White list protection matching method, system, terminal and storage medium

Abstract

The invention provides a white list protection matching method, a system, a terminal and a storage medium. The method comprises the steps: splitting a hash value in a white list into a plurality of parts, and storing each part in a corresponding database; establishing a mapping relationship among all parts of the same white list hash value, and generating a mapping relationship table among all databases according to the mapping relationship; splitting the hash value of the request program into a plurality of parts according to a splitting method of the hash value in the white list, and searching a matching part from a corresponding database for each part of the hash value of the request program according to the mapping relation table; if the hash value of the request program has a matchingpart in each database, judging that the hash value of the request program is in a white list. According to the method, the storage space of the white list library is reduced, the hash values of the request programs are subjected to subsection matching, the matching efficiency is improved, and most non-white list programs are quickly screened out.

Description

technical field [0001] The present invention relates to the technical field of cloud platforms, in particular to a whitelist protection matching method, system, terminal and storage medium. Background technique [0002] In the cloud platform environment, it often takes a long time to protect the host with the whitelist function. The longest time-consuming is often the matching of the huge whitelist library and the hash of the running program of the protected host. The main reason is that the whitelist library The Hash value of the entire whitelist program is stored in . [0003] The conventional hash matching method is: [0004] Maintain a huge whitelist library, which stores all the hash values ​​listed in the whitelist. When the protection host wants to run a certain program, it calculates the Hash value of the program and matches it with the huge white list library, and finds whether there is a Hash value consistent with the program in the white list library. If the ma...

AI Technical Summary

Problems solved by technology

[0005] Obviously, when there are a large number of Hash values ​​in the whitelist library, when the whitelist library matches the running program, it is very time-consuming and the completion of this process consumes a lot of host resources and time

Images