File security detection method, device and electronic device

Abstract

The present application discloses a file security detection method, device and electronic device, which are used to solve the problem that the security of files cannot be detected in batches and quickly in the prior art. The method includes: a security detection server obtains multiple groups of log data and multiple groups of rule data from a log collection database; the security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, and a group of data to be detected includes a group of log data and a group of rule data; the security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on the multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a file security detection method, device and electronic equipment. Background Art

[0002] With the rapid development of computer technology, the data storage capacity of database systems has been greatly improved, and Simple Storage Service (S3) servers have emerged.

[0003] In order to achieve the purpose of attacking the S3 server, attackers of the S3 server often disguise files containing threatening attack content as regular file types allowed to be uploaded by the S3 server, upload the files containing threatening attack content to the S3 server, and wait for the files containing threatening attack content to be called to cause an offensive event.

[0004] In the prior art, files of multiple S3 servers are stored in their respective corresponding S3 servers. This decentralized storage method results in extremely low efficiency in security detection of a large number of files on the S3 server, and it is impossible to perform batch security detection operations on a large number of files, which greatly increases the risk of the S3 server being attacked. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device and electronic device for detecting the security of files, which can solve the problem in the prior art that the security of files cannot be detected in batches and quickly.

[0006] In order to solve the above technical problems, this application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for detecting file security, the method comprising:

[0008] The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database;

[0009] The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0010] The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data;

[0011] Among them, a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0012] In a second aspect, an embodiment of the present application provides a device for detecting file security, the device comprising:

[0013] A security detection server is used to obtain multiple sets of log data and multiple sets of rule data from a log collection database;

[0014] The security detection server is used to associate the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0015] The security detection server is used to perform security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data;

[0016] Among them, a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0017] In a third aspect, an electronic device is provided, the electronic device comprising:

[0018] Processor; and

[0019] a memory arranged to store computer executable instructions which, when executed, cause the processor to:

[0020] The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database;

[0021] The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0022] The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data;

[0023] Among them, a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0024] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by an electronic device including a plurality of application programs, the electronic device performs the following operations:

[0025] The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database;

[0026] The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0027] The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data;

[0028] Among them, a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0029] In an embodiment of the present application, a security detection server obtains multiple groups of log data and multiple groups of rule data from a log collection database; the security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, and a group of data to be detected includes a group of log data and a group of rule data; the security detection server performs security detection operations on the multiple groups of log data in the multiple groups of data to be detected based on the multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; wherein a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0030] In this way, the security detection server can associate multiple sets of log data after data formatting with multiple sets of rule data to obtain multiple sets of data to be detected, and batch and quickly detect the security of the files corresponding to each set of log data in each set of data to be detected, thereby being able to quickly detect threat files hidden in a large number of files, improve the efficiency of security detection for files, and greatly reduce the probability of storage servers being attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of the implementation process of a file security detection method provided in an embodiment of the present application;

[0032] Figure 2 A schematic diagram of a physical architecture of a file security detection method provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of the deployment of a cache device in a file security detection method provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of a specific process of a file security detection method provided in an embodiment of the present application in a practical application;

[0035] Figure 5 A schematic diagram of the structure of a file security detection device provided in an embodiment of the present application;

[0036] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here. In addition, the "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally represents that the objects associated with each other are in an "or" relationship.

[0039] It should be noted that the file security detection method provided in the embodiment of the present application can be executed by a file security detection device, or a control module in the file security detection device for executing the loading file security detection method. In the embodiment of the present application, the file security detection device provided in the embodiment of the present application is taken as an example to illustrate the file security detection device executed by the loading file security detection method.

[0040] The following is a detailed description of the method for updating the process container address provided in the embodiment of the present application through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0041] Step 101, the security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database;

[0042] Among them, a group of rule data corresponds to a security detection rule specified by the first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0043] Specifically, Figure 2 As shown, a physical architecture diagram of the file security detection method provided in the embodiment of the present application. In the method provided in the embodiment of the present application, the storage server may be a server such as a simple storage server (SimpleStorage Service, S3) for storing log information of files; the rule submission server may be: a server for providing a second user such as a security operation and maintenance personnel with a platform for writing and submitting security detection criteria; the log management server may be a server deployed with log management tools such as Graylog; the log collection database cluster may be composed of multiple databases deployed with search servers such as ES (Elastic Search); the security detection server may be a server capable of executing the security detection steps in the method provided in the embodiment of the present application; the detection result database cluster may be composed of multiple MySQL (My Structure Quest Language) databases; the result display server may be a server for displaying the final security detection results to the second user such as the security operation and maintenance personnel or the first user.

[0044] It should be understood that in the prior art, the processing of file log information requires multiple cumbersome software coordination and connection to complete the aggregation of file log information and the format structuring of file log information. This results in the storage server simply collecting and storing file log information, without flexible security testing of various security policies for file log information, and staff are unable to perform batch security testing operations on the large amount of file log information collected by the storage server.

[0045] Specifically, on the one hand, the log information of the files uploaded to the storage server is stored in each storage server in a dispersed manner. The content in the log information is the original file text content. The prior art does not perform structured operations on the key attribute fields in the log information and lacks a structured data management model, which makes the log information have no corresponding life cycle. The storage server cannot perform management actions such as automatically creating or destroying log files, and it is impossible to easily perform security detection and analysis operations on the log information that has not been indexed.

[0046] On the other hand, the prior art lacks a more flexible security inspection method, and cannot conveniently create, change, and implement security detection rules for the log information of files, thereby being unable to flexibly change security detection rules according to external threats to cope with ever-changing external threats.

[0047] In addition, the log information collection of files in the prior art generally requires Filebeat log collector and Logstash log processing platform to complete the formatting of the log information of the file and the forwarding output of the log information in a specific protocol format. However, the installation cost and operation and maintenance cost of deploying the Logstash log processing platform on a large number of storage servers are high. In addition, the formatting of the log information of the file needs to be completed on the storage server. The installation of these data collection agent platforms will affect the stability of the storage server system and seriously increase the load burden of the storage server.

[0048] For example, in one prior art, the log information of files is usually collected by a Filebeat log collector and sent to a database deployed with an ES search server. A pre-written security detection script then reads the log information of the files provided by ES to perform data formatting and security detection operations.

[0049] For example, in another prior art, the log information of the file is usually collected by the Filebeat log collector and sent to the Logstash log processing platform of the storage server. After the Logstash log processing platform formats the log information of the file, the Logstash log processing platform converts the formatted data into Syslog protocol data and sends it to the Syslog log collection server.

[0050] Both of the above existing technologies require that in addition to deploying the Filebeat log collector on the storage server, the Logstash log processing platform must also be installed, and the data formatting operation of the file log information must be completed in the storage server, thereby increasing the software installation cost and operation and maintenance cost, and also increasing the failure probability of each server, and neither of them can directly send the collected file log information to the Syslog log collection server.

[0051] Therefore, the method provided in the embodiment of the present application can not only complete the data formatting operation and security detection operation of the log information of the file in the server other than the storage server, but also enable the second user such as the operation and maintenance personnel to write or change the security detection rules according to the real-time threats from the outside world. Finally, the server can automatically delete unsafe files according to the results of the security detection, thereby reducing the software installation cost and operation and maintenance cost, as well as the failure probability of each server, and improving the efficiency of the file security detection operation.

[0052] Optionally, in order to perform security detection operations on log information of files in batches and improve the efficiency of the security detection operations, data structuring operations may be performed on the log information of files obtained from multiple storage servers respectively.

[0053] Specifically, before the security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database, the method provided in the embodiment of the present application further includes:

[0054] The plurality of storage servers respectively send log information of the plurality of files to one or more cache devices;

[0055] The log management server obtains log information of multiple files from one or more cache devices;

[0056] The log management server splits the log information of multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database. One group of log data includes multiple log data corresponding to the log information of one file, and one log data corresponds to one field name.

[0057] It should be understood that the log information of a file may include information extracted from the file, and may also include upload information extracted from the file name, etc. Since the amount of log information of a file is huge, and the number of log management servers is far less than the amount of log information of a file, the method provided in the embodiment of the present application provides one or more cache devices deployed with a Kafka message queue function, so that the log management server can actively obtain the log information of other files from the one or more cache devices after completing the splitting of the log information of a part of the files, thereby avoiding the work congestion of the log management server and the data loss caused by the untimely response of the log management server.

[0058] Specifically, the log management server can first provide the write port and IP address of one or more cache devices to multiple storage servers, and then the Filebeat log collector in each storage server will transfer the log information of the file to one or more cache devices. After splitting, the log management server will store the split multiple groups of log data in the log collection database.

[0059] When the log management server performs data structuring operations on the log information of the file, it can split the log information of the file in JSON format according to multiple preset field names, such as field names preset by users such as operation and maintenance personnel or field names generated in the log collection database, and obtain the following multiple log data:

[0060] [Business name] [File name] [File extension] [File header type] [File hash], etc.

[0061] Among them, the business name can represent the name of the business corresponding to the file, the file name can represent the name of the file by the editor or uploader, the file extension can represent the type of file determined by the operating system, the file header type can represent the task type of a part of the file at the beginning of the file, and the file hash can be used as a unique identifier of the file to quickly locate the specified file.

[0062] In addition, after the log collection database stores multiple groups of log data, an index name may be assigned to each group of log data to indicate the position of each group of log data in the log collection database.

[0063] like Figure 3 , which is a schematic diagram of the deployment of the cache device in the file security detection method provided in an embodiment of the present application.

[0064] Optionally, if the log information data volume of the file is not large, only one cache device can be set. Figure 3 As shown in (a), n storage servers send the log information of the file to the cache device, and then m log management servers obtain the log information of the file from the cache server.

[0065] Optionally, if the amount of log information data in a file is too large, multiple cache devices can be set to relieve the input and output pressure of one cache device. Figure 3As shown in (b), in order to coordinate the workload among y cache devices, x coordination servers can also be set to balance the cache data volume of y cache devices. Then, n storage servers send the log information of the file to x coordination servers, and the x coordination servers distribute and send the log information of the file to y cache devices. When m log management servers want to obtain the log information of the file, they obtain the log information of the file from the y cache devices through x coordination servers. In the whole process, the n storage servers and m log management servers do not directly contact the y cache devices.

[0066] In addition, the x coordination servers and the y cache devices may be combined, that is, tools such as Zookeeper coordination service software may be deployed on the y cache devices respectively.

[0067] Specifically, in the method provided in the embodiment of the present application, the log management server obtains log information of multiple files from multiple cache devices, including:

[0068] The plurality of coordination servers obtain the log information of the plurality of files from the plurality of cache devices in response to the acquisition request for the log information of the files sent by the log management server, and one coordination server corresponds to one or more cache devices;

[0069] The log management server obtains log information of multiple files from multiple coordination servers.

[0070] Optionally, in order to obtain multiple sets of rule data for external real-time threats, the rule submission server may enable the second user to edit targeted security detection rules according to the external real-time threats.

[0071] Specifically, before the security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database, the method provided in the embodiment of the present application further includes:

[0072] The rule submission server sends the one or more security detection rules to be submitted to the log management server in response to the second user's submission operation on the one or more security detection rules to be submitted;

[0073] The log management server splits one or more security detection rules to be submitted into one or more groups of rule data, where a group of rule data includes multiple rule data corresponding to one security detection rule to be submitted.

[0074] Optionally, a Web management page application can be deployed on the rule server, so that the second user can edit and submit new security detection rules online. The log server can provide a REST API interface that does not require coding to the rule submission server, so that the REST API listening service of the HTTP protocol can receive the security detection rules sent by the rule submission server in real time. Then, the log management server can perform data structuring processing on all security detection rules submitted by the second user, and store the obtained multiple sets of rule data in the log collection database.

[0075] Among them, similar to the method of splitting the log information of the log server file, when the log management server performs data structuring operations on the security detection rules, it can split the security detection rules in JSON format according to multiple preset field names, such as field names preset by users such as operation and maintenance personnel or field names generated in the log collection database, and obtain the following multiple rule data:

[0076] [Business name] [Security detection regular rule], etc.

[0077] The business name may indicate the name of the business corresponding to the file, the file name may indicate the name given to the file by the editor or uploader, and the security detection regular rule may indicate the specific regular rule content of the security detection rule.

[0078] In addition, after the log collection database stores multiple groups of rule data, an index name may be assigned to each group of rule data to indicate the location of each group of rule data in the log collection database.

[0079] Step 102, the security detection server associates the multiple sets of log data with the multiple sets of rule data to obtain multiple sets of data to be detected;

[0080] The set of data to be detected includes a set of log data and a set of rule data.

[0081] Optionally, in order to facilitate the security detection server to perform security detection operations on multiple groups of log data, the log data and rule data may be associated in advance.

[0082] Specifically, first, the log information of files of the same business type can be searched according to the business type corresponding to the security detection rule specified by the first user or the second user, that is, multiple sets of log data with the same [business name] can be searched through the [business name] in multiple sets of rule data.

[0083] Then, the security detection server may associate a set of log data and a set of rule data into the following set of data to be detected:

[0084] [Business name] [File name] [File extension] [File header type] [File hash] [Security detection regular rule], etc.

[0085] Step 103 : The security detection server performs security detection operations on multiple sets of log data in the multiple sets of data to be detected based on the multiple sets of rule data in the multiple sets of data to be detected, so as to respectively determine the security of multiple log files corresponding to the multiple sets of log data.

[0086] Optionally, the security detection rules to be executed can be specified based on the submission time, version number or business type of the security detection rules, or the security detection rules submitted within a preset time period can be obtained and executed after each preset time period; the log information of the file to be security checked can be specified based on the business name of the file, upload time or file type, etc.

[0087] Optionally, the specific content of the security detection rule in the rule data may be the matching situations of multiple log data and their corresponding security levels. In order to facilitate detection, the security of the file may be determined by a relatively simple regular matching method.

[0088] Specifically, in the method provided in the embodiment of the present application, the security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including:

[0089] The security detection server obtains a plurality of to-be-matched data in a target to-be-detected data group respectively, where the target to-be-detected data group is any group of to-be-detected data in the plurality of groups of to-be-detected data, and the plurality of to-be-matched data is specified by a group of rule data in the target to-be-detected data group;

[0090] If the security detection server determines that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then the file corresponding to the target to-be-detected data group is determined to be safe;

[0091] If the security detection server determines that the multiple to-be-matched data do not match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is unsafe;

[0092] Among them, the multiple data to be matched include at least two of the business name, file name, file extension, file header type and file hash, and the multiple rule data in a set of rule data in the target data group to be detected include the business name and the security detection regular rule description.

[0093] It should be understood that in order to achieve the purpose of attacking the S3 server, attackers in the prior art often disguise files containing threatening attack content as regular file types allowed to be uploaded by the S3 server, upload the files containing threatening attack content to the S3 server, and wait for the file containing threatening attack content to be called to cause an offensive event.

[0094] Optionally, in order to identify a file with threatening attack content in the above-mentioned prior art, the file type and file header type of the file may be matched to determine whether the file is disguised.

[0095] Specifically, in the method provided in the embodiment of the present application, the security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including:

[0096] The security detection server obtains the file extensions and file header types of the plurality of to-be-matched data in the target to-be-detected data group respectively;

[0097] If the security detection server determines that the file type indicated by the file extension matches the file type indicated by the file header type based on the security detection regular rule description in a set of rule data in the target data to be detected, then the file corresponding to the target data group to be detected is determined to be safe;

[0098] If the security detection server determines that the file type identified by the file extension does not match the file type represented by the file header type based on the security detection regular rule description in a set of rule data in the target data to be detected, then the file corresponding to the target data group to be detected is determined to be unsafe.

[0099] Optionally, after detecting unsafe files, in order to prevent the unsafe files from continuing to threaten the information security of the storage server, the locations of these unsafe files can be quickly located through the file names and file hashes, and these unsafe files can be deleted. The result display server can display the final detection results and deletion results to the first user or the second user, etc., where the log information of the deleted files can be marked.

[0100] Specifically, after the security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, the method provided in the embodiment of the present application further includes:

[0101] The security detection server instructs the storage server to delete unsafe log files;

[0102] The security detection server sends the security detection results for the multiple log files to the detection result database;

[0103] The result display server displays to the user the security detection results of multiple log files obtained from the detection result database.

[0104] Optionally, in order to avoid accidental deletion of the storage server due to detection errors of the security detection server, the first user or the second user may specify the files to be deleted after the result display server displays the final detection results to the first user or the second user.

[0105] Specifically, Figure 4 FIG. 1 is a schematic diagram of a specific flow chart of a file security detection method provided in an embodiment of the present application in a practical application. Figure 4 An embodiment of the invention is described in detail, which specifically includes:

[0106] Step 401, multiple storage servers respectively send log information of multiple files to one or more cache devices for caching;

[0107] Step 402, in response to the second user's submission operation for the security detection rule, the rule server sends the security detection rule to the log management server;

[0108] Step 403, multiple log management servers obtain log information of multiple files from one or more cache devices, split the log information of the multiple files into multiple groups of log data respectively; and split the multiple security detection rules into multiple groups of rule data;

[0109] Step 404, the multiple log management servers send the multiple sets of log data and the multiple sets of rule data to the log collection database;

[0110] Step 405, the security detection server obtains multiple sets of rule data and multiple sets of log data from the log collection database cluster, and associates the multiple sets of rule data and the multiple sets of log data respectively to obtain multiple sets of data to be detected;

[0111] Step 406, the security detection server performs security detection on the multiple sets of log data based on the multiple sets of rule data in the multiple sets of data to be detected;

[0112] Step 407, the security detection server deletes the unsafe files and stores the detection results in the detection result database;

[0113] Step 408: The result display server displays the test results obtained from the test result database to the user.

[0114] In an embodiment of the present application, a security detection server obtains multiple groups of log data and multiple groups of rule data from a log collection database; the security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, and a group of data to be detected includes a group of log data and a group of rule data; the security detection server performs security detection operations on the multiple groups of log data in the multiple groups of data to be detected based on the multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; wherein a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0115] In this way, the security detection server can associate multiple sets of log data after data formatting with multiple sets of rule data to obtain multiple sets of data to be detected, and batch and quickly detect the security of the files corresponding to each set of log data in each set of data to be detected, thereby being able to quickly detect threat files hidden in a large number of files, improve the efficiency of security detection for files, and greatly reduce the probability of storage servers being attacked.

[0116] The present application also provides a file security detection device 500, such as Figure 5 As shown, including:

[0117] The security detection server 501 is used to obtain multiple sets of log data and multiple sets of rule data from the log collection database;

[0118] The security detection server 501 is used to associate the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0119] The security detection server 501 is used to perform security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple log files corresponding to the multiple groups of log data;

[0120] Among them, a group of rule data corresponds to a security detection rule specified by the first user from the log collection database, and a group of log data corresponds to information of a log file in the log collection database whose recording time is within a preset time period.

[0121] Optionally, in one embodiment, the device further comprises:

[0122] A plurality of storage servers 502, configured to send log information of the plurality of files to one or more cache devices respectively;

[0123] The log management server 503 is used to obtain the log information of the multiple files from the one or more cache devices;

[0124] The log management server splits the log information of the multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database. A group of log data includes multiple log data corresponding to the log information of a file, and one log data corresponds to one field name.

[0125] Optionally, in one embodiment, the apparatus further includes a plurality of coordination servers 504, wherein:

[0126] The multiple coordination servers 504 are used to obtain the log information of the multiple files from the multiple cache devices in response to the acquisition request for the log information of the files sent by the log management server, and one coordination server corresponds to one or more cache devices;

[0127] The log management server 503 is used to obtain log information of the multiple files from the multiple coordination servers.

[0128] Optionally, in one implementation, the device further includes a rule submission server 505, wherein:

[0129] The rule submission server 505 is used to send the one or more security detection rules to be submitted to the log management server in response to the second user's submission operation on the one or more security detection rules to be submitted;

[0130] The log management server 503 is further used to split the one or more security detection rules to be submitted into one or more groups of rule data, where a group of rule data includes multiple rule data corresponding to one security detection rule to be submitted.

[0131] Optionally, in one implementation, the security detection server 501 is used to:

[0132] Respectively acquiring a plurality of to-be-matched data in a target to-be-detected data group, wherein the target to-be-detected data group is any one of the plurality of to-be-detected data groups, and the plurality of to-be-matched data is specified by a set of rule data in the target to-be-detected data group;

[0133] If it is determined that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is safe;

[0134] If it is determined based on a set of rule data in the target data group to be detected that the plurality of data to be matched do not match each other, then it is determined that the file corresponding to the target data group to be detected is unsafe;

[0135] Among them, the multiple data to be matched include at least two of the business name, file name, file extension, file header type and file hash, and the multiple rule data in a set of rule data in the target data group to be detected include the business name and the security detection regular rule description.

[0136] Optionally, in one implementation, the security detection server 501 is used to:

[0137] Respectively obtaining file extensions and file header types from a plurality of to-be-matched data in the target to-be-detected data group;

[0138] If the file type identified by the file extension matches the file type indicated by the file header type based on the security detection regular rule description in a set of rule data in the target data to be detected, then the file corresponding to the target data group to be detected is determined to be safe;

[0139] If, based on the security detection regular rule description in a set of rule data in the target data to be detected, it is determined that the file type identified by the file extension does not match the file type represented by the file header type, then the file corresponding to the target data group to be detected is determined to be unsafe.

[0140] Optionally, in one implementation, the device further includes a result display server 506, wherein:

[0141] The security detection server 501 is also used to instruct the storage server to delete unsafe files;

[0142] The security detection server 501 is further used to send the security detection results for the multiple files to the detection result database;

[0143] The result display server 506 is used to display the security detection results of multiple files obtained from the detection result database to the user.

[0144] The file security detection device 500 can achieve Figure 1~Figure 4 For details, please refer to Figure 1~Figure 4 The file security detection method of the illustrated embodiment will not be described in detail.

[0145] In an embodiment of the present application, a security detection server obtains multiple groups of log data and multiple groups of rule data from a log collection database; the security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, and a group of data to be detected includes a group of log data and a group of rule data; the security detection server performs security detection operations on the multiple groups of log data in the multiple groups of data to be detected based on the multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; wherein a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0146] In this way, the security detection server can associate multiple sets of log data after data formatting with multiple sets of rule data to obtain multiple sets of data to be detected, and batch and quickly detect the security of the files corresponding to each set of log data in each set of data to be detected, thereby being able to quickly detect threat files hidden in a large number of files, improve the efficiency of security detection for files, and greatly reduce the probability of storage servers being attacked.

[0147] Figure 6 This is a schematic diagram of the structure of an electronic device provided by an embodiment of this specification. Figure 6 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0148] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0149] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0150] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a file security detection device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0151] The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database;

[0152] The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data;

[0153] The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data;

[0154] Among them, a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of multiple files in the log collection database whose recording time is within a preset time period.

[0155] In an embodiment of the present application, a security detection server obtains multiple groups of log data and multiple groups of rule data from a log collection database; the security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, and a group of data to be detected includes a group of log data and a group of rule data; the security detection server performs security detection operations on the multiple groups of log data in the multiple groups of data to be detected based on the multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; wherein a group of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a group of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period.

[0156] In this way, the security detection server can associate multiple sets of log data after data formatting with multiple sets of rule data to obtain multiple sets of data to be detected, and batch and quickly detect the security of the files corresponding to each set of log data in each set of data to be detected, thereby being able to quickly detect threat files hidden in a large number of files, improve the efficiency of security detection for files, and greatly reduce the probability of storage servers being attacked.

[0157] The above is as in this manual Figure 1~Figure 4 The file security detection method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in one or more embodiments of this specification can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in one or more embodiments of this specification can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0158] The electronic device may also perform Figure 1~Figure 4 The method for detecting the security of the file will not be described in detail in this manual.

[0159] Of course, in addition to software implementation, the electronic device of this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0160] In short, the above description is only a preferred embodiment of this specification and is not intended to limit the protection scope of this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the protection scope of one or more embodiments of this specification.

[0161] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0162] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0163] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0164] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A method for detecting file security, characterized in that: The method comprises: The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database; The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; Wherein, a set of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a set of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including: The security detection server respectively obtains a plurality of to-be-matched data in a target to-be-detected data group, wherein the target to-be-detected data group is any one of the plurality of to-be-detected data groups, and the plurality of to-be-matched data is specified by a set of rule data in the target to-be-detected data group; If the security detection server determines that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is safe; If the security detection server determines that the plurality of to-be-matched data do not match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is unsafe; The plurality of data to be matched include at least two of a service name, a file name, a file extension, a file header type, and a file hash, and the plurality of rule data in a set of rule data in the target data group to be detected include a service name and a security detection regular rule description; Before the security detection server obtains the multiple sets of log data and the multiple sets of rule data from the log collection database, the method further includes: The plurality of storage servers respectively send the log information of the plurality of files to one or more cache devices; The log management server obtains log information of the plurality of files from the one or more cache devices; The log management server splits the log information of the multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database. A group of log data includes multiple log data corresponding to the log information of a file, and one log data corresponds to one field name.

2. The method according to claim 1, characterized in that The log management server obtains log information of the multiple files from the multiple cache devices, including: The plurality of coordination servers obtain the log information of the plurality of files from the plurality of cache devices in response to the acquisition request for the log information of the files sent by the log management server, and one coordination server corresponds to one or more cache devices; The log management server obtains log information of the multiple files from the multiple coordination servers.

3. The method according to claim 1, characterized in that Before the security detection server obtains the multiple sets of log data and the multiple sets of rule data from the log collection database, the method further includes: The rule submission server sends the one or more security detection rules to be submitted to the log management server in response to a submission operation of the second user on the one or more security detection rules to be submitted; The log management server splits the one or more security detection rules to be submitted into one or more groups of rule data, where a group of rule data includes multiple rule data corresponding to one security detection rule to be submitted.

4. The method according to claim 1, characterized in that The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including: The security detection server respectively obtains the file extensions and file header types in the plurality of to-be-matched data in the target to-be-detected data group; If the security detection server determines that the file type identified by the file extension matches the file type represented by the file header type based on the security detection regular rule description in a set of rule data in the target data to be detected, then the file corresponding to the target data group to be detected is determined to be safe; If the security detection server determines, based on the security detection regular rule description in a set of rule data in the target data to be detected, that the file type identified by the file extension does not match the file type represented by the file header type, then it is determined that the file corresponding to the target data group to be detected is unsafe.

5. The method according to claim 1, characterized in that After the security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, the method further includes: The security detection server instructs the storage server to delete unsafe files; The security detection server sends the security detection results for the multiple files to the detection result database; The result display server displays the security detection results of multiple files obtained from the detection result database to the user.

6. A file security detection device, characterized in that: The device comprises: A security detection server is used to obtain multiple sets of log data and multiple sets of rule data from a log collection database; The security detection server is used to associate the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data; The security detection server is used to perform security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; Wherein, a set of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a set of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period; Wherein, the security detection server is used to: Respectively acquiring a plurality of to-be-matched data in a target to-be-detected data group, wherein the target to-be-detected data group is any one of the plurality of to-be-detected data groups, and the plurality of to-be-matched data is specified by a set of rule data in the target to-be-detected data group; If it is determined that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is safe; If it is determined based on a set of rule data in the target data group to be detected that the plurality of data to be matched do not match each other, then it is determined that the file corresponding to the target data group to be detected is unsafe; The plurality of data to be matched include at least two of a service name, a file name, a file extension, a file header type, and a file hash, and the plurality of rule data in a set of rule data in the target data group to be detected include a service name and a security detection regular rule description; The device also includes: a plurality of storage servers and a log management server; Before the security detection server obtains multiple groups of log data and multiple groups of rule data from the log collection database, the multiple storage servers are used to send the log information of the multiple files to one or more cache devices respectively; the log management server is used to obtain the log information of the multiple files from the one or more cache devices; the log management server splits the log information of the multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database, a group of log data includes multiple log data corresponding to the log information of a file, and one log data corresponds to one field name.

7. An electronic device comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database; The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; Wherein, a set of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a set of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including: The security detection server respectively obtains a plurality of to-be-matched data in a target to-be-detected data group, wherein the target to-be-detected data group is any one of the plurality of to-be-detected data groups, and the plurality of to-be-matched data is specified by a set of rule data in the target to-be-detected data group; If the security detection server determines that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is safe; If the security detection server determines that the plurality of to-be-matched data do not match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is unsafe; The plurality of data to be matched include at least two of a service name, a file name, a file extension, a file header type, and a file hash, and the plurality of rule data in a set of rule data in the target data group to be detected include a service name and a security detection regular rule description; Before the security detection server obtains the multiple sets of log data and the multiple sets of rule data from the log collection database, the executable instruction, when executed, causes the processor to perform the following operations: Multiple storage servers send the log information of the multiple files to one or more cache devices respectively; the log management server obtains the log information of the multiple files from the one or more cache devices; the log management server splits the log information of the multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database, one group of log data includes multiple log data corresponding to the log information of one file, and one log data corresponds to one field name.

8. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, cause the electronic device to perform the following operations: The security detection server obtains multiple sets of log data and multiple sets of rule data from the log collection database; The security detection server associates the multiple groups of log data with the multiple groups of rule data respectively to obtain multiple groups of data to be detected, where a group of data to be detected includes a group of log data and a group of rule data; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, so as to respectively determine the security of multiple files corresponding to the multiple groups of log data; in, A set of rule data corresponds to a security detection rule specified by a first user from the log collection database, and a set of log data corresponds to log information of a file in the log collection database whose recording time is within a preset time period; The security detection server performs security detection operations on multiple groups of log data in the multiple groups of data to be detected based on multiple groups of rule data in the multiple groups of data to be detected, respectively, including: The security detection server respectively obtains a plurality of to-be-matched data in a target to-be-detected data group, wherein the target to-be-detected data group is any one of the plurality of to-be-detected data groups, and the plurality of to-be-matched data is specified by a set of rule data in the target to-be-detected data group; If the security detection server determines that the plurality of to-be-matched data match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is safe; If the security detection server determines that the plurality of to-be-matched data do not match each other based on a set of rule data in the target to-be-detected data group, then it is determined that the file corresponding to the target to-be-detected data group is unsafe; The plurality of data to be matched include at least two of a service name, a file name, a file extension, a file header type, and a file hash, and the plurality of rule data in a set of rule data in the target data group to be detected include a service name and a security detection regular rule description; Before the security detection server obtains the multiple sets of log data and the multiple sets of rule data from the log collection database, the one or more programs, when executed by an electronic device including multiple application programs, further cause the electronic device to perform the following operations: Multiple storage servers send the log information of the multiple files to one or more cache devices respectively; the log management server obtains the log information of the multiple files from the one or more cache devices; the log management server splits the log information of the multiple files into multiple groups of log data based on multiple field names in the log collection database, and sends the multiple groups of log data to the log collection database, one group of log data includes multiple log data corresponding to the log information of one file, and one log data corresponds to one field name.

Images