Sharing file operation filtering method based on SMB protocol

Abstract

The invention relates to a method for file filtration, in particular to a sharing file operation filtering method based on the SMB protocol. The sharing file operation filtering method comprises the following steps: holding monitoring and data packet analysis on the ports (139 and 445) of a system; performing step-by-step operation of IP filtration, SMB-step filtration and file name acquisition on a captured data packet; automatically adding file types which meet user-defined monitoring rules and corresponding file names into an operation filtration monitoring list; converting a network data packet to local monitoring, continuously monitoring the progress of a local drive through the system, acquiring file creation information, and acquiring newly created file names; comparing basic information such as names and capacities of local newly created files with those of files in the monitoring list; monitoring the local progress through a resident system, and acquiring operation information of files. As the method is based on analysis filtration strategies of application layer protocol and nucleus filtration driving of an operation system, the operation is visible, hard to interfere and high in security.

Description

technical field [0001] The invention relates to a file filtering method, in particular to a shared file operation filtering method based on the SMB protocol. Background technique [0002] With the rapid development of computer network technology, the acquisition, sharing and dissemination of information has become more convenient, but the risk of information leakage has also increased. Within the government and enterprises, important documents are circulated and shared among multiple people, increasing the possibility of data leakage. How to effectively manage the security of shared files has become the focus and research hotspot of the current government and enterprises. [0003] The monitoring and management of file operation behavior can be realized through file operation filtering technology, which is an effective means of file monitoring. Based on the Windows file operating system, the file operation filtering technology mainly relies on intercepting file operation re...

AI Technical Summary

Problems solved by technology

[0005] (1) The monitoring technology based only on the file filtering driver can only monitor the target files in the local stand-alone system, and cannot effectively identify the files newly downloaded to the local machine, and the monitoring granularity is poor; (2) Known file monitoring The system generally implements global monitoring, lacks effective filtering rules, and increases the burden on the system; (3) users often need to install a specific client to access the browser, and the upgrade and maintenance of the monitoring system needs to be operated one by one on the client

Images