A method for quickly realizing file identification under a host white list mechanism

Abstract

The invention discloses a method for quickly realizing file identification under a host white list mechanism. The method comprises the following steps of step 1 a first fragmentation algorithm; step 2a fragmentation algorithm 2 characterized by fragmenting according to a fixed size, combining a plurality of adjacent fragmentations, calculating a HASH value, and recording the HASH value in a database; step 3 a fragmentation algorithm III characterized byperforming fragmentation according to the Section of the PE, combining the attribute field of the Section with the Section data body part, calculating a HASH value, and recording and verifying the HASH value; and step 4 carrying out the fragmentation according to the Section of the PE, and combining the attribute field of the Section with the Section data body part. The beneficial effects of the invention are as follows the problem that the process loading or running speed becomes slow due to the white list software is solved, the system jamming problem caused by existing white list software is solved, the memory paging control over executable files is achieved through kernel programming of Windows, and the HASH value of paging is quickly verified during paging exchange.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a method for quickly realizing file identification under a host white list mechanism. Background technique [0002] At present, host application whitelist technology is a common technology for host application layer security defense. It is different from blacklist technology and is used to achieve more accurate and relatively solid security defense effects on specific-purpose computers. Existing hosts use whitelist technology, and the commonly used file detection and identification technology is to verify the target file to be loaded through the HASH algorithm and digital signature mechanism. Full-text HASH method: Before loading the file, read the full text of the file into the memory, calculate HASH, and then query in the existing HASH library, and decide whether to refuse to load the file according to the query result and whitelist policy Signature mechan...

AI Technical Summary

Problems solved by technology

[0007] 1. A large amount of CPU is consumed in repeated calculations, the loading time is too long, and the user experience is poor

[0008] 2. In some cases, it will cause multi-task preemption, system deadlock, serious slowdown of response, and worse user experience

The shortcoming of prior art 2 is: it will not waste too many resources on computer reading files and calculating Hash

[0014] 3. The manufacturer's signature method has the same weakness as the HASH algorithm. Since the full text of the file is signed, the implementation of this technology will seriously slow down the system response speed

Images