Depth scanning method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a deep scanning method, electronic equipment, a storage medium and a program product. The method comprises the following steps: receiving a first message request sent by a client; determining a first scanning state corresponding to the first message request according to the first message request; circularly receiving an Nth message request sent by the client, and changing the first scanning state into a second scanning state after scanning of the cache file is completed; under the condition that the second scanning state is scanning ending, a cache file corresponding to the first message request is sent to the server, a state machine for sensing the scanning state is added and is used for maintaining the state and corresponding operation of a scanning service, multiple message requests can be processed under the condition of one-time long connection, all the scanning states can be identified, and the scanning efficiency is improved. The problem of deep scanning service failure in a long-connection multi-request scene is solved, the scanning efficiency is improved, and the scanning time is shortened.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a deep scanning method, electronic device, storage medium and program product. Background Art

[0002] The current firewall's access control policy and security engine follow the principle of "one match, multiple checks", that is, when a connection hits the access control policy, a security check is performed based on the security policy referenced by the access control policy.

[0003] The current firewall encrypted traffic inspection also needs to follow this principle, but the proxy process and the scanning process are separated in the technical solution of encrypted traffic detection. The proxy process is responsible for proxy and decryption services, and the scanning process is responsible for scanning services. The proxy process communicates with the scanning process once, which represents a security scanning service.

[0004] In the prior art, when scanning, usually an HTTP protocol connection is established and a request is processed. If multiple requests are received at the same time, they cannot be processed and the current connection needs to be disconnected and reconnected, which takes a lot of time. How to improve scanning efficiency and reduce scanning time is an urgent problem to be solved. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a deep scanning method, an electronic device, a storage medium and a program product. Through the technical solution of the embodiments of the present application, a first message request sent by a client is received; according to the first message request, a first scanning state corresponding to the first message request is determined; the Nth message request sent by the client is received cyclically, wherein N is a natural number greater than 0, and N is the maximum number of connection requests in a long connection; after the scanning of the cached file is completed, the first scanning state is changed to a second scanning state; when the second scanning state is the end of the scan, the cached file corresponding to the first message request is sent to the server. The embodiments of the present application add a state machine that perceives the scanning state to maintain the state and corresponding operations of the scanning service. In the case of a long connection, multiple message requests can be processed and each scanning state can be identified, so as to solve the problem of failure of the deep scanning service in the scenario of multiple requests for the long connection, improve the scanning efficiency and reduce the scanning time.

[0006] In a first aspect, some embodiments of the present application provide a deep scanning method, including:

[0007] Receive a first message request sent by a client;

[0008] Determining, according to the first message request, a first scanning state corresponding to the first message request;

[0009] Circularly receive the Nth message request sent by the client, where N is a natural number greater than 0 and N is the maximum number of connection requests in a persistent connection;

[0010] After the cache file is scanned, the first scanning state is changed to a second scanning state;

[0011] When the second scanning status is scanning completion, the cache file corresponding to the first message request is sent to the server.

[0012] Some embodiments of the present application add a state machine that perceives the scanning status to maintain the status of the scanning service and corresponding operations. In the case of a long connection, it can process multiple message requests and identify each scanning status, thereby solving the problem of deep scanning service failure in the scenario of multiple requests for a long connection, improving scanning efficiency and reducing scanning time.

[0013] Optionally, the receiving a first message request sent by the client includes:

[0014] Receive the first https message request sent by the client through the proxy process;

[0015] The proxy process parses the first https message request to obtain a cache file, and stores the cache file in a database.

[0016] In some embodiments of the present application, when the client and server are successfully connected, the proxy process receives the first https message request sent by the client, parses the first https message request, obtains a cache file, and stores the cache file in a database to facilitate subsequent scanning operations.

[0017] Optionally, determining, according to the first message request, a first scanning state corresponding to the first message request, the first scanning state being scanning, includes:

[0018] When the client and server are successfully connected, the first scanning request is sent to the scanning process through the proxy process. The proxy process records the serial number of the current connection and determines the first scanning state corresponding to the first message request. The first scanning state is scanning and marks the current connection with a no data sending identifier.

[0019] Some embodiments of the present application record the requested scanning status through a set state machine to maintain the status of the scanning service.

[0020] Optionally, the method further comprises:

[0021] When the proxy process receives the second https message request, determining whether the current connection is being scanned;

[0022] If it is determined that the current connection is being scanned, the second https message request is not processed.

[0023] In some embodiments of the present application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If it is in the scanning process, new message requests are not processed, thereby solving the problem of abnormal generation of zombie sub-processes in the scanning process and exhaustion of system memory in the scenario of multiple requests for a long connection.

[0024] Optionally, after scanning the cache file is completed, changing the first scanning state to the second scanning state includes:

[0025] The proxy process receives the scanning result returned by the scanning process, modifies the current connection state to indicate that the scanning is ended, and deletes the marked identifier of not sending data.

[0026] Some embodiments of the present application receive the scanning results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked data not to be sent, so that new message requests can be processed, solving the problem of system memory exhaustion caused by the abnormal generation of zombie sub-processes by the scanning process in the scenario of long connection and multiple requests.

[0027] Optionally, the method further comprises:

[0028] When the number of requests for the current connection reaches the N value, the cache file is deleted.

[0029] In some embodiments of the present application, when the number of requests for the current connection reaches a maximum value, the cache file is deleted to reduce memory usage.

[0030] Optionally, the method further comprises:

[0031] The client performs a three-way handshake with the proxy process to establish a left connection, and the client performs an SSL handshake with the proxy process to establish a left SSL connection;

[0032] The proxy process performs a three-way handshake with the server to establish a right-side connection. The proxy process performs an SSL handshake with the server to establish a right-side SSL connection.

[0033] Some embodiments of the present application establish connections with the proxy process through the client and the server respectively, and after the connection is successful, perform subsequent scanning operations through the scanning process.

[0034] In a second aspect, some embodiments of the present application provide a deep scanning device, including:

[0035] A receiving module, used for receiving a first message request sent by a client;

[0036] a determination module, configured to determine, according to the first message request, a first scanning state corresponding to the first message request;

[0037] A loop module, used for cyclically receiving the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in one long connection;

[0038] A changing module, used for changing the first scanning state to a second scanning state after scanning the cached file is completed;

[0039] A sending module is used to send the cache file corresponding to the first message request to the server when the second scanning state is the scanning end.

[0040] Some embodiments of the present application add a state machine that perceives the scanning status to maintain the status of the scanning service and corresponding operations. In the case of a long connection, it can process multiple message requests and identify each scanning status, thereby solving the problem of deep scanning service failure in the scenario of multiple requests for a long connection, improving scanning efficiency and reducing scanning time.

[0041] Optionally, the receiving module is used to:

[0042] Receive the first https message request sent by the client through the proxy process;

[0043] The proxy process parses the first https message request to obtain a cache file, and stores the cache file in a database.

[0044] In some embodiments of the present application, when the client and server are successfully connected, the proxy process receives the first https message request sent by the client, parses the first https message request, obtains a cache file, and stores the cache file in a database to facilitate subsequent scanning operations.

[0045] Optionally, determining, according to the first message request, a first scanning state corresponding to the first message request, the first scanning state being scanning, includes:

[0046] When the client and server are successfully connected, the first scanning request is sent to the scanning process through the proxy process. The proxy process records the serial number of the current connection and determines the first scanning state corresponding to the first message request. The first scanning state is scanning and marks the current connection with a no data sending identifier.

[0047] Some embodiments of the present application record the requested scanning status through a set state machine to maintain the status of the scanning service.

[0048] Optionally, the circulation module is used to:

[0049] When the proxy process receives the second https message request, determining whether the current connection is being scanned;

[0050] If it is determined that the current connection is being scanned, the second https message request is not processed.

[0051] In some embodiments of the present application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If it is in the scanning process, new message requests are not processed, thereby solving the problem of abnormal generation of zombie sub-processes in the scanning process and exhaustion of system memory in the scenario of multiple requests for a long connection.

[0052] Optionally, the changing module is used to:

[0053] The proxy process receives the scanning result returned by the scanning process, modifies the current connection state to indicate that the scanning is ended, and deletes the marked identifier of not sending data.

[0054] Some embodiments of the present application receive the scanning results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked data not to be sent, so that new message requests can be processed, solving the problem of system memory exhaustion caused by the abnormal generation of zombie sub-processes by the scanning process in the scenario of long connection and multiple requests.

[0055] Optionally, the changing module is used to:

[0056] When the number of requests for the current connection reaches the N value, the cache file is deleted.

[0057] In some embodiments of the present application, when the number of requests for the current connection reaches a maximum value, the cache file is deleted to reduce memory usage.

[0058] Optionally, the changing module is used to:

[0059] The client performs a three-way handshake with the proxy process to establish a left connection, and the client performs an SSL handshake with the proxy process to establish a left SSL connection;

[0060] The proxy process performs a three-way handshake with the server to establish a right-side connection. The proxy process performs an SSL handshake with the server to establish a right-side SSL connection.

[0061] Some embodiments of the present application establish connections with the proxy process through the client and the server respectively, and after the connection is successful, perform subsequent scanning operations through the scanning process.

[0062] In a third aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the deep scanning method as described in any embodiment of the first aspect can be implemented.

[0063] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the deep scanning method as described in any embodiment of the first aspect.

[0064] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the deep scanning method as described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 A schematic diagram of a flow chart of a deep scanning method provided in an embodiment of the present application;

[0067] Figure 2 A flowchart of another deep scanning method provided in an embodiment of the present application;

[0068] Figure 3 A schematic diagram of the structure of a depth scanning device provided in an embodiment of the present application;

[0069] Figure 4 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0071] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0072] The access control policy and security engine of the current firewall follow the principle of "one match, multiple checks", that is, when the connection hits the access control policy, security detection is performed according to the security policy referenced by the access control policy. The current firewall encrypted traffic inspection also needs to follow this principle, but the proxy process and the scanning process are separated in the technical solution of encrypted traffic detection. The proxy process is responsible for the proxy and decryption business, and the scanning process is responsible for the scanning business. The proxy process communicates with the scanning process once, which represents a security scanning business. In the prior art, when scanning, usually an HTTP protocol connection is made and a request is processed. If multiple requests are received at the same time, they cannot be processed and the current connection needs to be disconnected and reconnected, which takes a lot of time. How to improve scanning efficiency and reduce scanning time is a problem that needs to be solved urgently. In view of this, some embodiments of the present application provide a deep scanning method, which includes receiving a first message request sent by a client; determining a first scanning state corresponding to the first message request according to the first message request; cyclically receiving the Nth message request sent by the client, wherein N is a natural number greater than 0, and N is the maximum number of connection requests in a long connection; after scanning the cache file, changing the first scanning state to a second scanning state; when the second scanning state is the end of scanning, sending the cache file corresponding to the first message request to the server, the embodiment of the present application adds a state machine that perceives the scanning state, which is used to maintain the state and corresponding operation of the scanning service, and can process multiple message requests in a long connection, and identify each scanning state, so as to solve the problem of failure of the deep scanning service in the scenario of multiple requests for the long connection, improve the scanning efficiency, and reduce the scanning time.

[0073] like Figure 1 As shown, an embodiment of the present application provides a deep scanning method, the method comprising:

[0074] S101, receiving a first message request sent by a client;

[0075] Specifically, the client and the server are connected to the gateway respectively, and the client and the server establish a connection through HTTP. The gateway is provided with a proxy process and a scanning process. The first message request sent by the client is received through the proxy process. The first message request is an HTTP (Hypertext Transfer Protocol) message request, and the cache file corresponding to the first message request is stored.

[0076] S102, determining a first scanning state corresponding to the first message request according to the first message request;

[0077] Specifically, a state machine is added to the gateway. After receiving the first message request, the stored cache file is scanned and the first scanning state corresponding to the first request message is recorded. For example, the first scanning state may be not scanned, scanning or scanning is completed, and the state machine records the first scanning state.

[0078] S103, cyclically receiving the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in one long connection;

[0079] During the current HTTP long connection process, the gateway receives multiple message requests.

[0080] S104, after scanning the cached files is completed, changing the first scanning state to the second scanning state;

[0081] Specifically, the gateway scans the cache file corresponding to the first message request. When the scan is completed, the state machine changes the first scanning state to the second scanning state, that is, changes the scanning state information to the scanning completed state information.

[0082] S105: When the second scanning state is scanning completion, the cache file corresponding to the first message request is sent to the server.

[0083] Specifically, when the second scanning status is the scanning completion, the gateway will send the cache file corresponding to the first message request to the server, and then process the second message request, and perform status judgment in the above manner. When the status information is that the scanning is completed, the cache file will be sent to the server until the Nth message request is received, where N is a natural number greater than 0, and N is the maximum number of connection requests in a long connection. After the maximum number of connection requests is completed, the current connection is disconnected.

[0084] Some embodiments of the present application add a state machine that perceives the scanning status to maintain the status of the scanning service and corresponding operations. In the case of a long connection, it can process multiple message requests and identify each scanning status, thereby solving the problem of deep scanning service failure in the scenario of multiple requests for a long connection, improving scanning efficiency and reducing scanning time.

[0085] Another embodiment of the present application further supplements the depth scanning method provided in the above embodiment.

[0086] Optionally, receiving a first message request sent by a client includes:

[0087] Receive the first https message request sent by the client through the proxy process;

[0088] The proxy process parses the first https message request, obtains the cache file, and stores the cache file in the database.

[0089] In some embodiments of the present application, when the client and server are successfully connected, the proxy process receives the first https message request sent by the client, parses the first https message request, obtains a cache file, and stores the cache file in a database to facilitate subsequent scanning operations.

[0090] Optionally, determining, according to the first message request, a first scanning state corresponding to the first message request, the first scanning state being scanning, includes:

[0091] When the client and server are successfully connected, the first scanning request is sent to the scanning process through the proxy process. The proxy process records the serial number of the current connection and determines the first scanning state corresponding to the first message request. The first scanning state is scanning and marks the current connection with a no data sending flag.

[0092] Some embodiments of the present application record the requested scanning status through a set state machine to maintain the status of the scanning service.

[0093] Optionally, the method further comprises:

[0094] When the proxy process receives the second https message request, it determines whether the current connection is being scanned;

[0095] If the current connection is determined to be scanning, the second https message request will not be processed.

[0096] In some embodiments of the present application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If it is in the scanning process, new message requests are not processed, thereby solving the problem of abnormal generation of zombie sub-processes in the scanning process and exhaustion of system memory in the scenario of multiple requests for a long connection.

[0097] Optionally, after scanning the cache file is completed, changing the first scanning state to the second scanning state includes:

[0098] The proxy process receives the scanning result returned by the scanning process, modifies the current connection state to end the scanning, and deletes the marked not-sending data flag.

[0099] Some embodiments of the present application receive the scanning results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked data not to be sent, so that new message requests can be processed, solving the problem of system memory exhaustion caused by the abnormal generation of zombie sub-processes by the scanning process in the scenario of long connection and multiple requests.

[0100] Optionally, the method further comprises:

[0101] When the number of requests for the current connection reaches the N value, the cache file will be deleted.

[0102] In some embodiments of the present application, when the number of requests for the current connection reaches a maximum value, the cache file is deleted to reduce memory usage.

[0103] Optionally, the method further comprises:

[0104] The client and the proxy process perform a three-way handshake to establish a left connection. The client and the proxy process perform an SSL handshake to establish a left SSL connection.

[0105] The proxy process performs a three-way handshake with the server to establish a right-side connection. The proxy process performs an SSL handshake with the server to establish a right-side SSL connection.

[0106] Some embodiments of the present application establish connections with the proxy process through the client and the server respectively, and after the connection is successful, perform subsequent scanning operations through the scanning process.

[0107] like Figure 2 As shown, a deep scanning method provided in an embodiment of the present application includes:

[0108] 1. The client and the proxy process perform a three-way handshake to establish a left connection.

[0109] 2. The client performs an SSL handshake with the proxy process to establish an SSL connection on the left.

[0110] 3. The proxy process performs a three-way handshake with the server to establish the right connection.

[0111] 4. The proxy process performs an SSL handshake with the server to establish the right SSL connection.

[0112] 5. The client sends the first https message to the proxy process.

[0113] 6. The proxy process parses the first https message and calls the file restoration module to cache the file locally; and initializes the scanning status of the connection.

[0114] 7. After the proxy process caches the file, it sends the first scan request to the scanning process.

[0115] 8. After the proxy process sends a scan request, it records the scan sequence number of the first request on the current proxy connection, changes the scan status of the connection to scanning, sets a no data sending mark on the connection, and starts processing other connection services.

[0116] 9. The client sends a second https message to the proxy process.

[0117] 10. The proxy process receives a new event request and finds that the current connection is being scanned. The connection will not process new requests temporarily and will process other services.

[0118] 11. The scanning process performs the first deep scanning operation.

[0119] 12. The scanning process sends the scanning results of the first request to the proxy process.

[0120] 13. The proxy process handles the first requested service according to the scan results, changes the connection status to the end of the scan, and clears the connection flag indicating that no data is sent.

[0121] 14. If the scan result is not blocked, the proxy process sends the first requested file to the server.

[0122] 15. The proxy process releases the resources of the first request and starts to receive and parse the second request data; calls the file restoration module to cache the file locally and sets the scanning state of the connection to the initial state.

[0123] 16. The proxy process sends a second scan request to the scanning process.

[0124] 17. After the proxy process sends the scan request, it records the scan sequence number of the second request on the current connection, changes the scan status of the connection to scanning, sets a no data sending mark on the connection, and starts processing other connection services.

[0125] 18. The scanning process performs a second deep scan.

[0126] 19. The client sends a third request to the proxy process and repeats steps 10 to 18 until the number of requests reaches the maximum number of requests N for the long connection of the proxy process.

[0127] 20. The scanning process returns the scanning result of the Nth request to the proxy process.

[0128] 21. The proxy process processes the Nth request according to the scanning results, changes the connection status to the end of scanning, and clears the connection flag that does not send data.

[0129] 22. If the scan result is not blocking, the proxy process sends the Nth requested file to the server.

[0130] 23. The proxy process finds that the number of requests for the current connection has reached the maximum value and releases the current connection.

[0131] The proxy process in the embodiment of the present application supports the ability to perceive the current scanning status when processing HTTP services. The proxy process supports corresponding status processing based on the scanning status when processing HTTP long connection services. The proxy process uses a new blocking connection identifier to ensure that the connection can be recovered by the proxy timeout mechanism.

[0132] For example, the embodiment of the present application can be applied to the antivirus function of encrypted traffic files of a firewall long connection, and the specific process is as follows:

[0133] 1) Configure a proxy policy in the firewall and configure an ACL to reference the antivirus security policy.

[0134] 2) When the encrypted data message passing through the device matches the proxy policy and the ACL policy that references antivirus, the message will be introduced into the proxy process.

[0135] 3) When the client's first request arrives at the device (gateway), the proxy process on the gateway first performs SSL decryption on the encrypted data, then decodes the content and restores the file.

[0136] 4) The agent process informs the scanning process of the restored file path through the communication module.

[0137] 5) After receiving the first request information, the scanning process finds the file according to the file path and calls the antivirus engine to scan the file.

[0138] 6) The client's second request arrives at the device. At this time, the proxy process will not directly process the second request, but wait for the first scan result.

[0139] 7) After the antivirus engine completes the scan, it notifies the communication module of the scanning process of the first request scan result, and the communication module of the scanning process sends the scan result to the proxy process.

[0140] 8) After receiving the scan result, the proxy process performs subsequent processing according to the scan result. If it is allowed, the proxy process calls the proxy module to forward the task; if it is blocked, the proxy process terminates the task.

[0141] 9) After the proxy process processes the first scan result, it reads the content of the second request and repeats steps 3 to 8.

[0142] The embodiments of the present application can solve the problem of deep scanning service failure in the scenario of long connection and multiple requests, can solve the problem of system memory exhaustion caused by abnormal scanning process generating zombie sub-processes in the scenario of long connection and multiple requests, and can solve the problem of proxy service ineffectiveness caused by proxy connection being occupied and unable to be released in the scenario of long connection and multiple requests.

[0143] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0144] Another embodiment of the present application provides a depth scanning device for executing the depth scanning method provided in the above embodiment.

[0145] like Figure 3 , which is a schematic diagram of the structure of a deep scanning device provided in an embodiment of the present application. The deep scanning device includes a receiving module 301, a determining module 302, a loop module 303, a changing module 304 and a sending module 305, wherein:

[0146] The receiving module 301 is used to receive a first message request sent by a client;

[0147] The determination module 302 is used to determine a first scanning state corresponding to the first message request according to the first message request;

[0148] The loop module 303 is used to cyclically receive the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a long connection;

[0149] The changing module 304 is used to change the first scanning state to the second scanning state after the cache file is scanned;

[0150] The sending module 305 is used to send the cache file corresponding to the first message request to the server when the second scanning status is scanning completion.

[0151] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0152] Some embodiments of the present application add a state machine that perceives the scanning status to maintain the status of the scanning service and corresponding operations. In the case of a long connection, it can process multiple message requests and identify each scanning status, thereby solving the problem of deep scanning service failure in the scenario of multiple requests for a long connection, improving scanning efficiency and reducing scanning time.

[0153] Another embodiment of the present application further supplements the depth scanning device provided in the above embodiment.

[0154] Optionally, the receiving module is used to:

[0155] Receive the first https message request sent by the client through the proxy process;

[0156] The proxy process parses the first https message request, obtains the cache file, and stores the cache file in the database.

[0157] In some embodiments of the present application, when the client and server are successfully connected, the proxy process receives the first https message request sent by the client, parses the first https message request, obtains a cache file, and stores the cache file in a database to facilitate subsequent scanning operations.

[0158] Optionally, determining, according to the first message request, a first scanning state corresponding to the first message request, the first scanning state being scanning, includes:

[0159] When the client and server are successfully connected, the first scanning request is sent to the scanning process through the proxy process. The proxy process records the serial number of the current connection and determines the first scanning state corresponding to the first message request. The first scanning state is scanning and marks the current connection with a no data sending flag.

[0160] Some embodiments of the present application record the requested scanning status through a set state machine to maintain the status of the scanning service.

[0161] Optionally, a loop module for:

[0162] When the proxy process receives the second https message request, it determines whether the current connection is being scanned;

[0163] If the current connection is determined to be scanning, the second https message request will not be processed.

[0164] In some embodiments of the present application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If it is in the scanning process, new message requests are not processed, thereby solving the problem of abnormal generation of zombie sub-processes in the scanning process and exhaustion of system memory in the scenario of multiple requests for a long connection.

[0165] Optionally, change the module to:

[0166] The proxy process receives the scanning result returned by the scanning process, modifies the current connection state to end the scanning, and deletes the marked not-sending data flag.

[0167] Some embodiments of the present application receive the scanning results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked data not to be sent, so that new message requests can be processed, solving the problem of system memory exhaustion caused by the abnormal generation of zombie sub-processes by the scanning process in the scenario of long connection and multiple requests.

[0168] Optionally, change the module to:

[0169] When the number of requests for the current connection reaches the N value, the cache file will be deleted.

[0170] In some embodiments of the present application, when the number of requests for the current connection reaches a maximum value, the cache file is deleted to reduce memory usage.

[0171] Optionally, change the module to:

[0172] The client and the proxy process perform a three-way handshake to establish a left connection. The client and the proxy process perform an SSL handshake to establish a left SSL connection.

[0173] The proxy process performs a three-way handshake with the server to establish a right-side connection. The proxy process performs an SSL handshake with the server to establish a right-side SSL connection.

[0174] Some embodiments of the present application establish connections with the proxy process through the client and the server respectively, and after the connection is successful, perform subsequent scanning operations through the scanning process.

[0175] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0176] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0177] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation of the method corresponding to any embodiment of the deep scanning method provided in the above embodiments can be implemented.

[0178] An embodiment of the present application further provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations of the method corresponding to any embodiment of the deep scanning method provided in the above embodiments.

[0179] like Figure 4 As shown, some embodiments of the present application provide an electronic device 400, which includes: a memory 410, a processor 420, and a computer program stored in the memory 410 and executable on the processor 420, wherein the processor 420 can implement a method of any embodiment included in the above-mentioned deep scanning method when reading the program from the memory 410 through a bus 430 and executing the program.

[0180] Processor 420 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 420 can be a microprocessor.

[0181] The memory 410 may be used to store instructions executed by the processor 420 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 420 of the disclosed embodiment may be used to execute instructions in the memory 410 to implement the method shown above. The memory 410 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0182] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0183] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0184] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A deep scanning method, characterized in that: The method comprises: Receive a first message request sent by a client; Determining, according to the first message request, a first scanning state corresponding to the first message request; Circularly receive the Nth message request sent by the client, where N is a natural number greater than 0 and N is the maximum number of connection requests in a persistent connection; After the cache file is scanned, the first scanning state is changed to a second scanning state; When the second scanning status is scanning completion, the cache file corresponding to the first message request is sent to the server.

2. The deep scanning method according to claim 1, characterized in that: The receiving a first message request sent by the client includes: Receive the first https message request sent by the client through the proxy process; The proxy process parses the first https message request to obtain a cache file, and stores the cache file in a database.

3. The deep scanning method according to claim 2, characterized in that: The determining, according to the first message request, a first scanning state corresponding to the first message request includes: When the client and server are successfully connected, the first scanning request is sent to the scanning process through the proxy process. The proxy process records the serial number of the current connection and determines the first scanning state corresponding to the first message request. The first scanning state is scanning and marks the current connection with a no data sending identifier.

4. The deep scanning method according to claim 3, characterized in that: The method further comprises: When the proxy process receives the second https message request, determining whether the current connection is being scanned; If it is determined that the current connection is being scanned, the second https message request is not processed.

5. The deep scanning method according to claim 4, characterized in that: After the cache file is scanned, changing the first scanning state to the second scanning state includes: The proxy process receives the scanning result returned by the scanning process, modifies the current connection state to indicate that the scanning is ended, and deletes the marked identifier of not sending data.

6. The deep scanning method according to claim 2, characterized in that: The method further comprises: When the number of requests for the current connection reaches the N value, the cache file is deleted.

7. The deep scanning method according to claim 1, characterized in that: The method further comprises: The client performs a three-way handshake with the proxy process to establish a left connection, and the client performs an SSL handshake with the proxy process to establish a left SSL connection; The proxy process performs a three-way handshake with the server to establish a right-side connection. The proxy process performs an SSL handshake with the server to establish a right-side SSL connection.

8. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor can implement the deep scanning method described in any one of claims 1 to 7 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the program, when executed by a processor, can implement the deep scanning method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, wherein: When the computer program is executed by a processor, the deep scanning method described in any one of claims 1 to 7 can be implemented.

Images