DEB package detection method, device, electronic device and storage medium

Abstract

Embodiments of the present invention relate to a DEB package detection method, device, electronic device and storage medium, which identify candidate DEB packages from a terminal operating system according to a preset file name pattern; read the file header information of the candidate DEB package and determine the valid DEB package when it matches the preset file header information; read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; when it is determined that the target key information meets the preset DEB package format specification, read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer; when it is determined that each file meets the preset DEB package format specification, extract the basic information of each file, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package if the match is successful; and implement integrity and security detection of the DEB installation package through a multi-layer verification mechanism.

Description

Technical Field

[0001] The present invention relates to the technical field of terminal operating systems, and in particular to a DEB package detection method, device, electronic device and storage medium. Background Art

[0002] DEB package (Debian software package) is the main software package format of Debian and its derivative systems (such as Ubuntu). Different desktop terminal operating systems use this format. However, the integrity and security issues of DEB packages have always been the focus of users and developers.

[0003] In the related art, after downloading the DEB software package, the installer usually only performs hash value verification and digital signature authentication. However, this verification method has loopholes in security and integrity detection and may not fully ensure the security and integrity of the software package. Summary of the Invention

[0004] Embodiments of the present invention provide a DEB package detection method, device, electronic device, and storage medium to further improve the technical problem of the security and integrity detection performance of DEB packages.

[0005] In the first aspect, an embodiment of the present invention provides a DEB package detection method, which is applied to different types of terminal operating systems, and the method includes: identifying a candidate DEB package from the terminal operating system according to a preset file name pattern; reading the file header information of the candidate DEB package, and determining a valid DEB package when the file header information matches the preset file header information; reading the byte stream information of the valid DEB package and storing it in a buffer, and extracting target key information from the byte stream information based on a preset template in the buffer; when it is determined that the target key information conforms to the preset DEB package format specification, reading the file structure information of the valid DEB package, extracting the file directory tree, and parsing each file layer by layer; when it is determined that each file conforms to the preset DEB package format specification, extracting the basic information of each file, and matching the basic information with the preset standard information, and determining the integrity and security of the valid DEB package when the match is successful.

[0006] In some embodiments, the target key information includes at least one of the following: control files and data files; the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0007] In some embodiments, the file hash value is determined based on multiple hash algorithms.

[0008] In some embodiments, when the basic information includes file dependencies, matching the basic information with preset standard information includes: matching the file dependencies with reference dependencies of corresponding DEB packages in preset dependency data, wherein the preset dependency data stores reference dependencies corresponding to different DEB packages and is updated in real time.

[0009] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; after identifying the candidate DEB package from the terminal operating system according to the preset file name pattern, it also includes: calling the corresponding public key based on the public key management and verification plug-in to digitally sign and authenticate the DEB package.

[0010] In some embodiments, identifying candidate DEB packages from the terminal operating system according to a preset file name pattern includes: obtaining the access frequency of each file in the terminal operating system; determining the priority of each file according to the access frequency, and identifying candidate DEB packages in accordance with the preset file name pattern in order of priority.

[0011] In some embodiments, the priority of each file is determined according to the access frequency, and candidate DEB packages are identified in sequence according to a preset file name pattern in order of priority, including: storing the files in a file list in order from high to low according to the current access frequency of each file; identifying whether the first file in the file list is a candidate DEB package according to a preset file name pattern; repeating the step of storing the files in a file list in order from high to low according to the current access frequency of each file until all files in the file list are traversed.

[0012] In the second aspect, an embodiment of the present invention provides a DEB package detection device, including: a file name pattern matching module, used to identify a candidate DEB package from a terminal operating system according to a preset file name pattern; a file header information verification module, used to read the file header information of the candidate DEB package, and determine a valid DEB package when the file header information matches the preset file header information; a byte stream reading and parsing module, used to read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; a file directory structure parsing module, used to read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; a file information extraction and verification module, used to extract the basic information of each file when it is determined that each file conforms to the preset DEB package format specification, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package when the match is successful.

[0013] In a third aspect, an embodiment of the present invention provides an electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the steps of the DEB package detection method described in any one of the first aspects when executing the program stored in the memory.

[0014] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the DEB package detection method as described in any one of the first aspects are implemented.

[0015] The DEB package detection method, apparatus, electronic device, and storage medium provided by embodiments of the present invention utilize a multi-layered verification mechanism that includes DEB package file name pattern matching, file header information verification, byte stream reading, a file directory structure parsing algorithm, and file information extraction and verification. This allows for efficient and accurate identification of DEB installation packages, as well as integrity testing and security verification. This comprehensive verification process ensures a comprehensive inspection of DEB packages and enhances the system's ability to identify and verify the security and integrity of DEB packages. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of a DEB packet detection method provided in an embodiment of the present invention;

[0019] Figure 2 for Figure 1 A detailed flow chart of step S101 of the illustrated embodiment;

[0020] Figure 3 A schematic structural diagram of a DEB detection device provided in an embodiment of the present invention;

[0021] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0023] DEB package (Debian software package) is the main software package format of Debian and its derivative systems (such as Ubuntu). Different desktop terminal operating systems use this format. However, the integrity and security issues of DEB packages have always been the focus of users and developers.

[0024] In related technologies, after downloading a DEB package, the installer typically only performs hash value verification and digital signature authentication. Hash value verification involves generating a hash value (such as MD5, SHA1, etc.) for the DEB package and comparing it with the hash value published by the DEB package publisher to verify the integrity of the file. Digital signature authentication involves digitally signing the DEB package using tools such as GPG. When installing the package, the user can verify the validity of the signature to ensure that the package has not been tampered with. However, this verification method has vulnerabilities in security and integrity detection and may not fully ensure the security and integrity of the package.

[0025] In response to the above technical problems, the technical concept of the present invention is: according to the DEBIAN package specification, read each file of the DEB package to determine the integrity of the file; read the basic information of the internal files of the DEB package, including hash value, md2md5, modification time, size, etc., to determine the security of the file.

[0026] Figure 1 The present invention provides a flow chart of a DEB packet detection method, the execution subject of which is a DEB packet detection device, or an electronic device equipped with the DEB packet detection device. Figure 1 As shown, the method includes:

[0027] Step S101: identifying candidate DEB packages from the terminal operating system according to a preset file name pattern.

[0028] Specifically, this embodiment can be applied to different types of desktop terminal operating systems, such as Tongxin UOS, Kylin, and Ubuntu Kylin. File name pattern matching is the first step in identifying DEB packages. By performing pattern matching on file names, candidates that may be DEB package files can be preliminarily screened out. Regular expressions are usually used to match file names. For example, files ending with ".deb" can be matched, and the characteristics of the file name, such as version number, architecture information, etc., can be combined to further screen out potential DEB package files.

[0029] Step S102: Read the file header information of the candidate DEB package, and determine a valid DEB package if the file header information matches the preset file header information.

[0030] Specifically, after the initial screening in step S101, the file needs to be further verified to confirm whether it is a valid DEB package. First, the file is opened and the first few bytes are read to check its file header information. DEB files usually have a specific file header identifier (magic number), such as "0x213c6172". Second, the read file header information is compared with the preset DEB package file header information. If they match, the file is confirmed to be a DEB installation package.

[0031] Step S103: Read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer.

[0032] Specifically, in order to accurately identify and parse the DEB package, the byte stream of the file needs to be parsed in detail. In some embodiments, the target key information includes at least one of the following: a control file and a data file. First, the file is opened in binary mode, and the contents of the control file and the data file are read byte by byte to prepare for the subsequent analysis of the file content data. Since the file content is large in magnitude and the control and data file formats are relatively fixed, this embodiment uses buffer technology to store the formatted template in the buffer, and sets the key fields that need to be fixedly extracted. Once the file is stored in the buffer, targeted parsing can be performed to improve reading efficiency.

[0033] Secondly, according to the integrity requirements of the DEB package format specification, the file is gradually parsed, extracting key information such as control files and data files to ensure file integrity. In addition, during the parsing process, the package name is verified, SHA256 and MD5 values ​​are extracted for comparison, and the dependency data of the DEB package is extracted.

[0034] Step S104: When it is determined that the target key information complies with the preset DEB package format specification, the file structure information of the valid DEB package is read, the file directory tree is extracted, each file is parsed layer by layer, and it is determined whether each file complies with the preset DEB package format specification.

[0035] Specifically, after confirming that each target key information meets the integrity requirements of the DEB package format specification, the DEB package's internal directory structure information is read in accordance with the normative requirements of the DEB package format specification, the file directory tree is extracted, and each file and subdirectory is parsed layer by layer. Secondly, for each file, its basic information is extracted, such as file name, size, modification time, etc., and the structural information of the DEB installation package is verified, including the Control file (installation instructions, logo, scripts) and Data file (file header, etc.). This parsing process ensures the accurate interpretation of the DEB package's internal file structure and verifies whether the DEB package complies with the specification, thereby improving the comprehensive understanding and processing capabilities of the DEB package content.

[0036] Step S105: When it is determined that each file conforms to the preset DEB package format specification, basic information of each file is extracted, and the basic information is matched with the preset standard information. If the match is successful, the integrity and security of the valid DEB package are determined.

[0037] Specifically, to ensure the integrity and security of the DEB package, it is necessary to extract and verify basic information of each file. In some embodiments, the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0038] First, for each file, its hash value, size, modification time, dependent package name, version, installation instructions, and other information are extracted, and the original file information is recorded for subsequent verification. Second, the extracted information is compared with preset standard information to verify the file's hash value to ensure it has not been tampered with. The file size and modification time are checked to ensure that they are consistent with the expected hash value, size, etc. This information extraction and verification process helps to confirm the integrity of the files in the DEB package, prevent data tampering or corruption, and ensure the security of the DEB package.

[0039] It should be noted that step S103 is to decompress the compressed files in the DEB package and its first-level compressed package, that is, stream reading, to ensure that it is a usable and complete DEB package; step S105 is a deep analysis of the DEB file to ensure that all files therein comply with the specifications of the DEB package, and will parse the contents of related files.

[0040] In some embodiments, the file hash value is determined based on multiple hash algorithms. Specifically, traditional hash values ​​are calculated using a single hash algorithm, which is vulnerable to hash collision attacks. That is, an attacker can generate malicious files with the same hash value, thereby bypassing integrity detection. In this case, the user cannot ensure that the downloaded software package has not been tampered with. This embodiment introduces multiple hash algorithms (such as MD5, SHA-1, and SHA-256) to avoid the collision risk of a single algorithm.

[0041] In some embodiments, when the basic information includes file dependencies, matching the basic information with preset standard information includes: matching the file dependencies with reference dependencies of corresponding DEB packages in preset dependency data, wherein the preset dependency data stores reference dependencies corresponding to different DEB packages and is updated in real time.

[0042] Specifically, a dependency database is first established. This database contains all DEB packages and their dependency information and can be updated in real time. The establishment or update process is as follows: DEB packages and their dependency information, including package name, version number, and dependency library list, are collected from major software repositories; a relational database or graph database is used to store the collected dependency information for subsequent query and analysis. The control file of the DEB package is then parsed to obtain its dependency information and compared with the data in the dependency database. If a missing dependency library is identified or a version conflict between dependency libraries is analyzed, an early warning of potential problems can be provided. Preferably, based on predefined rules and policies, the appropriate version can be automatically selected to resolve dependency conflicts, ensuring a smooth installation process.

[0043] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; after step S101, it also includes: based on the public key management and verification plug-in, calling the corresponding public key to digitally sign and authenticate the DEB package.

[0044] Specifically, to address the complexities of public key management, this embodiment introduces a more user-friendly mechanism. This involves deploying a public key management and verification plug-in on the terminal operating system. This plug-in can be used to manage the public keys of multiple DEB packages. Different public keys are used to verify software packages released by different developers or sources, ensuring the legitimacy and integrity of the packages. After a DEB package is identified based on step S101, digital signature technology is first used to verify the authenticity and integrity of the DEB package. This involves the plug-in automatically calling the corresponding public key for verification. Once verification is successful, the next step is executed. If verification fails, indicating that the DEB package may have been tampered with, a failure message may be returned. Throughout this process, ordinary users can easily manage and use public keys, simplifying the signature verification process and improving the user experience.

[0045] Furthermore, when publishers release DEB installation packages, a public-private key pair generation plug-in can be installed on the terminal operating system. This plug-in provides a user-friendly interface that allows users to automatically generate public-private key pairs with the click of a button, eliminating the need to manually enter complex commands. The system automatically calls a cryptographic library (such as Python's cryptography library) to generate the public-private key pair. The generated public-private key pair is automatically stored in a secure area of ​​the system, such as the operating system's keychain or a dedicated encrypted storage file, to prevent unauthorized access. At the same time, the system prompts users to set a password to protect the private key, further enhancing security.

[0046] The DEB package detection method provided in this embodiment introduces multiple hash algorithms to avoid the hash collision risk of a single algorithm; it also introduces a public key management and verification plug-in to enable ordinary users to easily manage and use public keys, simplifying the signature verification process, improving user experience, and facilitating the popularization and promotion of digital signature technology; it also relies on a database to accurately analyze the dependencies of the DEB package, timely warning of problems such as missing dependency libraries, and ensuring that the software package will not fail due to dependency problems during installation; it also follows the DEBIAN package specification to comprehensively parse each file within the DEB package to ensure that the file format is correct and complete, avoiding installation problems caused by format errors; it also introduces a multi-level security verification mechanism to ensure the correctness of file permissions and attributes, and can detect and prevent complex tampering methods, thereby improving the security and reliability of the software package.

[0047] Based on the above embodiments, Figure 2 for Figure 1A detailed flow chart of step S101 of the embodiment shown is as follows: Figure 2 Shown, including:

[0048] Step S1011: Obtain the access frequency of each file in the terminal operating system.

[0049] Step S1012: Determine the priority of each file according to the access frequency, and identify candidate DEB packages in sequence according to the preset file name pattern in the order of priority.

[0050] Specifically, before performing integrity and security checks on DEB packages, the terminal operating system's scanning engine must first use a file system variable algorithm to identify and locate the DEB application software installation package stored in the operating system's internal file system. Considering that traditional file system traversal algorithms typically use fixed depth-first or breadth-first search strategies, they cannot fully utilize real-time changing file access patterns, resulting in low efficiency. This embodiment introduces an adaptive optimization algorithm based on file access frequency that can dynamically adjust the traversal strategy to improve efficiency. The process is as follows:

[0051] First, the file access frequency data is continuously collected in the file system manager or background service, including the number of times the file is opened, the number of times it is read, the modification time, etc., which reflect the actual access situation of the file. For example, the file access frequency collection can be completed by calling the track_file_access function; then, the priority of each file is determined based on the collected access frequency data, and the files or directories with higher access frequencies are preferentially identified as candidate DEB packages according to the preset file name pattern.

[0052] In some embodiments, step S1012 includes: storing the files in a file list in descending order according to the current access frequency of each file; identifying whether the first file in the file list is a candidate DEB package according to a preset file name pattern; repeating the steps of storing the files in a file list in descending order according to the current access frequency of each file until all files in the file list are traversed.

[0053] Specifically, the access frequency of each file is collected in real time, and each file is sorted in the file list in descending order of access frequency, and the files with higher access frequency are placed in the priority traversal position, usually the first one; then, based on the preset file name pattern, it is judged whether the first file is likely to be a DEB package; after the judgment is completed, the access frequency can be monitored in real time and the file traversal order can be adjusted in real time, which can quickly adapt to changes in file access patterns and maintain high-efficiency file system operations.

[0054] On the basis of the aforementioned embodiment, by preferentially identifying whether files with higher access frequencies are candidate DEB packages, the number of disk accesses is effectively reduced, and the overall efficiency of file system traversal is improved. Moreover, this method does not introduce complex machine learning or deep analysis technology, but can be implemented only through simple access frequency statistics and sorting, which is convenient for implementation and deployment in existing file systems. In addition, this method is applicable to various types of file management and storage systems, whether they are desktop applications, server systems or distributed file systems, and can more intelligently process file access order through access frequency.

[0055] Figure 3 A structural diagram of a DEB detection device provided by an embodiment of the present invention is shown as follows: Figure 3 As shown, the device includes:

[0056] The file name pattern matching module 301 is used to identify candidate DEB packages from the terminal operating system according to a preset file name pattern; the file header information verification module 302 is used to read the file header information of the candidate DEB package and determine the valid DEB package when the file header information matches the preset file header information; the byte stream reading and parsing module 303 is used to read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; the file directory structure parsing module 304 is used to read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; the file information extraction and verification module 305 is used to extract the basic information of each file when it is determined that each file conforms to the preset DEB package format specification, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package when the match is successful.

[0057] In some embodiments, the target key information includes at least one of the following: control files and data files; the basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

[0058] In some embodiments, the file hash value is determined based on multiple hash algorithms.

[0059] In some embodiments, the file information extraction and verification module 305 is specifically used to: when the basic information includes file dependencies, match the file dependencies with the reference dependencies of the corresponding DEB packages in the preset dependency data, wherein the preset dependency data stores the reference dependencies corresponding to different DEB packages and is updated in real time.

[0060] In some embodiments, a public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; the byte stream reading and parsing module 303 is also used to: call the corresponding public key based on the public key management and verification plug-in to digitally sign and authenticate the DEB package.

[0061] In some embodiments, the file name pattern matching module 301 is specifically used to: obtain the access frequency of each file in the terminal operating system; determine the priority of each file according to the access frequency, and identify candidate DEB packages according to the preset file name pattern in order of priority.

[0062] In some embodiments, the file name pattern matching module 301 is specifically used to: store the files in a file list in descending order according to the current access frequency of each file; identify whether the first file in the file list is a candidate DEB package according to a preset file name pattern; and repeat the steps of storing the files in a file list in descending order according to the current access frequency of each file until all files in the file list are traversed.

[0063] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and corresponding beneficial effects of the DEB detection device described above can refer to the corresponding process in the aforementioned method example and will not be repeated here.

[0064] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0065] Memory 403, used for storing computer programs;

[0066] In one embodiment of the present invention, the processor 401 is configured to implement the steps of the DEB package detection method provided in any one of the aforementioned method embodiments when executing the program stored in the memory 403 .

[0067] The implementation principle and technical effects of the electronic device provided by the embodiment of the present invention are similar to those of the above embodiment and will not be repeated here.

[0068] The memory 403 can be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read-Only Memory), an EPROM, a hard disk, or a ROM. The memory 403 has storage space for program code for executing any of the method steps described above. For example, the storage space for program code can include individual program codes for implementing each of the steps in the method described above. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disc (CD), a memory card, or a floppy disk. Such computer program products are typically portable or fixed storage units. The storage unit can have storage segments or storage space arranged similarly to the memory 403 in the electronic device described above. The program code can be compressed, for example, in a suitable form. Typically, the storage unit includes a program for executing the method steps according to an embodiment of the present invention, i.e., code that can be read by a processor such as 401, and when executed by an electronic device, causes the electronic device to execute the various steps in the method described above.

[0069] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the DEB package detection method described above.

[0070] The computer-readable storage medium may be included in the device / apparatus described in the above embodiments, or may exist independently without being incorporated into the device / apparatus. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0071] According to an embodiment of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0072] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0073] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is intended to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A DEB package detection method, characterized in that: Applicable to different types of terminal operating systems, the method includes: Identify candidate DEB packages from the terminal operating system based on a preset file name pattern; Reading file header information of the candidate DEB package, and determining a valid DEB package if the file header information matches preset file header information; Reading the byte stream information of the valid DEB package and storing it in a buffer, and extracting target key information from the byte stream information based on a preset template in the buffer; When it is determined that the target key information conforms to the preset DEB package format specification, the file structure information of the valid DEB package is read, the file directory tree is extracted, and each file is parsed layer by layer; If it is determined that each file conforms to the preset DEB package format specification, extract basic information of each file, and match the basic information with the preset standard information, and determine the integrity and security of the valid DEB package if the match is successful; The step of reading the byte stream information of the valid DEB package and storing it in a buffer, and extracting target key information from the byte stream information based on a preset template in the buffer, includes: Open the valid DEB package in binary mode, read the contents of the control file and the data file byte by byte, and store the obtained byte stream information in a buffer; According to the integrity requirements of the DEB package format specification, the control file and the data file are gradually parsed from the byte stream information based on the preset template in the buffer, and the target key information is extracted. During the parsing process, the package name is verified, the SHA256 and MD5 values ​​are extracted for comparison, and the dependency data of the DEB package is extracted; When it is determined that the target key information conforms to the preset DEB package format specification, the file structure information of the valid DEB package is read, the file directory tree is extracted, and each file is parsed layer by layer, including: After confirming that the key information of each target meets the integrity requirements of the DEB package format specification, read the directory structure information inside the valid DEB package in accordance with the normative requirements of the DEB package format specification, extract the file directory tree, and parse each file and subdirectory layer by layer; Verify the structural information of the Control file and Data file in the valid DEB package to ensure the accurate interpretation of the internal file structure of the DEB package. At the same time, verify whether the DEB package complies with the specifications and improve the comprehensive understanding and processing capabilities of the DEB package content.

2. The method according to claim 1, characterized in that The target key information includes at least one of the following: a control file and a data file; The basic information includes at least one of the following: file hash value, file modification time, file size, file dependency, and file version.

3. The method according to claim 2, characterized in that The file hash value is determined based on multiple hash algorithms.

4. The method according to claim 2, characterized in that In a case where the basic information includes file dependencies, matching the basic information with preset standard information includes: The file dependency is matched with the reference dependency of the corresponding DEB package in the preset dependency data, wherein the preset dependency data stores the reference dependency corresponding to different DEB packages and is updated in real time.

5. The method according to claim 1, wherein A public key management and verification plug-in is deployed on the terminal operating system, and the public key management and verification plug-in is used to manage the public keys of different DEB packages; After identifying the candidate DEB package from the terminal operating system according to the preset file name pattern, the method further includes: The public key management verification plug-in calls the corresponding public key to digitally sign and authenticate the DEB package.

6. The method according to any one of claims 1 to 5, characterized in that The step of identifying a candidate DEB package from the terminal operating system according to a preset file name pattern includes: Obtain the access frequency of each file in the terminal operating system; The priority of each file is determined according to the access frequency, and candidate DEB packages are identified in sequence according to the preset file name pattern in the order of priority.

7. The method according to claim 6, characterized in that Determining the priority of each file according to the access frequency, and identifying candidate DEB packages in accordance with the preset file name pattern in order of priority, includes: Store the files in the file list in descending order of their current access frequency; Identify whether the first file in the file list is a candidate DEB package according to a preset file name pattern; Repeat the step of storing the files in the file list in descending order of their current access frequencies until all files in the file list are traversed.

8. A DEB packet detection device, characterized in that: include: A file name pattern matching module is used to identify candidate DEB packages from the terminal operating system based on a preset file name pattern; A file header information verification module, configured to read the file header information of the candidate DEB package and determine a valid DEB package if the file header information matches preset file header information; A byte stream reading and parsing module, configured to read the byte stream information of the valid DEB package and store it in a buffer, and extract target key information from the byte stream information based on a preset template in the buffer; A file directory structure parsing module is used to read the file structure information of the valid DEB package, extract the file directory tree, and parse each file layer by layer when it is determined that the target key information conforms to the preset DEB package format specification; A file information extraction and verification module is used to extract basic information of each file when it is determined that each file conforms to the preset DEB package format specification, and match the basic information with the preset standard information. If the match is successful, the integrity and security of the valid DEB package are determined; The byte stream reading and parsing module is specifically used to: Open the valid DEB package in binary mode, read the contents of the control file and the data file byte by byte, and store the obtained byte stream information in a buffer; According to the integrity requirements of the DEB package format specification, the control file and the data file are gradually parsed from the byte stream information based on the preset template in the buffer, and the target key information is extracted. During the parsing process, the package name is verified, the SHA256 and MD5 values ​​are extracted for comparison, and the dependency data of the DEB package is extracted; The file directory structure parsing module is specifically used to: After confirming that the key information of each target meets the integrity requirements of the DEB package format specification, read the directory structure information inside the valid DEB package in accordance with the normative requirements of the DEB package format specification, extract the file directory tree, and parse each file and subdirectory layer by layer; Verify the structural information of the Control file and Data file in the valid DEB package to ensure the accurate interpretation of the internal file structure of the DEB package. At the same time, verify whether the DEB package complies with the specifications and improve the comprehensive understanding and processing capabilities of the DEB package content.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; The processor is configured to implement the steps of the DEB package detection method according to any one of claims 1 to 7 when executing a program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the DEB package detection method according to any one of claims 1 to 7 are implemented.

Images