A data tamper-proof method, system and related device

Abstract

The present application provides a data tamper-proof method, comprising: when a target file is rewritten, obtaining a rewrite function corresponding to the target file; determining the file path of the rewrite function; matching the file path with rules to determine whether the rewrite function is a hijacking operation; if so, refusing to rewrite the target file. The present application obtains the file path of the rewrite function used for rewriting when the target file is rewritten, matches the file path with rules to determine whether the rewrite function is a hijacking operation, and further determines whether the rewriting is a hijacking operation. Once it is confirmed to be a hijacking operation, the rewriting of the target file is rejected. It can effectively solve the common problem of web page tamper-proofing, thereby reducing the occurrence of malicious operations such as phishing, illegal content, fraud, and dark links. The present application also provides a data tamper-proof system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of network data security, and in particular to a data tamper-proofing method, system and related devices. Background Art

[0002] Web page tampering is a common method used by hackers. Tampered web pages often contain some bad information. The current anti-tampering method for web page files mainly relies on round-robin scanning, that is, a hash value is obtained for each web page through a digest algorithm. By regularly polling all web pages, the new and old hash values ​​are compared. If they are different, it means that the web page has been tampered with, a corresponding alarm is generated, and further recovery measures are taken. But it is obvious that round-robin is difficult to achieve non-real time, otherwise it will generate great performance consumption. There is a time difference between tampering and discovery of tampering. During this time difference period, it is easy to cause losses.

[0003] Therefore, how to achieve effective tamper-proofing is a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0004] The purpose of the present application is to provide a data tamper-proofing method, a data tamper-proofing system, a computer-readable storage medium and an electronic device, which can prevent data from being maliciously tampered with.

[0005] In order to solve the above technical problems, this application provides a data tamper-proof method, and the specific technical solution is as follows:

[0006] When the target file is rewritten, obtaining a rewriting function corresponding to the target file;

[0007] Determine the file path of the rewriting function;

[0008] Perform rule matching on the file path to determine whether the rewriting function is a hijacking operation;

[0009] If so, the rewriting of the target file is rejected.

[0010] Optionally, before obtaining the rewriting function corresponding to the target file, the method further includes:

[0011] Get the operation interface of all files;

[0012] Configuring a hook function in the dynamic link library corresponding to the operation interface;

[0013] Accordingly, obtaining the rewriting function corresponding to the target file includes:

[0014] The hook function is used to obtain the rewriting function corresponding to the target file.

[0015] Optionally, performing rule matching on the file path includes:

[0016] The file path is matched in a rule base using a multi-pattern matching algorithm.

[0017] Optionally, determining the file path of the rewriting function includes:

[0018] determining a rewriting process of the rewriting function;

[0019] Determining the process number of the rewriting process;

[0020] The file path of the rewriting function is determined according to the process number.

[0021] Optionally, also include:

[0022] Determine the files to be protected in the target system;

[0023] The rule base is obtained by configuring the target path corresponding to the file to be protected.

[0024] Optionally, performing file path matching on the file path in a rule base using a multi-pattern matching algorithm includes:

[0025] Construct finite state automata;

[0026] The file path is input step by step so that the finite state automaton matches the corresponding target path in the rule base according to the input content of the file path.

[0027] The present application also provides a data tamper-proof system, comprising:

[0028] An acquisition module, used for acquiring a rewriting function corresponding to the target file when the target file is rewritten;

[0029] A path determination module, used to determine the file path of the rewriting function;

[0030] A matching module, used for matching the file path with rules to determine whether the rewriting function is a hijacking operation;

[0031] The anti-tampering module is used to refuse rewriting of the target file when the judgment result of the matching module is yes.

[0032] Optionally, the matching module includes:

[0033] The AC automaton matching unit is used to perform file path matching on the file path in a rule base by using a multi-mode matching algorithm.

[0034] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the data tamper-proofing method as described above are implemented.

[0035] The present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the data tamper-proofing method as described above are implemented.

[0036] The present application provides a data tamper-proof method, comprising: when a target file is rewritten, obtaining a rewrite function corresponding to the target file; determining a file path of the rewrite function; performing rule matching on the file path to determine whether the rewrite function is a hijacking operation; if so, refusing to rewrite the target file.

[0037] This application obtains the file path of the rewriting function used for rewriting when the target file is rewritten, and matches the rules on the file path to determine whether the rewriting function is a hijacking operation, and then determines whether the rewriting is a hijacking operation. Once it is confirmed to be a hijacking operation, the rewriting of the target file is rejected. By establishing legal rules for the file path of the rewriting function and matching the corresponding rules when a rewriting operation occurs, the common problem of web page anti-tampering can be effectively solved, thereby reducing the occurrence of malicious operations such as phishing, illegal content, fraud, and dark links.

[0038] The present application also provides a data tamper-proof system, a computer-readable storage medium and an electronic device, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A flowchart of a data tamper-proof method provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of the structure of a data tamper-proof system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0043] At present, there are endless ways to tamper with web pages or network data to form network attacks, mainly referring to application layer hijacking. Compared with kernel state hijacking, application layer hijacking refers to hijacking at the RING3 layer. Tampering includes phishing and changing links. Phishing (Phishing, which is similar to the English word "fishing", also known as fishing or phishing attack) is an attack method that sends a large number of deceptive spam emails claiming to be from banks or other well-known institutions, intending to lure recipients to provide sensitive information (such as user names, passwords, account IDs, ATM PIN codes or credit card details).

[0044] In addition, some websites replace normal links with dark links or directly add dark links to the data, which are invisible website links. The links in the website are very hidden and are not easily detected by search engines in a short time. They may provide illegal content, fraud and loopholes, causing losses to users.

[0045] In order to solve the above problems, the present application provides a data tamper-proofing method, which can timely prevent data from being illegally tampered with, and ensure data security and user's property security.

[0046] Please refer to Figure 1 , Figure 1 Flow chart of a data tamper-proof method provided in an embodiment of the present application

[0047] S101: when a target file is rewritten, obtaining a rewriting function corresponding to the target file;

[0048] This step is intended to obtain the corresponding rewriting function when the target file is detected to be rewritten. The target file is not specifically limited here, and it can be any file in the system that is protected from tampering.

[0049] This step requires obtaining the corresponding rewriting function when the target file is rewritten. It is easy to understand that any rewriting operation requires calling the corresponding function to perform the corresponding action. This step is to obtain the corresponding rewriting function.

[0050] There is no specific limitation on how to obtain the rewritten function. The hook function can be used to hijack the rewritten function. The hook function hijacks the pre-existing function at runtime, and the pre-existing function is packaged in the hook function so that the operation function can perform some additional operations while maintaining the original function. The dynamic loading API of the Linux system allows functions in the dynamic link library to be loaded and run at runtime, so the hook function can be packaged into a dynamic link library to hijack the existing function. To implement this function, the LD_PRELOAD environment variable is usually required. The dynamic library loaded using LD_PRELOAD will be loaded first, which makes it possible to use dynamic loading technology in the hook function to bind the original function to the hook function, thereby achieving the effect of monitoring and tracking.

[0051] That is to say, if you want to use the hook function to hijack the rewrite function, you need to obtain the operation interface of all files before executing this step, and configure the hook function in the dynamic link library corresponding to the operation interface. After that, once the rewrite operation of the target file is detected, you can directly use the hook function to determine the rewrite function corresponding to the target file.

[0052] S102: Determine the file path of the rewriting function;

[0053] This step is to determine the file path of the rewriting function. No matter what kind of rewriting function, if it performs the corresponding rewriting operation, it needs a corresponding file path. The rewriting operation can be stored in the system in the form of function code or script. This step is to determine the file path of the rewriting function.

[0054] There is no specific limitation on how to determine the file path of the rewriting function. Preferably, this embodiment provides a method for determining the file path:

[0055] S1021: Determine the rewriting process of the rewriting function;

[0056] S1022: Determine the process number of the rewriting process;

[0057] S1023: Determine the file path of the rewriting function according to the process number.

[0058] That is, the rewriting process corresponding to the rewriting function is traversed, and the corresponding file path is determined by the process number PID (port ID, port number).

[0059] S103: matching the file path with rules to determine whether the rewriting function is a hijacking operation; if so, proceed to S104;

[0060] This step aims to match the file path rules to determine whether the rewritten function is a hijacking operation.

[0061] The so-called rule matching is to determine whether the file path is legal. It is easy to understand that in order to prevent data tampering, the legally operated files in the system are known, and the file path corresponding to the rewriting function used in illegal tampering does not belong to the legal path. Therefore, this step actually compares the file path with the legal path already saved in the system.

[0062] It should be noted that for the system, different file operation permissions are not the same. For example, if there is a protected file in the system, such as access protection or overwrite protection, access to the protected file will be denied, or overwriting of the protected file will be directly denied. From this, it can be seen that rule matching can be more than just a comparison between the file path and the legal path, it can also include file access rules. Usually files include operations such as adding, deleting, modifying, and checking, and rule matching can also be used to determine the access rules of different files. For example, if the target file is a protected file, regardless of whether the file path of the overwrite function is legal, the overwriting of the target file will be denied.

[0063] Preferably, in order to improve the efficiency of rule matching, when executing this step, a multi-pattern matching algorithm can be used to match the file path in the rule base, that is, the Aho-Corasick Algorithm algorithm, referred to as the AC algorithm, can be used. By preprocessing the pattern string into a deterministic finite state automaton, the text can be scanned once. Its complexity is O(n), that is, it is independent of the number and length of the pattern string.

[0064] The main idea of ​​the AC algorithm is to construct a finite state automaton, which will perform pattern string matching based on the input. The finite state automaton will transition states as characters are input, and there are three transition states:

[0065] 1. Success state, that is, the state that the AC automaton can directly reach according to the input (no jump occurs);

[0066] 2. Failure state, that is, the state that the AC automaton cannot reach directly according to the input, then a jump will occur, jumping to another path (for example, the AC root node is all the failure states of its first child)

[0067] 3. Output state, that is, successfully matching an input segment

[0068] The above three stages correspond to the three steps in the algorithm:

[0069] 1. Establish a pattern tree, that is, establish an AC automaton. Simply put, it is to construct a "tree" based on the input string;

[0070] 2. Establish a failure state, that is, add a failure state to each leaf node (not required for the root node), that is, mark the path that can be jumped if the current input string cannot continue to match when it reaches the current leaf node;

[0071] 3. Compare the file paths. When the output state is successfully reached, it means a successful match.

[0072] Since the file path usually includes a multi-level structure, after the finite state automaton is constructed, the file path can be input step by step so that the finite state automaton matches the corresponding target path in the rule base according to the input content of the file path.

[0073] Of course, those skilled in the art may also adopt other methods to improve matching efficiency when performing this step, such as the Wu-Manber algorithm multi-mode matching algorithm, etc., which should all be within the protection scope of this application.

[0074] In addition, no matter what algorithm is used to improve the efficiency of rule matching, the rule base exists by default in this step. The rule base can be obtained by determining the files to be protected in the target system and configuring the target path corresponding to the files to be protected. Of course, the specific content of the files to be protected is not limited here, and those skilled in the art can set it according to the role of the target files in the system and configure the corresponding rule base.

[0075] S104: Reject the rewriting of the target file.

[0076] If it is determined that the rewriting function is a hijacking operation, its rewriting of the target file is denied, otherwise its rewriting is allowed.

[0077] The embodiment of the present application obtains the file path of the rewrite function used for rewriting when the target file is rewritten, and matches the rules on the file path to determine whether the rewrite function is a hijacking operation, and then determines whether the rewriting is a hijacking operation. Once it is confirmed to be a hijacking operation, the rewriting of the target file is rejected. By establishing legal rules for the file path of the rewrite function and matching the corresponding rules when a rewrite operation occurs, the common problem of web page anti-tampering can be effectively solved, thereby reducing the occurrence of malicious operations such as phishing, illegal content, fraud, and dark links.

[0078] A data tamper-proof system provided in an embodiment of the present application is introduced below. The data tamper-proof system described below and the data tamper-proof method described above can refer to each other.

[0079] Figure 2 This is a schematic diagram of a data tamper-proof system structure provided in an embodiment of the present application. The present application also provides a data tamper-proof system, including:

[0080] The acquisition module 100 is used to acquire the rewriting function corresponding to the target file when the target file is rewritten;

[0081] A path determination module 200, used to determine the file path of the rewriting function;

[0082] A matching module 300 is used to perform rule matching on the file path to determine whether the rewriting function is a hijacking operation;

[0083] The anti-tampering module 400 is used to reject the rewriting of the target file when the judgment result of the matching module is yes.

[0084] Based on the above embodiment, as a preferred embodiment, the matching module 300 may include:

[0085] The AC automaton matching unit is used to perform file path matching on the file path in a rule base by using a multi-mode matching algorithm.

[0086] Based on the above embodiments, as a preferred embodiment, it also includes:

[0087] A hook function configuration module is used to obtain the operation interface of all files and configure the hook function in the dynamic link library corresponding to the operation interface;

[0088] Accordingly, the acquisition module 100 includes:

[0089] The acquisition unit is used to use the hook function to acquire the rewriting function corresponding to the target file.

[0090] Based on the above embodiment, as a preferred embodiment, the path determination module 200 includes:

[0091] A first determining unit, configured to determine a rewriting process of the rewriting function;

[0092] A second determining unit, used to determine the process number of the rewriting process;

[0093] The third determining unit is used to determine the file path of the rewriting function according to the process number.

[0094] Based on the above embodiments, as a preferred embodiment, it also includes:

[0095] The rule base generation module is used to determine the files to be protected in the target system; and configure the target path corresponding to the files to be protected to obtain the rule base.

[0096] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0097] The present application also provides an electronic device, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

[0098] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system provided in the embodiment, since it corresponds to the method provided in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0099] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0100] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A data tamper-proof method, characterized in that: include: When the target file is rewritten, obtaining a rewriting function corresponding to the target file; Determine the file path of the rewriting function; Perform rule matching on the file path to determine whether the rewriting function is a hijacking operation; If so, reject the rewriting of the target file; Before obtaining the rewriting function corresponding to the target file, the method further includes: Get the operation interface of all files; Configuring a hook function in the dynamic link library corresponding to the operation interface; Accordingly, obtaining the rewriting function corresponding to the target file includes: Using the hook function to obtain the rewriting function corresponding to the target file; Wherein, determining the file path of the rewriting function includes: Determine a rewriting process of the rewriting function; determine a process number of the rewriting process; determine a file path of the rewriting function according to the process number; The rule matching of the file path includes: The file path is matched in a rule base by using a multi-pattern matching algorithm, specifically comprising: constructing a finite state automaton; gradually inputting the file path so that the finite state automaton matches the corresponding target path in the rule base according to the input content of the file path; The rule base is generated in the following manner: The files to be protected in the target system are determined, and a rule base is obtained by configuring the target paths corresponding to the files to be protected.

2. A data tamper-proof system, characterized in that: include: An acquisition module, used for acquiring a rewriting function corresponding to the target file when the target file is rewritten; A path determination module, used to determine the file path of the rewriting function; A matching module, used for matching the file path with rules to determine whether the rewriting function is a hijacking operation; an anti-tampering module, used to refuse rewriting of the target file when the judgment result of the matching module is yes; A hook function configuration module is used to obtain the operation interface of all files and configure the hook function in the dynamic link library corresponding to the operation interface; Wherein, the acquisition module includes: An acquisition unit, used for acquiring a rewriting function corresponding to the target file by using the hook function; Wherein, the matching module includes: The AC automaton matching unit is used to perform file path matching on the file path in a rule base by using a multi-mode matching algorithm.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the data tamper-proofing method according to claim 1 are implemented.

4. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the data tamper-proof method as claimed in claim 1 when calling the computer program in the memory.

Images