File protection method, computing device and storage medium
By creating and managing piled files in the file partition of the computing device and judging their changes, the problem of insufficient file protection in the existing technology is solved, and effective protection of files is achieved to prevent file loss and malicious tampering.
Patent Information
- Application Number
- CN202210061780.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-10-21
- Publication Date
- 2025-01-14
- Estimated Expiration
- 2041-10-21
AI Technical Summary
The prior art cannot effectively protect files stored by computers, especially when the files' superior directories or storage partitions are attacked, the files will also be corrupted, and the added security measures may reduce the security of file transfers.
By determining the number of file nodes in the file partition, setting the sparseness of the pile file, and calculating the number of pile files based on the sparseness and number of nodes, creating multiple pile files to store in the file node, and determining whether the pile file has changed, thereby stopping improper Action to protect files or folders.
Effectively prevent file loss caused by viruses and human misoperation, improve the security of file protection, avoid improper operation and damage of file partitions, and enhance the protection effect of files.
Smart Images

Figure CN114386108B_ABST
Abstract
Description
[0001] This application is a divisional application of the invention patent application filed on October 21, 2021. The application number of the original application is: 202111225053X, and the name of the invention is: A file protection method, computing device and storage medium. Technical Field
[0002] The present invention relates to the field of system security, and in particular to a file protection method, a computing device and a storage medium. Background Art
[0003] With the development of computer technology, the security requirements for computer stored files are getting higher and higher. At present, when the stored files need to be protected, the operation permissions for the files can be set. When the operation instructions for the file do not have the operation permissions, the operation instructions are refused to be executed, thereby achieving the protection of the file. However, only protecting the file itself cannot achieve the effect of protecting the file; if the file node that is the parent directory of the file is damaged, or the file partition storing the file is attacked, the file will also be damaged.
[0004] In the prior art, a secure file directory can be set up to load files to be protected into the file directory, or to mount folders to be protected into the secure file directory. However, if the secure file directory itself is attacked, such as being deleted or hijacked, it is still impossible to effectively protect the files or folders to be protected, and the file transfer process is increased, which reduces security.
[0005] To this end, a new method of file protection is needed. Summary of the invention
[0006] To this end, the present invention provides a file protection method to try to solve or at least alleviate the above problems.
[0007] According to one aspect of the present invention, there is provided a file protection method suitable for execution in a computing device, the computing device comprising one or more file partitions, the method comprising the steps of: determining the number of file nodes in a file partition; setting the sparsity of piled files, and calculating the number of piled files based on the sparsity of piled files and the number of file nodes; creating multiple piled files based on the number of piled files, and storing them in the file nodes in the file partition; when accepting and executing an operation instruction on a file node, determining whether the piled file in the file node has changed; if it is determined that the piled file has changed, stopping execution of the operation instruction to protect other files or folders in the file node.
[0008] Optionally, in the method according to the present invention, calculating the number of piling files according to the piling file sparsity and the number of file nodes comprises the step of: multiplying the piling file sparsity by the number of file nodes to obtain the number of piling files.
[0009] Optionally, in the method according to the present invention, multiple piling files are created according to the number of piling files, and the storage in the file node in the file partition includes the following steps: if the file node includes one or more files, a piling file is created according to the file name, file type and file size of the file.
[0010] Optionally, in the method according to the present invention, creating a file according to the file name, file type and file size of the file includes the steps of: setting the file type of the file to the file type of the piling file; setting the file name of the piling file according to the file name, so that when the files under the file node are sorted according to the file name, the piling file is the first file; setting the size of the piling file according to the file size of the file, so that the file size of the piling file is larger than the file size of the file; and constructing the piling file according to the set file type, file name and file size of the piling file.
[0011] Optionally, the method according to the present invention further includes the step of: if the file node includes one or more folders, creating a stubbing folder according to the file name of the folder.
[0012] Optionally, in the method according to the present invention, creating a piling folder according to the file name of the folder includes the steps of: setting the file name of the piling file according to the file name of the folder, so that when the folders under the file node are sorted according to the file name, the piling folder is the first folder.
[0013] Optionally, the method according to the present invention further includes the steps of: performing incremental file monitoring on the file partition; when a new file or folder is detected in the file partition, creating a stubbing file under the file node where the new file or folder is located.
[0014] Optionally, the method according to the present invention further includes the steps of: converting the file content of the piling file into a file array; performing binary conversion on the file array, and obtaining the first eigenvalue of the piling file based on the number of bits of the file array in binary form.
[0015] Optionally, in the method according to the present invention, determining whether the piling file in the file node has changed includes the steps of: calculating the second characteristic value of the piling file after executing the operation instruction; comparing the second characteristic value with the first characteristic value to determine whether the piling file has changed.
[0016] Optionally, in the method according to the present invention, the computing device is also communicatively connected to the control server, and the control server is connected to one or more computing devices, and the method also includes: receiving and installing a test installation package constructed by the control server; storing multiple piling files in the file node of the installed test installation package; executing the test task in the test installation package to obtain test data, and sending the test data to the control server; when executing the test task, when accepting and executing the operation instruction on the file node of the test installation package, determining whether the piling file in the file node has changed; if it is determined that the piling file has changed, stopping the execution of the operation instruction to protect other files or folders in the file node of the test installation package.
[0017] According to another aspect of the present invention, a computing device performance testing method is provided, which is suitable for execution in a control server, wherein the control server is communicatively connected with a task server and a plurality of computing devices, and the method comprises the steps of: receiving a test task created by the task server, and constructing a test installation package according to the test task; sending the test installation package to a plurality of computing devices, so that the computing devices install the received test installation package and execute the test tasks in the test installation package to obtain test data; receiving the test data sent by each computing device to obtain multiple test data; drawing a test data table according to the multiple test data, and sending the test data table to the task server, so that the task server performs performance evaluation on each computing device according to the test data table.
[0018] Optionally, the method according to the present invention also includes the steps of: creating a listening process, and listening to test instructions from the task server according to the listening process; when test instructions from the task server are listened to, sending the received test instructions to multiple computing devices connected to the control server, so that the computing devices execute the test tasks according to the test instructions.
[0019] Optionally, in the method according to the present invention, the control server is also connected to the data server in communication, and the method further comprises the steps of sending the received multiple test data to the data server and storing them in the data server so that the task server can query the stored test data.
[0020] According to another aspect of the present invention, a computing device is provided, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a program for executing a file protection method according to the present invention.
[0021] According to another aspect of the present invention, a computer-readable storage medium storing one or more programs is provided. The one or more programs include instructions that, when executed by a computing device, cause the computing device to execute a file protection method according to the present invention.
[0022] The file protection method of the present invention is suitable for execution in a computing device, and the computing device includes one or more file partitions. First, by determining the number of file nodes in the file partition, the sparsity of the piled file is set, and the number of piled files is calculated according to the sparsity of the piled file and the number of file nodes; multiple piled files are created according to the number of piled files; and multiple piled files are stored in the file nodes in the file partition. The number of piled files created can be adjusted according to the file sparsity. When the file sparsity is low, the number of piled files is correspondingly reduced; when the file sparsity is high, the number of piled files is correspondingly high, which has a better protection effect on the files in the file partition. When accepting and executing an operation instruction for a file node, it is determined whether the piled file in the file node has been changed. If it is determined that the piled file has been changed, the execution of the operation instruction is stopped to protect other files or folders in the file node, so as to avoid improper operation behaviors from damaging the files or folders of the file partition to be protected, prevent viruses from maliciously tampering with files, and prevent important files from being lost due to human misoperation. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] In order to achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. By reading the following detailed description in conjunction with the accompanying drawings, the above and other purposes, features and advantages disclosed by the present invention will become more apparent. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.
[0024] Figure 1 A schematic diagram of a computing device testing system 100 according to an exemplary embodiment of the present invention is shown;
[0025] Figure 2 shows a block diagram of a computing device 200 according to an exemplary embodiment of the present invention; and
[0026] Figure 3 FIG. 3 is a flow chart of a file protection method 300 according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION
[0027] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to enable the scope of the present disclosure to be fully conveyed to those skilled in the art. The same reference numerals generally refer to the same components or elements.
[0028] Figure 1 FIG. 1 is a schematic diagram of a computing device testing system 100 according to an exemplary embodiment of the present invention. The file protection method 300 of the present invention can protect files in the following application scenarios. Figure 1 As shown, the computing device testing system 100 includes a control server 140 , a task server 150 , a data server 160 , and a computing device 200 that are communicatively connected to the control server 140 . Figure 1 The manner in which the computing device 200 is connected to the control server 140 is merely exemplary. The present invention does not limit the number of computing devices connected to the control server 140. The control server 140 can be connected to hundreds or thousands of computing devices to achieve simultaneous testing of a large number of computing devices and improve testing efficiency.
[0029] The task server 150 creates a test task and sends the test task to the control server 140 so that the control server 140 generates a test installation package according to the test task. At the same time, a test command is generated and the test instruction is sent to the control server 140. The test instruction instructs the computing device 200 that has installed the test installation package to execute the test items in the test task to perform the test and generate test data.
[0030] The control server 140 receives the test tasks and test commands sent by the task server 150, and generates a test installation package according to the test tasks. The control server 140 also sends the test installation package to the connected computing device 200, and forwards the test command to the computing device 200, and receives the test data returned by each computing device at the same time, obtains multiple test data, and further draws a test data table based on the multiple test data, so that the task server 150 can evaluate the performance of each computing device according to the test data table.
[0031] According to one embodiment of the present invention, the control server 140 may be provided with multiple backup servers (not shown in the figure), and the control server 140 is connected in communication with the multiple backup servers. When the control server 140 fails, the control server 140 promptly transfers the communication connection with the multiple computing devices 200 to the backup server, and the backup server acts as a control server, receives the test tasks and test commands from the task server 150, creates a test installation package, and sends the test installation package to the computing device 200, and forwards the test command. The backup server also receives the test data of each computing device, obtains multiple test data, and draws a test data table based on the multiple test data, so that the task server 150 can perform performance evaluation on each computing device according to the test data table.
[0032] The computing device 200 receives the test installation package, and installs the test installation package according to the received test installation package; the computing device 200 stores multiple pile files in the file node of the installed test installation package to protect the installed test installation package; receives the test command, executes the test task in the test installation package according to the test command to obtain the test data, and transmits the test data back to the control server 140. The pile file refers to a file used to protect the file or folder under the file node where the pile file is located.
[0033] Figure 1 The specific structures of the control server 140, the task server 150, the data server 160 and the computing device 200 in communication with the control server 140 can be implemented as follows Figure 2 The computing device shown. Figure 2 FIG. 2 shows a block diagram of a computing device 200 according to an exemplary embodiment of the present invention. Figure 2 As shown, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.
[0034] Depending on the desired configuration, the processor 204 can be any type of processor, including but not limited to: a microprocessor (μP), a microcontroller (μC), a digital information processor (DSP), or any combination thereof. The processor 204 can include one or more levels of cache such as a primary cache 210 and a secondary cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.
[0035] Depending on the desired configuration, the system memory 206 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 206 may include an operating system 220, one or more programs 222, and program data 228. In some embodiments, the program 222 may be arranged to be executed by one or more processors 204 on the operating system using the program data 228 to execute the instructions 223 of the method 300 according to the present invention.
[0036] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to the basic configuration 202 via the bus / interface controller 230. At least a portion of the operating system 220, the program 222, and the data 224 may be stored on the removable storage 236 and / or the non-removable storage 238, and when the computing device 200 is powered on or the program 222 is to be executed, it is loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204.
[0037] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include a graphics processing unit 248 and an audio processing unit 250. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which may be arranged to communicate with one or more other computing devices 262 via a network communication link via one or more communication ports 264.
[0038] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be carried out in a manner that encodes information in the signal. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.
[0039] In the computing device 200 according to the present invention, the program 222 includes multiple program instructions of the instruction execution method 300, which can instruct the processor 204 to execute some steps in the file protection method 300 running in the computing device 200 of the present invention, so that each part in the computing device 200 can protect the files of the file partition by executing the file protection method 300 of the present invention.
[0040] The computing device 200 can be implemented as a server, such as a file server 240, a database 250, a server, an application server, etc. These electronic devices can be such as personal digital assistants (PDAs), wireless network browsing devices, application-specific devices, or hybrid devices that can include any of the above functions. It can be implemented as a personal computer including desktop computers and notebook computer configurations. In some embodiments, the computing device 200 is configured to execute the file protection method 300.
[0041] Figure 3 A flow chart of a file protection method 300 according to an exemplary embodiment of the present invention is shown. The file protection method 300 in the present invention is suitable for execution in a computing device, and the computing device includes one or more file partitions. A file partition is a logical disk based on a physical disk of a computing device, and the logical disk is obtained by dividing the physical disk. The present invention does not limit the way of dividing the physical disk. Each file partition stores folders and / or files. A file refers to a collection of a group of related elements with a file name defined by the creator, which is used to store data and implement corresponding functions. A folder may include one or more files, and may include nested folders, and may also be implemented as an empty folder that does not include any content.
[0042] like Figure 3 As shown, the file protection method 300 begins at step S310, determining the number of file nodes in the file partition. A file node refers to a non-empty folder including one or more files and folders, and a file partition is also a file node. When determining the number of file nodes, all folders in the file partition are traversed to determine whether each folder is a file node.
[0043] Then, step S320 is executed to set the piling file sparsity, and the number of piling files is calculated according to the piling file sparsity and the number of file nodes. The piling file sparsity refers to the density of the piling files distributed in the file partition, that is, the probability of deploying a piling file in each file node, or represents the average number of file nodes in which a piling file is deployed. For example, if the piling file sparsity is 0.1, the probability of deploying a piling file under a file node is 0.1, and one piling file is deployed in every 10 file nodes on average.
[0044] When calculating the number of piling files, multiply the piling file sparsity by the number of file nodes to get the number of piling files. The piling file sparsity controls the number of piling files. If the piling file sparsity is low, the number of piling files is small; if the piling file sparsity is high, the number of piling files is large, which can achieve better protection for file partitions. When protecting files or folders in a file partition, the protection effect can be adjusted according to system performance by adjusting the piling file sparsity. When the number of piling files increases to a certain level, the protection effect will not increase, but the system resource consumption will increase significantly. Therefore, by adjusting the piling file sparsity, a lower system performance can be used to achieve a higher protection effect.
[0045] According to an embodiment of the present invention, the number of file nodes (innodes) of the file partition is 10,000, and the sparsity of the piling file is set to 0.01, that is, one piling file is deployed in every 100 file nodes on average. The sparsity of the piling file is multiplied by the number of file nodes to obtain the number of piling files as 100, and these 100 piling files are randomly distributed and created in 10,000 file nodes.
[0046] Subsequently, step S330 is performed to create multiple pile driving files according to the number of pile driving files, and store them in the file node in the file partition. The pile driving file refers to a file used to protect the files or folders under the file node where the pile driving file is located. The purpose of creating the pile driving file is that when the file node is operated, such as being deleted, modified, and maliciously encrypted, the pile driving file in the file node can be operated first. Once the system detects that the pile driving file is modified, the operation on the file node is blocked to protect other files or folders under the file node.
[0047] When creating a piling file, create the piling file according to the file situation stored in the file node. If the file node includes one or more files, create the piling file according to the file name, file type and file size of the file. Specifically, set the file type of the file to the file type of the piling file to ensure that the file type of the piling file is the same as the file type to be protected. When setting the file type of the piling file, when there are multiple files in a folder, these files are of the same file type, or when the number of files of a certain file type is the largest, set it according to the file type of this type of file.
[0048] Then, the file name of the stubbing file is set according to the file name, so that when the files under the file node are sorted according to the file name, the stubbing file is the first file.
[0049] When operating files in a file node, all files are generally sorted by file name. For example, files with file names starting with numbers are sorted first, files with file names starting with letters are sorted last, followed by other files with file names starting with Chinese characters. Files starting with letters are sorted in alphabetical order.
[0050] According to an embodiment of the present invention, the file node includes a file named b and a file named c, and the file name of the pile file is a. The present invention does not limit the specific form of the file name of the pile file, and a character combination that meets the requirements can be randomly selected as the file name of the pile file.
[0051] Then, the size of the piling file is set according to the file size of the file, so that the file size of the piling file is larger than the file size of the file to be protected. When there are multiple files to be protected in a folder, the size of the piling file is larger than the file size of the largest file among the multiple files to be protected. When operating the files in the file node, the files can also be sorted by file size, and the sorted files are processed in order from large to small. In order to ensure that the piling file is the first file to be processed no matter how it is sorted. When determining the size of the piling file, the file size of the piling file can be set to be slightly larger than the file size of the file to be protected to save storage space of the file partition.
[0052] According to one embodiment of the present invention, when the storage space of the file partition is insufficient, or in order to save the storage space of the file partition to a greater extent, the file size of the pile file can be set to be much smaller than the file size of the protected file, such as setting the file size of the pile file to a few bytes, 1KB or 2KB, etc. By setting the size of the pile file in the above manner, it is possible to protect the files in the file node when sorting according to the file size and processing them in order from small to large, and it is also possible to save the storage space of the file partition to the greatest extent.
[0053] The piling file is constructed according to the set file type, file name and file size of the piling file. When constructing the piling file, it is constructed according to the set piling file attributes: file type, file name and file size. According to one embodiment of the present invention, the file content of the piling file is a string generated by a random algorithm. When the piling file to be constructed is large, multiple lines of "0" characters can be interspersed between the strings in a fixed pattern as padding.
[0054] According to one embodiment of the present invention, when setting a piling file, it can also be set in the form of a piling folder, and multiple piling files can be set in the piling folder. By setting a piling folder, the time for processing the piling file can be extended, and a time window for determining whether the piling file has been modified and blocking related operations can be created, so that the system has more time to block the operation in time and avoid other files under the file node from being damaged. When creating a piling folder, the file name of the piling folder is set according to the file name of the file to be protected, so as to construct the piling folder.
[0055] According to an embodiment of the present invention, if the file node includes one or more folders, a piling folder is created according to the file name of the folder. Specifically, the file name of the piling file is set according to the file name of the folder, so that when the folders under the file node are sorted according to the file name, the piling folder is the first folder. The method of setting the file name of the piling folder is the same as the method of setting the file name of the piling file.
[0056] According to one embodiment of the present invention, when setting a pile file, not only is the pile file created by pile file sparsity, but also incremental file detection is performed on the file partition to protect newly added files or folders. When a new file or folder is detected in the file partition, a pile file is created under the file node where the new file or folder is located.
[0057] Then, step S340 is executed, and when the operation instruction for the file node is accepted and executed, it is determined whether the piling file in the file node has been changed. In order to determine whether the piling file has been changed, it is necessary to precalculate the first characteristic value of the piling file. Specifically, the file content of the piling file is converted into a file array, and then the file array is converted into binary, and the first characteristic value of the piling file is obtained according to the number of bits of the file array in binary form.
[0058] According to one embodiment of the present invention, the file content of the pile file is a string generated by a random algorithm. A larger pile file includes multiple strings, each of which is divided by multiple lines of "0" characters. The string is extracted from the file content of the pile file to obtain a file array including the string. If the pile file includes multiple strings, a file array including multiple strings is extracted from the line including the string. The file data is converted into binary, and the number of bits of the binary file data is counted to obtain a first eigenvalue.
[0059] When a pile file is operated by a non-read type, the file content of the pile file must have changed. When judging whether the pile file in the file node has changed, the second characteristic value of the pile file after executing the operation instruction is recalculated according to the above steps, and the second characteristic value is compared with the first characteristic value to determine whether the pile file has changed.
[0060] Finally, step S350 is executed. If it is determined that the pile file has been changed, the operation instruction is stopped to protect other files or folders in the file node. If the second characteristic value of the pile file is different from the first characteristic value, it is determined that the pile file has been changed, and the operation instruction is stopped to protect other files in the file node from being damaged.
[0061] According to an embodiment of the present invention, the computing device is also connected to the control server in communication, the control server is connected to one or more computing devices, and the control server is also connected to the task server in communication. The task server 150 creates a test task and sends the test task to the control server 140. The test task includes multiple test items, and the task server 150 constructs a configuration file for each test item, and combines the configuration files of the multiple test items to be tested as a test task.
[0062] The control server 140 constructs a test installation package according to the test task. The computing device receives and installs the test installation package constructed by the control server 140, and stores multiple piling files in the file node of the installed test installation package to protect the installed test installation package. The number of piling files constructed specifically can be obtained by setting the piling file sparsity and counting the number of file nodes of the test installation package. The test task in the test installation package is then executed to obtain test data, and the test data is sent to the control server; when executing the test task, when accepting and executing the operation instruction on the file node of the test installation package, it is determined whether the piling file in the file node has changed; if it is determined that the piling file has changed, the execution of the operation instruction is stopped to protect other files or folders in the file node of the test installation package.
[0063] According to an embodiment of the present invention, when the computing device determines that the stub file has been changed, it also sends a message to the control server 140 and closes the file to prevent the file from being further destroyed. After receiving the message, the control server 140 manually intervenes to restore the file of the computing device.
[0064] The file protection method of the present invention is suitable for execution in a computing device, and the computing device includes one or more file partitions. First, by determining the number of file nodes in the file partition, the sparsity of the piled file is set, and the number of piled files is calculated according to the sparsity of the piled file and the number of file nodes; multiple piled files are created according to the number of piled files; and multiple piled files are stored in the file nodes in the file partition. The number of piled files created can be adjusted according to the file sparsity. When the file sparsity is low, the number of piled files is correspondingly reduced; when the file sparsity is high, the number of piled files is correspondingly high, which has a better protection effect on the files in the file partition. When accepting and executing an operation instruction for a file node, it is determined whether the piled file in the file node has been changed. If it is determined that the piled file has been changed, the execution of the operation instruction is stopped to protect other files or folders in the file node, so as to avoid improper operation behaviors from damaging the files or folders of the file partition to be protected, prevent viruses from maliciously tampering with files, and prevent important files from being lost due to human misoperation.
[0065] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.
[0066] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.
[0067] Those skilled in the art will appreciate that the modules or units or groups of the devices in the examples disclosed herein may be arranged in the device as described in the embodiment, or alternatively may be located in one or more devices different from the devices in the example. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.
[0068] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or groups in the embodiments may be combined into one module or unit or group, and in addition they may be divided into a plurality of submodules or subunits or subgroups. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device so disclosed may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.
[0069] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present invention and to form different embodiments.
[0070] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.
[0071] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or portions of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a floppy disk, a CD-ROM, a hard disk drive, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.
[0072] In the case where the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the file protection method of the present invention according to the instructions in the program code stored in the memory.
[0073] By way of example and not limitation, computer readable media include computer storage media and communication media. Computer readable media include computer storage media and communication media. Computer storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and includes any information delivery medium. Any combination of the above is also included within the scope of computer readable media.
[0074] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.
[0075] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.
Claims
1. A file protection method, adapted to be executed in a computing device, the computing device comprising one or more file partitions, the method comprising the steps of: Determining the number of file nodes in the file partition; Setting the sparsity of the piling files, and calculating the number of piling files according to the sparsity of the piling files and the number of file nodes, wherein the sparsity of the piling files is the density of the piling files distributed in the file partition; Creating a plurality of piling files according to the number of the piling files, and storing them in the file nodes in the file partition; When accepting and executing an operation instruction on the file node, determining whether a stubbing file in the file node is changed; If it is determined that the stubbing file is changed, then the execution of the operation instruction is stopped to protect other files or folders in the file node; The method further comprises the steps of: Convert the file content of the stubbing file into a file array; Performing binary conversion on the file array, and obtaining a first characteristic value of the piling file according to the number of bits of the file array in binary form; The step of determining whether the stubbing file in the file node is changed comprises the following steps: Calculate the second characteristic value of the piling file after executing the operation instruction; The second characteristic value is compared with the first characteristic value to determine whether the piling file is changed.
2. The method of claim 1, wherein: The step of calculating the number of piling files according to the piling file sparsity and the number of file nodes comprises the following steps: The number of piling files is obtained by multiplying the sparsity of the piling file by the number of file nodes.
3. The method of claim 2, wherein: The step of creating a plurality of piling files according to the number of the piling files and storing them in the file nodes in the file partition comprises the following steps: If the file node includes one or more files, a stub file is created according to the file name, file type and file size of the file.
4. The method of claim 3, wherein: Creating a stub file based on the file name, file type and file size of the file includes the following steps: Setting the file type of the file to the file type of the stubbing file; The file name of the stubbing file is set according to the file name of the file, so that when the files under the file node are sorted according to the file name, the stubbing file is the first file; Setting the size of the piling file according to the file size of the file so that the file size of the piling file is larger than the file size of the file; Build a stub file based on the file type, file name, and file size you set.
5. The method of claim 4, wherein: Also includes the steps: If the file node includes one or more folders, a stubbing folder is created according to the file names of the folders.
6. The method of claim 5, wherein: The step of creating a piling folder according to the file name of the folder comprises the following steps: The file name of the piling file is set according to the file name of the folder, so that when the folders under the file node are sorted according to the file names, the piling folder is the first folder.
7. The method of claim 1, wherein: The method further comprises the steps of: Performing incremental file monitoring on the file partition; When it is detected that a new file or folder is created in the file partition, a stub file is created under the file node where the new file or folder is located.
8. The method according to any one of claims 1 to 6, wherein: The computing device is also in communication with a control server, the control server is connected to one or more computing devices, and the method further includes: Receive and install the test installation package built by the control server; Storing multiple stubbing files in the file node of the installed test installation package; Execute the test task in the test installation package to obtain test data, and send the test data to the control server; When executing the test task, when accepting and executing an operation instruction on a file node of the test installation package, determining whether a stubbing file in the file node is changed; If it is determined that the stubbing file is changed, the execution of the operation instruction is stopped to protect other files or folders in the file node of the test installation package.
9. A computing device comprising: one or more processors; Memory; as well as One or more devices comprising instructions for executing the method according to any one of claims 1-8.
10. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions which, when executed by a computing device, cause the computing device to perform the method according to any one of claims 1-8.
Citation Information
Patent Citations
File protection method and system based on event-driven mechanism
CN106446718A
Ransomware defense method and device
CN106951781A