A Monitoring Method for Static Object Tampering in Mixed Environment

Abstract

The invention discloses a monitoring method for tampering of a static object in a mixed environment, comprising: monitoring whether the static object is tampered with, the static object is sequentially monitored for tampering, recording the number of times of tampering, and judging whether the number of times of tampering reaches a predetermined value. Set the number of times t1, if it is, then further monitor whether the middleware has been tampered with; when it is judged that the middleware has been tampered with, then execute to monitor whether the operating system has been tampered with. Through the technical solution provided in the present invention, in the process of tampering monitoring for static objects, it is not only possible to quickly monitor whether the static objects have been tampered with, but also to further dig out the reason why the static objects have been tampered with, and each detection step can run in parallel or in series , flexible deployment and efficient operation.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a monitoring method for static object tampering in a mixed environment. Background technique [0002] As the Internet penetrates into people's daily life more and more, people obtain a lot of information through website resources, especially browsing official government websites and major portal websites. The information released by these websites is often policy and current affairs, so it is also easy to become a target for hackers. The primary target, cyberattacks are particularly prevalent. Once a webpage is tampered with by attackers, it will often cause bad social impact, especially tampering with political attack color, which will seriously damage the image of the government. Web servers that dominate the Internet, such as Apache and IIS, lack an integrity protection mechanism for pages requested by users, and cannot effectively prevent pages from being tampered with. In ...

AI Technical Summary

Problems solved by technology

The third-generation anti-tampering technology is a combination of file filtering driver and event triggering. Its core idea is to apply the core program of tampering monitoring to the Web server through file underlying driver technology, and automatically monitor through event triggering. All files in the database will be compared with their underlying file attributes, and the built-in fast hash algorithm will be used to calculate digital fingerprints for real-time monitoring. If attribute changes are found, the content of the backup path folder will be copied to the corresponding location of the monitoring folder through a non-protocol plain text safe copy method. Using the underlying file-driven technology, the entire file copy process is in milliseconds, so that the public cannot see the tampered pages

[0004] After the iterative development of multiple monitoring and tampering technologies, the existing monitoring methods for anti-tampering of static objects have become very mature. Monitor the static objects, and after monitoring, only the corresponding static files can be found to be tampered with, and then repaired

However, if the middleware of the system is tampered or, the repaired webpage will be tampered again, which will lead to repeated tampering of static files

Such a repair has no effect, and cannot count the frequency of tampering, etc.

Images