Small file quick inspection method, device, electronic device and storage medium

Abstract

The present application discloses a method, device, electronic device and storage medium for fast inspection of small files. The method first traverses all files under the target inspection directory, performs a file size query on each traversed file to obtain at least one small file, and records the data block numbers of all small files; after traversing all files, sorts the data blocks storing small files, and reads the data in the data blocks of all small files into the memory in the order of the physical sectors of the disk; checks the data in the memory, and finally, when there is illegal data, finds the file name corresponding to the data block by the data block number, and issues an alarm. It can be seen that the present application reduces the disk seek time and improves the efficiency of file inspection by aggregating and sorting a large number of data blocks storing small files and reading the data in the order of the physical sectors.

Description

Technical Field

[0001] The present invention relates to the field of software security protection, and in particular to a small file quick checking method, device, electronic equipment and storage medium. Background Art

[0002] With the popularization of computer applications, a large amount of data is stored in the computer disk in the form of electronic files. These files also include many important business secrets. How to ensure that this data is not illegally obtained by competitors has become an important topic.

[0003] Among them, data classification storage (important data is stored on a dedicated computer) is an effective management method. To ensure that data is effectively classified and stored, electronic file data inspection is the most effective technical means. Modern computer systems generally have a large number of small files (generally refers to files with a size of less than 64KB). Although small files do not store much data, a large number of small files will also affect the speed of electronic file inspection.

[0004] Currently, the file content check is to traverse the files on the disk, and then check each file separately, without special processing for small files. When there are a large number of small files on the disk, there is no fixed order for the storage of these small files on the disk. When checking these small files, it will cause a lot of disk seeks. Therefore, when checking the contents of a large number of small files, the speed of file checking will be greatly reduced. Summary of the invention

[0005] Based on this, the embodiments of the present application provide a small file quick inspection method, device, electronic device and storage medium, which can reduce the disk seek time during the file inspection process to increase the file inspection speed.

[0006] In a first aspect, a small file quick check method is provided, the method comprising:

[0007] Traverse all files in the target inspection directory, query the file size of each traversed file to obtain at least one small file, and record the data block numbers of all small files, wherein the small files include files whose file size is not higher than a preset threshold;

[0008] After traversing all files, sort the data blocks storing small files, and read the data in the data blocks of all small files into memory in the order of the physical sectors of the disk;

[0009] Check the data in the memory. When there is illegal data, find the file name corresponding to the data block by the data block number and issue an alarm.

[0010] Optionally, the traversing of all files under the target inspection directory and performing a file size query on each traversed file also includes obtaining normal files, and then performing a regular file check on the normal files, and the normal files include files whose file sizes are higher than a preset threshold.

[0011] Optionally, the preset threshold is 64 KB.

[0012] Optionally, the method further comprises: manually processing the illegal data and checking the processed data in the memory.

[0013] Optionally, after checking the data in the memory, if no illegal data exists in all the data, the check is completed.

[0014] In a second aspect, a small file quick inspection device is provided, the device comprising:

[0015] A recording module is used to traverse all files in the target inspection directory, perform a file size query on each traversed file to obtain at least one small file, and record the data block numbers of all small files, wherein the small files include files whose file sizes are not higher than a preset threshold;

[0016] The sorting module is used to sort the data blocks storing small files after traversing all files, and read the data in the data blocks of all small files into the memory in the order of the physical sectors of the disk;

[0017] The checking module is used to check the data in the memory. When there is illegal data, the file name corresponding to the data block is found by the data block number and an alarm is issued.

[0018] Optionally, the recording module is also used to: traverse all files under the target inspection directory, perform file size query on each traversed file and obtain normal files, then perform regular file inspection on the normal files, and the normal files include files with file sizes higher than a preset threshold.

[0019] Optionally, the checking module is further used to: after checking the data in the memory, if no illegal data exists in all the data, then the checking is completed.

[0020] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the small file quick checking method described in any one of the first aspects is implemented.

[0021] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the small file quick checking method described in any one of the first aspects is implemented.

[0022] In the technical solution provided by the embodiment of the present application, firstly, all files under the target inspection directory are traversed, and the file size query is performed on each traversed file to obtain at least one small file, and the data block numbers of all small files are recorded; after traversing all files, the data blocks storing small files are sorted, and the data in the data blocks of all small files are read into the memory in the order of the physical sectors of the disk; the data in the memory is checked, and when there is illegal data, the file name corresponding to the data block is found by the data block number, and an alarm is issued. It can be seen that the present application reduces the disk seek time and improves the efficiency of file inspection by aggregating and sorting a large number of data blocks storing small files and reading the data in the order of the physical sectors. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0024] Figure 1 A flowchart of a method for quickly checking small files provided in an embodiment of the present application;

[0025] Figure 2 A block diagram of a small file quick inspection device provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] There are usually a large number of small files (generally referring to files with a size of less than 64KB) in modern computer systems. Although small files do not store much data, a large number of small files will also affect the speed of electronic file inspection. Studies have found that the main reason affecting the inspection efficiency in the process of inspecting a large number of small files is disk seek. If multiple small files can be combined for inspection and the data of small files can be read in the normal order of sectors during the inspection process, the disk seek time will be greatly reduced, thereby improving the inspection efficiency of small files.

[0029] This solution aggregates a large number of small files together for inspection, sorts all the data blocks storing these files before inspection, then reads the data blocks of all small files in sector order, aggregates the data, and then checks the file content, reducing the disk seek time during the file inspection process to improve the file inspection speed.

[0030] To facilitate understanding of this embodiment, a small file quick inspection method disclosed in the embodiment of the present application is first introduced in detail.

[0031] Please refer to Figure 1 , which shows a flowchart of a small file quick inspection method provided by an embodiment of the present application, the method may include the following steps:

[0032] Step 101, traverse all files in the target inspection directory, query the file size of each traversed file to obtain at least one small file, and record the data block numbers storing all small files.

[0033] Among them, small files include files whose file size is not higher than a preset threshold. In this application, the threshold can be preset to 64KB.

[0034] In an embodiment of the present application, all files in the directory to be checked are first traversed, and the file size of each traversed file is determined. If the file is a normal file (file size is greater than 64KB), the file content is directly checked. If the file is a small file (file size is less than or equal to 64KB), the data block number corresponding to this file and the size of the prepared data in the data block are recorded.

[0035] Step 102, after traversing all files, sort the data blocks storing small files, and read the data in the data blocks of all small files into the memory in the order of the physical sectors of the disk.

[0036] In an embodiment of the present application, after traversing all files, the data blocks storing small files are sorted, and then all data blocks storing small files are read into the memory in the order of the physical sectors of the disk.

[0037] When all files have not been traversed, the specific steps of traversing and checking all files in the directory in step 101 are executed again.

[0038] Step 103, check the data in the memory, and when there is illegal data, find the file name corresponding to the data block by the data block number, and issue an alarm.

[0039] In an embodiment of the present application, the data in the memory is checked. If any illegal data is detected, the file name corresponding to the data is found through the correspondence between the data block number and the file, and an alarm is issued. After the data in the memory is checked, if no illegal data exists, the check is completed.

[0040] The present application aggregates a large number of small files together, sorts the data blocks storing these small files, and reads the file contents in the order of the physical sectors of the disk during the inspection process, thereby reducing the disk seek time and improving the efficiency of file inspection.

[0041] Please refer to Figure 2 , which shows a block diagram of a small file fast checking device 200 provided in an embodiment of the present application. The device 200 may include: a recording module 201, a sorting module 202, and a checking module 203.

[0042] The recording module 201 is used to traverse all files in the target inspection directory, query the file size of each traversed file to obtain at least one small file, and record the data block numbers of all small files. Small files include files whose file sizes are not higher than a preset threshold.

[0043] The sorting module 202 is used to sort the data blocks storing the small files after traversing all the files, and read the data in the data blocks of all the small files into the memory according to the order of the physical sectors of the disk;

[0044] The checking module 203 is used to check the data in the memory. When there is illegal data, the file name corresponding to the data block is searched by the data block number and an alarm is issued.

[0045] In an optional embodiment of the present application, the recording module 201 is also used to: traverse all files under the target inspection directory, perform a file size query on each traversed file and also obtain normal files, then perform a regular file check on the normal files, and normal files include files whose file size is higher than a preset threshold.

[0046] In an optional embodiment of the present application, the checking module 203 is further used to: after checking the data in the memory, if no illegal data exists in all the data, the checking is completed.

[0047] For the specific definition of the small file quick inspection device, please refer to the definition of the small file quick inspection method above, which will not be repeated here. Each module in the above-mentioned small file quick inspection device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0048] In one embodiment, an electronic device is provided. The electronic device may be a computer, and its internal structure diagram may be as follows: Figure 3 As shown. The electronic device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used for fast checking data of small files. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a small file fast checking method is implemented.

[0049] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0050] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned small file fast checking method are implemented.

[0051] The computer-readable storage medium provided in this embodiment has similar implementation principles and technical effects to those of the above method embodiments, and will not be described in detail here.

[0052] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (SyMchliMk) DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0053] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A small file quick inspection method, characterized in that: The method comprises: Traverse all files in the target inspection directory, query the file size of each traversed file to obtain at least one small file, and record the data block numbers of all small files, wherein the small files include files whose file size is not higher than a preset threshold; After traversing all files, sort the data blocks storing small files, and read the data in the data blocks of all small files into memory in the order of the physical sectors of the disk; Check the data in the memory. If there is any illegal data, find the file name corresponding to the data block by the data block number and issue an alarm. The traversing of all files in the target inspection directory, performing a file size query on each traversed file also includes obtaining normal files, and then performing a regular file check on the normal files, wherein the normal files include files whose file sizes are higher than a preset threshold; The preset threshold is 64KB; The method further comprises: manually processing the illegal data and checking the processed data in the memory; After checking the data in the memory, if no illegal data exists in all the data, the check is completed.

2. A small file quick inspection device, characterized in that: The device comprises: A recording module is used to traverse all files in the target inspection directory, perform a file size query on each traversed file to obtain at least one small file, and record the data block numbers of all small files, wherein the small files include files whose file sizes are not higher than a preset threshold; The sorting module is used to sort the data blocks storing small files after traversing all files, and read the data in the data blocks of all small files into the memory in the order of the physical sectors of the disk; The checking module is used to check the data in the memory. When there is illegal data, the file name corresponding to the data block is found by the data block number and an alarm is issued; The recording module is also used for: traversing all files in the target inspection directory, performing a file size query on each traversed file, and obtaining a normal file, and then performing a regular file check on the normal file, wherein the normal file includes a file whose file size is higher than a preset threshold; The preset threshold is 64KB; The checking module is also used for: after checking the data in the memory, if no illegal data exists in all the data, the checking is completed.

3. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the small file quick checking method as claimed in claim 1 is implemented.

4. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the small file quick checking method as claimed in claim 1 is implemented.

Images