Method and apparatus for processing compressed file, and nonvolatile storage medium

Abstract

The application discloses a processing method and device of a compressed file, and a nonvolatile storage medium. The method comprises the following steps: obtaining identification information of the compressed file, determining a pre-check code of the compressed file according to the identification information; determining a check code of the compressed file, and comparing the pre-check code with the check code to obtain a first comparison result; in the case that the first comparison result is that the pre-check code is consistent with the check code, obtaining a compression ratio of the compressed file, comparing the compression ratio with a first preset threshold to obtain a second comparison result; and decompressing the compressed file by using a decompression strategy corresponding to the second comparison result. The application solves the technical problem that a server is attacked by a compressed bomb due to the fact that the compressed file is not detected and defended.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a compressed file processing method and device and a nonvolatile storage medium. BACKGROUND

[0002] In some business scenarios, an application will decompress a compressed package to perform corresponding business logic. If the decompressed compressed package is a compressed bomb, the decompression process will occupy a large amount of resources of a server such as a central processing unit (CPU) and memory, resulting in server crashes and server non-responses.

[0003] At present, no effective solution has been proposed for the above problems. SUMMARY

[0004] Embodiments of the present application provide a compressed file processing method and device and a nonvolatile storage medium to at least solve the technical problem of server attacks by compressed bombs due to the lack of detection and defense of compressed files.

[0005] According to an aspect of an embodiment of the present application, a compressed file processing method is provided, including: obtaining identification information of a compressed file, determining a pre-check code of the compressed file according to the identification information; determining a check code of the compressed file, and comparing the pre-check code with the check code to obtain a first comparison result; in the case that the first comparison result is that the pre-check code is consistent with the check code, obtaining a compression ratio of the compressed file, and comparing the compression ratio with a first preset threshold to obtain a second comparison result; and decompressing the compressed file using a decompression strategy corresponding to the second comparison result.

[0006] Optionally, determining the pre-check code of the compressed file according to the identification information includes: comparing the identification information of the compressed file with identification information in a target database to obtain a third comparison result, wherein the target database is a database storing identification information of compressed bombs; if the third comparison result indicates that the identification information of the compressed file belongs to the target database, determining that the compressed file is a compressed bomb and sending an error code, wherein the error code is used to indicate that the compressed file is a compressed bomb; and if the third comparison result indicates that the compressed file does not belong to the target database, determining the pre-check code according to the identification information of the compressed file.

[0007] Optionally, decompressing the compressed file using the decompression strategy corresponding to the second comparison result includes: in the case that the second comparison result indicates that the compression ratio is less than the first preset threshold, decompressing the compressed file; and in the case that the second comparison result indicates that the compression ratio is greater than or equal to the first preset threshold, obtaining an identification of the compressed file, and storing the identification in a target list, wherein the target list is used to store the identification of the compressed file to be rechecked.

[0008] Optionally, after storing the identifier in the target list, the processing method of the compressed file further includes: decompressing the compressed file in the isolated sandbox; obtaining memory occupied by the decompressed compressed file, and comparing the memory occupied by the decompressed compressed file with the second preset threshold; if the memory occupied by the decompressed compressed file is less than the second preset threshold, determining that the compressed file is not a compressed bomb; and if the memory occupied by the decompressed compressed file is greater than or equal to the second preset threshold, determining that the compressed file is a compressed bomb.

[0009] Optionally, after determining that the compressed file is a compressed bomb, the processing method of the compressed file further includes: storing the identifier information in a target database.

[0010] Optionally, the processing method of the compressed file further includes: in a case where the first comparison result is that the pre-check code and the check code are inconsistent, sending a prompt message indicating that the pre-check code and the check code are inconsistent to the terminal.

[0011] Optionally, determining the check code of the compressed file includes: before uploading the compressed file to the server end, obtaining the pre-check code; if the server end receives the compressed file and the pre-check code, generating the check code according to the identifier information of the compressed file; and if the server end only receives the compressed file or only receives the pre-check code, refusing to generate the check code according to the identifier information of the compressed file.

[0012] According to another aspect of the embodiments of the present application, a processing apparatus of a compressed file is also provided, which includes: an obtaining module, configured to obtain identifier information of a compressed file, and determine a pre-check code of the compressed file according to the identifier information; a first comparison module, configured to determine a check code of the compressed file, and compare the pre-check code with the check code to obtain a first comparison result; a second comparison module, configured to, in a case where the first comparison result is that the pre-check code and the check code are consistent, obtain a compression ratio of the compressed file, and compare the compression ratio with a first preset threshold to obtain a second comparison result; and a decompression module, configured to decompress the compressed file by using a decompression strategy corresponding to the second comparison result.

[0013] According to another aspect of the embodiments of the present application, a nonvolatile storage medium is also provided, which stores a program, wherein when the program is running, the nonvolatile storage medium controls a device in which the nonvolatile storage medium is located to execute the processing method of the compressed file.

[0014] According to another aspect of the embodiments of the present application, an electronic device is also provided, which includes a memory and a processor, and the processor is configured to run a program stored in the memory, wherein when the program is running, the processing method of the compressed file is executed.

[0015] In the embodiment of the present application, the identification information of the compressed file is obtained, the pre-check code of the compressed file is determined according to the identification information, the check code of the compressed file is determined, and the pre-check code is compared with the check code to obtain a first comparison result; in the case that the first comparison result is that the pre-check code is consistent with the check code, the compression ratio of the compressed file is obtained, and the compression ratio is compared with a first preset threshold to obtain a second comparison result; and the compressed file is decompressed by using a decompression strategy corresponding to the second comparison result, thereby providing a method for detecting and defending against a compressed bomb, and whether the compressed file is a compressed bomb is determined by detecting the identification information and the compression ratio of the compressed file; at the same time, the compressed file with an abnormal detection result is decompressed in an isolated sandbox to recheck the abnormal compressed file, so that the purpose of detecting and defending against a compressed bomb is achieved, the technical effect of avoiding security risks caused by uploading a compressed file is achieved, and the technical problem of a server being attacked by a compressed bomb due to failure to detect and defend against a compressed file is solved. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0017] Figure 1 is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a compressed file processing method according to an embodiment of the present application;

[0018] Figure 2 is a flowchart of a compressed file processing method according to an embodiment of the present application;

[0019] Figure 3 is a structure diagram of a compressed file processing device according to an embodiment of the present application;

[0020] Figure 4 is a flowchart of detecting a compressed file according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", and the like in the description and claims of the application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to better understand the embodiments of the application, the technical terms involved in the embodiments of the application are explained as follows:

[0024] Compression bomb: a compressed virus, the ratio of the size of the compressed bomb before decompression and the size of the compressed bomb after decompression is greater than 20, decompression of the compressed bomb will occupy a large amount of resources of the server, resulting in server crash.

[0025] Isolation sandbox: an independent running environment isolated from the system established in the disk by using virtualization technology, used for running files with unknown security.

[0026] Hash value: also known as hash value, is a random number used to uniquely identify the corresponding file, usually in the form of a string of random letters and numbers.

[0027] In the related art, whether the compressed file is a compression bomb is determined by judging the number of files in the compressed package. Therefore, there is a problem of missing detection, false detection, and server attack by the compression bomb when the server decompresses the compression bomb. In order to solve this problem, in the embodiments of the application, whether the compressed file is a compression bomb is determined by detecting the hash value and compression ratio of the compressed file, and the isolation sandbox is provided for rechecking the compressed file detected abnormally, avoiding false detection and missing detection, so as to solve the above problem, which will be described in detail below.

[0028] According to the embodiments of the application, a method embodiment of a compressed file processing method is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0029] The method embodiment provided by the embodiments of the application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1A hardware structure block diagram of a computer terminal (or mobile device) for implementing the processing method of compressed files is shown. As shown in Figure 1 The computer terminal 10 (or mobile device 10) can include one or more processors 102 (the processor 102 can include but not limited to a microprocessor MCU or a programmable logic device FPGA processing device, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in Figure 1 or have a different configuration than that shown in Figure 1 .

[0030] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be referred to herein as "data processing circuits" in general. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or any one of the other elements combined into the computer terminal 10 (or mobile device) in whole or in part. As referred to in the embodiments of the present application, the data processing circuit as a kind of processor control (for example, the selection of the variable resistance terminal path connected with the interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the processing method of compressed files in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implements the above-mentioned application program processing method of compressed files. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 can further include a memory remotely disposed with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0032] The transmission device 106 is configured to receive or send data via a network. The network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network interface controller (NIC) that can connect to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module that is configured to communicate with the Internet wirelessly.

[0033] The display can be a liquid crystal display (LCD) that is touch screen, for example, which can enable a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0034] Figure 2 A flowchart of a method for processing a compressed file is provided according to an embodiment of the present application, as shown in FIG. 2, the method includes the following steps: Figure 2

[0035] In step S202, identification information of the compressed file is obtained, and a pre-check code of the compressed file is determined according to the identification information.

[0036] The pre-detection of the compressed file is performed by step S202 before the compressed file is uploaded to the server; the identification information of the compressed file is obtained at the browser end, the identification information being a hash value of the compressed file, or a file name of the compressed file, or other information related to the compressed file, and the pre-check code of the compressed file is obtained by performing an operation on the identification information of the compressed file after the pre-detection is passed.

[0037] In step S204, a check code of the compressed file is determined, and the pre-check code is compared with the check code to obtain a first comparison result.

[0038] In step S204, if the pre-detection in step S202 is passed, the check code of the compressed file is obtained by performing an operation on the identification information of the compressed file, and the (first) comparison result is obtained by comparing the check code with the pre-check code obtained in step S202.

[0039] In step S206, if the first comparison result is that the pre-check code is consistent with the check code, the compression ratio of the compressed file is obtained, and the compression ratio is compared with a first preset threshold to obtain a second comparison result.

[0040] If the (first) comparison result obtained in step S204 is that the pre-check code is inconsistent with the check code, the compression ratio of the compressed file is detected in step S206, and the (second) comparison result is obtained by comparing the compression ratio with a compression ratio threshold (i.e., the first preset threshold).

[0041] ​Step S208, using the decompression strategy corresponding to the second comparison result to decompress the compressed file.

[0042] In step S208, the decompression strategy for the compressed file is determined according to the comparison result (i.e., the second comparison result) of the compression ratio of the compressed file and the compression ratio threshold (i.e., the first preset threshold), and the compressed file is decompressed when the compressed file meets the decompression condition.

[0043] Through the above steps, the compressed file can be pre-detected by detecting the hash value of the compressed file before uploading to the server; the compressed file can be detected again by detecting the compression ratio of the compressed file after uploading to the server; double detection of the compressed file is realized, and the security is higher.

[0044] According to an optional embodiment of the present application, the pre-detection code of the compressed file is determined according to the identification information, including the following steps: comparing the identification information of the compressed file with the identification information in the target database to obtain a third comparison result, wherein the target database is a database storing the identification information of the compressed bomb; if the third comparison result indicates that the identification information of the compressed file belongs to the target database, it is determined that the compressed file is a compressed bomb and an error code is sent, wherein the error code is used to indicate that the compressed file is a compressed bomb; if the third comparison result indicates that the compressed file does not belong to the target database, the pre-detection code is determined according to the identification information of the compressed file.

[0045] In this embodiment, the compressed file is pre-detected, and the pre-detection code of the compressed file is determined after the pre-detection is passed, wherein the pre-detection method is as follows: the identification information of the compressed file is obtained, and a query is performed in the database (i.e., the target database) storing the identification information of the compressed bomb; whether the compressed file is a compressed bomb is judged according to the query result; for example, the hash value of the compressed file is obtained, and the hash value of the compressed file is queried in the compressed bomb database storing the hash value of the compressed file to obtain a query result (i.e., the third comparison result); if the hash value of the compressed file is queried in the above compressed bomb database, it is determined that the compressed file is a compressed bomb, at this time, an error code is sent to the browser end to prompt the browser end that the compressed file is a compressed bomb and there is a security problem. Otherwise, if the hash value of the compressed file is not queried in the above compressed bomb database, it is determined that the compressed file is not a compressed bomb, at this time, the identification information of the compressed file is operated to obtain the pre-detection code; for example, the hash value of the compressed file, the file name of the compressed file and the compression time of the compressed file and other identification information are comprehensively operated to obtain the pre-detection code, and a success code for prompting the pre-detection success is sent to the browser end.

[0046] According to another optional embodiment of the present application, decompressing the compressed file by using the decompression strategy corresponding to the second comparison result comprises the following steps: decompressing the compressed file when the second comparison result indicates that the compression ratio is less than the first preset threshold; and obtaining the identifier of the compressed file and storing the identifier in a target list when the second comparison result indicates that the compression ratio is greater than or equal to the first preset threshold, wherein the target list is used to store the identifiers of the compressed files to be rechecked.

[0047] In the embodiment, the compression ratio threshold is denoted as Y2, and the compression ratio of the compressed file is denoted as Y1. The determination of the decompression strategy for the compressed file according to the comparison result (i.e., the second comparison result) of the compression ratio of the compressed file and the compression ratio threshold (i.e., the first preset threshold) in the step S208 comprises the following two strategies: when the compression ratio of the compressed file is less than the compression ratio threshold (i.e., the first preset threshold), i.e., Y1Y2, it is determined that the compressed file is a normal compressed file and is decompressed; and when the compression ratio of the compressed file is greater than or equal to the compression ratio threshold (i.e., the first preset threshold), i.e., Y1≥Y2, it is determined that the file is a compressed bomb or other abnormal phenomenon occurs, and in this case, the identifier of the compressed file, such as the name of the compressed file, is stored in the list of files to be rechecked (i.e., the target list) to facilitate the subsequent rechecking of the compressed file.

[0048] According to the above embodiment, after the identifier is stored in the target list, the processing method of the compressed file further comprises: decompressing the compressed file in the isolated sandbox; obtaining the memory occupied by the decompressed compressed file, and comparing the memory occupied by the decompressed compressed file with a second preset threshold; if the memory occupied by the decompressed compressed file is less than the second preset threshold, it is determined that the compressed file is not a compressed bomb; and if the memory occupied by the decompressed compressed file is greater than or equal to the second preset threshold, it is determined that the compressed file is a compressed bomb.

[0049] In the embodiment, after the identifier of the compressed file whose compression ratio is greater than or equal to the compression ratio threshold (i.e., the first preset threshold) is stored in the list of files to be rechecked (i.e., the target list), the compressed file is rechecked by the manual detection method, and the method is as follows: the list of files to be rechecked (i.e., the target list) is read, and the compressed file is selected and moved to the isolated sandbox; since the isolated sandbox provides an independent environment isolated from the external system and does not affect the system, the compressed file is decompressed in the isolated sandbox, the size of the memory occupied by the decompressed compressed file is obtained, and if the memory occupied by the decompressed compressed file is much smaller than the memory occupied by the compressed bomb (i.e., the second preset threshold), it is determined that the compressed file is a normal file and the compressed file is decompressed; otherwise, if the memory occupied by the decompressed compressed file is greater than or equal to the memory occupied by the compressed bomb (i.e., the second preset threshold), it is determined that the compressed file is a compressed bomb.

[0050] It should be noted that, in the process of decompressing the compressed file in the isolated sandbox, the percentage of CPU occupied in decompressing the compressed file is also recorded and compared with the percentage of CPU occupied in decompressing the compressed bomb (i.e. the second preset threshold). If the percentage of CPU occupied in decompressing the compressed file is less than the percentage of CPU occupied in decompressing the compressed bomb (i.e. the second preset threshold), it is determined that the compressed file is a normal file and the compressed file is decompressed; otherwise, if the percentage of CPU occupied in decompressing the compressed file is greater than or equal to the percentage of CPU occupied in decompressing the compressed bomb (i.e. the second preset threshold), it is determined that the compressed file is a compressed bomb.

[0051] According to some preferred embodiments of the present application, after determining that the compressed file is a compressed bomb, the processing method of the compressed file further comprises: storing the identification information in the target database.

[0052] In some preferred embodiments, after the method according to the above embodiments determines that the compressed file is a compressed bomb, the identification information of the compressed file is stored in the database (i.e. the target database) storing the identification information of the compressed bomb, so as to update the target database; otherwise, if the compressed file is determined not to be a compressed bomb according to the above embodiments, the identification information of the compressed file is stored in the white list database; through the above method, the compressed file can be quickly determined whether it is a compressed bomb next time.

[0053] According to an optional embodiment of the present application, the processing method of the compressed file further comprises: in the case that the first comparison result is that the pre-check code and the check code are inconsistent, sending a prompt message to the terminal for indicating that the pre-check code and the check code are inconsistent.

[0054] In the present embodiment, if the comparison result (i.e. the first comparison result) obtained by comparing the pre-check code and the check code in the above step S204 is that the pre-check code and the check code are inconsistent, an error is reported to the terminal, and a prompt message is sent to prompt the terminal user that the pre-check code and the check code of the compressed file are inconsistent, and the compressed file fails the security detection.

[0055] According to some preferred embodiments of the present application, the determination of the check code of the compressed file comprises: obtaining the pre-check code before uploading the compressed file to the server end; if the server end receives the compressed file and the pre-check code, generating the check code according to the identification information of the compressed file; if the server end only receives the compressed file or only receives the pre-check code, refusing to generate the check code according to the identification information of the compressed file.

[0056] In some other preferred embodiments, the identification information and compression ratio of the compressed file are used to determine whether the compressed file is a compression bomb. After the compressed file is uploaded to the server, it can only be uploaded to the server if it passes the pre-detection. If the server receives both the compressed file and the pre-detection code at the same time, it means that the compressed file has passed the pre-detection. At this time, the identification information of the compressed file is calculated to obtain the verification code of the compressed file. Otherwise, if the server only receives the compressed file or only receives the pre-detection code, it is determined that the compressed file has not passed the pre-detection.

[0057] Figure 3 This is a structural diagram of a file compression processing apparatus provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes: an acquisition module 30, used to acquire the identification information of the compressed file and determine the pre-check code of the compressed file based on the identification information; a first comparison module 32, used to determine the check code of the compressed file and compare the pre-check code with the check code to obtain a first comparison result; a second comparison module 34, used to acquire the compression ratio of the compressed file if the first comparison result shows that the pre-check code and the check code are consistent, and compare the compression ratio with a first preset threshold to obtain a second comparison result; and a decompression module 36, used to decompress the compressed file using a decompression strategy corresponding to the second comparison result.

[0058] Figure 4 This is a flowchart for detecting compressed files, such as... Figure 4As shown, the processing device of the compressed file starts to work, the identification information of the compressed file is acquired by the acquisition module 30 to pre-detect the compressed file: the identification information is inquired in the compressed bomb database, if the identification information is inquired in the compressed bomb database, it is determined that the pre-detection is failed, and an abnormal file prompt is sent; if the identification information is not inquired, it is determined that the compressed file is not a compressed bomb, and it is determined that the pre-detection is passed. After the pre-detection is passed, the first comparison module 32 is used for safety detection of the compressed file: after the server side receives the uploaded compressed file, the identification information of the compressed file is extracted and calculated to obtain a pre-check code, whether the pre-check code and the pre-check code are consistent is judged; if not, an abnormal file prompt is sent, and if consistent, the safety detection is passed. After the safety detection is passed, the second comparison module 34 is used for acquiring the compression ratio of the compressed file to perform compression ratio detection: the compression ratio of the compressed file is compared with the compression ratio threshold, if the compression ratio of the compressed file is less than the compression ratio threshold, it is determined that the compression ratio detection is passed, it is determined that the compressed file is not a compressed bomb, and the detection is successful; if the compression ratio of the compressed file is greater than or equal to the compression ratio threshold, it is determined that the compression ratio detection is failed, the identification information of the compressed file is stored in the file list to be rechecked by the decompression module 36, the compressed file is moved to the isolated sandbox for decompression, the CPU occupied by decompressing the compressed file and the memory occupied by the decompressed file are observed, and the content of the decompressed file is observed, and it is manually judged whether the file is a compressed bomb; if yes, the detection is failed, an abnormal file prompt is sent, and the identification information of the compressed file is added to the compressed bomb database; if not, the detection is passed, and the identification information of the compressed file is added to the white list database.

[0059] It should be noted that, Figure 3 The preferred embodiments of the embodiments shown can be referred to Figure 2 The related description of the embodiments shown will not be repeated here.

[0060] The embodiments of the present application also provide a non-volatile storage medium, which stores a program, wherein when the program runs, the device where the non-volatile storage medium is located performs the above processing method of the compressed file.

[0061] The non-volatile storage medium is used to store a program for performing the following functions: acquiring identification information of a compressed file, determining a pre-check code of the compressed file according to the identification information; determining a check code of the compressed file, and comparing the pre-check code with the check code to obtain a first comparison result; in the case that the first comparison result is that the pre-check code is consistent with the check code, acquiring a compression ratio of the compressed file, and comparing the compression ratio with a first preset threshold to obtain a second comparison result; and decompressing the compressed file by using a decompression strategy corresponding to the second comparison result.

[0062] The embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the processor is used to run a program stored in the memory, and the program is used to execute the processing method of the compressed file.

[0063] The processor in the electronic device is used to run a program to perform the following functions: obtaining identification information of the compressed file, determining a pre-check code of the compressed file according to the identification information; determining a check code of the compressed file, and comparing the pre-check code with the check code to obtain a first comparison result; in the case that the first comparison result is that the pre-check code is consistent with the check code, obtaining a compression ratio of the compressed file, and comparing the compression ratio with a first preset threshold to obtain a second comparison result; and decompressing the compressed file by using a decompression strategy corresponding to the second comparison result.

[0064] It should be noted that each module in the processing device of the compressed file can be a program module (for example, a program instruction set for realizing a certain specific function) or a hardware module, and for the latter, it can be in the following form, but is not limited to: the form of each module is a processor, or the functions of each module are realized by a processor.

[0065] The serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0066] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0067] In the several embodiments provided by the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the unit described as the division is only a logical function division, and there can be another division way during actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection between each other can be indirect coupling or communication connection through some interface, unit or module, and can be electrical or other forms.

[0068] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0069] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0070] When the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or the part that contributes to the related art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0071] The above is only the preferred embodiment of the present application, and it should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method for processing compressed files, characterized in that, include: Obtain the identification information of the compressed file, and determine the pre-detection code of the compressed file based on the identification information; Determine the checksum of the compressed file, and compare the pre-check code with the checksum to obtain a first comparison result; If the first comparison result is that the pre-detection code and the check code are consistent, the compression ratio of the compressed file is obtained, and the compression ratio is compared with a first preset threshold to obtain a second comparison result; The compressed file is decompressed using the decompression strategy corresponding to the second comparison result; wherein... The step of determining the pre-detection code of the compressed file based on the identification information includes: comparing the identification information of the compressed file with the identification information in a target database to obtain a third comparison result, wherein the target database is a database storing identification information of compressed bombs; if the third comparison result indicates that the identification information of the compressed file belongs to the target database, determining that the compressed file is the compressed bomb and sending an error code, wherein the error code is used to indicate that the compressed file is the compressed bomb; if the third comparison result indicates that the compressed file does not belong to the target database, determining the pre-detection code based on the identification information of the compressed file; The method further includes: decompressing the compressed file in an isolated sandbox; obtaining the memory occupied by decompressing the compressed file, and comparing the memory occupied by decompressing the compressed file with a second preset threshold; if the memory occupied by decompressing the compressed file is less than the second preset threshold, determining that the compressed file is not the compressed bomb; if the memory occupied by decompressing the compressed file is greater than or equal to the second preset threshold, determining that the compressed file is the compressed bomb.

2. The method according to claim 1, characterized in that, The compressed file is decompressed using a decompression strategy corresponding to the second comparison result, including: If the second comparison result indicates that the compression ratio is less than the first preset threshold, the compressed file is decompressed; If the second comparison result indicates that the compression ratio is greater than or equal to the first preset threshold, the identifier of the compressed file is obtained and the identifier is stored in the target list, wherein the target list is used to store the identifiers of compressed files to be re-examined.

3. The method according to claim 1, characterized in that, After determining that the compressed file is the compressed bomb, the method further includes: storing the identification information in the target database.

4. The method for processing compressed files according to claim 1, characterized in that, The method further includes: If the first comparison result indicates that the pre-check code and the check code are inconsistent, a prompt message indicating that the pre-check code and the check code are inconsistent is sent to the terminal.

5. The method according to claim 1, characterized in that, Determining the checksum of the compressed file includes: Before uploading the compressed file to the server, obtain the pre-check code; If the server receives the compressed file and the pre-check code, it generates the check code based on the identification information of the compressed file. If the server only receives the compressed file, or only receives the pre-check code, it refuses to generate the check code based on the identification information of the compressed file.

6. A device for processing compressed files, characterized in that, include: The acquisition module is used to acquire the identification information of the compressed file and determine the pre-detection code of the compressed file based on the identification information. The first comparison module is used to determine the checksum of the compressed file and compare the pre-check code with the checksum to obtain a first comparison result; The second comparison module is used to obtain the compression ratio of the compressed file when the first comparison result is that the pre-detection code and the check code are consistent, and compare the compression ratio with a first preset threshold to obtain a second comparison result; A decompression module is used to decompress the compressed file using a decompression strategy corresponding to the second comparison result; wherein, determining the pre-detection code of the compressed file based on the identification information includes: comparing the identification information of the compressed file with identification information in a target database to obtain a third comparison result, wherein the target database is a database storing identification information of compression bombs; if the third comparison result indicates that the identification information of the compressed file belongs to the target database, determining that the compressed file is the compression bomb and sending an error code, wherein the error code is used to indicate that the compressed file is the compression bomb; if the third comparison result indicates that the compressed file does not belong to the target database, determining the pre-detection code based on the identification information of the compressed file; The processing device is further configured to decompress the compressed file in an isolated sandbox; obtain the memory occupied by decompressing the compressed file, and compare the memory occupied by decompressing the compressed file with a second preset threshold; if the memory occupied by decompressing the compressed file is less than the second preset threshold, determine that the compressed file is not the compressed bomb; if the memory occupied by decompressing the compressed file is greater than or equal to the second preset threshold, determine that the compressed file is the compressed bomb.

7. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a program, wherein when the program is executed, it controls the device where the non-volatile storage medium is located to perform the compressed file processing method according to any one of claims 1 to 5.

8. An electronic device, characterized in that, include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the method for processing compressed files according to any one of claims 1 to 5.

Images