DEB packet detection method and device, electronic equipment and storage medium

Abstract

Embodiments of the invention relate to a DEB packet detection method and apparatus, an electronic device and a storage medium. The method comprises the steps of identifying candidate DEB packets from a terminal operating system according to a preset filename mode; reading file header information of the candidate DEB packet and determining an effective DEB packet when the file header information is matched with preset file header information; byte stream information of the effective DEB packet is read and stored in a buffer area, and target key information is extracted from the byte stream information based on a preset template in the buffer area; under the condition of determining that the target key information accords with a preset DEB packet format specification, reading file structure information of an effective DEB packet, extracting a file directory tree, and analyzing each file layer by layer; extracting basic information of each file under the condition of determining that each file accords with a preset DEB packet format specification, matching the basic information with preset standard information, and determining the integrity and security of an effective DEB packet under the condition of successful matching; and integrity and security detection of the DEB installation package is realized through a multi-layer verification mechanism.

Description

Technical Field

[0001] The present invention relates to the technical field of terminal operating systems, and in particular to a DEB package detection method, device, electronic equipment and storage medium. Background Art

[0002] DEB package (Debian software package) is the main software package format of Debian and its derivative systems (such as Ubuntu, etc.). Different desktop terminal operating systems all use this format. However, the integrity and security issues of DEB packages have always been the focus of users and developers.

[0003] In the related art, after the installer downloads the DEB software package, usually only hash value verification and digital signature authentication are performed. However, this verification method has loopholes in security and integrity detection, and may not fully ensure the security and integrity of the software package. Summary of the invention

[0004] The embodiments of the present invention provide a DEB package detection method, device, electronic device and storage medium to further improve the technical problem of the security and integrity detection performance of the DEB package.

[0005] In a first aspect, an embodiment of the present invention provides a DEB package detection method, which is applied to different types of terminal operating systems, and the method includes: identifying a candidate DEB package from the terminal operating system according to a preset file name pattern; reading the file header information of the candidate DEB package, and determining a valid DEB package when the file header information matches the preset file header information; reading the byte stream information of the valid DEB package and storing it in a buffer, and extracting target key information from the byte stream information based on a preset template in the buffer; when it is determined that the target key information conforms to the preset DEB package format specification, reading the file structure information of the valid DEB package, extracting the file directory tree, and parsing each file layer by layer; when it is determined that each file conforms to the preset DEB package format specification, extracting the basic information of each file, and matching the basic information with the preset standard information, and determining the integrity and security of the valid DEB package when the match is successful.

[0006] In some embodiments, the target key information includes at least one of the following: control files and data files; the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0007] In some embodiments, the file hash value is determined based on multiple hash algorithms.

[0008] In some embodiments, when the basic information includes file dependencies, matching the basic information with preset standard information includes: matching the file dependencies with reference dependencies of corresponding DEB packages in preset dependency data, wherein the preset dependency data stores reference dependencies corresponding to different DEB packages and is updated in real time.

[0009] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; after identifying the candidate DEB package from the terminal operating system according to the preset file name pattern, it also includes: calling the corresponding public key based on the public key management and verification plug-in to digitally sign and authenticate the DEB package.

[0010] In some embodiments, identifying candidate DEB packages from the terminal operating system according to a preset file name pattern includes: obtaining the access frequency of each file in the terminal operating system; determining the priority of each file according to the access frequency, and identifying candidate DEB packages in accordance with the preset file name pattern in order of priority.

[0011] In some embodiments, the priority of each file is determined according to the access frequency, and candidate DEB packages are identified in sequence according to a preset file name pattern in order of priority, including: storing the files in a file list in order from high to low according to the current access frequency of each file; identifying whether the first file in the file list is a candidate DEB package according to a preset file name pattern; repeating the step of storing the files in a file list in order from high to low according to the current access frequency of each file until all files in the file list are traversed.

[0012] In a second aspect, an embodiment of the present invention provides a DEB package detection device, comprising: a file name pattern matching module, used to identify a candidate DEB package from a terminal operating system according to a preset file name pattern; a file header information verification module, used to read the file header information of the candidate DEB package, and determine a valid DEB package when the file header information matches the preset file header information; a byte stream reading and parsing module, used to read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; a file directory structure parsing module, used to read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; a file information extraction and verification module, used to extract the basic information of each file when it is determined that each file conforms to the preset DEB package format specification, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package when the match is successful.

[0013] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the steps of the DEB package detection method described in any one of the first aspects when executing the program stored in the memory.

[0014] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the DEB package detection method as described in any one of the first aspects are implemented.

[0015] The DEB package detection method, device, electronic device and storage medium provided by the embodiments of the present invention can efficiently and accurately identify the DEB installation package, and perform integrity detection and security verification through the multi-layer verification mechanism of DEB package file name pattern matching, file header information verification, byte stream reading, file directory structure parsing algorithm and file information extraction and verification. This comprehensive verification process ensures a comprehensive inspection of the DEB package and improves the system's ability to identify and verify the security and integrity of the DEB package. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of a DEB package detection method provided by an embodiment of the present invention;

[0019] Figure 2 for Figure 1 A detailed flow chart of step S101 of the illustrated embodiment;

[0020] Figure 3 A schematic diagram of the structure of a DEB detection device provided in an embodiment of the present invention;

[0021] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] DEB package (Debian software package) is the main software package format of Debian and its derivative systems (such as Ubuntu, etc.). Different desktop terminal operating systems all use this format. However, the integrity and security issues of DEB packages have always been the focus of users and developers.

[0024] In the related art, after the installer downloads the DEB software package, they usually only perform hash value verification and digital signature authentication. Hash value verification refers to generating a hash value (such as MD5, SHA1, etc.) for the DEB package and comparing it with the hash value published by the DEB package publisher to verify the integrity of the file. Digital signature authentication refers to digitally signing the DEB package through tools such as GPG. When installing the software package, the user can verify the validity of the signature to ensure that the software package has not been tampered with. However, this verification method has loopholes in security and integrity detection, and may not be able to fully ensure the security and integrity of the software package.

[0025] In response to the above technical problems, the technical concept of the present invention is: according to the DEBIAN package specification, read each file of the DEB package to determine the integrity of the file; read the basic information of the internal files of the DEB package, including hash value, md2md5, modification time, size, etc., to determine the security of the file.

[0026] Figure 1 The present invention provides a flow chart of a DEB packet detection method, wherein the execution subject is a DEB packet detection device, or an electronic device equipped with the DEB packet detection device. Figure 1 As shown, the method includes:

[0027] Step S101: identifying candidate DEB packages from a terminal operating system according to a preset file name pattern.

[0028] Specifically, this embodiment can be applied to different types of desktop terminal operating systems, such as Tongxin UOS, Galaxy Kirin, Ubuntu Kirin, etc. File name pattern matching is the first step in identifying DEB packages. By matching the file name pattern, candidates that may be DEB package files can be preliminarily screened out. Regular expressions are usually used to match file names. For example, files ending with ".deb" can be matched, and the characteristics of the file name, such as version number, architecture information, etc., can be combined to further screen out potential DEB package files.

[0029] Step S102: read the file header information of the candidate DEB package, and determine a valid DEB package when the file header information matches the preset file header information.

[0030] Specifically, after the preliminary screening in step S101, the file needs to be further verified to confirm whether it is a valid DEB package. First, open the file and read the first few bytes to check its file header information. DEB files usually have a specific file header identifier (magic number), such as "0x213c6172". Secondly, compare the read file header information with the preset DEB package file header information. If they match, it is confirmed that the file is a DEB installation package.

[0031] Step S103: read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer.

[0032] Specifically, in order to accurately identify and parse the DEB package, the byte stream of the file needs to be parsed in detail. In some embodiments, the target key information includes at least one of the following: a control file and a data file. First, open the file in binary mode, and read the contents of the control file and the data file byte by byte to prepare for the subsequent analysis of the file content data. Since the file content is large in magnitude and the control and data file formats are relatively fixed, the buffer technology is used in this embodiment to store the formatted template into the buffer, and set the key fields that need to be fixedly extracted. Once the file is stored in the buffer, targeted parsing can be performed to improve reading efficiency.

[0033] Secondly, according to the integrity requirements in the DEB package format specification, the various parts of the file are gradually parsed to extract key information, such as control files, data files, etc., to ensure the integrity of the file. In addition, during the parsing process, the package name is verified, the SHA256 and MD5 values ​​are extracted for comparison, and the dependency data of the DEB package is extracted.

[0034] Step S104, when it is determined that the target key information complies with the preset DEB package format specification, read the file structure information of the valid DEB package, extract the file directory tree, parse each file layer by layer, and determine whether each file complies with the preset DEB package format specification.

[0035] Specifically, after determining that each target key information meets the integrity requirements in the DEB package format specification, the directory structure information inside the DEB package is read in accordance with the normative requirements in the DEB package format specification, the file directory tree is extracted, and each file and subdirectory is parsed layer by layer. Secondly, for each file, its basic information is extracted, such as file name, size, modification time, etc., and the structural information of the DEB installation package is verified, including Control files (installation instructions, logos, scripts) and Data files (file headers, etc.). Such a parsing process ensures the accurate interpretation of the internal file structure of the DEB package, and at the same time verifies whether the DEB package complies with the specification, thereby improving the comprehensive understanding and processing capabilities of the DEB package content.

[0036] Step S105: When it is determined that each file complies with the preset DEB package format specification, basic information of each file is extracted, and the basic information is matched with the preset standard information. When the match is successful, the integrity and security of the valid DEB package are determined.

[0037] Specifically, in order to ensure the integrity and security of the DEB package, it is necessary to extract and verify the basic information of each file. In some embodiments, the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0038] First, for each file, extract its hash value, size, modification time, dependent package name, version, installation instructions and other information, and record the original information of the file for subsequent verification; second, compare the extracted information with the preset standard information, verify the hash value of the file to ensure that it has not been tampered with, check the file size and modification time to ensure that they are consistent with the expected hash value, size and other information. This information extraction and verification process helps to confirm the integrity of the files in the DEB package, prevent data tampering or damage, and ensure the security of the DEB package.

[0039] It should be noted that step S103 is to decompress the compressed files in the DEB package and its first-level compressed package, that is, stream reading, to ensure that it is a usable and complete DEB package; step S105 is a deep analysis of the DEB file to ensure that all files therein comply with the specifications of the DEB package, and will parse the contents of related files.

[0040] In some embodiments, the file hash value is determined based on multiple hash algorithms. Specifically, the traditional hash value is calculated using a single hash algorithm, which is vulnerable to hash collision attacks, that is, an attacker can generate a malicious file with the same hash value, thereby bypassing integrity detection. In this case, the user cannot ensure that the downloaded software package has not been tampered with; this embodiment introduces multiple hash algorithms (such as MD5, SHA-1, SHA-256) to avoid the collision risk of a single algorithm.

[0041] In some embodiments, when the basic information includes file dependencies, matching the basic information with preset standard information includes: matching the file dependencies with reference dependencies of corresponding DEB packages in preset dependency data, wherein the preset dependency data stores reference dependencies corresponding to different DEB packages and is updated in real time.

[0042] Specifically, first, a dependency database is established, which contains all DEB packages and their dependency information, and can be updated in real time. The establishment or update process is as follows: DEB packages and their dependency information, including package name, version number, dependency library list, etc., are collected from major software repositories; a relational database or a graph database is used to store the collected dependency information for subsequent query and analysis. Then, the control file of the DEB package is parsed to obtain its dependency information, and compared with the data in the dependency database. If a missing dependency library is identified or a version conflict between dependency libraries is analyzed, possible problems can be warned in advance. Preferably, based on predefined rules and policies, the appropriate version can be automatically selected to resolve dependency conflicts to ensure a smooth installation process.

[0043] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; after the step S101, it also includes: based on the public key management and verification plug-in, calling the corresponding public key to digitally sign and authenticate the DEB package.

[0044] Specifically, in order to solve the problem of complex public key management, this embodiment introduces a more user-friendly mechanism, that is, deploying a public key management and verification plug-in on the terminal operating system. The plug-in can be used to manage the public keys of multiple DEB packages. Different public keys are used to verify the software packages released by different developers or sources to ensure the legitimacy and integrity of the software packages. After the DEB package is identified based on step S101, the digital signature technology is first used to verify the authenticity and integrity of the DEB package, that is, the corresponding public key is automatically called for verification through the plug-in. After the verification is passed, the next step is continued. If the verification fails, it means that the DEB package may be tampered with, and a failure message can be returned. During the whole process, ordinary users can easily manage and use public keys, which simplifies the signature verification process and improves the user experience.

[0045] In addition, when the publisher releases the DEB installation package, a plug-in for generating public and private key pairs can be installed on the terminal operating system. The plug-in provides a user-friendly interface for users. Users only need to click a button to automatically generate public and private key pairs without manually entering complex commands. The system background will automatically call the encryption library (such as Python's cryptography library) to generate public and private key pairs; the generated public and private key pairs will be automatically stored in a secure area of ​​the system, such as the operating system's key chain or a dedicated encrypted storage file to prevent unauthorized access. At the same time, the system will prompt users to set a password to protect the private key to further improve security.

[0046] The DEB package detection method provided in this embodiment introduces multiple hash algorithms to avoid the hash collision risk of a single algorithm; it also introduces a public key management and verification plug-in to enable ordinary users to easily manage and use public keys, simplify the signature verification process, improve user experience, and facilitate the popularization and promotion of digital signature technology; it also relies on the database to accurately analyze the dependency relationship of the DEB package, timely warn of the problem of missing dependency libraries, and ensure that the software package will not fail due to dependency problems during installation; it also follows the DEBIAN package specification to comprehensively parse each file in the DEB package to ensure that the file format is correct and complete, and avoid installation problems caused by format errors; it also introduces a multi-level security verification mechanism to ensure the correctness of file permissions and attributes, and can detect and prevent complex tampering methods, thereby improving the security and reliability of the software package.

[0047] Based on the above embodiments, Figure 2 for Figure 1A detailed flow chart of step S101 of the embodiment shown in FIG. Figure 2 As shown, including:

[0048] Step S1011: Obtain the access frequency of each file in the terminal operating system.

[0049] Step S1012: determine the priority of each file according to the access frequency, and identify candidate DEB packages in sequence according to the preset file name pattern according to the priority order.

[0050] Specifically, before performing integrity and security checks on DEB packages, the terminal operating system's scanning engine must first use a file system variable algorithm to identify and locate the DEB application software installation package stored in the operating system's internal file system; considering that traditional file system traversal algorithms usually use fixed depth-first search or breadth-first search strategies, they cannot fully utilize real-time changing file access patterns, resulting in low efficiency. This embodiment introduces an adaptive optimization algorithm based on file access frequency that can dynamically adjust traversal strategies to improve efficiency. The process is as follows:

[0051] First, the file access frequency data is continuously collected in the file system manager or background service, including the number of times the file is opened, the number of times it is read, the modification time, etc., which reflect the actual access situation of the file. For example, the collection of file access frequency can be completed by calling the track_file_access function; then, the priority of each file is determined based on the collected access frequency data, and the files or directories with higher access frequency are preferentially identified as candidate DEB packages according to the preset file name pattern.

[0052] In some embodiments, the step S1012 includes: storing the files in a file list in order from high to low according to the current access frequency of each file; identifying whether the first file in the file list is a candidate DEB package according to a preset file name pattern; repeating the step of storing the files in a file list in order from high to low according to the current access frequency of each file until all files in the file list are traversed.

[0053] Specifically, the access frequency of each file is collected in real time, and each file is sorted in the file list in descending order of access frequency, and files with higher access frequency are placed in the priority traversal position, usually the first place; then, according to the preset file name pattern, it is determined whether the first file is likely to be a DEB package; after the judgment is completed, the access frequency can be monitored in real time and the file traversal order can be adjusted in real time, which can quickly adapt to changes in file access patterns and maintain efficient file system operations.

[0054] On the basis of the foregoing embodiments, by preferentially identifying whether files with higher access frequencies are candidate DEB packages, the number of disk accesses is effectively reduced, and the overall efficiency of file system traversal is improved; moreover, this method does not introduce complex machine learning or deep analysis technology, and can be implemented only through simple access frequency statistics and sorting, which is convenient for implementation and deployment in existing file systems; in addition, this method is applicable to various types of file management and storage systems, whether it is a desktop application, a server system or a distributed file system, and the file access order can be processed more intelligently through the access frequency.

[0055] Figure 3 A structural diagram of a DEB detection device provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the device comprises:

[0056] A file name pattern matching module 301 is used to identify candidate DEB packages from the terminal operating system according to a preset file name pattern; a file header information verification module 302 is used to read the file header information of the candidate DEB package and determine a valid DEB package when the file header information matches the preset file header information; a byte stream reading and parsing module 303 is used to read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; a file directory structure parsing module 304 is used to read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; a file information extraction and verification module 305 is used to extract the basic information of each file when it is determined that each file conforms to the preset DEB package format specification, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package when the match is successful.

[0057] In some embodiments, the target key information includes at least one of the following: control files and data files; the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0058] In some embodiments, the file hash value is determined based on multiple hash algorithms.

[0059] In some embodiments, the file information extraction and verification module 305 is specifically used to: when the basic information includes file dependencies, match the file dependencies with the reference dependencies of the corresponding DEB packages in the preset dependency data, wherein the preset dependency data stores the reference dependencies corresponding to different DEB packages and is updated in real time.

[0060] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; the byte stream reading and parsing module 303 is also used to: call the corresponding public key based on the public key management and verification plug-in to digitally sign and authenticate the DEB package.

[0061] In some embodiments, the file name pattern matching module 301 is specifically used to: obtain the access frequency of each file in the terminal operating system; determine the priority of each file according to the access frequency, and identify candidate DEB packages in accordance with the preset file name pattern in order of priority.

[0062] In some embodiments, the file name pattern matching module 301 is specifically used to: store the files in a file list in descending order according to the current access frequency of each file; identify whether the first file in the file list is a candidate DEB package according to a preset file name pattern; repeat the steps of storing the files in a file list in descending order according to the current access frequency of each file until all files in the file list are traversed.

[0063] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and corresponding beneficial effects of the DEB detection device described above can refer to the corresponding process in the aforementioned method example, and will not be repeated here.

[0064] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0065] Memory 403, used for storing computer programs;

[0066] In one embodiment of the present invention, the processor 401 is used to implement the steps of the DEB package detection method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 403.

[0067] The implementation principle and technical effect of the electronic device provided by the embodiment of the present invention are similar to those of the above embodiment and will not be described in detail here.

[0068] The above-mentioned memory 403 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 403 has a storage space for program codes for executing any method steps in the above-mentioned method. For example, the storage space for program codes may include various program codes for implementing various steps in the above method respectively. These program codes can be read from or written into one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are usually portable or fixed storage units. The storage unit may have a storage segment or storage space arranged similarly to the memory 403 in the above-mentioned electronic device. The program code can be compressed, for example, in an appropriate form. Generally, the storage unit includes a program for executing the method steps according to an embodiment of the present invention, that is, a code that can be read by a processor such as 401, which, when run by an electronic device, causes the electronic device to execute various steps in the method described above.

[0069] The embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the DEB package detection method described above are implemented.

[0070] The computer-readable storage medium may be included in the device / apparatus described in the above embodiment; or it may exist independently without being assembled into the device / apparatus. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0071] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0072] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0073] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A DEB package detection method, characterized in that: Applied to different types of terminal operating systems, the method includes: Identify candidate DEB packages from the terminal operating system based on a preset file name pattern; Reading file header information of the candidate DEB package, and determining a valid DEB package when the file header information matches preset file header information; Read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; When it is determined that the target key information conforms to the preset DEB package format specification, the file structure information of the valid DEB package is read, the file directory tree is extracted, and each file is parsed layer by layer; When it is determined that each file complies with the preset DEB package format specification, basic information of each file is extracted and matched with the preset standard information, and the integrity and security of the valid DEB package are determined if the match is successful.

2. The method according to claim 1, characterized in that The target key information includes at least one of the following: a control file and a data file; The basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

3. The method according to claim 2, characterized in that The file hash value is determined based on multiple hash algorithms.

4. The method according to claim 2, characterized in that: In the case where the basic information includes a file dependency, matching the basic information with preset standard information includes: The file dependency is matched with the reference dependency of the corresponding DEB package in the preset dependency data, wherein the preset dependency data stores the reference dependency corresponding to different DEB packages and is updated in real time.

5. The method according to claim 1, characterized in that A public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage public keys of different DEB packages; After identifying the candidate DEB package from the terminal operating system according to the preset file name pattern, the method further includes: Based on the public key management verification plug-in, the corresponding public key is called to digitally sign and authenticate the DEB package.

6. The method according to any one of claims 1 to 5, characterized in that: The step of identifying a candidate DEB package from the terminal operating system according to a preset file name pattern includes: Obtaining the access frequency of each file in the terminal operating system; The priority of each file is determined according to the access frequency, and candidate DEB packages are identified in sequence according to the preset file name pattern according to the priority order.

7. The method according to claim 6, characterized in that Determining the priority of each file according to the access frequency, and identifying candidate DEB packages in sequence according to the preset file name pattern according to the priority order, includes: The files are stored in the file list in descending order according to their current access frequency; Identify whether the first file in the file list is a candidate DEB package according to a preset file name pattern; The step of storing the files in the file list in descending order according to the current access frequency of each file is repeated until all the files in the file list are traversed.

8. A DEB packet detection device, characterized in that: include: A file name pattern matching module, used to identify candidate DEB packages from the terminal operating system according to a preset file name pattern; A file header information verification module, used to read the file header information of the candidate DEB package, and determine a valid DEB package if the file header information matches the preset file header information; A byte stream reading and parsing module, used for reading the byte stream information of the valid DEB package and storing it in a buffer, and extracting target key information from the byte stream information based on a preset template in the buffer; A file directory structure parsing module, for reading the file structure information of the valid DEB package, extracting the file directory tree, and parsing each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; The file information extraction and verification module is used to extract the basic information of each file and match the basic information with the preset standard information when it is determined that each file conforms to the preset DEB package format specification. If the match is successful, the integrity and security of the valid DEB package are determined.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the steps of the DEB package detection method according to any one of claims 1 to 7 when executing a program stored in a memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the DEB package detection method according to any one of claims 1 to 7 are implemented.

Images