Security detection method and device for memory and computer equipment

Abstract

The invention discloses a security detection method and device for a memory, computer equipment and a storage medium. The method comprises the following steps that: a scanning station traverses a directory tree of a memory by using metadata of a memory file system, and calculates a first hash value associated with the directory tree of the memory; traversing the directory tree of the memory by an agent using the metadata of the memory file system, and calculating a second hash value associated with the directory tree of the memory; the first hash value and the second hash value are compared to determine whether a file in the memory is modified. In this way, security detection can be quickly carried out on the memory, and reading redundancy is greatly reduced.

Description

Method, device, and computer equipment for memory security detection Technical Field

[0001] The present application relates to computer security, and in particular, to a method, apparatus, computer device, and storage medium for memory security detection. Background Art

[0002] Industrial control systems typically have limited computing resources, and running computer security software often requires significant computational resources. Therefore, there is a need for improved computer security software that can efficiently ensure the security of devices, such as memory, within industrial control systems, even with limited computing resources.

[0003] Summary of the Invention

[0004] This summary is provided to introduce some selected concepts in a simplified form, which will be further described in the detailed description below. This summary is not intended to identify any key features or essential features of the claimed subject matter, nor is it intended to be used to help determine the scope of the claimed subject matter.

[0005] Based on this, the present application proposes a method for security detection of a memory, comprising: a scanning station traversing a directory tree of the memory using metadata of a memory file system and calculating a first hash value associated with the directory tree of the memory; an agent traversing the directory tree of the memory using metadata of the memory file system and calculating a second hash value associated with the directory tree of the memory; and comparing the first hash value and the second hash value to determine whether a file in the memory has been modified.

[0006] By using the above method, it is possible to quickly determine whether a file in the memory has been tampered with when computer resources are limited, thereby ensuring the safe use of the memory.

[0007] The present application also provides a device for security detection of a memory, comprising: a first hash value calculation module, configured to traverse a directory tree of the memory using metadata of a memory file system, and calculate a first hash value associated with the directory tree of the memory; a second hash value calculation module, configured to traverse the directory tree of the memory using metadata of the memory file system, and calculate a second hash value associated with the directory tree of the memory; and a comparison module, configured to compare the first hash value and the second hash value to determine whether a file in the memory has been modified.

[0008] The present application also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the above method when executing the computer program.

[0009] The present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Implementations of the present disclosure are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate the same or similar parts.

[0011] FIG1 is a flowchart of a method for memory security detection according to an embodiment of the present application.

[0012] FIG2 is a schematic diagram of a device for memory security detection according to an embodiment of the present application.

[0013] FIG3 is a schematic diagram of a computer device for memory security detection according to an embodiment of the present application.

[0014] The accompanying drawings are numerals as follows:

[0015] Steps S101-S103

[0016] 200: Safety detection device for memory

[0017] 201: First hash value calculation module

[0018] 202: Second hash value calculation module

[0019] 203: Comparison module

[0020] 300: Computer equipment

[0021] 302: Processor

[0022] 304: Memory DETAILED DESCRIPTION

[0023] In the following description, for the purpose of explanation, a large number of specific details are set forth. However, it is understood that the present invention can be implemented without these specific details. In other examples, well-known circuits, structures, and technologies are not shown in detail so as not to affect the understanding of the description.

[0024] References throughout this specification to "an implementation," "an implementation," "an exemplary implementation," "some implementations," "various implementations," etc., indicate that the implementations of the invention being described may include particular features, structures, or characteristics. However, it does not imply that every implementation must include those particular features, structures, or characteristics. Furthermore, some implementations may have some, all, or none of the features described for other implementations.

[0025] In the following description, the terms "coupled" and "connected" and their derivatives may be used. It should be understood that these terms are not intended to be synonymous with each other. On the contrary, in a specific implementation, "connected" is used to indicate that two or more components are in direct physical or electrical contact with each other, while "coupled" is used to indicate that two or more components cooperate or interact with each other, but they may or may not be in direct physical or electrical contact. Figure 1 is a flowchart of a method for security detection of a memory according to an embodiment of the present application.

[0026] FIG1 is a flowchart of a method for memory security detection according to an embodiment of the present application.

[0027] An industrial control system may include a scanning station and an agent. The scanning station can be a desktop computer with security software installed. This security software can be antivirus software that detects malware. The agent can be antivirus software or any other security software running on the target computer.

[0028] Herein, the memory may refer to a USB memory or any other storage medium. In order to ensure that the USB memory can run safely on the target computer, the present application proposes a security detection method for the memory.

[0029] The method 100 for security detection of a memory starts at step 101. At step 101, a scanning station traverses a directory tree of the memory using metadata of a file system of the memory and calculates a first hash value associated with the directory tree of the memory.

[0030] Here, the storage file system may be a FAT32 file system. FAT stands for File Allocation Table and is a type of file system. This file system is characterized by the fact that when files are deleted and new data is written, FAT does not organize the files into complete fragments before writing them. Over time, this can cause the file data to become fragmented, slowing down read and write speeds. Therefore, security checks on FAT-formatted data are a very slow process.

[0031] The FAT file system consists of four parts.

[0032] The first section is the reserved area, located at the very beginning. The first reserved sector is the boot sector. It includes an area called the Basic Input / Output Parameter Block (BPB), which typically contains the operating system's startup code. The total number of reserved sectors is recorded in a parameter in the boot sector.

[0033] The second part is the FAT area. It contains two file allocation tables for system redundancy. It is a mapping table of partition information and indicates how clusters are stored.

[0034] The third part is the root directory area. This is the directory table that stores file and directory information in the root directory. Under FAT32, it can be located anywhere on the partition.

[0035] The fourth section is the data area. This is where the actual file and directory data is stored, occupying the vast majority of the partition. By simply adding file links to the FAT, the file size and number of subdirectories can be increased arbitrarily (as long as there are free clusters). However, it is important to note that each cluster can only be occupied by one file. Therefore, if a 1KB file is contained in a 32KB cluster, 31KB of space is wasted. Therefore, if files are read sequentially, a lot of information irrelevant to ensuring the security of the storage will be read.

[0036] This application utilizes the metadata of the FAT file system and the FAT storage format to skip information not related to storage security, thereby quickly locating data related to file size or file modification time in the storage, thereby determining whether the file stored in the file system has been modified. Here, the metadata can refer to data located in a reserved area, such as data located in a basic input and output parameter block (BPB).

[0037] Based on the metadata mentioned above, the directory tree of the memory can be traversed. In one embodiment, a first hash value associated with the directory tree of the memory can be calculated. Here, the first hash value can correspond to the file size of the file stored in the memory, or can correspond to the modification time of the file, or a combination of the two. However, the present application is not limited to this. As long as the information can be used to determine whether the file in the memory has been modified, a hash value can be calculated for it.

[0038] Preferably, the present application may further include the following solution. In one embodiment, the scanning station traversing the directory tree of the memory using metadata of the memory file system may include: the scanning station reading a reserved area and a file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; and based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the scanning station reading data in the first cluster of the data area of ​​the root directory of the memory to traverse the directory tree of the memory.

[0039] Based on the above information, the location of the target information in the memory can be quickly and accurately located, thereby greatly accelerating the speed of traversing the file tree.

[0040] The method 100 proceeds to step 102. At step 102, the agent traverses the directory tree of the memory using the metadata of the memory file system and calculates a second hash value associated with the directory tree of the memory.

[0041] In one embodiment, the above process can be substantially similar to the process described in step 101. The difference lies in the execution subject. Here, the above operation is performed by an agent.

[0042] In one embodiment, for example, in an industrial control environment, a USB storage device may need to be tested for security using a scanning station. The scanning station determines whether malware is present in the storage device. In response to the scanning station determining that the storage device does not contain the malware, the agent determines whether a file in the storage device has been modified.

[0043] In summary, using an agent to perform secondary detection on the file system can prevent the files in the storage from being re-infected by malware due to other reasons after the user has detected it at the operation station.

[0044] Preferably, the agent can be configured to perform a process substantially similar to that of a scanning station. In one embodiment, the agent using metadata of the storage file system to traverse the directory tree of the storage may include: the agent reading a reserved area and a file allocation table area of ​​the storage file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; and based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the agent reading data from the first cluster of the data area of ​​the root directory of the storage to traverse the directory tree of the storage.

[0045] Based on the above information, the location of the target information in the memory can be quickly and accurately located, thereby greatly accelerating the speed of traversing the file tree.

[0046] The method 100 proceeds to step 103. At step 103, the first hash value and the second hash value are compared to determine whether the file in the memory is modified.

[0047] In summary, by using the above method, it is possible to quickly determine whether a file in the memory has been tampered with when computer resources are limited, thereby ensuring the safe use of the memory.

[0048] It should be understood that although the various steps in the flowchart of FIG1 are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in FIG1 may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0049] FIG2 provides a device 200 for memory security detection. The device 200 includes: a first hash value calculation module 201, configured to traverse a directory tree of the memory using metadata of a memory file system and calculate a first hash value associated with the directory tree of the memory; a second hash value calculation module 202, configured to traverse the directory tree of the memory using metadata of the memory file system and calculate a second hash value associated with the directory tree of the memory; and a comparison module 203, configured to compare the first hash value and the second hash value to determine whether a file in the memory has been modified.

[0050] In one embodiment, the apparatus is further configured to: determine whether malware exists in the memory; and in response to determining that the malware does not exist in the memory, determine whether a file in the memory has been modified.

[0051] In one embodiment, the memory file system is a FAT32 file system.

[0052] In one embodiment, the first hash value calculation module is further configured to read the reserved area and the file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the first hash value calculation module reads the data of the first cluster of the data area of ​​the root directory of the memory to traverse the directory tree of the memory.

[0053] In one embodiment, the second hash value calculation module is further configured to read the reserved area and the file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the second hash value calculation module reads the data of the first cluster of the data area of ​​the root directory of the memory to traverse the directory tree of the memory.

[0054] It should be noted that the apparatus may include more or fewer modules to implement the described functionality. For example, at least one module in FIG. 2 may be further divided into a plurality of different submodules, each of which is configured to perform at least a portion of the operations described herein in conjunction with the corresponding module. Furthermore, in some examples, the apparatus 200 may further include additional modules for performing other operations already described in the specification. Furthermore, those skilled in the art will appreciate that the exemplary apparatus 200 may be implemented using software, hardware, firmware, or any combination thereof.

[0055] Figure 3 provides a computer device for memory security detection. According to one embodiment, the computer device 300 may include a processor 302, which executes a computer program stored in a memory 304. When the computer program is executed by the processor, a method for memory security detection is implemented.

[0056] Those skilled in the art will understand that the structure shown in Figure 3 is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0057] Those skilled in the art will appreciate that all or part of the processes in the methods for implementing the above embodiments can be accomplished by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0058] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above steps when executed by a processor.

[0059] Some implementations of the present disclosure may include articles of manufacture. Articles of manufacture may include storage media for storing logic. Examples of storage media may include one or more types of computer-readable storage media capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and the like. Examples of logic may include various software units, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof. In some implementations, for example, articles of manufacture may store executable computer program instructions that, when executed by a processor, cause the processor to perform the methods and / or operations described herein. Executable computer program instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. Executable computer program instructions can be implemented according to a predefined computer language, method or syntax for commanding a computer to perform a specific function. The instructions can be implemented using any appropriate high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0060] What has been described above includes examples of the disclosed architecture. It is, of course, not possible to describe every conceivable combination of components and / or methodologies, but those skilled in the art will appreciate that many other combinations and permutations are possible. Therefore, the novel architecture is intended to embrace all such alternatives, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. A method for memory security detection, comprising: The scanning station traverses a directory tree of the memory using metadata of the memory file system and calculates a first hash value associated with the directory tree of the memory; An agent traverses the directory tree of the memory using the metadata of the memory file system and calculates a second hash value associated with the directory tree of the memory; The first hash value and the second hash value are compared to determine whether the file in the memory has been modified.

2. The method according to claim 1, further comprising: The scanning station determines whether malware is present in the memory. In response to the scanning station determining that the memory is free of the malware, the agent determines whether a file in the memory has been modified.

3. The method according to claim 1, wherein The memory file system is a FAT32 file system.

4. The method according to claim 1, wherein The scanning station traverses the directory tree of the memory using metadata of the memory file system, including: The scanning station reads the reserved area and the file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; Based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the scanning station reads data of a first cluster of a data area of ​​a root directory of the memory to traverse the directory tree of the memory.

5. The method according to claim 1, wherein The agent traverses the directory tree of the memory using metadata of the memory file system, including: The agent reads the reserved area and the file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; Based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the agent reads data of a first cluster of a data area of ​​a root directory of the memory to traverse the directory tree of the memory.

6. A device (200) for memory security detection, comprising: A first hash value calculation module (201) is used to traverse the directory tree of the memory using metadata of the memory file system and calculate a first hash value associated with the directory tree of the memory; A second hash value calculation module (202) is configured to traverse the directory tree of the memory using the metadata of the memory file system and calculate a second hash value associated with the directory tree of the memory; A comparison module (203) is used to compare the first hash value and the second hash value to determine whether the file in the memory has been modified.

7. The apparatus according to claim 6, further configured to: Determine whether malware exists in the memory, and in response to determining that the malware does not exist in the memory, determine whether a file in the memory has been modified.

8. The device according to claim 6, wherein The memory file system is a FAT32 file system.

9. The device according to claim 6, wherein The first hash value calculation module is further configured to: Reading a reserved area and a file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; Based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the first hash value calculation module reads data of a first cluster in a data area of ​​a root directory of the memory to traverse the directory tree of the memory.

10. The device according to claim 6, wherein The second hash value calculation module is further configured to: Reading a reserved area and a file allocation table area of ​​the memory file system to obtain the number of bytes contained in each sector and the number of sectors contained in each cluster; Based on the number of bytes contained in each sector and the number of sectors contained in each cluster, the second hash value calculation module reads data of a first cluster in a data area of ​​a root directory of the memory to traverse the directory tree of the memory.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images