WO2020252698A1

WO2020252698A1 - Data flow tracking method and system, storage medium, and server

Info

Publication number: WO2020252698A1
Application number: PCT/CN2019/091919
Authority: WO
Inventors: 潘志祥; 万振华; 王颉
Original assignee: 深圳开源互联网安全技术有限公司
Priority date: 2019-06-19
Filing date: 2019-06-19
Publication date: 2020-12-24
Also published as: CN114127721A

Abstract

A data flow tracking method and system, a storage medium, and a server, the method comprising: obtaining request data; before responding to the request data, obtaining a function needed to be called when responding to the request data; determining, on the basis of the function, whether or not to trigger execution of a data flow tracking process; and if so, executing the data flow tracking process, and performing data flow tracking on the request data. The invention can prevent introduction of a large amount of unnecessary tracking logic code and reduce memory occupation, thereby reducing performance overheads and improving the efficiency of program operations.

Description

Data flow tracking method, system, storage medium and server

Technical field

The invention relates to the technical field of information security, in particular to a data stream tracking method, system, storage medium and server.

Background technique

Data flow tracking technology is a security technology widely used in the field of information security. In the data flow tracking technology, the use of taint analysis can more accurately monitor the information flow of the application during operation, such as tracking whether sensitive data is transmitted from the preset taint source to the preset security sensitive operation point. Stain analysis has been widely used in security research fields such as unknown vulnerability detection, malware analysis, and test case generation.

In the prior art, if the behavior of tainted data is to be tracked, in the specific implementation process, the instrumentation code needs to involve almost all data operations, that is, instrumentation is a wide range. In this case, a large amount of unnecessary tracking logic codes will be introduced into the execution of a normal program, occupying a large amount of memory, leading to a relatively large performance overhead and reducing the efficiency of program operation.

technical problem

The embodiments of the present invention provide a data flow tracking method, system, storage medium and server to solve the problem that in the prior art, large-scale instrumentation causes a large amount of unnecessary tracking logic codes to be introduced in the execution of a normal program, which takes up a lot of The memory, resulting in relatively large performance overhead, and the problem of reduced program operation efficiency.

Technical solutions

The first aspect of this application provides a data stream tracking method, including:

Get request data;

Before responding to the request data, obtain the function to be called when responding to the request data;

Determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data;

If it is determined that the execution of the data flow tracking process is triggered, the data flow tracking process is executed, and the data flow tracking is performed on the requested data.

The second aspect of the application provides a data stream tracking system, including:

Data acquisition unit for acquiring requested data;

The function determining unit is configured to obtain the function to be called in response to the request data before responding to the request data;

The data flow tracking judgment unit is configured to determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data;

The data flow tracking unit is configured to, if it is determined that the execution of the data flow tracking process is triggered, execute the data flow tracking process, and perform data flow tracking on the requested data.

A third aspect of the present application provides a server. The server includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the following steps when the processor executes the computer program:

Get request data;

A fourth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

Get request data;

The fifth aspect of the present application provides a computer program product. The computer program product includes a computer program. When the computer program is executed by one or more processors, the following steps are implemented:

Get request data;

Beneficial effect

In the embodiment of the present invention, by acquiring request data, before responding to the request data, the function to be called in response to the request data is acquired, and based on the function to be called in response to the request data, it is determined whether to trigger execution Data flow tracking process, if it is determined that the execution of the data flow tracking process is triggered, the data flow tracking process is executed, the data flow tracking is performed on the requested data, and the data flow tracking process is executed for all function calls, reducing the introduction of a large number of unnecessary The tracking logic code reduces memory usage, thereby reducing performance overhead and improving the efficiency of program operation.

Description of the drawings

In order to explain the technical solutions in the embodiments of the present invention more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only of the present invention. For some embodiments, for those of ordinary skill in the art, other drawings can be obtained from these drawings without creative labor.

FIG. 1 is an implementation flowchart of a data flow tracking method provided by an embodiment of the present invention;

2 is a schematic flowchart of a process for determining whether to trigger execution of data tracking according to an embodiment of the present invention;

Figure 3 is a structural block diagram of a data flow tracking system provided by an embodiment of the present invention;

Fig. 4 is a schematic diagram of a server provided by an embodiment of the present invention.

Embodiments of the invention

In order to make the objectives, features, and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the following The described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Fig. 1 shows an implementation process of a data flow tracking method provided by an embodiment of the present invention, and the method process includes steps S101 to S104. The specific implementation principles of each step are as follows:

S101: Obtain request data.

In the embodiment of the present invention, the request data carries tainted data. The tainted data refers to the data sent by the client or the front-end browser, and may also be the second part of the data sent by another server to the client or the front-end browser. The data sent after encapsulation. The tainted data in the HTTP request includes: all request header information, all request body information, and all parameter information carried in the URL.

S102: Before responding to the request data, obtain a function to be called when responding to the request data.

Specifically, in the embodiment of the present invention, in order to respond to the request data, a function corresponding to processing the request data needs to be called. There may be multiple functions that need to be called in response to the requested data.

In the embodiment of the present invention, a function that may propagate stain data is determined in advance as an objective function, and the stain function is instrumented to insert a data flow tracking function. Before responding to the request data, obtain the function that needs to be called when responding to the request data, and determine whether the function is the target function. If the function is the target function, the function instrumentation has a data flow tracking function that can execute the data flow tracking process.

S103: Determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data.

The above step S103 specifically includes: determining whether to trigger the execution of the data flow tracking process based on the phase to which the function to be called in response to the request data belongs and the data flow tracking trigger condition corresponding to the function of the phase. Optionally, a pre-marked key function is preset, and the key function is a function prone to loopholes set by the user. It is determined whether the function to be called in response to the request data is a key function, and if so, it is determined to trigger the execution of the data flow tracking process. If not, even if the function instrumentation has a data flow tracking function, the execution of the data flow tracking process is not triggered.

Optionally, because almost all functions are instrumented, if there is no complete and efficient control mechanism, all methods will fall into a similar infinite recursion, similar to infinite recursion, as an embodiment of the present invention, as shown in Figure 2. As shown, the above S103 specifically includes:

A1: Obtain the stage to which the function called in response to the request data belongs.

A2: Invoke and execute the lock mechanism corresponding to the stage to which the function belongs. The lock mechanism is pre-stored in the local thread and used to determine whether to execute the data flow tracking process.

A3: Determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism.

Optionally, the lock mechanism corresponding to the stage is set according to the functions of different stages, that is, the function belonging to a stage has a lock mechanism corresponding to the stage. In the embodiment of the present invention, the stage to which the function called in response to the requested data belongs includes the source stage, the propagation stage, the label stage, and the precipitation stage. The lock mechanism is established in advance according to the stage, and the lock mechanism is distinguished by the stage feature name. .

For the source phase, it is necessary to ensure the uniqueness of the tainted data flow tracking process: other source functions may be called inside the source phase function, and other source functions have been instrumented inside. If other source functions called inside the source function can be instrumented In the data flow tracking process in the logic, other source functions called internally will also initiate a taint tracking process, so that the same tainted data will start two or more taint tracking processes.

For the dissemination stage, the web application will logically process the data input by the user. These processes will make judgments and modify the data, and the data may continue to undergo state changes during this process. The dissemination stage is the link entered after the establishment of the taint tracking process in the source stage. If there is no taint tracking process established in the source stage, the tracking and analysis of related taint data will not be performed in the dissemination stage. Similarly, there may be a large number of other propagation functions belonging to the unified phase in the function at this stage. When running to other functions at the same stage inside the function at this stage, it will also try to enter the instrumented tracking analysis logic, and the taint tracking analysis logic is When tracing and analyzing a propagation function, you only need to pay attention to what data is processed by the current propagation function and what data is the result of the processing, but not how to process it internally. The internally processed tainted data is in an intermediate state, and the application will not do any processing on the intermediate state data. Therefore, by establishing the following lock mechanism, a large amount of tainted data in the intermediate state can be prevented from being tracked, thereby Cause performance problems. The propagation phase may call functions belonging to other phases.

For the labeling stage, the web application may perform some verification and security processing on the data entered by the user. Once the data is safely processed, it may not meet the reporting conditions of certain vulnerabilities, such as HTML encoding the data, so if the data is returned directly In the browser, there will be no XSS problem, but the web application may also perform HTML decoding after the HTML encoding operation. In this way, the data is still threatened by XSS vulnerabilities. Therefore, different labeling operations need to be performed on the data at this stage. The specific labeling operation is completed in the instrumentation logic. This stage belongs to the propagation stage, but the tracking analysis logic of the instrumentation is different. The instrumentation logic in the propagation stage is mainly responsible for the continuous tracking of taints, while the instrumentation logic in the labeling stage is mainly responsible for making different tainted data continuously tracked in the propagation stage. Processing tags, these tags will be used as one of the basis for judging whether there are loopholes in the precipitation stage. The lock mechanism in the label phase and the propagation phase use the same lock mechanism and object lock, that is, the lock in the propagation phase will be effective in the label phase.

For the precipitation phase, the function that enters this phase has already met the vulnerability reporting conditions. The precipitation function, such as Java PrintWriter.println(String str), will be executed before the content to be displayed is pushed to the front end through this function. The detection logic determines whether the content comes from user input and whether the application has been processed for security (whether there are related tags). Similarly, the precipitation phase function may call other precipitation phase functions. If it is not controlled, the same vulnerability may be reported repeatedly. The current precipitation function should only report one vulnerability of the same type. There may be other types of functions at this stage, but the processing results of other types of functions will not be analyzed. The precipitation phase is the vulnerability analysis and reporting phase. The function processing in other phases called internally in this phase will not affect the vulnerability detection and reporting process, but may affect the vulnerability reporting of the next precipitation function, so the processing functions in other phases called are not It will be locked, but it will normally enter the tracking analysis logic of other stages of instrumentation, but its internal will still follow the locking mechanism of other stages.

In the embodiment of the present invention, since each instrumented function is an atomic individual, there are other propagation functions inside an instrumented propagation function, but the data flow tracking module only pays attention to the effect of this propagation function on the tainted data. Deal with the results without caring about internal processing. Therefore, the propagation function should be atomic, and its internal propagation function will not enter the data flow tracking process. However, the internal propagation function of the propagation function is also instrumented, so it is necessary to control its internal propagation function not to enter The data flow tracking process is equipped with a lock mechanism, through which the execution of the data flow tracking process is controlled, avoiding the execution of the data flow tracking process for all function calls, reducing the introduction of a large number of unnecessary tracking logic codes, and reducing the memory usage. Thereby reducing performance overhead and improving the efficiency of program operation.

Specifically, the lock mechanism includes a lock object, and the specific implementation process of step A3 is described in detail as follows:

A31: Obtain the value of the lock object when the lock mechanism is executed.

A32: Determine whether to trigger the execution of the data flow tracking process according to the value of the lock object. Specifically, if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow does not need to be executed Track the process. Specifically, the initial value of the lock object is 0.

Optionally, after the step of performing data flow tracking on the requested data, the method further includes initializing the value of the lock object.

In the embodiment of the present invention, the essence of the lock mechanism is to set a number initialized to 0 as the lock object and store it in the local thread, and set the lock mechanism corresponding to the stage according to the functions of different stages. For example, for the source stage, the source stage is named after the characteristics of the source stage to distinguish it from the source stage lock object. When the program runs into the source stage function, the trace analysis logic function instrumented in the current function will first take out the applicable function of the current stage Lock the object, and add 1 to the value in the lock object, and then the tracking analysis logic will take out the value of the current lock object after adding 1, and judge whether to enter the tracking analysis logic according to the lock object value, and determine whether the lock object value is 1. As long as it is not 1, it does not enter the follow-up tracking analysis logic. When the current function calls other functions at the same stage, the internal function will first enter the internal instrumented tracking analysis logic. Similarly, the instrumented tracking analysis logic of the internal function will also affect the lock object value in the current thread. Add 1, and then determine whether the value after adding 1 is 1, if it is not 1, it does not enter the tracking analysis logic. So far, the lock mechanism implements the tracking analysis logic that controls entry or non-entry into the instrumented function. But after the lock object is repeatedly incremented by 1, it needs to be restored to the initial value (0); otherwise, after the current instrumented function is executed, all other instrumented functions of the same type at the same stage will not be able to enter the specific tracking analysis logic. . Specifically, after the execution of the currently instrumented function is completed, the inserted tracking analysis logic needs to take out the current lock object and reduce the value in the lock object by 1, even if it is the instrumented stub in the internal function of the current instrumented function In the tracking analysis logic, the value of the lock object should be reduced by 1 at the end of the internal function, because the tracking analysis logic has already increased the value of the lock object by 1 when entering the internal function. In this way, no matter how many times the same type of function is called within the current function, the lock object value will be restored to 0 after the current function ends, and then enter the next instrumented function, running the same lock mechanism.

S104: If it is determined that the inserted data flow tracking process needs to be executed, perform data flow tracking on the requested data based on the executing data flow tracking process.

In the embodiment of the present invention, if it is determined that the inserted data flow tracking process needs to be executed, data flow tracking is performed on the requested data based on the executing data flow tracking process. After the application processes the current request, it will send response information to the front end. Before the request response information is returned, the tainted data may repeatedly enter the four stages of source, propagation, labeling and precipitation until the request response is completely completed, which is used to track the tainted data Data flow tracking is temporarily stopped.

It should be understood that the size of the sequence number of each step in the foregoing embodiment does not mean the order of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

Corresponding to the data flow tracking method described in the above embodiment, FIG. 3 shows a structural block diagram of a data flow tracking system provided in an embodiment of the present application. For ease of description, only parts related to the embodiment of the present application are shown.

3, the data flow tracking system includes: a data acquisition unit 31, a function determination unit 32, a data flow tracking judgment unit 33, and a data flow tracking unit 34, wherein:

The data acquisition unit 31 is configured to acquire requested data;

The function determining unit 32 is configured to obtain the function to be called in response to the request data before responding to the request data;

The data flow tracking judgment unit 33 is configured to determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data;

The data flow tracking unit 34 is configured to, if it is determined that the execution of the data flow tracking process is triggered, execute the data flow tracking process, and perform data flow tracking on the requested data.

Optionally, the data flow tracking and judging unit 33 includes:

The phase acquisition module is used to acquire the phase to which the function called in response to the request data belongs;

The lock mechanism calling module is used to call and execute the lock mechanism corresponding to the stage to which the function belongs, and the lock mechanism is pre-stored in the local thread for determining whether to execute the data flow tracking process;

The data flow tracking judgment module is used to determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism.

Optionally, the lock mechanism includes a lock object, and the data flow tracking judgment module specifically includes:

The value acquisition sub-module is used to acquire the value of the lock object when the lock mechanism is executed;

The data flow tracking trigger sub-module is used to determine whether to trigger the execution of the data flow tracking process according to the value of the lock object. Further, if the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed; if the value of the lock object is not 1, it is determined that the inserted data flow does not need to be executed Track the process.

Optionally, the data flow tracking and judging module further includes:

The data initialization sub-module is used to initialize the value of the lock object after executing the data flow tracking process.

Fig. 4 is a schematic diagram of a server provided by an embodiment of the present invention. As shown in FIG. 4, the server 4 in this embodiment includes a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and running on the processor 40, such as a data flow tracking program. When the processor 40 executes the computer program 42, the steps in the foregoing embodiments of the data flow tracking method are implemented, such as steps 101 to 104 shown in FIG. 1. Alternatively, when the processor 40 executes the computer program 42, the functions of the modules/units in the foregoing system embodiments, such as the functions of the units 31 to 34 shown in FIG. 3, are realized.

Exemplarily, the computer program 42 may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 41 and executed by the processor 40 to complete this invention. The one or more modules/units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 42 in the server 4. For example, the computer program 62 can be divided into a data acquisition unit, a function determination unit, a data flow tracking judgment unit, and a data flow tracking unit. The specific functions of each unit are as follows:

Data acquisition unit for acquiring requested data;

The server 4 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The server may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art can understand that FIG. 4 is only an example of the server 4, and does not constitute a limitation on the server 4. It may include more or less components than shown in the figure, or a combination of certain components, or different components, such as The server may also include input and output devices, network access devices, buses, and the like.

It should be understood that in the embodiment of the present application, the processor 402 may be a central processing unit (Central Processing Unit, CPU), which can also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 401 may include a read-only memory and a random access memory, and provides instructions and data to the processor 402. A part or all of the memory 401 may also include a non-volatile random access memory. For example, the memory 401 may also store device type information.

Those skilled in the art can clearly understand that for the convenience and conciseness of description, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned functions can be allocated to different functional units and modules as required. Module completion, that is, divide the internal structure of the system into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist alone physically, or two or more units can be integrated into one unit. The above-mentioned integrated units can be hardware-based Formal realization can also be realized in the form of software functional units. In addition, the specific names of the functional units and modules are only used to facilitate distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working process of the units and modules in the foregoing system, reference may be made to the corresponding process in the foregoing method embodiment, which is not repeated here.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail or recorded in an embodiment, reference may be made to related descriptions of other embodiments.

A person of ordinary skill in the art may be aware that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.

In the embodiments provided by the present invention, it should be understood that the disclosed system and method may be implemented in other ways. For example, the system embodiment described above is merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be Combined or can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, systems or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the program is executed by the processor, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms. The computer-readable medium may include: any entity or system capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media. It should be noted that the content contained in the computer-readable medium can be appropriately added or deleted according to the requirements of the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to the legislation and patent practice, the computer-readable medium Does not include electrical carrier signals and telecommunication signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still implement the foregoing The technical solutions recorded in the examples are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in Within the protection scope of the present invention.

Claims

A data flow tracking method, characterized in that it comprises:

Get request data;

Before responding to the request data, obtain the function to be called when responding to the request data;

Determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data;

If it is determined that the execution of the data flow tracking process is triggered, the data flow tracking process executes the data flow tracking process and performs data flow tracking on the requested data.
The data flow tracking method according to claim 1, wherein the step of determining whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data comprises:

Acquiring the stage to which the function called in response to the request data belongs;

Calling and executing the lock mechanism corresponding to the stage to which the function belongs, the lock mechanism is stored in a local thread in advance, and is used to determine whether to execute the data flow tracking process;

According to the result of calling and executing the lock mechanism, it is determined whether to trigger the execution of the data flow tracking process.
The data flow tracking method according to claim 2, wherein the lock mechanism includes a lock object, and the step of determining whether to trigger the execution of the data flow tracking process is determined based on the result of calling and executing the lock mechanism ,include:

Acquiring the value of the lock object when the lock mechanism is executed;

According to the value of the lock object, it is determined whether to trigger the execution of the data flow tracking process.
The data flow tracking method according to claim 3, wherein the step of determining whether to trigger execution of the data flow tracking process according to the value of the lock object specifically comprises:

If the value of the lock object is 1, it is determined that the inserted data flow tracking process needs to be executed;

If the value of the lock object is not 1, it is determined that the inserted data flow tracking process does not need to be executed.
The data stream tracking method according to claim 3, wherein the data stream tracking method further comprises:

After the data flow tracking process is executed, the value of the lock object is initialized.
A data flow tracking system, characterized in that, the data flow tracking system includes:

Data acquisition unit for acquiring requested data;

The function determining unit is configured to obtain the function to be called in response to the request data before responding to the request data;

The data flow tracking judgment unit is configured to determine whether to trigger the execution of the data flow tracking process based on the function to be called when responding to the requested data;

The data flow tracking unit is configured to, if it is determined that the execution of the data flow tracking process is triggered, execute the data flow tracking process, and perform data flow tracking on the requested data.
The data stream tracking system according to claim 6, wherein the data stream tracking and judging unit comprises:

The phase acquisition module is used to acquire the phase to which the function called in response to the request data belongs;

The lock mechanism calling module is used to call and execute the lock mechanism corresponding to the stage to which the function belongs, and the lock mechanism is pre-stored in the local thread for determining whether to execute the data flow tracking process;

The data flow tracking judgment module is used to determine whether to trigger the execution of the data flow tracking process according to the result of calling and executing the lock mechanism.
The data flow tracking system according to claim 7, wherein the lock mechanism includes a lock object, and the data flow tracking judgment module specifically includes:

The value acquisition sub-module is used to acquire the value of the lock object when the lock mechanism is executed;

The data flow tracking trigger sub-module is used to determine whether to trigger the execution of the data flow tracking process according to the value of the lock object.
A computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the data flow tracking method according to any one of claims 1 to 5 A step of.
A server comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the computer program as claimed in claims 1 to 5 The steps of any one of the data stream tracking methods.