FTP file restoration method and device and electronic equipment

Abstract

The invention provides an FTP file restoration method and device and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: receiving a file transfer protocol FTP data connection message; whether FTP control connection associated with an internet protocol IP of the FTP data connection message exists in a first application gateway ALG cache or not is inquired, and the first ALG cache is used for storing the association relationship between the IP and the received FTP control connection; if the FTP control connection associated with the IP exists in the first ALG cache, the FTP data connection message is cached; and associating the cached FTP data connection message with the received control connection to obtain a restored FTP file. By introducing the first ALG cache, the FTP control connection is searched through the IP when the FTP data connection is established, the FTP data connection message is cached, FTP data connection restoration is completed, and the FTP file restoration accuracy can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an FTP file restoration method, device and electronic equipment. Background Art

[0002] File Transfer Protocol (FTP) is a common file transfer method. In order to detect malicious files or sensitive information in files in bypass mode, it is necessary to restore the files transferred by FTP.

[0003] FTP is a typical dual-connection protocol, requiring both a control connection and a data connection. In multi-core concurrency scenarios, messages from different connections are mirrored out of order, with the control and data connections distributed across different central processing unit (CPU) cores. In bypass mode, data connection messages may arrive before control connection messages, leading to data connection association failures with the control connection. This can cause some FTP file restore failures and low FTP file restore accuracy. Summary of the Invention

[0004] In view of the problems existing in the prior art, the present invention provides an FTP file restoration method, device and electronic device.

[0005] The present invention provides an FTP file restoration method, comprising:

[0006] Receive FTP data connection message;

[0007] querying whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message in the first application gateway ALG cache, wherein the first ALG cache is used to store the association relationship between the IP and the received FTP control connection;

[0008] If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message;

[0009] The cached FTP data connection message is associated with the received control connection to obtain a restored FTP file.

[0010] According to the present invention, a method for restoring an FTP file is provided, the method further comprising:

[0011] querying whether there is an FTP control connection associated with the Internet Protocol port IP-PORT of the FTP data connection message in the second ALG cache, wherein the second ALG cache is used to store the association relationship between the IP-PORT and the FTP control connection;

[0012] If the FTP control connection associated with the IP-PORT is not found in the second ALG cache, the operation of querying whether the FTP control connection associated with the IP of the FTP data connection message exists in the first ALG cache is performed.

[0013] According to the present invention, a method for restoring an FTP file is provided, the method further comprising:

[0014] When an FTP control connection message is received, the FTP session port and file name are written into the parameter cache list of the corresponding FTP control connection, wherein the FTP control connection message carries the FTP session port and file name.

[0015] According to the present invention, a method for restoring an FTP file is provided, the method further comprising:

[0016] After the FTP file transfer is completed, the parameter cache list of the corresponding FTP control connection is queried according to the destination port of the FTP session;

[0017] If the session port in the parameter cache list includes the destination port, the FTP file is associated with the file name corresponding to the destination port.

[0018] According to an FTP file restoration method provided by the present invention, if the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message includes:

[0019] If the FTP control connection associated with the IP exists in the first ALG cache, creating an application waiting cache;

[0020] The FTP data connection message is cached in the application waiting cache.

[0021] According to the present invention, an FTP file restoration method is provided, the method further comprising: after receiving the FTP control connection message, storing the FTP control connection message in the second ALG cache.

[0022] According to an FTP file restoration method provided by the present invention, the FTP control connection message includes: at least one of an FTP control command, a transfer file name, and a transfer mode;

[0023] The FTP data connection message includes an FTP file.

[0024] The present invention also provides an FTP file restoration device, comprising:

[0025] A receiving module, used for receiving a file transfer protocol FTP data connection message;

[0026] a query module, configured to query a first application gateway ALG cache whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message, wherein the first ALG cache is configured to store an association between the IP and the received FTP control connection;

[0027] a cache module, configured to cache the FTP data connection message if the FTP control connection associated with the IP exists in the first ALG cache;

[0028] The association module is used to associate the cached FTP data connection message with the received control connection to obtain a restored FTP file.

[0029] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned FTP file restoration methods is implemented.

[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the FTP file restoration method described above is implemented.

[0031] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned FTP file restoration methods.

[0032] The FTP file restoration method, device, and electronic device provided by the present invention query, upon receiving an FTP data connection message, whether an FTP control connection associated with the IP address of the FTP data connection message exists in a first ALG cache, wherein the first ALG cache is used to store the association between the IP address and the received FTP control connection. If the FTP control connection associated with the IP address exists in the first ALG cache, the FTP data connection message is cached, and the cached FTP data connection message is associated with the received control connection to obtain a restored FTP file. Thus, by introducing the first ALG cache, the FTP control connection is searched by IP address when the FTP data connection is established, and the FTP data connection message is cached to complete FTP data connection restoration, thereby improving the accuracy of FTP file restoration. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 This is one of the schematic diagrams of FTP file restoration in the prior art;

[0035] Figure 2 This is the second schematic diagram of FTP file restoration in the prior art;

[0036] Figure 3 This is one of the flow charts of the FTP file restoration method provided by the present invention;

[0037] Figure 4 This is the second flow chart of the FTP file restoration method provided by the present invention;

[0038] Figure 5 It is a structural diagram of the FTP file restoration device provided by the present invention;

[0039] Figure 6 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0040] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0041] In order to facilitate a clearer understanding of the technical solutions provided by the embodiments of the present invention, some relevant knowledge is first introduced as follows.

[0042] 1. FTP control connection: This is used to transmit control instructions and does not involve specific file transfers. For example, it negotiates the FTP authentication method and whether the FTP data connection should use active or passive mode.

[0043] 2. FTP data connection: used for actual file transfer, including listing files, uploading and downloading files, etc.

[0044] 3. FTP active mode: After the FTP server receives the PORT active mode command and port number, it connects through port 20 of the server and the port opened by the client to send data.

[0045] 4. FTP passive mode: Send the PASV command to the FTP server. The server randomly opens a port (above 1024) locally, and then tells the client the open port. The client then connects to the open port on the server for data transmission.

[0046] 5. Under normal logic, after parsing the FTP control command port (PORT) command, an Application Level Gateway (ALG) entry for the Internet Protocol port (IP-PORT) is added. Subsequently, during server synchronization (Server SYN), the ALG module associates the FTP control command session (Session), sets this session as the FTP data channel, and then performs file restoration.

[0047] Figure 1 This is one of the schematic diagrams of FTP file restoration in the prior art, such as Figure 1 As shown in the figure, when the probe receives traffic data, the data may be playback data or received by multiple cores. As a result, when the server SYN arrives, the probe has not received the PORT command, and the ALG cannot be associated.

[0048] 6. When transferring files, first establish a control connection. After receiving the PORT command, create an ALG table entry. After the data connection completes the file transfer, it is necessary to associate the file name of the control connection (STOR command parameter).

[0049] Figure 2 This is the second schematic diagram of FTP file restoration in the prior art, such as Figure 2 As shown in the figure, when transferring files in batches, the data may be playback data or received by multiple cores, which may cause the associated STOR command to deviate when the Server SYN arrives.

[0050] The FTP file restoration method, device, and electronic device provided by the present invention, by introducing a first ALG cache, implement a search for an FTP control connection through the Internet Protocol (IP) when an FTP data connection is established, and then cache the FTP data connection message to complete the FTP data connection restoration, thereby improving the accuracy of FTP file restoration.

[0051] The following combination Figure 3-Figure 6 The present invention describes an FTP file restoration method, device and electronic device.

[0052] Figure 3 This is one of the flow charts of the FTP file restoration method provided by the present invention, such as Figure 3As shown, the method includes steps 301 to 304, wherein:

[0053] Step 301: Receive an FTP data connection message.

[0054] Step 302: Check whether there is an FTP control connection associated with the IP address of the FTP data connection message in the first ALG cache, wherein the first ALG cache is used to store the association relationship between the IP address and the received FTP control connection.

[0055] For example, according to the association relationship between the IP cached in the first ALG and the received FTP control connection, it is queried in the first ALG cache whether there is an FTP control connection associated with the IP of the FTP data connection message.

[0056] Step 303: If the FTP control connection associated with the IP exists in the first ALG cache, cache the FTP data connection message.

[0057] Step 304: Associate the cached FTP data connection message with the received control connection to obtain a restored FTP file.

[0058] It should be noted that the FTP file restoration method provided by the present invention is applicable to scenarios where files transferred via FTP need to be restored. The method can be performed by an FTP file restoration device, such as an electronic device, a server, or a control module in the device for performing the FTP file restoration method provided by the present invention.

[0059] The FTP control connection message includes at least one of an FTP control command, a transfer file name, and a transfer mode. The FTP file includes a plurality of FTP data connection messages.

[0060] Optionally, the first ALG cache may also be called an IP ALG cache.

[0061] Optionally, before executing the operation of querying the first ALG cache in step 302 whether there is an FTP control connection associated with the IP address of the FTP data connection message, the method further includes querying the second ALG cache whether there is an FTP control connection associated with the Internet Protocol port (IP-PORT) of the FTP data connection message, wherein the second ALG cache is used to store the association between the IP-PORT and the FTP control connection.

[0062] The second ALG cache is also an IP-PORT ALG cache. If the FTP control connection associated with the IP-PORT is not found in the second ALG cache, the operation of querying whether the first ALG cache has the FTP control connection associated with the IP of the FTP data connection message is performed.

[0063] Based on the existing IP-PORT ALG table, the present invention adds an IP ALG table for FTP data connections to determine whether an FTP control connection exists for the IP address. For connections that cannot be associated with an IP-PORT ALG, the IP ALG is searched. If it is an FTP control connection, the message is cached. Each time a data message is received, the associated control connection is queried again until the message cache times out or exceeds the limit. Optionally, after receiving an FTP control connection message, the FTP control connection message is stored in the second ALG cache.

[0064] The FTP file restoration method provided by the present invention queries a first ALG cache upon receiving an FTP data connection message to determine whether an FTP control connection associated with the IP address of the FTP data connection message exists. The first ALG cache is used to store associations between IP addresses and received FTP control connections. If the FTP control connection associated with the IP address exists in the first ALG cache, the FTP data connection message is cached, and the cached FTP data connection message is associated with the received control connection to obtain a restored FTP file. Thus, by introducing the first ALG cache, the FTP control connection is searched by IP address when the FTP data connection is established, and the FTP data connection message is cached to complete FTP data connection restoration, thereby improving the accuracy of FTP file restoration.

[0065] To address the problem in the prior art of batch file transfer that, due to factors such as the possibility that the data is playback data or that the data is received by multiple cores, the associated STOR command may deviate when the Server SYN arrives. The FTP file restoration method provided by the present invention further includes the following steps:

[0066] When an FTP control connection message is received, the FTP session port and file name are written into the parameter cache list of the corresponding FTP control connection, wherein the FTP control connection message carries the FTP session port and file name.

[0067] After the FTP file transfer is completed, the parameter cache list of the corresponding FTP control connection is queried according to the destination port of the FTP session;

[0068] If the session port in the parameter cache list includes the destination port, the FTP file is associated with the file name corresponding to the destination port.

[0069] That is to say, the present invention adds a port and file name cache in the FTP control connection, and adds it to the cache list after receiving the PORT and STOR commands; after the FTP data connection file transfer is completed, the cache of the corresponding control connection is queried according to the destination port of the SESSION, the file name association is completed, and the corresponding cache is released.

[0070] Optionally, in step 302, if the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message may include: if the FTP control connection associated with the IP exists in the first ALG cache, creating an application pending buffer (APP-PENDING) (TCP three-way handshake); and caching the FTP data connection message in the application pending buffer. The application pending buffer is used to cache the FTP data connection message.

[0071] The FTP file restoration method provided by the present invention includes restoring the FTP control connection and restoring the FTP data connection. The FTP control connection mainly restores the FTP control command, the name of the transferred file, the transfer mode and other information to prepare for establishing the data connection.

[0072] FTP data connection restoration mainly restores the file information actually transferred. Because the data connection is only responsible for transferring file data, all file-related information is stored in the control connection. Therefore, when the data connection is established, it is necessary to actively associate with the control connection to obtain the corresponding information.

[0073] The present invention proposes an IP ALG cache based on the existing IP-PORT ALG cache. After an IP-PORT ALG query fails, the IP ALG is queried again. If all queries fail, the query is terminated and the associated failure is resolved. If the IP ALG query succeeds, an APP-PENDING (TCP three-way handshake) cached data packet is created. The APP-PENDING (TCP three-way handshake) cached data packet is released until the IP-PORT ALG is subsequently found.

[0074] When restoring the control connection, the present invention establishes a PORT and STOR parameter cache list. When restoring the data connection, after the file restoration is completed, the PORT and STOR parameter cache list of the corresponding control connection will be searched according to the destination port, thereby greatly improving the accuracy of file restoration in the case of large traffic and batch transmission.

[0075] Figure 4This is the second flow chart of the FTP file restoration method provided by the present invention, as shown in FIG. Figure 4 As shown, the following steps are included:

[0076] First, when the bypass device receives the FTP data packet, it checks whether it hits the Session (connection information established by the first packet).

[0077] If the session is not found, the right branch is taken to check whether there is ALG information. If ALG is found, the FTPSession is created and the right branch ends. If ALG information is not found, the source port is checked to see if it is 20, and the IP ALG is checked to see if it exists. The session is created as an FTP cache type.

[0078] When a message hits a session, it checks whether it's an FTP cache session. If so, it performs an APP PENDING cache packet and an IP-PORT ALG query. If the query succeeds, it sends the cache packet up with the flag removed. This method significantly improves the correlation rate between FTP data connections and control connections, thereby increasing the FTP file restoration rate.

[0079] When restoring the control connection, a PORT and STOR cache list is established. After the data connection restores the file, the corresponding cache is searched through the destination port to obtain the restored file name, thereby completing the corresponding FTP file restoration. This avoids the problem of incorrect correspondence between data connection and control connection commands during batch file transfer, thereby improving the accuracy of FTP file restoration.

[0080] The FTP file restoration method provided by the present invention can effectively solve the problem of low FTP file restoration rate caused by disordered data connection and control connection in bypass mode by using two-level cache technology, and can improve the FTP file restoration rate under disordered connection in bypass mode.

[0081] The FTP file restoration device provided by the present invention is described below. The FTP file restoration device described below and the FTP file restoration method described above can be referenced to each other.

[0082] Figure 5 Schematic diagram of the structure of the FTP file restoration device provided by the present invention; the FTP file restoration device 500 includes: a receiving module 501, a query module 502, a cache module 503 and an association module 504; wherein,

[0083] Receiving module 501, for receiving a file transfer protocol FTP data connection message;

[0084] A query module 502 is configured to query a first application gateway ALG cache whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message, wherein the first ALG cache is configured to store an association between the IP and the received FTP control connection;

[0085] a cache module 503 configured to cache the FTP data connection message if the FTP control connection associated with the IP exists in the first ALG cache;

[0086] The association module 504 is configured to associate the cached FTP data connection message with the received control connection to obtain a restored FTP file.

[0087] The FTP file restoration device provided by the present invention queries a first ALG cache upon receiving an FTP data connection message for an FTP control connection associated with the IP address of the FTP data connection message. The first ALG cache is used to store associations between IP addresses and received FTP control connections. If the FTP control connection associated with the IP address exists in the first ALG cache, the FTP data connection message is cached, and the cached FTP data connection message is associated with the received control connection to obtain a restored FTP file. Thus, by introducing the first ALG cache, the FTP control connection is searched by IP address when the FTP data connection is established, and the FTP data connection message is cached to complete FTP data connection restoration, thereby improving the accuracy of FTP file restoration.

[0088] Optionally, the query module 502 is further configured to:

[0089] querying whether there is an FTP control connection associated with the Internet Protocol port IP-PORT of the FTP data connection message in the second ALG cache, wherein the second ALG cache is used to store the association relationship between the IP-PORT and the FTP control connection;

[0090] If the FTP control connection associated with the IP-PORT is not found in the second ALG cache, the operation of querying whether the FTP control connection associated with the IP of the FTP data connection message exists in the first ALG cache is performed.

[0091] Optionally, the device further comprises:

[0092] The writing module is used to write the FTP session port and file name into the parameter cache list of the corresponding FTP control connection when receiving the FTP control connection message, wherein the FTP control connection message carries the FTP session port and file name.

[0093] Optionally, the device further comprises:

[0094] A query module is used to query the parameter cache list of the corresponding FTP control connection according to the destination port of the FTP session after the FTP file transfer is completed;

[0095] An associating module is configured to associate the FTP file with a file name corresponding to the destination port if the session port in the parameter cache list includes the destination port.

[0096] Optionally, the cache module 503 is specifically configured to:

[0097] If the FTP control connection associated with the IP exists in the first ALG cache, creating an application waiting cache;

[0098] The FTP data connection message is cached in the application waiting cache.

[0099] Optionally, the cache module 503 is further configured to store the FTP control connection message in the second ALG cache after receiving the FTP control connection message.

[0100] Optionally, the FTP control connection message includes at least one of an FTP control command, a transfer file name, and a transfer mode.

[0101] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the FTP file restoration method, which includes:

[0102] Receive FTP data connection message;

[0103] querying whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message in the first application gateway ALG cache, wherein the first ALG cache is used to store the association relationship between the IP and the received FTP control connection;

[0104] If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message;

[0105] The cached FTP data connection message is associated with the received control connection to obtain a restored FTP file.

[0106] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0107] On the other hand, the present invention further provides a computer program product, comprising a computer program, which may be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the FTP file restoration method provided by the above methods, which includes:

[0108] Receive FTP data connection message;

[0109] querying whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message in the first application gateway ALG cache, wherein the first ALG cache is used to store the association relationship between the IP and the received FTP control connection;

[0110] If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message;

[0111] The cached FTP data connection message is associated with the received control connection to obtain a restored FTP file.

[0112] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the FTP file restoration method provided by the above methods is implemented, and the method includes:

[0113] Receive FTP data connection message;

[0114] querying whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message in the first application gateway ALG cache, wherein the first ALG cache is used to store the association relationship between the IP and the received FTP control connection;

[0115] If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message;

[0116] The cached FTP data connection message is associated with the received control connection to obtain a restored FTP file.

[0117] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0118] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for restoring FTP files, characterized in that: include: Receive FTP data connection message; querying whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message in the first application gateway ALG cache, wherein the first ALG cache is used to store the association relationship between the IP and the received FTP control connection; If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message; The cached FTP data connection message is associated with the received control connection to obtain a restored FTP file.

2. The method according to claim 1, characterized in that The method further comprises: querying whether there is an FTP control connection associated with the Internet Protocol port IP-PORT of the FTP data connection message in the second ALG cache, wherein the second ALG cache is used to store the association relationship between the IP-PORT and the FTP control connection; If the FTP control connection associated with the IP-PORT is not found in the second ALG cache, the operation of querying whether the FTP control connection associated with the IP of the FTP data connection message exists in the first ALG cache is performed.

3. The method according to claim 1, characterized in that The method further comprises: When an FTP control connection message is received, the FTP session port and file name are written into the parameter cache list of the corresponding FTP control connection, wherein the FTP control connection message carries the FTP session port and file name.

4. The method according to claim 3, characterized in that The method further comprises: After the FTP file transfer is completed, the parameter cache list of the corresponding FTP control connection is queried according to the destination port of the FTP session; If the session port in the parameter cache list includes the destination port, the FTP file is associated with the file name corresponding to the destination port.

5. The method according to claim 1, wherein If the FTP control connection associated with the IP exists in the first ALG cache, caching the FTP data connection message includes: If the FTP control connection associated with the IP exists in the first ALG cache, creating an application waiting cache; The FTP data connection message is cached in the application waiting cache.

6. The method according to claim 2, characterized in that The method further includes: after receiving the FTP control connection message, storing the FTP control connection message in the second ALG cache.

7. The method according to claim 3, characterized in that The FTP control connection message includes at least one of: an FTP control command, a transfer file name, and a transfer mode.

8. An FTP file restoration device, characterized in that: include: A receiving module, used for receiving a file transfer protocol FTP data connection message; a query module, configured to query a first application gateway ALG cache whether there is an FTP control connection associated with the Internet Protocol IP of the FTP data connection message, wherein the first ALG cache is configured to store an association between the IP and the received FTP control connection; a cache module, configured to cache the FTP data connection message if the FTP control connection associated with the IP exists in the first ALG cache; The association module is used to associate the cached FTP data connection message with the received control connection to obtain a restored FTP file.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the FTP file restoration method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the FTP file restoration method according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the FTP file restoration method according to any one of claims 1 to 7 is implemented.

Images