SMB protocol file restoration method and system

Abstract

The present application provides an SMB protocol file restoration method and system, which obtains the restore instruction of the target file by obtaining the restore file field information of the message if the direction is a request direction, and saves the restore file field information to the session control structure, wherein the restore file field information at least includes an interactive message number and a file offset. If the direction is a response direction, match other restore file field information in the restore file field information by the interactive message number; write the file block of the request direction message or the response direction message into the memory according to the file offset; if the total length of the file blocks written into the memory is the same as the total length of the file in the corresponding restore file field information, it indicates that the target file restoration is completed. The method solves the problem of out-of-order file blocks in SMB protocol file transfer through interactive message numbers and file offsets to restore the complete target file.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and system for restoring SMB protocol files. Background Art

[0002] Files transmitted in the network need to be audited and protected against viruses. Auditing and anti-virus functions require parsing the transmission protocol to identify the file name, file size, and file content during the file transmission process. For example, in some scenarios, the SMB (Server Message Block) protocol needs to be controlled and protected against viruses during file transmission, and control and anti-virus rely on file restoration during the transmission process.

[0003] In SMB protocol file restoration, you can parse the SMB protocol to obtain information such as file name and file size during the transmission process. Based on the information obtained, you can control SMB file transmission, such as limiting file size and sensitive words in file names. However, the real file type and anti-virus functions that are identified based on file content require a complete file.

[0004] During the SMB protocol transmission process, when the client transfers a file to the server, the file will be divided into multiple file blocks, and then these file blocks will be sent to the server one by one. However, during the SMB protocol file transmission process, due to network delays, interruptions or other reasons, the file blocks will be out of order. In addition, the above method can only obtain the file name, file size and other contents during the file transmission process. Since only the file name and file size can be obtained, and the file blocks will be out of order during the transmission process, it is impossible to restore the complete file. Summary of the invention

[0005] The present application provides an SMB protocol file restoration method and system to solve the problem of being unable to restore complete files.

[0006] In a first aspect, the present application provides a method for restoring an SMB protocol file, the method comprising:

[0007] Get the restore instruction of the target file;

[0008] In response to the restore instruction, if the message type of the SMB protocol is to download a file, obtain the direction of the message;

[0009] If the direction is a request direction, obtaining the restored file field information of the request direction message, and saving the restored file field information to the session control structure, wherein the restored file field information includes the interaction message number, file offset, file name, file size, and total file length information;

[0010] If the direction is a response direction, obtaining an interaction message number of the response direction message;

[0011] If the interactive message number of the response direction message exists in the session control structure, matching the other restored file field information in the restored file field information except the interactive message number;

[0012] Writing the file block of the request direction message or the response direction message into the memory according to the file offset;

[0013] The total length of the file blocks written in the memory and the total file length in the corresponding restored file field information are read. If the total length written is the same as the total file length, it indicates that the target file restoration is completed.

[0014] In some feasible embodiments, after responding to the restore instruction, the method includes:

[0015] If the message type of the SMB protocol is to upload a file, obtain the direction of the message;

[0016] If the direction is a request direction, obtaining the restored file field information of the request direction message, and saving the restored file field information to the session control structure;

[0017] If the interactive message number in the restore file field information of the request direction message exists in the session control structure, match the file offset in the session control structure;

[0018] According to the file offset, the file block of the request direction message is written into the memory.

[0019] In some feasible embodiments, writing the file block of the request direction message or the response direction message into the memory according to the file offset includes:

[0020] Detecting a memory file structure in the session control structure, wherein the session control structure includes a plurality of structures;

[0021] If the memory file structure is in a default initial state, the file block of the request direction message or the response direction message is written into the memory according to the file offset, and the memory includes a plurality of fields.

[0022] In some feasible embodiments, writing the file block of the request direction message or the response direction message into the memory according to the file offset includes:

[0023] Assigning the restored file field information in the session control structure to the field of the memory, wherein the restored file field information and the field have a mapping relationship;

[0024] Set the file pointer offset to the offset field of the memory;

[0025] According to the file offset of the request direction message, the file block of the request direction message is written into the offset field corresponding to the memory.

[0026] In some feasible embodiments, writing the file block of the request direction message or the response direction message into the memory according to the file offset further includes:

[0027] Apply for memory from the operating system, where the memory includes multiple memory blocks.

[0028] In some feasible embodiments, after reading the total length of the file blocks written in the memory and the total length of the file in the corresponding restored file field information, the method includes:

[0029] According to the written file block, searching for the restored file field information corresponding to the file block;

[0030] If the total length of the written file blocks is the same as the total length of the file in the restored file field information, it indicates that the target file is saved in the memory;

[0031] The target file stored in the memory is written into the hard disk to complete the restoration of the target file.

[0032] In some feasible embodiments, the step of saving the restored file field information to a session control structure includes:

[0033] Obtaining the interval time of the request direction message;

[0034] If the interval time is less than the time threshold, the number of sessions that the session control structure can save is obtained; and an integer array is created in the session control structure, the array is used to store the interaction message number, file offset and file size of the request direction message, and the size of the array is the same as the number of sessions that the session control structure can save.

[0035] In some feasible embodiments, the method further includes:

[0036] Get five-tuple information;

[0037] A session control structure is created according to the five-tuple information.

[0038] In some feasible embodiments, writing the file block of the request direction message or the response direction message into the memory further includes:

[0039] Obtain the file block type;

[0040] If the file block type is an executable file, detecting the file block based on a behavior analysis detection method to obtain a detection result;

[0041] If the detection result is that no malicious behavior is detected, the file block content is written.

[0042] In a second aspect, the present application provides an SMB protocol file restoration system, which is used to execute the SMB protocol file restoration method according to any one of the first aspects, and the system includes:

[0043] An acquisition unit, the acquisition unit is used to acquire a restore instruction for a target file;

[0044] In response to the restore instruction, if the message type of the SMB protocol is to download a file, the acquisition unit is further used to acquire the direction of the message; if the direction is a request direction, it is used to acquire the restore file field information of the request direction message, and save the restore file field information to the session control structure, wherein the restore file field information includes an interactive message number, a file offset, a file name, a file size, and a total file length information; if the direction is a response direction, it is used to acquire the interactive message number of the response direction message;

[0045] a matching unit, wherein if the interactive message number of the response direction message exists in the session control structure, the matching unit is used to match the other restored file field information in the restored file field information except the interactive message number;

[0046] A writing unit, the writing unit is used to write the file block of the request direction message or the response direction message into a memory according to the file offset;

[0047] A reading unit is used to read the total length of the file blocks written in the memory and the total length of the file in the corresponding restored file field information. If the total length of the file blocks written is the same as the total length of the file, it indicates that the target file restoration is completed.

[0048] It can be seen from the above technical solution that the present application provides an SMB protocol file restoration method and system, which obtains the restore instruction of the target file, and if the message type of the SMB protocol is to download the file, obtains the direction of the message; if the direction is the request direction, obtains the restore file field information of the request direction message, and saves the restore file field information to the session control structure, wherein the restore file field information includes the interactive message number, file offset, file name, file size and total file length information. If the direction is the response direction, obtain the interactive message number of the response direction message; if the interactive message number of the response direction message exists in the session control structure, match the restore file field information other than the interactive message number in the restore file field information; according to the file offset, write the file block of the request direction message or the response direction message into the memory; read the total length of the written file blocks in the memory and the total file length in the corresponding restore file field information, if the total length of the written file blocks is the same as the total file length, it indicates that the target file restoration is completed. The present application solves the problem of out-of-order file blocks in SMB protocol file transfer by storing the restored file field information in the session control structure and using the interactive message number and file offset to restore the complete target file. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] Figure 1 This is a schematic diagram of the structure of the SMB protocol file restoration method shown in this embodiment;

[0051] Figure 2 A schematic diagram of the interactive process of downloading file messages shown in this embodiment;

[0052] Figure 3 This is a schematic diagram of the interaction process of uploading a file message shown in this embodiment;

[0053] Figure 4 This is a schematic diagram of the offset position structure shown in this embodiment. DETAILED DESCRIPTION

[0054] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0055] SMB is a protocol used for file sharing, printer sharing and general network communication. Through the SMB protocol, client applications can read and write files on the server in various network environments, and make service requests to server programs. In addition, through the SMB protocol, applications can access files and printers on the remote server.

[0056] However, the SMB protocol may also be used by malicious users to carry out attacks, such as man-in-the-middle attacks, or spread viruses through shared files. In order to achieve the functions of file transfer control and anti-virus of the SMB protocol, it is necessary to restore the files during the transfer process. When controlling the anti-virus function, it is necessary to parse the transfer protocol to identify the file name, file size, and file content during the file transfer process.

[0057] Network security devices, such as IP protocol ciphers, secure routers, line ciphers, firewalls, etc., can only control traffic by file name and file size. At the same time, the anti-virus function also matches by calculating the MD5 (Message Digest Algorithm 5 version 5) of each message.

[0058] Functions such as real file types and antivirus based on file content identification require a complete file. For example, the real file type identification function based on file content requires the file header information for identification. During the upload or download process of the SMB protocol, the file header content is not necessarily in the first file transfer message, resulting in the inability to accurately identify the file type. For the antivirus function based on stream MD5, there will be a problem of file block disorder during the SMB protocol transmission process, which may cause MD5 calculation errors and lead to inaccurate message antivirus identification rate. In summary, due to problems such as file header information and file block disorder, it is impossible to restore the complete file.

[0059] In order to solve the problem that the file blocks are out of order during the SMB protocol file transfer process, resulting in the inability to restore the complete file, some embodiments of the present application provide an SMB protocol file restoration method, see Figure 1 , methods include:

[0060] S100: Obtain a restore instruction for a target file.

[0061] The target file is a deleted file, a damaged file, a file infected by a virus, etc. When the above situation is detected in the target file, a restore instruction for restoring the entire file can be sent, that is, the entire file is the data of the complete target file.

[0062] When the target file is restored based on demand, it is possible to obtain whether the functions required by the SMB protocol file transfer process require a complete file, for example: anti-virus function, audit function, which require a complete file; first determine the function of the SMB protocol file transfer process, and then obtain the restore instruction.

[0063] When using the SMB protocol to transfer files, the client sends a request, the server receives and responds to the request sent by the client, and the server sends the target file to the client. When the anti-virus function needs to be implemented, the server can generate a restore instruction. For example, when the client receives an alert from the anti-virus software and detects that a target file may carry virus software, the client can request the server to delete or quarantine the file. Then, the server will perform this operation and restore the corresponding file, for example: deleting the virus file or moving it to the quarantine area.

[0064] S200: In response to the restore instruction, if the message type of the SMB protocol is to download a file, obtain the direction of the message.

[0065] The message types of SMB include uploading write files and downloading read files. For the SMB protocol, file restoration includes file restoration of uploaded files and file restoration of downloaded files. According to the RFC (Request For Comments) document, the message format during the SMB protocol transmission process includes three parts: NETBIOS (Network Basic Input / Output System) header, SMB header, and body content. For file restoration of the SMB protocol, the fields such as the operation command (used to distinguish whether it is a read download or a write upload), the interactive message ID, the offset length of the file transfer, and the total file length can be obtained from the SMB header. Because the message formats of download and upload are different during the interactive process, the data of each field of the message is different, and the data structure used in the processing process is also different. Therefore, the upload and download are restored separately.

[0066] The client is configured to respond to the restore instruction of the server and obtain the direction of the message during the transmission process, where the direction of the message includes the request direction and the response direction. The direction is the role and communication order between the sender and the receiver of the message. In the SMB protocol, the request direction is the client sending the message to the server, and the response direction is the server sending the message to the client as a response to the request.

[0067] S210: If the direction is a request direction, obtain the restored file field information of the request direction message, and save the restored file field information to the session control structure.

[0068] The restored file field information includes the interactive message number message-id, file offset offset, file name, file size, and total file length information. When the SMB message is to download the read file and the direction of the message is the request direction, parse the request direction message to obtain the interactive message number message_id, file offset offset, file name, file size, and total file length information of the request direction message. The session control structure includes multiple structures, and different structures are used to store different restored file field information.

[0069] In some embodiments, the session control structure further includes a linked list, which is used to store and manage multiple message_ids in the session structure.

[0070] For example, when a request message is received, the server will assign a unique message_id to it and add it to the linked list of the session structure. Each node in the linked list contains information related to the message_id. Through the linked list of the session control structure, the server can track and manage multiple request messages. When it needs to process or respond to a request, the server can obtain the corresponding message_id and related information by searching the linked list, and then perform the corresponding operation.

[0071] During the SMB protocol transmission process, if the message receives multiple request messages continuously, when the server receives multiple request messages continuously, the server will search for the corresponding message_id and related information from the session control structure linked list, and then perform corresponding processing according to the type of request and the operation performed.

[0072] After obtaining the restore file field information of the request direction message, save this information to the session control structure. In network communication, a session is defined as an interaction process between the client and the server. This interaction process involves the exchange of one or more data packets. The establishment of a session usually begins with the client sending a request to the server, such as an HTTP request. The server responds to this request and sends one or more data packets in response. This process will contain some specific information, such as: source IP address, destination IP address, source port, destination port, protocol type, that is, five-tuple information, which is used to uniquely identify a session.

[0073] Since the session control structure is used to save information on the same session, it is understandable that if other instructions that are the same as this instruction already exist before this save, then the session control structure already exists before this save, and this time the restored file field information can be saved to the existing session control structure.

[0074] In network communication, the five-tuple information can be used to identify a specific network connection or session. That is, if the five-tuple information of two network connections is the same, then they are connections in the same session. For the first appearance of session information, in some embodiments, by obtaining the five-tuple information; creating a session control structure according to the five-tuple information. Messages with the same five-tuple information belong to the same session.

[0075] Because the interaction of the SMB protocol is not static, during the message interaction process, there may be many request messages sent in sequence, and then response messages are sent to write files. Figure 2 In the message interaction mode, the offset file offset in the request process is not necessarily to read the file sequentially, and the file may be read in a jumpy manner. Therefore, it is necessary to record the message_id and the file offset offset that matches it in each request. The offset information that matches it can be found in the session control structure through the message_id.

[0076] When searching for file restore field information such as file offset, it is obtained through message_id. Since message_id needs to be frequently searched, the message_id information of each request can be saved in the form of an array, and the array can efficiently access and operate data. In some embodiments, the interval time of the request direction message can be obtained; if the interval time is less than the time threshold, the number of sessions that can be saved in the session control structure is obtained; and an integer array is created in the session control structure, and the array is used to store the interactive message number, file offset and file size of the request direction message. The size of the array is the same as the number of sessions that can be saved in the session control structure.

[0077] By setting the size of the session control structure and array, you can limit the number of sessions running simultaneously to prevent excessive consumption of system resources due to too many concurrent requests.

[0078] Then save the file restoration field information to the session control structure, and determine whether the session->mem_file structure is empty. If it is empty, it means that the first request message is received. At this time, it is necessary to apply for memory of the corresponding size in the memory system to store the file block of the request message according to the file offset.

[0079] It is understandable that each message_id is only used once in a complete file transfer interaction process. During the file download or upload process, the client sends a request to the server to request the server to send or receive a file. This request contains a message_id to identify the request. After receiving the request, the server will process the message_id in the request accordingly and send a response to the client. In this process, the role of message_id is to identify the uniqueness of each request or response. Since each message_id is unique, each message_id is only used once in a complete file transfer interaction process. When a message_id is sent, it will be discarded and will not be reused. Therefore, in the file download and upload process of the SMB protocol, there is no situation where the client and the server complete an interaction and then proceed to the next message_id, which is different from the process of restoring files in other protocols. Each message_id is independent and unique, and is only associated with a specific file transfer interaction process.

[0080] S220: If the direction is a response direction, obtain the interaction message number of the response direction message.

[0081] For the message_id information, each request message corresponds to a message_id, and the response message also carries the same message_id field, which is used to indicate that it is a complete interactive request. Therefore, the message_id of the response message is the same as the message_id of the request message, because the restored file field information of the same session has been saved in the session control structure in the response message. If the same message_id can be obtained, it means that other restored file field information saved together with the message_id can be obtained.

[0082] S300: If the interactive message number of the response direction message exists in the session control structure, match the other restored file field information except the interactive message number in the restored file field information.

[0083] See also Figure 3 In the message interaction process, in addition to the interactive message number, other restored file field information includes file offset, file name, file size and total file length information. Among them, the file offset is used to indicate the position of the current read and write position in the file. Whenever a read or write operation is performed, it starts from the current file offset and increases the offset by the number of bytes read or written.

[0084] S400: Writing the file block of the request direction message or the response direction message into the memory according to the file offset.

[0085] Since the message format during the SMB protocol transmission process includes three parts: the NETBIOS header, the SMB header and the body content, among which the body content is the file data. It can be understood that the message, whether in the upload or download process, contains the body content, and this part of the body content is the file that needs to be restored in this embodiment. Therefore, when matching the request direction message or the response direction message, the body content in the message includes multiple file blocks. According to the above, by judging that the session->mem_file structure is empty, that is, detecting the memory file structure mem_file in the session control structure, if the memory file structure is in the default initial state, then apply to restore the memory of the file size in the file field information in the memory. Exemplarily, the memory structure is as follows:

[0086] {

[0087] Void*mem_file; / / File content pointer

[0088] Int mem_len; / / The length of the file currently written

[0089] Int mem_offset; / / Write the offset value of the file

[0090] Char*mem_file_name; / / file name

[0091] }

[0092] When the memory file structure is in the default initial state, it means that all member variables of the structure are set to default values. For example, if the structure contains an integer variable, the integer variable may be initialized to 0; if it contains a character variable, the character variable may be initialized to the null character '\0'; if it contains a pointer variable, the pointer variable may be initialized to NULL.

[0093] In order to dynamically adjust the size of the memory, in some embodiments, the memory can be applied to the operating system. The memory includes multiple memory blocks, and the memory block provides small memory spaces by applying for a fixed-size memory space in advance and dividing the memory space into multiple small blocks. It can be understood that the memory block can be used to store one file block or multiple file blocks. Each memory block can have a unique identifier to facilitate tracking and management. At the same time, the size of the memory block can also be dynamically adjusted according to the size of the target file.

[0094] After the memory block application is completed, the file name and file offset data in the session control structure can be distributed and assigned to different memory blocks. In some embodiments, the restored file field information in the session control structure is first assigned to the field of the memory; the file pointer offset is set to the offset field of the memory; and according to the file offset of the request direction message, the file block of the request direction message is written to the offset field corresponding to the memory.

[0095] There is a mapping relationship between the restored file field information and the fields; illustratively, the file name is assigned to mem_file_name, and the file offset is assigned to mem_offset.

[0096] After the assignment, the file pointer is offset to mem_offset. When processing the response message, the content of the target file can be written to the correct location based on the file offset of the request direction. For example: Figure 4 offset1 in .

[0097] In some embodiments, before writing the file block into the memory, the type of the file block can also be obtained; if the file type of the file block is an executable file, the file block is detected based on a behavioral analysis detection method to obtain a detection result; if the detection result is that no malicious behavior is detected, the file block content is written.

[0098] By setting file type restrictions, you can prevent the transmission of viruses and other malicious files. For example, you can prohibit the transmission of specific types of executable files (such as .exe, .com, .dll, etc.), thereby reducing the risk of virus transmission. Then check the content of the transmitted file to identify potential malicious code. This can be achieved through file scanning, virus signature matching, or detection methods based on behavioral analysis. Behavioral analysis can detect malicious behavior of files, such as stealing sensitive data, damaging systems, remote control, etc., and can discover potential malicious activities. If no malicious behavior is detected, the contents of the file block can be safely written to the file.

[0099] S500: Read the total length of the written file blocks in the memory and the total file length in the corresponding restored file field information. If the total length of the written file blocks is the same as the total file length, it indicates that the target file restoration is completed.

[0100] After gradually writing the file blocks into the memory, if the total length of the written file blocks is the same as the total length of the file, it indicates that the target file is saved in the memory; the file blocks saved in the memory are written to the hard disk to complete the restoration of the target file. By writing the target file to the hard disk after writing it to the memory, the performance can be improved and the IO operation can be reduced. It can be understood that the file blocks kept in the memory include multiple file blocks, and the target file includes multiple file blocks. By judging whether the length of the file blocks written into the memory is the same as the total length of the file in the restored file field information, if they are the same, the target file can be written to the hard disk.

[0101] For example, take the read operation to download a 2M file as an example. The data structure of S200-S500 is as follows:

[0102]

[0103]

[0104] Similar to downloading files, after determining that the message type of the SMB protocol is to upload files, the direction of the message is also obtained; in some embodiments, if the message type of the SMB protocol is to upload files, the direction of the message is obtained; if the direction is a request direction, the restore file field information of the request direction message is obtained, and the restore file field information is saved to the session control structure; if the interaction message number in the restore file field information of the request direction message exists in the session control structure, the file offset in the session control structure is matched; according to the file offset, the file block of the request direction message is written into the memory.

[0105] However, unlike downloading files, this embodiment does not consider the response direction message during the file upload process, directly obtains the restoration field information of the request direction message, and after saving it in the session control structure, directly obtains the file offset through message_id and writes the file block into the memory.

[0106] In order to facilitate the execution of the above-mentioned method, some embodiments of the present application also provide an SMB protocol file restoration system, including:

[0107] An acquisition unit, the acquisition unit is used to acquire a restore instruction of a target file;

[0108] In response to the restore instruction, if the message type of the SMB protocol is to download a file, the acquisition unit is further used to acquire the direction of the message; if the direction is a request direction, it is used to acquire the restore file field information of the request direction message, and save the restore file field information to the session control structure, wherein the restore file field information includes the interactive message number, file offset, file name, file size and total file length information; if the direction is a response direction, it is used to acquire the interactive message number of the response direction message;

[0109] A matching unit, wherein if the interactive message number of the response direction message exists in the session control structure, the matching unit is used to match the other restored file field information except the interactive message number in the restored file field information;

[0110] A writing unit, the writing unit is used to write a file block of a request direction message or a response direction message into a memory according to a file offset;

[0111] The reading unit is used to read the total length of the file blocks written in the memory and the total length of the file in the corresponding restored file field information. If the total length of the file blocks written is the same as the total length of the file, it indicates that the target file restoration is completed.

[0112] It can be seen from the above technical solution that the present application provides an SMB protocol file restoration method and system, which obtains the restore instruction of the target file, and if the message type of the SMB protocol is to download the file, obtains the direction of the message; if the direction is the request direction, obtains the restore file field information of the request direction message, and saves the restore file field information to the session control structure, wherein the restore file field information includes the interactive message number, file offset, file name, file size and total file length information. If the direction is the response direction, obtain the interactive message number of the response direction message; if the interactive message number of the response direction message exists in the session control structure, match the restore file field information other than the interactive message number in the restore file field information; according to the file offset, write the file block of the request direction message or the response direction message into the memory; read the total length of the file blocks written in the memory and the total file length in the corresponding restore file field information, if the total length of the file blocks written is the same as the total file length, it indicates that the target file restoration is completed. The present application solves the problem of out-of-order file blocks in SMB protocol file transfer by storing the restored file field information in the session control structure and using the interactive message number and file offset to restore the complete target file.

[0113] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A method for restoring SMB protocol files, characterized in that: The method comprises: Get the restore instruction of the target file; In response to the restore instruction, if the message type of the SMB protocol is to download a file, obtain the direction of the message; If the direction is a request direction, obtaining the restored file field information of the message in the request direction, and saving the restored file field information to the session control structure, wherein the restored file field information includes the interactive message number, file offset, file name, file size, and total file length information; recording the interactive message number in the request and the file offset matching the interactive message number, so as to search for the file offset information matching the interactive message number in the session control structure; If the direction is a response direction, obtaining an interactive message number of a message in the response direction; If the interactive message number of the message in the response direction exists in the session control structure, matching the other restored file field information except the interactive message number in the restored file field information; Writing the file block of the message in the request direction or the message in the response direction into the memory according to the file offset; The total length of the file blocks written in the memory and the total file length in the corresponding restored file field information are read. If the total length of the file blocks written is the same as the total file length, it indicates that the target file restoration is completed.

2. The SMB protocol file restoration method according to claim 1, characterized in that: After responding to the restore instruction, the method further comprises: If the message type of the SMB protocol is to upload a file, obtain the direction of the message; If the direction is a request direction, obtaining the restored file field information of the message in the request direction, and saving the restored file field information to the session control structure; If the interactive message number in the restore file field information of the message in the request direction exists in the session control structure, match the file offset in the session control structure; According to the file offset, the file block of the message in the request direction is written into the memory.

3. The SMB protocol file restoration method according to claim 1, characterized in that: Writing the file block of the message in the request direction or the message in the response direction into the memory according to the file offset includes: Detecting a memory file structure in the session control structure, wherein the session control structure includes a plurality of structures; If the memory file structure is in a default initial state, the file block of the message in the request direction or the message in the response direction is written into the memory according to the file offset, and the memory includes multiple fields.

4. The SMB protocol file restoration method according to claim 3, characterized in that: Writing the file block of the message in the request direction or the message in the response direction into the memory according to the file offset includes: Assigning the restored file field information in the session control structure to the field of the memory, wherein the restored file field information and the field have a mapping relationship; Set the file pointer offset to the offset field of the memory; According to the file offset of the message in the request direction, the file block of the message in the request direction is written into the offset field corresponding to the memory.

5. The SMB protocol file restoration method according to claim 3, characterized in that: The step of writing the file block of the message in the request direction or the message in the response direction into the memory according to the file offset further includes: Apply for memory from the operating system, where the memory includes multiple memory blocks.

6. The SMB protocol file restoration method according to claim 1, characterized in that: After the total length of the file blocks written in the memory and the total length of the file in the corresponding restored file field information are read, the method includes: According to the written file block, searching for the restored file field information corresponding to the file block; If the total length of the written file blocks is the same as the total length of the file in the restored file field information, it indicates that the target file is saved in the memory; The target file stored in the memory is written into the hard disk to complete the restoration of the target file.

7. The SMB protocol file restoration method according to claim 1, characterized in that: The step of saving the restored file field information to the session control structure includes: Obtaining the interval time of the message in the request direction; If the interval time is less than the time threshold, the number of sessions that the session control structure can save is obtained; and an integer array is created in the session control structure, the integer array is used to store the interactive message number, file offset and file size of the message in the request direction, and the size of the integer array is the same as the number of sessions that the session control structure can save.

8. The SMB protocol file restoration method according to claim 1, characterized in that: The method further comprises: Get five-tuple information; A session control structure is created according to the five-tuple information.

9. The SMB protocol file restoration method according to claim 1, characterized in that: The step of writing the file block of the message in the request direction or the message in the response direction into the memory further includes: Obtain the type of the file block; If the type of the file block is an executable file, detecting the file block based on a behavior analysis detection method to obtain a detection result; If the detection result is that no malicious behavior is detected, the content of the file block is written.

10. An SMB protocol file restoration system, characterized in that: Used to execute the SMB protocol file restoration method according to any one of claims 1 to 9, the system comprises: An acquisition unit, the acquisition unit is used to acquire a restore instruction for a target file; In response to the restore instruction, if the message type of the SMB protocol is to download a file, the acquisition unit is further used to acquire the direction of the message; if the direction is a request direction, it is used to acquire the restore file field information of the message in the request direction, and save the restore file field information to the session control structure, wherein the restore file field information includes an interactive message number, a file offset, a file name, a file size, and a total file length information; if the direction is a response direction, it is used to acquire the interactive message number of the message in the response direction; a matching unit, wherein if the interactive message number of the message in the response direction exists in the session control structure, the matching unit is used to match the other restored file field information in the restored file field information except the interactive message number; A writing unit, the writing unit is used to write the file block of the message in the request direction or the message in the response direction into the memory according to the file offset; A reading unit is used to read the total length of the file blocks written in the memory and the total length of the file in the corresponding restored file field information. If the total length of the file blocks written is the same as the total length of the file, it indicates that the target file restoration is completed.

Images