Method, device, electronic device and storage medium for determining maliciously copied files

Abstract

The embodiments of the present application disclose a method, device, electronic device and storage medium for determining maliciously copied files. The method comprises: after detecting a copy operation on a local folder, determining a target folder to be protected; creating an obfuscated file in a target file directory of files existing in the target folder, and hiding the obfuscated file; the file name of the obfuscated file is the target file name obtained by hash calculation; after performing the copy operation, based on a recursive algorithm, detecting whether the file name of the copied file is the target file name obtained by hash calculation; when detecting that the file name of the copied file is the target file name, determining that the copy operation is a malicious copy operation. The embodiments of the present application can prevent illegal operations that occur after the user password is leaked, and prevent security accidents in which important data is copied as a whole.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for determining maliciously copied files. Background Art

[0002] The security measures of traditional file systems mainly include user password and permission management, server system security settings, storage and transmission encryption, etc. Once the above measures are breached, the folders storing important data are at risk of being maliciously copied in full.

[0003] There are two existing technical solutions to prevent malicious full copying. One is to compare the successfully authenticated master key with the master key of the AAA server before the important data is copied, so as to determine whether the copying is voluntary by the user or by a third party. However, it uses traditional cryptographic technology, which is applicable to the field of network security or communication, with complex information interaction and large development volume. Once the authentication is passed, the full copy can be made, which cannot solve the problem of illegal operation of legitimate accounts.

[0004] The other is to monitor the running behavior of sample files and generate log files, and then match these log files through the extracted feature rules to achieve malicious detection of sample files. However, it is a traditional data extraction and rule matching method, which only describes the detection method after the malicious behavior occurs. At this time, the harm has been caused and it is impossible to prevent or solve the problem. Summary of the invention

[0005] The present application provides a method, device, electronic device and storage medium for determining maliciously copied files to solve the problem that the prior art cannot solve the illegal operation of legitimate accounts, as well as the detection method after the malicious behavior occurs, at which time the harm has been caused and the malicious file copying behavior cannot be prevented or solved.

[0006] In order to solve the above problems, the embodiment of the present application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for determining a maliciously copied file, comprising:

[0008] After detecting a copy operation on a local folder, determining a target folder to be protected;

[0009] Creating an obfuscated file in a target file directory of the file in the target folder, and hiding the obfuscated file; the file name of the obfuscated file is the target file name obtained by hash calculation;

[0010] After executing the copy operation, based on a recursive algorithm, detecting whether the file name of the copied file is the target file name obtained by hash calculation;

[0011] When it is detected that the file name of the copied file is the target file name, the copy operation is determined to be a malicious copy operation.

[0012] Optionally, creating an obfuscated file in a target file directory of the file in the target folder and hiding the obfuscated file includes:

[0013] Obtain a target account of a user who performs the copy operation;

[0014] Performing hash processing on the target account and the file information corresponding to the target file directory to generate the target file name;

[0015] Creating the obfuscated file in the target file directory, and assigning the target file name to the obfuscated file;

[0016] Hide the obfuscated files.

[0017] Optionally, performing hash processing on the target account and the file information corresponding to the target file directory to generate the target file name includes:

[0018] Performing hash processing on the target account and all file name concatenation information under the target file directory to generate the target file name; or

[0019] Hash processing is performed on the target account and all file name information under the target file directory to generate the target file name.

[0020] Optionally, after creating an obfuscated file in a target file directory of the file in the target folder and hiding the obfuscated file, the method further includes:

[0021] Before executing the copy operation, storing the target file path of the copied target folder as a recovery point;

[0022] After determining that the copy operation is a malicious copy operation, the method further includes:

[0023] Deletes all subdirectories and files of the recovery point in question.

[0024] Optionally, after determining that the copy operation is a malicious copy operation, the method further includes:

[0025] Generate and output prompt information; the prompt information refers to information used to prompt the existence of maliciously copied files; and / or

[0026] The copy operation of the target account of the user who performs the copy operation is terminated.

[0027] In a second aspect, an embodiment of the present application provides a device for determining a maliciously copied file, including:

[0028] A target folder determination module, used to determine a target folder to be protected after detecting a copy operation on a local folder;

[0029] An obfuscated file creation module is used to create an obfuscated file in a target file directory of the file in the target folder, and hide the obfuscated file; the file name of the obfuscated file is the target file name obtained by hash calculation;

[0030] A target file name detection module is used to detect whether the file name of the copied file is the target file name obtained by hash calculation based on a recursive algorithm after executing the copy operation;

[0031] The malicious copy operation determination module is used to determine that the copy operation is a malicious copy operation when it is detected that the file name of the copied file is the target file name.

[0032] Optionally, the obfuscated file creation module includes:

[0033] A target account acquisition unit, used to acquire a target account of a user who performs the copy operation;

[0034] A file name generating unit, configured to perform hash processing on the target account and the file information corresponding to the target file directory to generate the target file name;

[0035] A file name assigning unit, used to create the obfuscated file in the target file directory and assign the target file name to the obfuscated file;

[0036] The obfuscated file hiding unit is used to hide the obfuscated file.

[0037] Optionally, the file name generating unit includes:

[0038] A first file name generation subunit is used to perform hash processing on the target account and all file name cascade information under the target file directory to generate the target file name;

[0039] The second file name generation subunit is used to perform hash processing on the target account and all file name information under the target file directory to generate the target file name.

[0040] Optionally, the device further comprises:

[0041] A recovery point storage module, used for storing the target file path of the copied target folder as a recovery point before executing the copy operation;

[0042] The directory file deletion module is used to delete all subdirectories and files of the recovery point after determining that the copy operation is a malicious copy operation.

[0043] Optionally, the device further comprises:

[0044] A prompt information output module, used to generate and output prompt information; the prompt information refers to information used to prompt the existence of malicious duplicate files;

[0045] The copy operation termination module is used to terminate the copy operation of the target account of the user who performs the copy operation.

[0046] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0047] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above methods for determining maliciously copied files when executing the program.

[0048] In a fourth aspect, an embodiment of the present application provides a readable storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the methods for determining maliciously copied files described above.

[0049] Compared with the prior art, this application has the following advantages:

[0050] The embodiment of the present application provides a method, device, electronic device and storage medium for determining maliciously copied files, which determines a target folder to be protected after detecting a copy operation on a local folder, creates an obfuscated file in a target file directory of a file in the target folder, and hides the obfuscated file, wherein the file name of the obfuscated file is the target file name obtained by hash calculation, and after performing the copy operation, detects whether the file name of the copied file is the target file name obtained by hash calculation based on a recursive algorithm, and determines that the copy operation is a malicious copy operation when the file name of the copied file is detected to be the target file name. The embodiment of the present application can prevent illegal operations that occur after the user password is leaked, and prevent security accidents in which important data is copied as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A flowchart of a method for determining a maliciously copied file provided in an embodiment of the present application;

[0052] Figure 2 A schematic diagram of recursively traversing a directory tree provided in an embodiment of the present application;

[0053] Figure 3 A schematic diagram of a recursive calling process provided in an embodiment of the present application;

[0054] Figure 4 A schematic diagram of preventing files from being maliciously copied provided in an embodiment of the present application;

[0055] Figure 5 A schematic diagram of discovering malicious copying behavior provided in an embodiment of the present application;

[0056] Figure 6 A schematic diagram of the structure of a device for determining maliciously copied files provided in an embodiment of the present application;

[0057] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0059] Embodiment 1

[0060] Reference Figure 1 , shows a flowchart of the steps of a method for determining a maliciously copied file provided by an embodiment of the present application, such as Figure 1 As shown, the method for determining the maliciously copied file may include the following steps:

[0061] Step 101: After detecting a copy operation on a local folder, determine a target folder to be protected.

[0062] The embodiments of the present application can be applied to create an obfuscated file in a folder where a message is required to detect whether there is malicious file copying behavior.

[0063] The target folder refers to a locally saved folder that needs to be protected. In a specific implementation, the target folder can be determined based on the file content saved in the folder, or the user can pre-define local folders that need to be copy-protected, etc. Specifically, the method for determining the target folder can be determined based on usage requirements, and this embodiment does not limit this.

[0064] After the copy operation on the local folder is detected, the local target folder to be protected may be determined.

[0065] After the local target folder to be protected is determined, step 102 is executed.

[0066] Step 102: creating an obfuscated file in a target file directory of the file in the target folder, and hiding the obfuscated file; the file name of the obfuscated file is the target file name obtained by hash calculation.

[0067] Obfuscated files are files created to detect whether users have malicious copying behavior.

[0068] In this example, the shuffle file's file name is the target file name calculated by hashing.

[0069] After determining the local target folder to be protected, an obfuscated file can be created in the target file directory of the file in the target folder, and the obfuscated file can be hidden, such as Figure 2 As shown, the protected source folder is folder 11. Folder 11 contains two sub-files, namely folder 21 and folder 22. Folder 21 contains sub-folders: folder 31 and a file 32. Folder 22 contains a file 33. Folder 31 contains a file 41. At this time, an obfuscated file can be created in folder 21, that is, file 32 with special file name 2, an obfuscated file can be created under folder 22, that is, file 33 with special file name 3, and an obfuscated file can be created under folder 31, that is, file 41 with special file name 1, and so on.

[0070] It can be understood that the above examples are merely examples listed for a better understanding of the technical solutions of the embodiments of the present application, and are not intended to be the sole limitation to the embodiments.

[0071] The process of creating an obfuscated file can be described in detail in conjunction with the following specific implementation method.

[0072] In a specific implementation of the present application, the above step 102 may include:

[0073] Sub-step A1: Obtain the target account of the user who performs the copy operation.

[0074] In this embodiment, the target account refers to the account used by the user who currently performs the copy operation, such as "zhangsan", "lisi", etc.

[0075] After detecting a copy operation on a local folder, a target account of a user who performs the copy operation may be obtained.

[0076] After the target account of the user performing the copy operation is obtained, sub-step A2 is executed.

[0077] Sub-step A2: Perform hash processing on the target account and the file information corresponding to the target file directory to generate the target file name.

[0078] The file information refers to information associated with the target file directory. In this example, the file information may be all file name cascade information under the target file directory, or may be all file name information under the target file directory.

[0079] After determining the local target folder to be protected, the target file directory storing the files in the target folder may be obtained, and then the file information associated with the target file directory may be obtained.

[0080] After obtaining the file information corresponding to the target account and the target file directory, the target account and the file information may be hashed to generate a target file name for the obfuscated file. Specifically, the process of generating the target file name may be described in detail in conjunction with the following specific implementation method.

[0081] In another specific implementation of the present application, the above sub-step A2 may include:

[0082] Sub-step B1: Hash the target account and all file name concatenation information under the target file directory to generate the target file name.

[0083] In this embodiment, hash processing may be performed on the target account and all file name concatenation information under the target file directory to generate the target file name.

[0084] Sub-step B2: Perform hash processing on the target account and all file name information under the target file directory to generate the target file name.

[0085] In this embodiment, hash processing may be performed on the target account and all file name information under the target file directory to generate a target file name.

[0086] In a specific implementation, the target file name is not limited to the one obtained by hash calculation, but can also be obtained by processing using other encryption methods, for example, Figure 2 As shown, the special file names of the obfuscated files created are as follows:

[0087] Special file name 1: “#h508#”+md5(“zhangsan|41”)+“*@”=“#h5O8#aed39e948d502e93*@”

[0088] Special file name 1: “#h5O8#”+md5(“zhangsan|41”)+“*@”=“#h508#aed39e948d502e93*@”

[0089] Special file name 2: “#h5O8#”+md5(“zhangsan|3132”)+“*@”=“#h508#3302b8990e7b1d7c*@”

[0090] Special file name 3: “#h5O8#”+md5(“zhangsan|33”)+“*@”=“#h508#60476696355900a1*@”

[0091] In the above special file name, "zhangsan" is the target account. The special file name can be obtained by performing MD5 calculation on the file information of the target account and the target file directory.

[0092] It can be understood that the above examples are merely examples listed for a better understanding of the technical solutions of the embodiments of the present application, and are not intended to be the sole limitation to the embodiments.

[0093] In this embodiment, a recursive call method can be used to create an obfuscated file, such as Figure 3 As shown in the figure, during the recursive call process, the first file directory of the folder is first detected to check whether there is a file, and the detected account is recorded, such as "E: / zhangsan / 11", etc. When src is a directory type, the target path directory is also created. The difference is that during the continuous recursive call process, when src is a file type, an obfuscated file is created.

[0094] The code for recursively creating obfuscated files is as follows:

[0095]

[0096]

[0097] Create a special format file at the same level as src and hide it

[0098] In actual applications, when generating a target file name, the target account number + other information may also be used, as long as the detection of malicious copying operations can be achieved. This embodiment does not limit the specific content of other information.

[0099] After performing hash processing on the target account and the file information corresponding to the target file directory to generate the target file name, sub-step A3 is executed.

[0100] Sub-step A3: creating the obfuscated file in the target file directory, and assigning the target file name to the obfuscated file.

[0101] After the target account and the file information corresponding to the target file directory are hashed to generate the target file name, an obfuscated file can be created in the target file directory, and the target file name is assigned to the shuffled file, that is, the target file name is used as the file name of the obfuscated file.

[0102] After creating the obfuscated file in the target file directory and assigning the target file name to the obfuscated file, sub-step A4 is executed.

[0103] Sub-step A4: hiding the obfuscated file.

[0104] After creating an obfuscated file in the target file directory and assigning the target file name to the obfuscated file, the obfuscated file can be hidden to detect malicious copying. That is, when a user copies all files in the folder, if the obfuscated file is copied, it means that the user is performing malicious copying behavior.

[0105] After creating the obfuscated file in the target file directory of the file in the target folder and hiding the obfuscated file, step 103 is performed.

[0106] Step 103: After executing the copy operation, based on a recursive algorithm, detect whether the file name of the copied file is the target file name obtained by hash calculation.

[0107] After creating the obfuscated file in the target file directory where the file exists in the target folder and hiding the obfuscated file, the copy operation can be performed.

[0108] After executing the copy operation, the system can cache the copied file and perform a recursive algorithm on the copied file name, that is, detect whether the copied file name is the target file name obtained by hash calculation. The recursive detection process can be as follows: Figure 4 shown.

[0109] The existing file replication principle and method can be as follows Figure 4 The left half of the figure shows: traverse the source path to get the name of each file name and subdirectory under the path. There may also be directories under these subdirectories, and the same process as the first layer is carried out in sequence, so it is necessary to recursively call itself. This process needs to determine whether it is a file. If it is, the file is copied. If it is a directory, it calls itself again, and so on until the innermost directory.

[0110] The method provided in this embodiment to prevent a folder from being maliciously copied can be as follows: Figure 4 The right half of the figure shows: When src is a directory type, the target path directory is also created. The difference is that in the continuous recursive call process, when src is a file type, if the copied file is found to have a special file name format (obfuscated data), it is identified as a malicious operation, and a series of subsequent warning, freezing, and recovery actions are initiated, and then the program terminates.

[0111] The recursive detection process can be Figure 5 As shown ( Figure 2 The system can detect each file directory of the copied folder in turn to detect whether there is a file with a special file name, and then determine that there is malicious copying behavior, such as Figure 5As shown in the figure, if there is "#h508#aed39e948d502e93*@" in the file name, it means that there is a special format file name, which is identified as a malicious copy operation.

[0112] The recursive code to prevent folders from being maliciously copied is as follows:

[0113]

[0114]

[0115] As shown in the above code, during the recursive detection process, if the source path src is a file, and the file name is a file name in a special format, it means that there is malicious copying behavior. At this time, an alarm can be issued and / or the account can be frozen, and all subdirectories and files of the recovery point can be deleted. If the file name is not a file name in a special format, the file copy is implemented based on the read() and write() of InputStream and OutputStream.

[0116] It can be understood that the above examples are merely examples listed for a better understanding of the technical solutions of the embodiments of the present application, and are not intended to be the sole limitation to the embodiments.

[0117] If it is detected that the file name of the copied file is not the target file name obtained by hash calculation, it means that the currently executed copy operation is a normal copy operation, and the copy process can be continued.

[0118] When it is detected that the file name of the copied file is the target file name obtained by hash calculation, step 104 is executed.

[0119] Step 104: When it is detected that the file name of the copied file is the target file name, the copy operation is determined to be a malicious copy operation.

[0120] In the case where it is detected that the file name of the copied file is the target file name, it can be determined that the copy operation is a malicious copy operation.

[0121] The embodiment of the present application creates an obfuscated file in a directory where files exist, and uses a recursive detection algorithm to detect whether the copied file contains a file name calculated by hash, thereby preventing illegal operations that occur after the user password is leaked and preventing security accidents in which important data is copied as a whole.

[0122] In a specific implementation of the present application, after hiding the obfuscated file and before performing the copy operation, the target file path of the copied target folder can also be stored as a recovery point. After determining that the copy operation is a malicious copy operation, all subdirectories and files of the recovery point are deleted.

[0123] In another specific implementation of the present application, after the above step 104, the following may also be included:

[0124] Step S1: Generate and output prompt information; the prompt information refers to information used to prompt the existence of malicious duplicate files; and / or

[0125] Step S2: terminating the copy operation of the target account of the user who performs the copy operation.

[0126] In this embodiment, when it is determined that the currently executed copy operation is a malicious copy operation, prompt information can be generated and output to prompt relevant personnel that there is information about the malicious copy file so that the relevant personnel can handle it.

[0127] You can also terminate the copy operation for the target account of the user who performs the copy operation.

[0128] The embodiment of the present application recursively inserts a special file calculated by hash (and hidden) into the source folder. When a copy operation occurs, if the file being copied is a special file, it is identified as a malicious copy operation, and then an alarm is issued, the account is frozen, and all subdirectories and files of the recovery point are deleted. This can prevent illegal operations that occur after the user password is leaked, and prevent security accidents in which important data is copied as a whole.

[0129] The method for determining maliciously copied files provided by the embodiment of the present application determines the target folder to be protected after detecting the copy operation on the local folder, creates an obfuscated file in the target file directory of the file in the target folder, and hides the obfuscated file. The file name of the obfuscated file is the target file name obtained by hash calculation. After performing the copy operation, based on a recursive algorithm, it is detected whether the file name of the copied file is the target file name obtained by hash calculation. When it is detected that the file name of the copied file is the target file name, the copy operation is determined to be a malicious copy operation. The embodiment of the present application can prevent illegal operations that occur after the user password is leaked, and prevent the occurrence of security accidents where important data is copied as a whole.

[0130] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0131] Embodiment 2

[0132] Reference Figure 6, shows a schematic diagram of the structure of a device for determining maliciously copied files provided by an embodiment of the present application, such as Figure 6 As shown, the determination 600 of the maliciously copied file may include the following modules:

[0133] The target folder determination module 610 is used to determine the target folder to be protected after detecting the copy operation on the local folder;

[0134] The obfuscated file creation module 620 is used to create an obfuscated file in the target file directory of the file in the target folder, and hide the obfuscated file; the file name of the obfuscated file is the target file name obtained by hash calculation;

[0135] A target file name detection module 630 is used to detect whether the file name of the copied file is the target file name obtained by hash calculation based on a recursive algorithm after executing the copy operation;

[0136] The malicious copy operation determination module 640 is used to determine that the copy operation is a malicious copy operation when it is detected that the file name of the copied file is the target file name.

[0137] Optionally, the obfuscated file creation module 620 includes:

[0138] A target account acquisition unit, used to acquire a target account of a user who performs the copy operation;

[0139] A file name generating unit, configured to perform hash processing on the target account and the file information corresponding to the target file directory to generate the target file name;

[0140] A file name assigning unit, used to create the obfuscated file in the target file directory and assign the target file name to the obfuscated file;

[0141] The obfuscated file hiding unit is used to hide the obfuscated file.

[0142] Optionally, the file name generating unit includes:

[0143] A first file name generation subunit is used to perform hash processing on the target account and all file name cascade information under the target file directory to generate the target file name;

[0144] The second file name generation subunit is used to perform hash processing on the target account and all file name information under the target file directory to generate the target file name.

[0145] Optionally, the device further comprises:

[0146] A recovery point storage module, used for storing the target file path of the copied target folder as a recovery point before executing the copy operation;

[0147] The directory file deletion module is used to delete all subdirectories and files of the recovery point after determining that the copy operation is a malicious copy operation.

[0148] Optionally, the device further comprises:

[0149] A prompt information output module, used to generate and output prompt information; the prompt information refers to information used to prompt the existence of malicious duplicate files;

[0150] The copy operation termination module is used to terminate the copy operation of the target account of the user who performs the copy operation.

[0151] The malicious copy file determination device provided by the embodiment of the present application determines the target folder to be protected after detecting the copy operation on the local folder, creates an obfuscated file in the target file directory of the file in the target folder, and hides the obfuscated file. The file name of the obfuscated file is the target file name obtained by hash calculation. After performing the copy operation, based on a recursive algorithm, it is detected whether the file name of the copied file is the target file name obtained by hash calculation. When it is detected that the file name of the copied file is the target file name, the copy operation is determined to be a malicious copy operation. The embodiment of the present application can prevent illegal operations that occur after the user password is leaked, and prevent the occurrence of security accidents where important data is copied as a whole.

[0152] Embodiment 3

[0153] An embodiment of the present application provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned methods for determining maliciously copied files when executing the program.

[0154] Reference Figure 7 , shows a schematic diagram of the structure of an electronic device provided by an embodiment of the present application, such as Figure 7 As shown, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 702 or computer program instructions loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0155] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, a microphone, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0156] The various processes and processing described above may be performed by the processing unit 701. For example, the method of any of the above embodiments may be implemented as a computer software program, which is tangibly contained in a computer-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the CPU 701, one or more actions in the method described above may be performed.

[0157] Embodiment 4

[0158] An embodiment of the present application provides a readable storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above-mentioned methods for determining maliciously copied files.

[0159] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0160] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0161] The above is a detailed introduction to a method for determining a maliciously copied file, a device for determining a maliciously copied file, an electronic device and a storage medium provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for determining maliciously copied files, characterized in that: include: After detecting a copy operation on a local folder, determining a target folder to be protected; In the target folder, create an obfuscated file in the target file directory where the file exists, and hide the obfuscated file; The file name of the obfuscated file is the target file name obtained by hash calculation; storing a target file path of the copied target folder as a recovery point; After executing the copy operation, based on a recursive algorithm, detecting whether the file name of the copied file is the target file name obtained by hash calculation; In the case where it is detected that the file name of the copied file is the target file name, determining that the copy operation is a malicious copy operation; Delete all subdirectories and files of the recovery point; Generate and output prompt information; The prompt information refers to information used to prompt the existence of maliciously copied files; and / or terminating the copy operation of the target account of the user who performs the copy operation; The step of creating an obfuscated file in the target file directory of the target file and hiding the obfuscated file includes: Obtain a target account of a user who performs the copy operation; Performing hash processing on the target account and the file information corresponding to the target file directory to generate the target file name; Creating the obfuscated file in the target file directory, and assigning the target file name to the obfuscated file; Hide the obfuscated files.

2. The method according to claim 1, characterized in that: The performing hash processing on the target account and the file information corresponding to the target file directory to generate the target file name includes: Performing hash processing on the target account and all file name concatenation information under the target file directory to generate the target file name; or Hash processing is performed on the target account and all file name information under the target file directory to generate the target file name.

3. A device for determining maliciously copied files, characterized in that: include: A target folder determination module, used to determine a target folder to be protected after detecting a copy operation on a local folder; An obfuscated file creation module, used to create an obfuscated file in the target file directory where the file exists in the target folder, and hide the obfuscated file; The file name of the obfuscated file is the target file name obtained by hash calculation; A recovery point storage module, used for storing the target file path of the copied target folder as a recovery point before executing the copy operation; A target file name detection module is used to detect whether the file name of the copied file is the target file name obtained by hash calculation based on a recursive algorithm after executing the copy operation; A malicious copy operation determination module, configured to determine that the copy operation is a malicious copy operation when it is detected that the file name of the copied file is the target file name; A directory file deletion module, used to delete all subdirectories and files of the recovery point after determining that the copy operation is a malicious copy operation; A prompt information output module, used for generating and outputting prompt information; The prompt information refers to information used to prompt the existence of maliciously copied files; A copy operation termination module, used to terminate the copy operation of the target account of the user who performs the copy operation; Wherein, the obfuscated file creation module includes: A target account acquisition unit, used to acquire a target account of a user who performs the copy operation; A file name generating unit, configured to perform hash processing on the target account and the file information corresponding to the target file directory to generate the target file name; A file name assigning unit, used to create the obfuscated file in the target file directory and assign the target file name to the obfuscated file; The obfuscated file hiding unit is used to hide the obfuscated file.

4. The device according to claim 3, characterized in that The file name generating unit comprises: A first file name generation subunit is used to perform hash processing on the target account and all file name cascade information under the target file directory to generate the target file name; The second file name generation subunit is used to perform hash processing on the target account and all file name information under the target file directory to generate the target file name.

5. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for determining maliciously copied files according to any one of claims 1 to 2 when executing the program.

6. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method for determining maliciously copied files according to any one of claims 1 to 2.

Images