WO2020062980A1

WO2020062980A1 - File access tracking method, device, storage medium and terminal

Info

Publication number: WO2020062980A1
Application number: PCT/CN2019/093511
Authority: WO
Inventors: 周明君; 方攀; 陈岩
Original assignee: 上海瑾盛通信科技有限公司
Priority date: 2018-09-26
Filing date: 2019-06-28
Publication date: 2020-04-02
Also published as: CN110955631B; CN110955631A

Abstract

A file access tracking method, device, storage medium and terminal. The method comprises: when a preset file access event is triggered, determining whether a preset program code written on the basis of a preset virtual machine is present before a function to be called corresponding to the preset file access event in a kernel space (110); in response to the determination result that a preset program code written on the basis of a preset virtual machine is present, by means of the preset program code, acquiring file access information corresponding to the function to be called (120); storing the file access information by using a storage format corresponding to the preset virtual machine for user space reading (130).

Description

File access tracking method, device, storage medium and terminal

This application claims priority from a Chinese patent application filed with the Chinese Patent Office on September 26, 2018, with an application number of 201811126366.8, the entire contents of which are incorporated herein by reference.

Technical field

The embodiments of the present application relate to the technical field of terminals, for example, to a method, a device, a storage medium, and a terminal for tracking file access.

Background technique

A lot of data or information is stored in the form of files. In the operating system of the terminal, one or more types of files are accessed frequently. How to optimize file access is an important part of the system optimization topic.

When researching the optimization of file access, it is usually necessary to track the file access to understand the relevant information when the file is accessed. However, the file tracking solution in related technologies is still not perfect and needs to be improved.

Summary of the Invention

The embodiments of the present application provide a file access tracking method, device, storage medium, and terminal, which can optimize a file access tracking scheme.

In an embodiment, an embodiment of the present application provides a file access tracking method, including:

If a preset file access event is triggered, determining whether there is a preset program code written based on a preset virtual machine in a kernel space before a function to be called corresponding to the preset file access event;

Responding to the judgment result of the preset program code written based on the preset virtual machine, obtaining file access information corresponding to the function to be called through the preset program code;

The file access information is stored in a storage format corresponding to the preset virtual machine for user space reading.

In an embodiment, an embodiment of the present application provides a file access tracking device, including:

A judging module configured to judge whether a preset program code written based on a preset virtual machine exists in a kernel space before a function to be called corresponding to the preset file access event is triggered when a preset file access event is triggered;

The access information acquisition module is configured to acquire file access information corresponding to the function to be called through the preset program code in response to a judgment result of the preset program code written based on the preset virtual machine;

The access information storage module is configured to store the file access information in a storage format corresponding to the preset virtual machine for user space to read.

In an embodiment, a computer-readable storage medium is provided in the embodiment of the present application, and a computer program is stored on the computer program. When the computer program is executed by the processor, the file access tracking method according to the embodiment of the present application is implemented.

In an embodiment, an embodiment of the present application provides a terminal, including a memory, a processor, and a computer program stored in the memory and executable by the processor. When the processor executes the computer program, the implementation is as in the present application The file access tracking method according to the embodiment.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flowchart of a file access tracking method according to an embodiment of the present application;

2 is a schematic flowchart of another file access tracking method according to an embodiment of the present application;

3 is a schematic flowchart of another file access tracking method according to an embodiment of the present application;

4 is a structural block diagram of a file access tracking device according to an embodiment of the present application;

5 is a schematic structural diagram of a terminal according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of still another terminal provided by an embodiment of the present application.

detailed description

The technical solutions of the present application will be further described below with reference to the accompanying drawings and specific embodiments. The specific embodiments described herein are used to explain the present application, rather than limiting the present application. For ease of description, only some, but not all, structures related to the present application are shown in the drawings.

Some exemplary embodiments herein are described as processes or methods depicted as flowcharts. Although flowcharts describe multiple steps as sequential processing, many of these steps can be performed in parallel, concurrently, or simultaneously. In addition, the order of one or more steps may be rearranged. The process may be terminated when its operation is completed, but may also have additional steps not included in the drawings. The processing may correspond to methods, functions, procedures, subroutines, subroutines, and so on.

FIG. 1 is a schematic flowchart of a file access tracking method according to an embodiment of the present application. The method may be performed by a file access tracking device, where the device may be implemented by software and / or hardware, and may generally be integrated in a terminal. As shown in Figure 1, the method includes:

Step 110: When a preset file access event is triggered, determine whether there is a preset program code written based on a preset virtual machine in a kernel space before a function to be called corresponding to the preset file access event.

Exemplarily, the terminal in the embodiment of the present application may include a device provided with an operating system, such as a mobile phone, a tablet computer, a notebook computer, a computer, and a smart home appliance.

The type of the operating system is not limited in the embodiments of the present application, and may include, for example, an Android operating system, a Windows operating system, and an Apple operating system. For ease of description, the embodiments of this application will take the Android operating system as an example for subsequent description. In the terminal's Android operating system, access to one or more types of files is very frequent. How to optimize file access is an important part of the system optimization topic. In related technologies, classification is generally based on existing features provided by file systems such as file names or types (such as text or pictures). However, this classification is relatively simple and crude, and is not accurate in many scenarios, such as two different The text may be used in different ways. For example, the use may include the access order (such as reading from the beginning of the file to the end of the file is an access order, and reading from the middle of the file to the end of the file is another access order). If you can track file access in real time, you can classify files more accurately. For real-time tracking of file access, the solutions in related technologies generally place a large burden on the system and easily affect the stability of the system, which needs to be improved.

Exemplarily, the purpose of file access tracking can be achieved by tracking the kernel information of file access. Linux kernel-level tracing frameworks like ftrace are generally used. The earliest ftrace is a function tracer, which can only record the function call process of the kernel. Now ftrace has developed into a framework, which can be used to support developers to add more kinds of traces (plugin). The trace) function helps developers understand the runtime behavior of the Linux kernel for fault debugging or performance analysis. Therefore, it can be used to trace kernel information for file access. However, when using a tracing framework such as ftrace for file access tracing, the collected information is written into a ring buffer (ring buffer), and the information cannot be filtered or counted during the collection process. When collecting kernel information Only the information in the kernel standard format can be obtained, resulting in a large amount of collected information, and the storage space in the ring buffer is limited. In order to prevent information loss, user space programs will continuously read the content in the ring buffer, and then in the user The space performs operations such as filtering, calculation or statistics on the read information. In this way, a large amount of kernel space and user space interactions will be generated, and user space programs will occupy a large number of processors, such as central processing unit (CPU) resources. In addition, if you want to collect other types of information than the standard format information of the kernel, you need to insert the corresponding code in the kernel. Inserting code into the kernel based on architectures such as ftrace will cause exceptions such as kernel crashes, reduce system stability, and lead to development. The cycle is long and it is difficult to integrate in the actual mass production system.

In the embodiment of the present application, file access tracking may be implemented based on a preset virtual machine implemented in a kernel space. Exemplarily, the preset file access event may include at least one of a file read, a file write, a file synchronization (fsync), and a file data synchronization (fdatasync). Among them, read means reading the file; write means writing the file; fsync means synchronizing all the modified file data in the memory to the storage device. In addition to synchronizing the modified content (dirty pages) of the file, fsync also synchronizes the file's description information (metadata (metadata), including size (size), access time and modification time (st_atime & st_mtime), etc .; fdatasync means refreshing data to disk. fdatasync functions similarly to fsync, but only synchronizes metadata if necessary, so you can Reduce one input / output (IO) write operation. Of course, other file access events may also be included, and the types or names of file access events may be different in different operating systems, and those skilled in the art may make adaptive selections according to the actual operating system used.

For many operating systems, the kernel is generally implemented based on Linux, and the bottom layer of the system is generally the Linux kernel (Linux Kernel). The system divides the kernel space and user space. Different operating systems may have different division methods or division results. User space generally refers to the memory area where the user process is located. Application programs run in user space, and user process data is stored in user space. Kernel space is the memory area occupied by the operating system. The operating system and drivers run in kernel space. The operating system The data is stored in the system space. In this way, user data and system data can be isolated to ensure system stability. In general, user space and kernel space interact through system calls. System calls can be understood as a set of all system calls provided by the operating system implementation, that is, a program interface or application programming interface (Application Programming Interface, API). ) Is the interface between the application and the system. The function of the operating system is to manage hardware resources and provide a good environment for application developers to make applications more compatible. In order to achieve this purpose, the kernel provides a series of multi-kernel functions with predetermined functions. An interface called a system call is presented to the user. The system call passes the application's request to the kernel, calls the corresponding kernel function to complete the required processing, and returns the processing result to the application.

In the embodiment of the present application, when an application program accesses a file, the kernel space is accessed through a system call, that is, the corresponding system call interface is called to access the kernel space. Therefore, a system call corresponding to a preset file access event may be used. Whether the interface is called to determine whether the preset file access event is triggered. If it is called, the preset file access event may be considered to be triggered.

Exemplarily, after calling a corresponding system call interface, a corresponding function in the kernel space is also called to implement file access, and the corresponding function may be called a function to be called. Taking the aforementioned read, write, fsync, and fdatasync as examples, each preset file access event corresponds to a corresponding function to be called, and is used to implement functions of reading a file, writing a file, synchronizing a file, and synchronizing file data. The specific implementation form of the function may be different in different operating systems, which are not limited in the embodiments of the present application.

In the embodiment of the present application, a preset program code writing method based on a preset virtual machine may be used in advance, and a preset program code is inserted before a function to be called in the kernel space, and the preset program code is used to obtain file access information. In this way, when the preset file access event is triggered, it can be determined whether there is a preset program code written based on the preset virtual machine, and then it is determined whether the preset program code is executed first or the code corresponding to the function to be called is directly executed. Inserting the preset program code based on the preset virtual machine can ensure the stability of the system.

Step 120: In response to a judgment result that the preset program code written based on the preset virtual machine exists, obtain file access information corresponding to the function to be called through the preset program code.

For example, when it is determined that a preset program code exists, the preset program code may be executed first, and then the function to be called is executed, and the preset program code is used to access file-related information when the function to be called is executed. This information is obtained, which is referred to as file access information in the embodiments of the present application. The file access information may include detailed information reflecting the file access process, such as what files are accessed, where the files are stored, attribute information of the files, and specific access methods, etc. Optionally, the file access information includes offset information, where the offset information is used to indicate a file access location. The access location of the file can include, for example, the location where the access starts and the location where the access ends. When accessing a file, it may not access all the content in the file, and it may access only a part of the content. According to the offset information, you can know the specific What content in the file was accessed, whether it was sequential access, reverse access, skip access, etc. In addition, the file access information may further include at least one of a file name, a file path, and a file size.

Step 130: Store the file access information in a storage format corresponding to the preset virtual machine for user space reading.

In the embodiment of the present application, the obtained file access information is stored by using a preset storage format corresponding to the virtual machine, instead of storing in a kernel standard format, which can save storage space. The user space does not need to read the file access information constantly, but can read the required file access information on a regular basis or at a time when required, which can effectively reduce the number of interactions between kernel space and user space. The preset storage format of the virtual machine reduces the amount of read information and transmission, so the amount of interactive data is also reduced, thereby reducing the burden of file access tracking on the system and improving system stability.

In the file access tracking method provided in the embodiment of the present application, when a preset file access event is triggered, if it is determined that a function to be called corresponding to the preset file access event exists in a kernel space, there is a preset program written based on a preset virtual machine. Code, the file access information corresponding to the function to be called is obtained through the preset program code, and the file access information is stored in a preset storage format corresponding to the virtual machine for user space reading. By adopting the above technical solution, based on a preset virtual machine implemented in the kernel space, a preset program code can be inserted before a function to be called corresponding to a preset file access event in the kernel space, and the preset program code can be used to obtain and Storing file access information for user space reading can reduce the interaction between kernel space and user space, reduce the burden of file access tracking on the system, and improve system stability.

In some embodiments, before the determining whether a function to be called corresponding to the preset file access event in the kernel space exists, the preset program code written based on the preset virtual machine includes determining a virtual file in the kernel space. In the system layer, whether a preset program code written based on a preset virtual machine exists at a starting position of a function to be called corresponding to the preset file access event. The advantage of this setting is that it does not destroy existing code in kernel space. The virtual file system layer can be understood as a file abstraction layer. The function to be called for implementing file access is generally in this layer. A program based on a preset virtual machine can be written at the starting position of the function to be called, and used to In order to obtain file access information, the timing and location of determining whether a preset program code exists is more clear, and the preset program code can be successfully executed.

In some embodiments, acquiring the file access information corresponding to the function to be called by using the preset program code includes: acquiring function parameter content and / or the function to be called by using the preset program code. Content of the kernel data structure corresponding to the function to be called; and determining file access information corresponding to the function to be called according to the function parameter content and / or the content of the kernel data structure. The advantage of this setting is that it can successfully and accurately obtain file access information. When the function to be called is executed, some file access information will exist in the function parameters, such as file path, file size, or offset information, and some may exist in corresponding kernel data structures, such as file names. Among them, the existing form is not limited. After obtaining the content of the function parameters or the content of the kernel data structure, it may be necessary to perform conversion to obtain the finally required file access information.

In some embodiments, the preset virtual machine includes an extended Berkeley Packet Filter (eBPF), and a storage format corresponding to the preset virtual machine includes a hash table. eBPF is a set of virtual machines implemented in the kernel. It was originally designed to filter network packets. Now it has the ability to insert and execute virtual machine code anywhere in the kernel, and generally inserts virtual machine code. A large number of tests will be performed before to ensure that the stability of the system will not be affected. The storage format specified in eBPF includes a hash table (Hash table). A hash table is also called a hash table. It is a data structure that is directly accessed according to a key value (key value). It maps key values to A place in the table to access records to speed up lookups. The advantage of this setting is that it can further ensure system stability and reduce interaction between kernel space and user space.

In some embodiments, storing the file access information by using a storage format corresponding to the preset virtual machine includes: using a file identifier corresponding to the file access information as a key value of a hash table, The file access information is stored, wherein the file identifier includes a device number to which the file belongs and an i-node of the file. The advantage of this setting is that the file access information can be stored concisely and accurately, and it is convenient to query. The device number may be understood as a label of a hardware or software partition in the terminal, such as a label of a data area, a system area, and a memory card area. Inodes can be used to identify files. There may be files with the same index node in two different device numbers. Therefore, in the embodiment of the present application, the device number and the inode number may be combined as a key value and stored in the hash table.

In some embodiments, before the storing the file access information by using the storage format corresponding to the preset virtual machine, the method further includes: obtaining a preset hash table, where the preset hash table is The user space is passed to the kernel space, and filter condition information is stored in the preset hash table; and the file access information is filtered according to the filter condition information in the preset hash table. In an embodiment, the storing the file access information by using the storage format corresponding to the preset virtual machine includes storing the filtered file access information by using the storage format corresponding to the preset virtual machine. . Among them, filtering can be forward filtering or reverse filtering. The advantage of this setting is that before the file access information is stored, it can be selectively filtered to further reduce the storage amount. In addition, the preset hash table is passed from user space to kernel space, which allows users to set the preset hash table by themselves, such as selecting an application or a file under a path that they care about as filter condition information. Instruct kernel space to filter out file access information corresponding to these files for storage. Exemplarily, the application name or path can be used as the key value, and the filtering method can be used as the corresponding storage content (such as reserved or filtered out). Alternatively, the filtering method can be used as the key value, and the application name or path can be used as the corresponding Store content and more. For example, optionally, in some embodiments, it may further include: receiving a filtering condition setting operation through user space, and generating a preset hash table according to the filtering condition setting operation; User space is passed to the kernel space.

In some embodiments, after storing the file access information in a storage format corresponding to the preset virtual machine for reading in user space, the method further includes: upon receiving the preset reading in the user space. When requested, a hash table storing file access information is queried according to the preset read request, and the query result is fed back to the user space. The advantage of this setting is that user space can send preset read requests to kernel space at any time or periodically according to its own wishes, and the kernel space completes the query, instead of user space reading the entire hash table that stores file access information and Querying by yourself can further reduce the amount of interactive data between user space and kernel space, and reduce the load on the system caused by trace file access. Optionally, after the query result is fed back to the user space, further operations such as analysis or statistics on the query result may be performed in the user space. For example, analyze the files that are read more frequently, and focus on these files as hot files; for example, analyze the access order of multiple files, which type of files are accessed from beginning to end, and which types of files Use random access to analyze user's file access habits.

FIG. 2 is a schematic flowchart of another file access tracking method according to an embodiment of the present application. Taking a preset virtual machine as an eBPF as an example, the method includes the following steps:

Step 201: It is detected that a preset file access event is triggered.

Exemplarily, whether a preset file access event is triggered may be determined according to whether a system call interface corresponding to the preset file access event is called. If it is called, the preset file access event may be considered to be triggered. The preset file access events may include read, write, fsync, and fdatasync.

Step 202: Determine whether there is a preset program code written based on eBPF at the start position of the function to be called corresponding to the preset file access event in the virtual file system layer in the kernel space, and if yes, perform step 203; Otherwise, go to step 207.

Exemplarily, assuming that the current preset file access event is read, the corresponding function to be called may be a vfs_read function, etc., and the function prototype may be ssize_t vfs_read (struct file * file, char__user * buf, size_t count, loff_t * pos).

Step 203: Obtain the content of the function parameters corresponding to the function to be called and the content of the kernel data structure corresponding to the function to be called through the preset program code.

For example, the preset program code can be executed first, and then the function to be called is executed. Some file access information may exist in the function parameters, and some may exist in the corresponding kernel data structure. Therefore, the preset program code may be used. Obtain the contents of function parameters and kernel data structures involved in the execution of the called function.

Step 204: Determine file access information corresponding to the function to be called according to the content of the function parameters and the content of the kernel data structure.

The file access information may include file name, path, size, and offset information, and the offset information is used to indicate a file access location.

For example, from the above vfs_read function, it can be seen that the parameter buf points to a memory address in user space, so that the file path in the file access information can be obtained. Through the acquisition of function parameter content and kernel data structure content, the above file access information can be obtained comprehensively. After obtaining the content of the function parameters or the content of the kernel data structure, it may need to be converted to obtain the file access information ultimately required. For example, some kernel data structures may have file descriptions or numbers used to indicate file names. There is a one-to-one correspondence between file descriptions or numbers and file names, so they can be converted to the required file names.

Step 205: Use the file identifier corresponding to the file access information as a key value of the hash table to store the file access information.

The file identifier includes a device number to which the file belongs and an i-node of the file. The device number and the i-node can be combined into a continuous string to form a key value of the hash table.

Step 206: When a preset read request from the user space is received in the kernel space, a hash table storing file access information is queried according to the preset read request, and the query result is fed back to the user space.

Step 207: Execute the function to be called.

Exemplarily, if there is no preset program code at the starting position of the function to be called, then it can be shown that the current file access event is not concerned, and there is no need to track the file access and obtain the corresponding File access information, you can directly execute the function to be called.

The file access tracking method provided by the embodiment of the present application utilizes the eBPF framework to implement real-time file access statistics in the kernel, and inserts an eBPF program at the starting position of the function to be called to implement file access information acquisition and stores in In the hash table, when a preset read request in the user space is received, the kernel space queries the hash table according to the preset read request, and feeds back the query result to the user space. Practice has proved that the amount of each transmission can be reduced to tens of KB. It can be seen that by using the solution provided in the embodiments of the present application, the interaction between the kernel space and the user space can be effectively reduced, the burden of the file access tracking on the system, and the system stability can be improved. .

FIG. 3 is a schematic flowchart of another file access tracking method according to an embodiment of the present application. The method includes:

Step 301: Receive a filtering condition setting operation through user space, and generate a first hash table according to the filtering condition setting operation.

For example, the file tracking setting interface may be displayed to the user in the terminal, and the user may enter a filtering condition setting operation based on the setting interface, such as selecting an application or a storage path that he or she cares about as a target application or a target storage path. The user space generates a first hash table according to the filtering condition setting operation input by the user, and is used to instruct the kernel space to track the files in the target application or the files in the target storage path in real time.

Step 302: Pass the first hash table from user space to kernel space.

Step 303: It is detected that a preset file access event is triggered.

Step 304: In the virtual file system layer in the kernel space, a preset program code written based on eBPF is detected at a start position of a function to be called corresponding to a preset file access event.

Step 305: Obtain the content of the function parameters corresponding to the function to be called and the content of the kernel data structure corresponding to the function to be called through the preset program code.

Step 306: Determine file access information corresponding to the function to be called according to the content of the function parameters and the content of the kernel data structure.

Step 307: Filter the file access information according to the filter condition information in the first hash table.

For example, it can be determined whether the file corresponding to the current file access information belongs to the target application (or whether it is in the target path). If so, it indicates that the file access needs to be tracked and the current file access information can be retained; if not , It means that there is no need to track file access, and the current file access information can be ignored, that is, filtering is performed.

Step 308: Use the file identifier corresponding to the filtered file access information as a key value of the hash table, store the filtered file access information, and obtain a second hash table.

The file identifier includes a device number to which the file belongs and an i-node of the file. The device number and the i-node can be combined into a continuous string to form a key value of the second hash table.

Step 309: When a preset read request from the user space is received in the kernel space, a second hash table is queried according to the preset read request, and the query result is fed back to the user space.

The file access tracking method provided by the embodiment of the present application can pre-set the files that need to be tracked by the user. After the file access information is obtained through the eBPF program in the kernel space, the corresponding filtering is performed according to the user's settings and then stored in In the hash table, not only can the storage amount be further reduced, but the pertinence and personalization of file access tracking can be enhanced. When the user space needs to read the file access information, the interaction between the kernel space and the user space can be further reduced. Magnitude of file tracking facilitates deployment to mass production systems.

FIG. 4 is a structural block diagram of a file access tracking device according to an embodiment of the present application. The device may be implemented by software and / or hardware, and is generally integrated in a terminal. File access tracking may be performed by executing a file access tracking method. As shown in Figure 4, the device includes:

The judging module 401 is configured to judge whether a preset program code written based on a preset virtual machine exists in a kernel space before a function to be called corresponding to the preset file access event is triggered when a preset file access event is triggered. ;

The access information acquisition module 402 is configured to acquire the file access information corresponding to the function to be called through the preset program code when the judgment result of the judgment module is present;

The access information storage module 403 is configured to store the file access information in a storage format corresponding to the preset virtual machine for user space to read.

In the file access tracking device provided in the embodiment of the present application, when a preset file access event is triggered, if it is determined that a function to be called corresponding to the preset file access event exists in a kernel space, there is a preset program written based on a preset virtual machine. Code, the file access information corresponding to the function to be called is obtained through the preset program code, and the file access information is stored in a preset storage format corresponding to the virtual machine for user space reading. By adopting the above technical solution, based on a preset virtual machine implemented in the kernel space, a preset program code can be inserted before a function to be called corresponding to a preset file access event in the kernel space, and the preset program code can be used to obtain and Storing file access information for user space reading can reduce the interaction between kernel space and user space, reduce the burden of file access tracking on the system, and improve system stability.

In one embodiment, the determining module 401 is configured to:

It is determined whether a preset program code written based on a preset virtual machine exists in a virtual file system layer in kernel space at a starting position of a function to be called corresponding to the preset file access event.

Optionally, the file access information includes offset information, where the offset information is used to indicate a file access location.

In one embodiment, the access information acquisition module 402 is configured to:

Obtaining the function parameter content corresponding to the function to be called and / or the kernel data structure content corresponding to the function to be called through the preset program code;

Determine file access information corresponding to the function to be called according to the function parameter content and / or the kernel data structure content.

Optionally, the preset virtual machine includes an extended Berkeley packet filter eBPF, and the storage format corresponding to the preset virtual machine includes a hash table.

In an embodiment, the access information storage module 403 is configured to:

The file identification information corresponding to the file access information is used as a key value of the hash table to store the file access information, where the file identification includes a device number to which the file belongs and an index node of the file.

Optionally, the device further includes:

The preset hash table acquisition module is configured to obtain a preset hash table before storing the file access information in the storage format corresponding to the preset virtual machine, wherein the preset hash table The user space is passed to the kernel space, and filter condition information is stored in the preset hash table.

The filtering module is configured to filter the file access information according to the filtering condition information in the preset hash table.

In an embodiment, the access information storage module 403 is configured to:

The filtered file access information is stored in a storage format corresponding to the preset virtual machine.

Optionally, the device further includes:

The query result feedback module is configured to receive the user space preset in the kernel space after storing the file access information in a storage format corresponding to the preset virtual machine for reading by the user space. When a read request is made, a hash table storing file access information is queried according to the preset read request, and the query result is fed back to the user space.

Optionally, the device may further include:

A preset hash table generating module configured to receive a filtering condition setting operation through user space, and generate a preset hash table according to the filtering condition setting operation;

The preset hash table transfer module is configured to transfer the preset hash table from the user space to the kernel space.

An embodiment of the present application further provides a storage medium including computer-executable instructions, which are used to execute a file access tracking method when executed by a computer processor, and the method includes:

If the preset program code written based on the preset virtual machine exists, obtaining file access information corresponding to the function to be called through the preset program code;

Storage medium-any one or more types of memory devices or storage devices. The term "storage medium" is intended to include: installation media, such as Compact Disc Read-Only Memory (CD-ROM), floppy disks or magnetic tape devices; computer system memory or random access memory, such as dynamic random access memory Access Memory (Dynamic Random Access Memory, DRAM), Double-Rate Random Access Memory (Double Random Access Memory, DDRRAM), Static Random Access Memory (Static Random-Access Memory, SRAM), extended data output random storage Access memory (Extended Data Output Random Access Memory (EDORAM), Rambus Random Access Memory (Rambus Random Access Memory, Rambus RAM), etc .; non-volatile memory such as flash memory, magnetic media (such as hard disk or optical storage) Registers or other similar types of memory elements, etc. The storage medium may further include other types of memory or a combination thereof. In addition, the storage medium may be located in a first computer system in which the program is executed, or may be located in a different second computer system connected to the first computer system through a network such as the Internet. The second computer system may provide program instructions to the first computer, and the first computer is configured to execute the program instructions. The term "storage medium" may include two or more storage media that may reside in different locations, such as in different computer systems connected through a network. The storage medium may store program instructions (for example, embodied as a computer program) executable by one or more processors.

Certainly, a storage medium including computer-executable instructions provided in the embodiments of the present application is not limited to the file access tracking operation described above, and can also perform the file access tracking provided by any embodiment of the application. Related operations in the method.

The embodiment of the present application provides a terminal, and the terminal may integrate the file access tracking device provided by the embodiment of the present application. FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present application. The terminal 500 may include: a memory 501, a processor 502, and a computer program stored on the memory 501 and executable on the processor 502. When the processor 502 executes the computer program, file access as described in the embodiments of the present application is implemented. Tracking method.

The terminal provided in the embodiment of the present application may be based on a preset virtual machine implemented in the kernel space, insert a preset program code before a function to be called corresponding to a preset file access event in the kernel space, and use the preset program code. Obtaining and storing file access information for user space reading can reduce the interaction between kernel space and user space, reduce the burden of file access tracking on the system, and improve system stability.

FIG. 6 is a schematic structural diagram of another terminal provided by an embodiment of the present application. The terminal may include: a housing (not shown in the figure), a memory 601, a central processing unit (CPU) 602 (also referred to as processing). Device), a circuit board (not shown in the figure), and a power supply circuit (not shown in the figure). The circuit board is disposed in a space surrounded by the housing; the CPU 602 and the memory 601 are disposed on the circuit board; and the power supply circuit is configured to supply power to each circuit or device of the terminal The memory 601 is configured to store executable preset program code; the CPU 602 runs a computer program corresponding to the executable preset program code by reading the executable preset program code stored in the memory 601 To achieve the following steps:

If there is a preset program code written based on a preset virtual machine, obtaining file access information corresponding to the function to be called through the preset program code;

The terminal further includes: a peripheral interface 603, a radio frequency (RF) circuit 605, an audio circuit 606, a speaker 611, a power management chip 608, an input / output (I / O) subsystem 609, and other The input / control device 610, the touch screen 612, other input / control devices 610, and the external port 604, these components communicate through one or more communication buses or signal lines 607.

It should be understood that the illustrated terminal 600 is only an example of the terminal, and the terminal 600 may have more or fewer components than those shown in the figure, may combine two or more components, or may have Different component configurations. The one or more components shown in the figures may be implemented in hardware, software, or a combination of hardware and software including one or more signal processing and / or application specific integrated circuits.

The terminal for file access tracking provided in this embodiment is described in detail below. The terminal uses a mobile phone as an example.

Memory 601, which can be accessed by CPU602, peripheral interface 603, etc. The memory 601 can include high-speed random access memory, and can also include non-volatile memory, such as one or more disk storage devices, flash memory devices , Or other volatile solid-state storage devices.

Peripheral interface 603, which can connect the input and output peripherals of the device to the CPU 602 and the memory 601.

I / O subsystem 609, which can connect input / output peripherals on the device, such as touch screen 612 and other input / control devices 610, to peripheral interface 603. The I / O subsystem 609 may include a display controller 6091 and one or more input controllers 6092 for controlling other input / control devices 610. Among them, one or more input controllers 6092 receive electrical signals from or send electrical signals to other input / control devices 610. Other input / control devices 610 may include physical buttons (press buttons, rocker buttons, etc.) ), Dial, slide switch, joystick, click wheel. It is worth noting that the input controller 6092 can be connected to any of the following: a keyboard, an infrared port, a USB interface, and a pointing device such as a mouse.

A touch screen 612, which is an input interface and an output interface between a user terminal and a user, and displays a visual output to the user. The visual output may include graphics, text, icons, videos, and the like.

The display controller 6091 in the I / O subsystem 609 receives electrical signals from the touch screen 612 or sends electrical signals to the touch screen 612. The touch screen 612 detects a contact on the touch screen, and the display controller 6091 converts the detected contact into interaction with a user interface object displayed on the touch screen 612, that is, realizes human-computer interaction. The user interface object displayed on the touch screen 612 may be an operation Icons for games, icons connected to the appropriate network, etc. In an embodiment, the device may further include a light mouse, which is a touch-sensitive surface that does not display a visible output, or an extension of the touch-sensitive surface formed by a touch screen.

The RF circuit 605 is configured to establish communication between the mobile phone and the wireless network (that is, the network side), and realize data reception and transmission of the mobile phone and the wireless network. For example, send and receive text messages, e-mail, and so on. In an embodiment, the RF circuit 605 receives and sends RF signals. The RF signals are also referred to as electromagnetic signals. The RF circuit 605 converts electrical signals into electromagnetic signals or converts electromagnetic signals into electrical signals, and communicates with the communication network through the electromagnetic signals. As well as other devices. RF circuit 605 may include known circuits for performing these functions, including but not limited to antenna systems, RF transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, codec (COder-DECoder, CODEC) chipset, Subscriber Identity Module (SIM), and so on.

The audio circuit 606 is configured to receive audio data from the peripheral interface 603, convert the audio data into an electrical signal, and send the electrical signal to the speaker 611.

The speaker 611 is configured to restore a voice signal received by the mobile phone from the wireless network through the RF circuit 605 to a sound and play the sound to a user.

The power management chip 608 is configured to provide power and power management for the hardware connected to the CPU 602, the I / O subsystem 609, and the peripheral interface 603.

The file access tracking device, storage medium, and terminal provided in the foregoing embodiments can execute the file access tracking method provided by any embodiment of the present application, and have corresponding function modules and effects for executing the method. For technical details not described in detail in the foregoing embodiments, reference may be made to a file access tracking method provided in any embodiment of the present application.

Claims

A file access tracking method includes:

If a preset file access event is triggered, determining whether there is a preset program code written based on a preset virtual machine in a kernel space before a function to be called corresponding to the preset file access event;

Responding to the judgment result of the preset program code written based on the preset virtual machine, obtaining file access information corresponding to the function to be called through the preset program code;

The file access information is stored in a storage format corresponding to the preset virtual machine for user space reading.
The method according to claim 1, wherein, before the determining whether a function to be called corresponding to the preset file access event in the kernel space exists, a preset program code written based on a preset virtual machine comprises:

It is determined whether a preset program code written based on a preset virtual machine exists in a virtual file system layer in kernel space at a starting position of a function to be called corresponding to the preset file access event.
The method according to claim 1, wherein the file access information comprises offset information of a file, and wherein the offset information is used to indicate an access location of the file.
The method according to claim 1, wherein the acquiring file access information corresponding to the function to be called by the preset program code comprises:

Obtaining at least one of content of a function parameter corresponding to the function to be called and content of a kernel data structure corresponding to the function to be called through the preset program code;

Determine file access information corresponding to the function to be called according to at least one of the function parameter content and the kernel data structure content.
The method according to claim 1, wherein the preset virtual machine comprises an extended Berkeley packet filter eBPF, and the storage format corresponding to the preset virtual machine comprises a hash table.
The method according to claim 5, wherein the storing the file access information by using a storage format corresponding to the preset virtual machine comprises:

The file identification information corresponding to the file access information is used as a key value of the hash table to store the file access information, where the file identification includes a device number to which the file belongs and an index node of the file.
The method according to claim 5, before the storing the file access information by using the storage format corresponding to the preset virtual machine, further comprising:

Obtaining a preset hash table, wherein the preset hash table is passed from the user space to the kernel space, and the preset hash table stores filter condition information;

And filtering the file access information according to the filter condition information in the preset hash table.
The method according to claim 7, wherein the storing the file access information by using a storage format corresponding to the preset virtual machine comprises:

The filtered file access information is stored in a storage format corresponding to the preset virtual machine.
The method according to any one of claims 5-8, after storing the file access information in a storage format corresponding to the preset virtual machine for user space reading, further comprising:

In the case where the kernel space receives a preset read request of the user space, a hash table storing file access information is queried according to the preset read request, and the query result is fed back to the user space .
The method according to claim 3, wherein the file access information further comprises at least one of the following: a file name, a file path, and a file size.
The method according to claim 1, wherein the preset file access event comprises at least one of the following: file reading, file writing, file synchronization, and file data synchronization.
The method according to claim 1, wherein the preset file access event is triggered comprises:

In response to a system call interface corresponding to the preset file access event being called, it is determined that the preset file access event is triggered.
The method according to claim 1, wherein the acquiring file access information corresponding to the function to be called by the preset program code comprises:

After the preset program code is executed, the function to be called is executed, where the preset program code is used to obtain file access information when the function to be called is executed.
The method according to claim 7, wherein the obtaining a preset hash table comprises:

Receiving a filtering condition setting operation through the user space, and generating the preset hash table according to the filtering condition setting operation.
The method according to claim 9, after feeding the query result to the user space, further comprising:

Perform analysis or statistical operations on the query results in the user space.
The method according to claim 15, wherein the analyzing or statistical operation comprises: obtaining a file whose reading times exceed a set threshold, obtaining an access sequence of multiple files, a file type of sequential access, a file type of random access, and User access habits.
The method according to claim 7, wherein the filtering the file access information according to the filter condition information in the preset hash table comprises:

Determining whether a file corresponding to the file access information belongs to a target application;

Responsive to the judgment result that the file corresponding to the file access information belongs to the target application, retaining the file access information;

In response to a determination result that the file corresponding to the file access information does not belong to the target application, the file access information is filtered.
A file access tracking device includes:

A judging module, configured to judge whether a preset program code written based on a preset virtual machine exists in a kernel space before a function to be called corresponding to the preset file access event is triggered in a case where a preset file access event is triggered;

The access information acquisition module is configured to acquire file access information corresponding to the function to be called through the preset program code in response to a judgment result of the preset program code written based on the preset virtual machine;

The access information storage module is configured to store the file access information in a storage format corresponding to the preset virtual machine for user space to read.
A computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method according to any one of claims 1-17 is implemented.
A terminal includes a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the device implements any one of claims 1-17. The method described.