresponding to the operation behavior according to the log information, and determine a code file corresponding to the target submission hash value according to a correspondence between the submission hash value and the code file.

[0095] S208: Determine whether the operation of pushing to the remote code repository complies with a safe operation based on the address of the remote code repository and a pre-configured platform identification policy.

[0096] S209: When it is determined that the operation of pushing to the remote code repository does not comply with a security operation, determine whether the code file is a designated protected code file based on the file attribute information of the code file and a pre-configured file identification policy.

[0097] S210 : When it is determined that the code file belongs to the designated protected code file, information is generated indicating that there is a risk of externally sending the designated protected code file.

[0098] The detailed description of the above steps S201-S210 can refer to the above embodiments and will not be repeated here.

[0099] FIG3 is a block diagram of a device for detecting code operation behavior according to an exemplary embodiment of the present disclosure. Referring to FIG3 , the device 300 for detecting code operation behavior includes:

[0100] A first acquisition module 310 is configured to, in response to a recording operation of a remote code repository operation log, obtain log information corresponding to the recording operation;

[0101] A first determining module 320 is configured to determine whether there is an operation of pushing a code file to a remote code repository based on the log information;

[0102] The second acquisition module 330 is configured to, when determining that there is an operation of pushing a code file to the remote code repository, obtain the address of the remote code repository to which the code file is pushed;

[0103] The second determination module 340 is configured to determine whether the operation pushed to the remote code repository complies with security operations based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation pushed to the remote code repository.

[0104] Optionally, the code operation behavior detection device 300 further includes:

[0105] a third determining module configured to determine whether the code file is a designated protected code file based on the file attribute information of the code file and a pre-configured file identification policy;

[0106] The first generating module is configured to generate information indicating that there is a risk of sending the designated protected code file externally when determining that the code file belongs to the designated protected code file.

[0107] Optionally, the code operation behavior detection device 300 further includes:

[0108] The second generating module is configured to generate a violation operation record when it is determined that the operation of pushing the code file to the remote code repository does not comply with the safety operation, wherein the violation operation record is used to record the unsafe behavior of pushing the code file to the remote code repository.

[0109] Optionally, the pre-configured file identification policy includes at least one attribute information of the specified file content to be protected, file type, file name, and file size.

[0110] Optionally, the pre-configured platform identification policy includes a code hosting platform whitelist address, and the code hosting platform whitelist address is used to indicate that an operation pushed to a code hosting platform address outside the whitelist address does not comply with a safe operation; or;

[0111] The pre-configured platform identification policy includes a code hosting platform blacklist address, and the code hosting platform blacklist address is used to indicate that an operation pushed to a code hosting platform address on the blacklist address does not comply with a safe operation.

[0112] Optionally, the code operation behavior detection device 300 further includes:

[0113] A third acquisition module is configured to, when monitoring a file write operation generated on the operating system, acquire a file write path associated with the file write operation;

[0114] The fourth determining module is configured to determine that a recording operation of the code repository operation log occurs when the file writing path includes a preset designated path, wherein the preset designated path represents a storage path feature of the code repository operation log.

[0115] Optionally, the second acquisition module 330 includes:

[0116] A first determining submodule is configured to determine a local code repository according to the file writing path;

[0117] The second determining submodule is configured to determine the address of the remote code repository according to the configuration file in the local code repository.

[0118] Optionally, the second acquisition module 330 includes:

[0119] A first acquisition submodule is configured to, when determining that an operation of pushing a code file to the code repository exists, acquire an operation time corresponding to the operation according to the log information;

[0120] The second acquisition submodule is configured to acquire the address of the remote code repository to which the code file is pushed when the difference between the operation time and the current time is less than a preset duration.

[0121] Optionally, the code operation behavior detection device 300 further includes:

[0122] A fifth determination module is configured to determine a target submission hash value corresponding to the operation according to the log information;

[0123] The sixth determining module is configured to determine the code file corresponding to the target submission hash value according to the correspondence between the submission hash value and the code file.

[0124] Reference is now made to Figure 4, which illustrates a schematic diagram of the structure of an electronic device 400 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, computers and laptops. The electronic device illustrated in Figure 4 is merely an example and should not limit the functionality or scope of use of the embodiments of the present disclosure.

[0125] As shown in Figure 4, electronic device 400 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 into a random access memory (RAM) 403. Various programs and data required for the operation of electronic device 400 are also stored in RAM 403. Processing device 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to bus 404.

[0126] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. Although FIG4 shows the electronic device 400 with various devices, it should be understood that not all of the devices shown are required to be implemented or present. More or fewer devices may alternatively be implemented or present.

[0127] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0128] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a solid-state drive, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0129] In some embodiments, electronic devices can communicate using any currently known or later developed network protocol, such as HTTP, and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or later developed network.

[0130] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0131] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to the recording operation of the remote code repository operation log, obtains the log information corresponding to the recording operation; determines whether there is an operation of pushing a code file to the remote code repository based on the log information; when it is determined that there is an operation of pushing a code file to the remote code repository, obtains the address of the remote code repository to which the code file is pushed; determines whether the operation of pushing to the remote code repository complies with the security operation based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation pushed to the remote code repository.

[0132] The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0133] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0134] The modules described in the embodiments of the present disclosure may be implemented in software or hardware, wherein the name of a module does not necessarily limit the module itself.

[0135] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0136] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0137] The description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the present disclosure is not limited to technical solutions formed by a specific combination of the aforementioned technical features, but also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents without departing from the aforementioned disclosed concepts. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0138] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0139] Although the subject matter has been described using language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims. Regarding the apparatus in the above-described embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments related to the method and will not be elaborated upon here.

Claims

1. A code operation behavior detection method, comprising: In response to a recording operation of a remote code repository operation log, obtaining log information corresponding to the recording operation; Determine whether there is an operation of pushing a code file to a remote code repository according to the log information; When it is determined that there is an operation of pushing a code file to the remote code repository, obtaining an address of the remote code repository to which the code file is pushed; According to the address of the remote code repository and a pre-configured platform identification policy, determine whether the operation pushed to the remote code repository complies with the security operation; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation pushed to the remote code repository.

2. The code operation behavior detection method according to claim 1, wherein: When it is determined that the operation of pushing to the remote code repository does not comply with a safe operation, the code operation behavior detection method further includes: Determining whether the code file belongs to a designated protected code file according to the file attribute information of the code file and a pre-configured file identification strategy; When it is determined that the code file belongs to the designated protected code file, information indicating that there is a risk of externally sending the designated protected code file is generated.

3. The code operation behavior detection method according to claim 1 or 2, further comprising: When it is determined that the operation of pushing the code file to the remote code repository does not comply with a safe operation, a violation operation record is generated, where the violation operation record is used to record an unsafe behavior of pushing the code file to the remote code repository.

4. The code operation behavior detection method according to claim 2 or 3, wherein: The pre-configured file identification strategy includes at least one attribute information of the specified file content to be protected, file type, file name, and file size.

5. The code operation behavior detection method according to any one of claims 1 to 4, wherein: The pre-configured platform identification policy includes a code hosting platform whitelist address, and the code hosting platform whitelist address is used to indicate that an operation pushed to a code hosting platform address outside the whitelist address does not comply with a safe operation; or; The pre-configured platform identification policy includes a code hosting platform blacklist address, and the code hosting platform blacklist address is used to indicate that an operation pushed to a code hosting platform address on the blacklist address does not comply with a safe operation.

6. The code operation behavior detection method according to any one of claims 1 to 5, further comprising: When a file write operation is detected on the operating system, a file write path associated with the file write operation is obtained; When the file writing path includes a preset designated path, it is determined that a recording operation of the code repository operation log occurs, wherein the preset designated path represents a storage path feature of the code repository operation log.

7. The code operation behavior detection method according to claim 6, wherein: The obtaining the address of the remote code repository to which the code file is pushed includes: Determine the local code repository according to the file writing path; The address of the remote code repository is determined according to the configuration file in the local code repository.

8. The code operation behavior detection method according to any one of claims 1 to 7, wherein: When it is determined that there is an operation of pushing the code file to the remote code repository, obtaining the address of the remote code repository to which the code file is pushed includes: When it is determined that there is an operation of pushing a code file to the code repository, obtaining an operation time corresponding to the operation according to the log information; When the difference between the operation time and the current time is less than a preset duration, an address of a remote code repository to which the code file is pushed is obtained.

9. The code operation behavior detection method according to any one of claims 1 to 8, further comprising: Determine the target submission hash value corresponding to the operation according to the log information; According to the correspondence between the submitted hash value and the code file, determine the corresponding target submitted hash value The code file should be 10. A code operation behavior detection device, comprising: A first acquisition module is configured to, in response to a recording operation of a remote code repository operation log, obtain log information corresponding to the recording operation; A first determination module is configured to determine whether there is an operation of pushing a code file to a remote code repository according to the log information; A second acquisition module is configured to, when determining that there is an operation of pushing a code file to the remote code repository, acquire an address of the remote code repository to which the code file is pushed; The second determination module is configured to determine whether the operation pushed to the remote code repository complies with the security operation based on the address of the remote code repository and a pre-configured platform identification policy; wherein the pre-configured platform identification policy is used to indicate the security scope of the operation pushed to the remote code repository.

11. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processing device, the steps of the code operation behavior detection method described in any one of claims 1 to 9 are implemented.

12. An electronic device comprising: a storage device having a computer program stored thereon; A processing device, used to execute the computer program in the storage device to implement the steps of the code operation behavior detection method described in any one of claims 1-9.

Images