Method for monitoring tampering of a static object in a mixed environment

Abstract

The invention discloses a method for monitoring tampering of a static object in a mixed environment, which comprises the following steps: monitoring whether the static object is tampered or not, sequentially monitoring whether the static object is tampered or not, recording the tampered frequency, judging whether the tampered frequency reaches a preset frequency t1 or not, and if yes, further monitoring whether the middleware is tampered or not; And when it is judged that the middleware is tampered, monitoring whether the operating system is tampered or not. According to the technical scheme provided by the invention, in the tampering monitoring process aiming at the static object, whether the static object is tampered or not can be rapidly monitored, the tampering reason of the static object is further mined, each detection step can be operated in parallel or in series, the deployment is flexible, and the operation is efficient.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a monitoring method for static object tampering in a mixed environment. Background technique [0002] As the Internet penetrates into people's daily life more and more, people obtain a lot of information through website resources, especially browsing official government websites and major portal websites. The information released by these websites is often policy and current affairs, so it is also easy to become a target for hackers. The primary target, cyberattacks are particularly prevalent. Once a webpage is tampered with by attackers, it will often cause bad social impact, especially tampering with political attack color, which will seriously damage the image of the government. Web servers that dominate the Internet, such as Apache and IIS, lack an integrity protection mechanism for pages requested by users, and cannot effectively prevent pages from being tampered with. In ...

AI Technical Summary

Problems solved by technology

The third-generation anti-tampering technology is a combination of file filtering driver and event triggering. Its core idea is to apply the core program of tampering monitoring to the Web server through file underlying driver technology, and automatically monitor through event triggering. All files in the database will be compared with their underlying file attributes, and the built-in fast hash algorithm will be used to calculate digital fingerprints for real-time monitoring. If attribute changes are found, the content of the backup path folder will be copied to the corresponding location of the monitoring folder through a non-protocol plain text safe copy method. Using the underlying file-driven technology, the entire file copy process is in milliseconds, so that the public cannot see the tampered pages

[0004] After the iterative development of multiple monitoring and tampering technologies, the existing monitoring methods for anti-tampering of static objects have become very mature. Monitor the static objects, and after monitoring, only the corresponding static files can be found to be tampered with, and then repaired

However, if the middleware of the system is tampered or, the repaired webpage will be tampered again, which will lead to repeated tampering of static files

Such a repair has no effect, and cannot count the frequency of tampering, etc.

Images