File tampering detection method, device, electronic equipment and storage medium
By scanning and verifying files carrying digital signatures, the problem that the anti-virus engine cannot detect tampered white files is solved, effectively detecting tampered files, and ensuring the integrity and authenticity of the files.
Patent Information
- Application Number
- CN202210330159.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-03-31
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-03-31
AI Technical Summary
The anti-virus engine cannot effectively detect white files tampered with by viruses, especially because malicious code and junk data are added to the tail of the binary code, resulting in increased detection difficulty.
By scanning the files carrying digital signatures, verifying the validity of the digital signature, obtaining valid data, reorganizing the files, and detecting whether the file has been tampered with based on the new digital signature, and removing the redundant data at the end of the binary code.
It effectively solves the problem that the anti-virus engine cannot detect tampered white files, improves the detection ability of tampered files, and ensures the integrity and authenticity of the files.
Smart Images
Figure CN114756863B_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present invention relate to the field of computer security technology, and in particular to a file tampering detection method, device, electronic device and storage medium. Background Art
[0002] With the widespread use of computer technology in various fields of social life, viruses have also come one after another as its accessories. Due to the infectivity, replication and destructiveness of these viruses, they have become a major problem that plagues computer use.
[0003] In the related art, the virus may tamper with the officially released white file by, for example, adding redundant data such as malicious code and junk data to the end of the binary code of the white file, and hiding the malicious code in the junk data. The tampered white file increases the detection difficulty of the anti-virus engine (such as anti-virus software), so that the tampered white file cannot be effectively detected. Summary of the invention
[0004] In order to solve the problem that the anti-virus engine cannot effectively detect tampered white files, the embodiments of the present invention provide a file tampering detection method, device, electronic device and storage medium.
[0005] In a first aspect, an embodiment of the present invention provides a file tampering detection method, which is applied to a client and includes:
[0006] Scanning a first file to be detected that carries a digital signature;
[0007] Verifying whether the digital signature of each of the first files to be detected is valid;
[0008] If the digital signature of the current first file to be detected is invalid, obtaining valid data of the current first file to be detected based on the digital signature of the current first file to be detected;
[0009] Recombining the valid data and digital signature of the current first file to be detected into a second file to be detected;
[0010] Based on the digital signature of the second file to be detected, detect whether the first file to be detected and the second file to be detected have been tampered with.
[0011] In a possible design, verifying whether the digital signature of each of the first files to be detected is valid includes:
[0012] For each of the first files to be detected, execute:
[0013] Extracting a first hash value from the digital signature of the current first file to be detected;
[0014] Performing hash calculation on the data except the digital signature in the current first file to be detected to obtain a second hash value;
[0015] Based on the first hash value and the second hash value, verify whether the digital signature of the current first file to be detected is valid.
[0016] In a possible design, verifying whether the digital signature of the current first file to be detected is valid based on the first hash value and the second hash value includes:
[0017] If the first hash value and the second hash value are the same, it indicates that the digital signature of the current first file to be detected is valid;
[0018] If the first hash value is different from the second hash value, it indicates that the digital signature of the current first file to be detected is invalid.
[0019] In a possible design, the obtaining of valid data of the current first file to be detected based on the digital signature of the current first file to be detected includes:
[0020] Extracting the digital signature of the current first file to be detected, and obtaining the starting position and length of the valid data of the current first file to be detected in the binary code of the current first file to be detected;
[0021] Based on the starting position and the occupied length, valid data of the current first file to be detected is obtained.
[0022] In a possible design, the detecting whether the first file to be detected and the second file to be detected are tampered with based on the digital signature of the second file to be detected includes:
[0023] Verifying whether the digital signature of the second file to be detected is valid;
[0024] If the digital signature of the second file to be detected is valid, the second file to be detected is determined as a white file that has not been tampered with, and the first file to be detected is determined as a white file that has been tampered with.
[0025] In a possible design, verifying whether the digital signature of the second file to be detected is valid includes:
[0026] Extracting a third hash value from the digital signature of the second file to be detected;
[0027] Performing hash calculation on the data except the digital signature in the second to-be-detected file to obtain a fourth hash value;
[0028] Based on the third Hash value and the fourth Hash value, verify whether the digital signature of the second file to be detected is valid.
[0029] In a possible design, verifying whether the digital signature of the second to-be-detected file is valid based on the third hash value and the fourth hash value includes:
[0030] If the third hash value is the same as the fourth hash value, it indicates that the digital signature of the current second file to be detected is valid;
[0031] If the third hash value is different from the fourth hash value, it indicates that the digital signature of the current second file to be detected is invalid.
[0032] In a second aspect, an embodiment of the present invention further provides a file tampering detection device, which is applied to a client and includes:
[0033] A scanning module, used for scanning a first file to be detected carrying a digital signature;
[0034] A verification module, used to verify whether the digital signature of each of the first files to be detected is valid;
[0035] An acquisition module, configured to acquire valid data of the current first file to be detected based on the digital signature of the current first file to be detected if the digital signature of the current first file to be detected is invalid;
[0036] A reorganization module, used for reorganizing the valid data and digital signature of the current first file to be detected into a second file to be detected;
[0037] A detection module is used to detect whether the first file to be detected and the second file to be detected have been tampered with based on the digital signature of the second file to be detected.
[0038] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.
[0039] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.
[0040] The embodiment of the present invention provides a file tampering detection method, device, electronic device and storage medium. First, an anti-virus engine scans a first file to be detected carrying a digital signature, and verifies whether the digital signature of each first file to be detected is valid; if the digital signature of the current first file to be detected is invalid, then based on the digital signature of the current first file to be detected, valid data of the current first file to be detected is obtained, so that redundant data added to the end of the binary code of a white file can be removed; then the valid data and the digital signature of the current first file to be detected are recombined into a second file to be detected, so as to detect whether the first file to be detected and the second file to be detected are tampered with based on the digital signature of the second file to be detected, thereby solving the problem that the anti-virus engine cannot effectively detect the tampered white file. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0042] Figure 1 It is a flow chart of a file tampering detection method provided by an embodiment of the present invention;
[0043] Figure 2 is a flow chart of another file tampering detection method provided by an embodiment of the present invention;
[0044] Figure 3 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;
[0045] Figure 4 It is a structural diagram of a file tampering detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0047] As mentioned above, the virus may tamper with the officially released white file by, for example, adding redundant data such as malicious code and junk data to the end of the binary code of the white file and hiding the malicious code in the junk data.
[0048] In order to solve this technical problem, the inventors considered that officially released files often carry digital signatures, so the validity of the digital signature can be used to detect whether the file to be detected has been tampered with, thereby solving the problem that the anti-virus engine cannot effectively detect tampered white files.
[0049] The specific implementation of the above concept is described below.
[0050] Please refer to Figure 1 , an embodiment of the present invention provides a file tampering detection method, the method comprising:
[0051] Step 100: Scanning a first file to be detected that carries a digital signature;
[0052] Step 102: Verify whether the digital signature of each first file to be detected is valid;
[0053] Step 104: if the digital signature of the current first file to be detected is invalid, obtaining valid data of the current first file to be detected based on the digital signature of the current first file to be detected;
[0054] Step 106: Recombining the valid data and digital signature of the current first file to be detected into a second file to be detected;
[0055] Step 108: Based on the digital signature of the second file to be detected, detect whether the first file to be detected and the second file to be detected have been tampered with.
[0056] In the embodiment of the present invention, the anti-virus engine first scans the first files to be detected that carry digital signatures, and verifies whether the digital signatures of each first file to be detected are valid; if the digital signature of the current first file to be detected is invalid, then based on the digital signature of the current first file to be detected, valid data of the current first file to be detected is obtained, so that redundant data added to the end of the binary code of the white file can be removed; then the valid data and the digital signature of the current first file to be detected are recombined into a second file to be detected, so as to detect whether the first file to be detected and the second file to be detected are tampered with based on the digital signature of the second file to be detected, thereby solving the problem that the anti-virus engine cannot effectively detect the tampered white file.
[0057] Described below Figure 1 How the various steps are performed.
[0058] For step 100:
[0059] A digital signature refers to a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information sent by the sender.
[0060] Take PE file as an example. There is an IMAGE_OPTIONAL_HEADER32 structure in the IMAGE_NT_HEADERS structure of PE file. The fifth IMAGE_DATA_DIRECTORY item in the IMAGE_OPTIONAL_HEADER32 structure points to the digital signature of the PE file. Specifically, VirtualAddress and dwSingSize in the fifth IMAGE_DATA_DIRECTORY item indicate the location and size of the digital signature respectively. If these two items are not zero, it means that there is a digital signature in the PE file.
[0061] In order to prevent tampering, white files released by official sources (such as Office, Windows, etc.) usually carry digital signatures. In order to increase the difficulty of anti-virus detection, criminals will add redundant data such as malicious code and junk data to the end of the binary code of white files, and hide the malicious code in the junk data. Therefore, in order to detect whether the white files released by the official sources have been tampered with, you can use the digital signatures carried by the white files. For specific methods of use, please refer to the following.
[0062] Regarding step 102:
[0063] The anti-tampering logic of digital signature is: the sender uses a hash function to generate a message digest from the message text, and then encrypts the digest with the sender's private key. The encrypted summary will be sent to the receiver together with the message as the digital signature of the message. The receiver first uses the same hash function as the sender to calculate the message digest (i.e. hash value) from the original message received, and then uses the public key to decrypt the digital signature attached to the message. If the two digests are the same, the receiver can confirm that the message is from the sender.
[0064] Digital signatures have two functions: one is that they can determine that the message is indeed signed and sent by the sender, because no one can forge the sender's signature; the other is that digital signatures can determine the integrity of the message, because the characteristic of digital signatures is that they represent the characteristics of the file. If the file changes, the value of the digital summary (that is, the hash value) will also change, that is, different files will get different digital summaries.
[0065] In some implementations, step 102 may include:
[0066] For each first file to be detected, execute:
[0067] Extracting a first hash value from the digital signature of the current first file to be detected;
[0068] Performing hash calculation on the data except the digital signature in the current first file to be detected to obtain a second hash value;
[0069] Based on the first hash value and the second hash value, verify whether the digital signature of the current first file to be detected is valid.
[0070] In this embodiment, by comparing the first hash value in the digital signature with the second hash value obtained by hash calculation, it can be determined whether the digital signature of the current first file to be detected is valid.
[0071] It is understandable that the first hash value is an encrypted field in the digital signature. To extract the first hash value, it is necessary to access the official website where the current first file to be detected is located to obtain the public key corresponding to the current first file to be detected, thereby decrypting the digital signature and obtaining the first hash value. At the same time, the hash function corresponding to the first file to be detected can also be obtained from the official website where the current first file to be detected is located, so as to use the hash function to perform hash calculation on the data in the current first file to be detected except the digital signature to obtain the second hash value. Among them, hash functions include but are not limited to MD5 (Message-Digest Algorithm 5), SHA-1, SHA-2, SHA-3 and RIPEMD-160.
[0072] In some implementations, the step of “verifying whether the digital signature of the current first file to be detected is valid based on the first hash value and the second hash value” may include:
[0073] If the first hash value and the second hash value are the same, it indicates that the digital signature of the current first file to be detected is valid;
[0074] If the first hash value and the second hash value are different, it indicates that the digital signature of the current first file to be detected is invalid.
[0075] If the digital signature of the first file to be detected is valid, it further indicates that the first file to be detected is a white file that has not been tampered with; if the digital signature of the first file to be detected is invalid, it indicates that the officially released white file has been tampered with. However, at this time, it is not possible to determine the real reason for the tampering of the white file, that is, it is not possible to determine whether the valid data of the white file has been tampered with or whether redundant data has been added to the end of the binary code of the white file. Therefore, it is necessary to continue to determine the real reason for the tampering of the white file through subsequent steps.
[0076] Regarding step 104:
[0077] In order to determine the real reason for the white file tampering when the digital signature of the current first file to be detected is invalid, the digital signature of the current first file to be detected can be used to obtain valid data of the current first file to be detected.
[0078] In some implementations, step 104 may include:
[0079] Extracting the digital signature of the current first file to be detected, and obtaining the starting position and length of the valid data of the current first file to be detected in the binary code of the current first file to be detected;
[0080] Based on the starting position and the length occupied, obtain the valid data of the current first file to be detected.
[0081] In this embodiment, the valid data of the first file to be detected can be obtained by extracting the starting position and length of the valid data from the digital signature.
[0082] Take PE file as an example. For example, if the size of PE file is 11M and the digital signature is located at 10-11M, by extracting the starting position and length of the valid data in the digital signature, it can be obtained that the valid data of the PE file is located at 0-10M.
[0083] Regarding step 106:
[0084] After obtaining the valid data of the current first file to be detected, the valid data and digital signature of the current first file to be detected can be reorganized, so that the reorganized second file to be detected can continue to be verified, which is helpful to determine the real reason for the white file tampering when the digital signature of the current first file to be detected is invalid.
[0085] It can be understood that reassembly may refer to splicing the binary code of the digital signature to the end of the binary code of the valid data.
[0086] Regarding step 108:
[0087] In some implementations, step 108 may include:
[0088] Verify whether the digital signature of the second file to be detected is valid;
[0089] If the digital signature of the second file to be detected is valid, the second file to be detected is determined as a white file that has not been tampered with, and the first file to be detected is determined as a white file that has been tampered with.
[0090] In this embodiment, by verifying whether the digital signature of the second file to be detected is valid, if the digital signature of the second file to be detected is valid, the second file to be detected can be determined as a white file that has not been tampered with. At the same time, it can also be determined that the real reason for the tampering of the white file when the digital signature of the current first file to be detected is invalid is due to the addition of redundant data at the end of the binary code of the white file, that is, the first file to be detected is a tampered white file.
[0091] In some implementations, the step of “verifying whether the digital signature of the second file to be detected is valid” may include:
[0092] Extracting a third hash value from the digital signature of the second file to be detected;
[0093] Performing hash calculation on the data except the digital signature in the second to-be-detected file to obtain a fourth hash value;
[0094] Based on the third hash value and the fourth hash value, verify whether the digital signature of the second file to be detected is valid.
[0095] In this embodiment, by comparing the third hash value in the digital signature with the fourth hash value obtained by hash calculation, it can be determined whether the digital signature of the second file to be detected is valid.
[0096] It can be understood that a first hash value of a digital signature of a first file to be detected is the same as a third hash value of a second detection file obtained from the first file to be detected.
[0097] It can also be understood that the third hash value is encrypted in the digital signature. To extract the third hash value, it is necessary to access the official website where the second file to be detected is located to obtain the public key corresponding to the second file to be detected, thereby decrypting the digital signature to obtain the third hash value. Of course, the first hash value obtained in the above step 102 can also be used as the third hash value in the digital signature of the second file to be detected.
[0098] At the same time, the hash function corresponding to the second file to be detected can also be obtained from the official website where the second file to be detected is located, so as to use the hash function to perform hash calculation on the data except the digital signature in the second file to be detected to obtain a fourth hash value. Among them, the hash function includes but is not limited to MD5 (Message-Digest Algorithm 5), SHA-1, SHA-2, SHA-3 and RIPEMD-160.
[0099] In some implementations, the step of “verifying whether the digital signature of the second to-be-detected file is valid based on the third hash value and the fourth hash value” may include:
[0100] If the third hash value and the fourth hash value are the same, it indicates that the digital signature of the current second file to be detected is valid;
[0101] If the third hash value is different from the fourth hash value, it indicates that the digital signature of the current second file to be detected is invalid.
[0102] If the digital signature of the second file to be detected is valid, it further indicates that the second file to be detected is a white file that has not been tampered with; if the digital signature of the second file to be detected is invalid, it indicates that the valid data and the digital signature of the second file to be detected do not match, that is, at least one of the two has been tampered with. In other words, when the digital signature of the second file to be detected is invalid, it is still impossible to determine that the white file has not been tampered with, that is, it is impossible to determine the real reason for the tampering of the white file.
[0103] In order to further determine the real reason why the white file has been tampered with, the server can be used to determine whether there is a white file corresponding to the digital signature of the second file to be detected. If so, it can be proved that the digital signature of the second file to be detected is correct and the valid data of the second file to be detected has been tampered with. At the same time, the server can also feedback the white file that has not been tampered with to the client.
[0104] In some implementations, if the digital signature of the second file to be detected is invalid, the following operations are performed:
[0105] Upload the digital signature of the second file to be detected to the server;
[0106] Receive the result fed back by the server;
[0107] If the server has a white file corresponding to the digital signature of the second file to be detected, the server receives the white file sent by the server, and determines the first file to be detected and the second file to be detected as tampered white files.
[0108] In this embodiment, when the digital signature of the second file to be detected is invalid, the client can upload the digital signature of the second file to be detected to the server, so that the server can determine whether it has a white file corresponding to the digital signature of the second file to be detected; if the server has a white file corresponding to the digital signature of the second file to be detected, it can be proved that the digital signature of the second file to be detected is correct and the valid data of the second file to be detected has been tampered with, and the server can also feedback the white file that has not been tampered with to the client.
[0109] It should be noted that when the server receives a query request carrying a digital signature from the client, it will decrypt the digital signature and obtain the hash value to be searched, and then the server will determine the result to be fed back to the client based on the hash value to be searched and a pre-created database; wherein the database includes white files and hash values corresponding to the digital signatures of each white file, and the results include whether the server has a white file corresponding to the digital signature of the query request and whether the server does not have a white file corresponding to the digital signature of the query request.
[0110] In some implementations, the query request also carries the official source of the white file corresponding to the digital signature, and the specific manner in which the server decrypts the digital signature may include:
[0111] The server visits the official website of the white file according to the official source of the white file;
[0112] The server obtains the public key of the white file from the official website;
[0113] The server uses the public key to decrypt the digital signature and obtain the hash value to be found.
[0114] In some implementations, after the step of “receiving the result fed back by the server”, the following steps may also be included:
[0115] If the server does not have a white file corresponding to the digital signature of the second file to be detected, the first file to be detected and the second file to be detected are determined as suspected malicious files.
[0116] In this embodiment, if the real reason for the tampering of the white file still cannot be determined with the help of the server, the maliciousness of the first file to be detected and the second file to be detected can be increased by introducing the server judgment scheme. Therefore, there is reason to determine the first file to be detected and the second file to be detected as suspected malicious files to remind users to operate with caution.
[0117] In order to improve the responsiveness of the server, the corresponding official website can be accessed according to the query requests sent by each client, and the white files corresponding to the query requests can be collected.
[0118] In some embodiments, the query request also carries the official source of the white file corresponding to the digital signature;
[0119] When the result is that the server does not have a white file corresponding to the digital signature of the query request, the server can access the official website of the white file according to the official source of the white file carried in the query request sent by each client to collect the white file from the official website.
[0120] In this embodiment, when each client sends a query request to the server, it indicates that the client may have been infected by a virus that tampered with a specific white file. Therefore, the server can access the corresponding official website to collect the corresponding white file and feed it back to the client, which can improve the server's responsiveness.
[0121] Since some viruses that infect specific white files belong to the same virus family and have similar tampering habits, these specific white files can be centrally analyzed with the help of query requests sent by various clients.
[0122] In some embodiments, the query request also carries the official source of the white file corresponding to the digital signature;
[0123] When the result is that the server does not have a white file corresponding to the digital signature of the query request, the server can classify the official websites of the white files according to the official sources of the white files carried in the query requests sent by each client to analyze the first file to be detected of the same official website.
[0124] In this embodiment, by classifying the official websites of the white files, it is convenient for the user to analyze the first to-be-detected files of the same official website to identify the virus family, thereby further improving the anti-virus detection capability of the client anti-virus engine.
[0125] Figure 2 FIG. 1 is a flowchart showing a method for detecting file tampering according to another embodiment. Figure 2 , when applied to the client, includes:
[0126] Step 200: The client scans the first file to be detected that carries the digital signature;
[0127] Step 202: The client verifies whether the digital signature of each first file to be detected is valid; if so, execute step 204; if not, execute step 206;
[0128] Step 204: The client determines the first file to be detected as a white file that has not been tampered with;
[0129] Step 206: The client obtains valid data of the current first file to be detected based on the digital signature of the current first file to be detected;
[0130] Step 208: The client reassembles the valid data and digital signature of the current first file to be detected into a second file to be detected;
[0131] Step 210: The client verifies whether the digital signature of the second file to be detected is valid; if so, execute step 212; if not, execute step 214;
[0132] Step 212: The client determines the second file to be detected as a white file that has not been tampered with, and determines the first file to be detected as a white file that has been tampered with;
[0133] Step 214: The client uploads the digital signature of the second file to be detected to the server;
[0134] Step 216: The client receives the result fed back by the server;
[0135] Step 218: The client receives the white file sent by the server, and determines the first file to be detected and the second file to be detected as tampered white files.
[0136] When the method is applied to a server, it includes:
[0137] Step 300: The server receives a query request sent by the client and carrying a digital signature of a second file to be detected;
[0138] Step 302: The server decrypts the digital signature to obtain the hash value to be searched;
[0139] Step 304: The server determines the result to be fed back to the client based on the hash value to be found and the pre-created database; and executes steps 306, 308 and 310 respectively;
[0140] Step 306: The server sends the result to the client;
[0141] Step 308: When the result is that the server does not have a white file corresponding to the digital signature of the query request, the server accesses the official website of the white file according to the official source of the white file carried in the query request sent by each client, so as to collect the white file from the official website;
[0142] Step 310: When the result is that the server does not have a white file corresponding to the digital signature of the query request, the server classifies the official websites of the white files according to the official sources of the white files carried in the query requests sent by each client, so as to analyze the first file to be detected of the same official website.
[0143] like Figure 3 , Figure 4 As shown, an embodiment of the present invention provides a file tampering detection device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 3 As shown in FIG. 1 , a hardware architecture diagram of an electronic device in which a file tampering detection device provided by an embodiment of the present invention is located is shown in FIG. Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 4 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it.
[0144] like Figure 4 As shown, this embodiment provides a file tampering detection device, including:
[0145] The scanning module 400 is used to scan the first file to be detected that carries the digital signature;
[0146] Verification module 402, used to verify whether the digital signature of each first file to be detected is valid;
[0147] The acquisition module 404 is used to acquire valid data of the current first file to be detected based on the digital signature of the current first file to be detected if the digital signature of the current first file to be detected is invalid;
[0148] A reorganization module 406, configured to reorganize the valid data and digital signature of the current first file to be detected into a second file to be detected;
[0149] The detection module 408 is used to detect whether the first file to be detected and the second file to be detected have been tampered with based on the digital signature of the second file to be detected.
[0150] In an embodiment of the present invention, the scanning module 400 can be used to execute step 100 in the above method embodiment, the verification module 402 can be used to execute step 102 in the above method embodiment, the acquisition module 404 can be used to execute step 104 in the above method embodiment, the recombination module 406 can be used to execute step 106 in the above method embodiment, and the detection module 408 can be used to execute step 108 in the above method embodiment.
[0151] In one embodiment of the present invention, the verification module 402 is used to perform the following operations:
[0152] For each first file to be detected, execute:
[0153] Extracting a first hash value from the digital signature of the current first file to be detected;
[0154] Performing hash calculation on the data except the digital signature in the current first file to be detected to obtain a second hash value;
[0155] Based on the first hash value and the second hash value, verify whether the digital signature of the current first file to be detected is valid.
[0156] In one embodiment of the present invention, when verifying whether the digital signature of the current first file to be detected is valid based on the first hash value and the second hash value, the verification module 402 is used to perform the following operations:
[0157] If the first hash value and the second hash value are the same, it indicates that the digital signature of the current first file to be detected is valid;
[0158] If the first hash value and the second hash value are different, it indicates that the digital signature of the current first file to be detected is invalid.
[0159] In one embodiment of the present invention, the acquisition module 404 is used to perform the following operations:
[0160] Extracting the digital signature of the current first file to be detected, and obtaining the starting position and length of the valid data of the current first file to be detected in the binary code of the current first file to be detected;
[0161] Based on the starting position and the length occupied, obtain the valid data of the current first file to be detected.
[0162] In one embodiment of the present invention, the detection module 408 is used to perform the following operations:
[0163] Verify whether the digital signature of the second file to be detected is valid;
[0164] If the digital signature of the second file to be detected is valid, the second file to be detected is determined as a white file that has not been tampered with, and the first file to be detected is determined as a white file that has been tampered with.
[0165] In one embodiment of the present invention, the detection module 408 is used to perform the following operations when verifying whether the digital signature of the second file to be detected is valid:
[0166] Extracting a third hash value from the digital signature of the second file to be detected;
[0167] Performing hash calculation on the data except the digital signature in the second to-be-detected file to obtain a fourth hash value;
[0168] Based on the third hash value and the fourth hash value, verify whether the digital signature of the second file to be detected is valid.
[0169] In one embodiment of the present invention, when verifying whether the digital signature of the second to-be-detected file is valid based on the third hash value and the fourth hash value, the detection module 408 is configured to perform the following operations:
[0170] If the third hash value and the fourth hash value are the same, it indicates that the digital signature of the current second file to be detected is valid;
[0171] If the third hash value is different from the fourth hash value, it indicates that the digital signature of the current second file to be detected is invalid.
[0172] In one embodiment of the present invention, when the digital signature of the second file to be detected is invalid, the method further includes:
[0173] The interactive module is used to perform the following operations:
[0174] Upload the digital signature of the second file to be detected to the server;
[0175] Receive the result fed back by the server;
[0176] If the server has a white file corresponding to the digital signature of the second file to be detected, the server receives the white file sent by the server, and determines the first file to be detected and the second file to be detected as tampered white files.
[0177] In one embodiment of the present invention, the result fed back by the server is determined in the following manner:
[0178] The server receives a query request with a digital signature sent by the client;
[0179] The server decrypts the digital signature and obtains the hash value to be found;
[0180] The server determines the result to be fed back to the client based on the hash value to be found and a pre-created database; wherein the database includes white files and hash values corresponding to the digital signatures of each white file, and the results include whether the server has a white file corresponding to the digital signature of the query request and whether the server does not have a white file corresponding to the digital signature of the query request.
[0181] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a file tampering detection device. In other embodiments of the present invention, a file tampering detection device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.
[0182] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.
[0183] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a file tampering detection method in any embodiment of the present invention is implemented.
[0184] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a file tampering detection method in any embodiment of the present invention.
[0185] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.
[0186] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.
[0187] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.
[0188] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.
[0189] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.
[0190] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.
[0191] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.
[0192] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A file tampering detection method, characterized in that: Applied to the client, including: Scanning a first file to be detected that carries a digital signature; Verifying whether the digital signature of each of the first files to be detected is valid; If the digital signature of the current first file to be detected is invalid, obtaining valid data of the current first file to be detected based on the digital signature of the current first file to be detected; Recombining the valid data and digital signature of the current first file to be detected into a second file to be detected; Based on the digital signature of the second file to be detected, detecting whether the first file to be detected and the second file to be detected have been tampered with; The obtaining valid data of the current first file to be detected based on the digital signature of the current first file to be detected includes: Extracting the digital signature of the current first file to be detected, and obtaining the starting position and length of the valid data of the current first file to be detected in the binary code of the current first file to be detected; Based on the starting position and the occupied length, obtaining valid data of the current first file to be detected; The detecting whether the first file to be detected and the second file to be detected have been tampered with based on the digital signature of the second file to be detected includes: Verifying whether the digital signature of the second file to be detected is valid; If the digital signature of the second file to be detected is valid, determining the second file to be detected as a white file that has not been tampered with, and determining the first file to be detected as a white file that has been tampered with; The verifying whether the digital signature of the second file to be detected is valid includes: Extracting a third hash value from the digital signature of the second file to be detected; Performing hash calculation on the data except the digital signature in the second to-be-detected file to obtain a fourth hash value; Based on the third Hash value and the fourth Hash value, verify whether the digital signature of the second file to be detected is valid; The verifying whether the digital signature of the second to-be-detected file is valid based on the third Hash value and the fourth Hash value includes: If the third hash value is the same as the fourth hash value, it indicates that the digital signature of the current second file to be detected is valid; If the third hash value is different from the fourth hash value, it indicates that the digital signature of the current second file to be detected is invalid.
2. The method according to claim 1, characterized in that The verifying whether the digital signature of each of the first files to be detected is valid includes: For each of the first files to be detected, execute: Extracting a first hash value from the digital signature of the current first file to be detected; Performing hash calculation on the data except the digital signature in the current first file to be detected to obtain a second hash value; Based on the first hash value and the second hash value, verify whether the digital signature of the current first file to be detected is valid.
3. The method according to claim 2, characterized in that The verifying whether the digital signature of the current first file to be detected is valid based on the first hash value and the second hash value includes: If the first hash value and the second hash value are the same, it indicates that the digital signature of the current first file to be detected is valid; If the first hash value is different from the second hash value, it indicates that the digital signature of the current first file to be detected is invalid.
4. A file tampering detection device, characterized in that: Applied to the client, including: A scanning module, used for scanning a first file to be detected carrying a digital signature; A verification module, used to verify whether the digital signature of each of the first files to be detected is valid; An acquisition module, configured to acquire valid data of the current first file to be detected based on the digital signature of the current first file to be detected if the digital signature of the current first file to be detected is invalid; A reorganization module, used for reorganizing the valid data and digital signature of the current first file to be detected into a second file to be detected; A detection module, configured to detect whether the first file to be detected and the second file to be detected have been tampered with based on the digital signature of the second file to be detected; The acquisition module is used to perform the following operations: Extracting the digital signature of the current first file to be detected, and obtaining the starting position and length of the valid data of the current first file to be detected in the binary code of the current first file to be detected; Based on the starting position and the occupied length, obtaining valid data of the current first file to be detected; The detection module is used to perform the following operations: Verifying whether the digital signature of the second file to be detected is valid; If the digital signature of the second file to be detected is valid, determining the second file to be detected as a white file that has not been tampered with, and determining the first file to be detected as a white file that has been tampered with; When executing the verification of whether the digital signature of the second file to be detected is valid, the detection module is used to perform the following operations: Extracting a third hash value from the digital signature of the second file to be detected; Performing hash calculation on the data except the digital signature in the second to-be-detected file to obtain a fourth hash value; Based on the third Hash value and the fourth Hash value, verify whether the digital signature of the second file to be detected is valid; When the detection module verifies whether the digital signature of the second file to be detected is valid based on the third Hash value and the fourth Hash value, the detection module is used to perform the following operations: If the third hash value is the same as the fourth hash value, it indicates that the digital signature of the current second file to be detected is valid; If the third hash value is different from the fourth hash value, it indicates that the digital signature of the current second file to be detected is invalid.
5. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.
6. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 3.