A deep scanning method, electronic device, storage medium and program product

Abstract

Embodiments of the present application provide a deep scanning method, an electronic device, a storage medium and a program product, the method comprising: receiving a first message request sent by a client; determining a first scanning state corresponding to the first message request according to the first message request; cyclically receiving an Nth message request sent by the client, changing the first scanning state to a second scanning state after scanning a cache file is completed; and in the case that the second scanning state is a scanning end, sending the cache file corresponding to the first message request to a server, adding a state machine for sensing a scanning state, used for maintaining a state and a corresponding operation of a scanning service, so that multiple message requests can be processed in a case of a long connection, and each scanning state is identified, the problem of invalid deep scanning service in a long connection multiple request scenario is solved, the scanning efficiency is improved, and the scanning time is reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a depth scanning method, electronic device, storage medium, and program product. Background Technology

[0002] The current firewall's access control policies and security engines follow the principle of "match once, check multiple times," meaning that when a connection matches an access control policy, security checks are performed based on the security policies referenced by the access control policy.

[0003] Current firewall encrypted traffic inspection also needs to follow this principle, but because the proxy process and scanning process are separated in the technical solution for encrypted traffic inspection, the proxy process is responsible for proxying and decryption, while the scanning process is responsible for scanning. Each communication between the proxy process and the scanning process represents one security scan.

[0004] In existing technologies, scanning typically involves establishing an HTTP connection and processing one request at a time. If multiple requests are received simultaneously, the system cannot process them all and must disconnect and reconnect, which consumes a significant amount of time. Improving scanning efficiency and reducing scanning time is a pressing issue that needs to be addressed. Summary of the Invention

[0005] The purpose of some embodiments of this application is to provide a deep scanning method, electronic device, storage medium, and program product. The technical solution of the embodiments of this application involves: receiving a first message request sent by a client; determining a first scan state corresponding to the first message request based on the first message request; cyclically receiving an Nth message request sent by the client, where N is a natural number greater than 0 and N is the maximum number of connection requests in a single long connection; changing the first scan state to a second scan state after scanning the cache file; and sending the cache file corresponding to the first message request to the server when the second scan state is "scan completed." This application embodiment adds a state machine that senses the scan state to maintain the state of the scanning service and corresponding operations. This allows for the processing of multiple message requests within a single long connection and the identification of each scan state, solving the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improving scanning efficiency, and reducing scanning time.

[0006] In a first aspect, some embodiments of this application provide a depth scanning method, including:

[0007] Receive the first message request sent by the client;

[0008] Based on the first message request, determine the first scan state corresponding to the first message request;

[0009] The system continuously receives the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a single long connection.

[0010] After the cache file scan is complete, change the first scan state to the second scan state;

[0011] If the second scan status is "scan completed", the cache file corresponding to the first message request will be sent to the server.

[0012] Some embodiments of this application add a state machine that senses the scanning state to maintain the state of the scanning service and the corresponding operations. This allows multiple message requests to be processed in a single long connection, and each scanning state to be identified. This solves the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improves scanning efficiency, and reduces scanning time.

[0013] Optionally, the first message request sent by the receiving client includes:

[0014] The proxy process receives the first HTTPS message request sent by the client.

[0015] The proxy process parses the first HTTPS message request, obtains a cache file, and stores the cache file in the database.

[0016] In some embodiments of this application, when the client and server are successfully connected, the proxy process receives the first HTTPS message request sent by the client, parses the first HTTPS message request to obtain a cache file, and stores the cache file in the database for subsequent scanning operations.

[0017] Optionally, determining the first scan state corresponding to the first message request based on the first message request, wherein the first scan state is scanning in progress, includes:

[0018] When the client and server successfully connect, the proxy process sends the first scan request to the scanning process. The proxy process records the sequence number of the current connection, determines the first scan status corresponding to the first message request, the first scan status is scanning in progress, and marks the current connection as not sending data.

[0019] Some embodiments of this application maintain the status of the scanning service by recording the requested scanning status through a state machine.

[0020] Optionally, the method further includes:

[0021] If the proxy process receives a second HTTPS message request, it determines whether the current connection is being scanned.

[0022] If it is determined that the current connection is scanning, the second HTTPS message request will not be processed.

[0023] In some embodiments of this application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If scanning is in progress, no new message requests are processed, thus solving the problem of system memory exhaustion caused by abnormal generation of zombie child processes in the scanning process during multiple requests from long connections.

[0024] Optionally, changing the first scan state to the second scan state after the cache file scan is completed includes:

[0025] The proxy process receives the scan results returned by the scanning process, modifies the current connection status to end the scan, and deletes the marker indicating that no data will be sent.

[0026] Some embodiments of this application receive the scan results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked "do not send data" flag. This allows new message requests to be processed, solving the problem of the scanning process abnormally generating zombie child processes and causing system memory exhaustion in long-connection multiple request scenarios.

[0027] Optionally, the method further includes:

[0028] The cached file is deleted when the number of requests for the current connection reaches N.

[0029] In some embodiments of this application, when the number of requests for the current connection reaches the maximum value, the cache file is deleted to reduce memory usage.

[0030] Optionally, the method further includes:

[0031] The client and the proxy process perform a three-way handshake to establish a left-side connection; the client and the proxy process also perform an SSL handshake to establish a left-side SSL connection.

[0032] The proxy process performs a three-way handshake with the server to establish a right-side connection, and then performs an SSL handshake with the server to establish a right-side SSL connection.

[0033] Some embodiments of this application establish connections with the agent process through the client and server respectively, and perform subsequent scanning operations through the scanning process after the connection is successful.

[0034] Secondly, some embodiments of this application provide a depth scanning device, including:

[0035] The receiving module is used to receive the first message request sent by the client;

[0036] The determining module is used to determine the first scan state corresponding to the first message request based on the first message request;

[0037] The loop module is used to repeatedly receive the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a single long connection;

[0038] The module is modified to change the first scan state to the second scan state after the scan of the cache files is completed;

[0039] The sending module is used to send the cache file corresponding to the first message request to the server when the second scan state is scan completed.

[0040] Some embodiments of this application add a state machine that senses the scanning state to maintain the state of the scanning service and the corresponding operations. This allows multiple message requests to be processed in a single long connection, and each scanning state to be identified. This solves the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improves scanning efficiency, and reduces scanning time.

[0041] Optionally, the receiving module is configured to:

[0042] The proxy process receives the first HTTPS message request sent by the client.

[0043] The proxy process parses the first HTTPS message request, obtains a cache file, and stores the cache file in the database.

[0044] In some embodiments of this application, when the client and server are successfully connected, the proxy process receives the first HTTPS message request sent by the client, parses the first HTTPS message request to obtain a cache file, and stores the cache file in the database for subsequent scanning operations.

[0045] Optionally, determining the first scan state corresponding to the first message request based on the first message request, wherein the first scan state is scanning in progress, includes:

[0046] When the client and server successfully connect, the proxy process sends the first scan request to the scanning process. The proxy process records the sequence number of the current connection, determines the first scan status corresponding to the first message request, the first scan status is scanning in progress, and marks the current connection as not sending data.

[0047] Some embodiments of this application maintain the status of the scanning service by recording the requested scanning status through a state machine.

[0048] Optionally, the loop module is used for:

[0049] If the proxy process receives a second HTTPS message request, it determines whether the current connection is being scanned.

[0050] If it is determined that the current connection is scanning, the second HTTPS message request will not be processed.

[0051] In some embodiments of this application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If scanning is in progress, no new message requests are processed, thus solving the problem of system memory exhaustion caused by abnormal generation of zombie child processes in the scanning process during multiple requests from long connections.

[0052] Optionally, the modification module is used to:

[0053] The proxy process receives the scan results returned by the scanning process, modifies the current connection status to end the scan, and deletes the marker indicating that no data will be sent.

[0054] Some embodiments of this application receive the scan results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked "do not send data" flag. This allows new message requests to be processed, solving the problem of the scanning process abnormally generating zombie child processes and causing system memory exhaustion in long-connection multiple request scenarios.

[0055] Optionally, the modification module is used to:

[0056] The cached file is deleted when the number of requests for the current connection reaches N.

[0057] In some embodiments of this application, when the number of requests for the current connection reaches the maximum value, the cache file is deleted to reduce memory usage.

[0058] Optionally, the modification module is used to:

[0059] The client and the proxy process perform a three-way handshake to establish a left-side connection; the client and the proxy process also perform an SSL handshake to establish a left-side SSL connection.

[0060] The proxy process performs a three-way handshake with the server to establish a right-side connection, and then performs an SSL handshake with the server to establish a right-side SSL connection.

[0061] Some embodiments of this application establish connections with the agent process through the client and server respectively, and perform subsequent scanning operations through the scanning process after the connection is successful.

[0062] Thirdly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the depth scanning method as described in any embodiment of the first aspect.

[0063] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the depth scanning method as described in any embodiment of the first aspect.

[0064] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein the computer program, when executed by a processor, can implement the depth scanning method as described in any embodiment of the first aspect. Attached Figure Description

[0065] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 A schematic flowchart of a depth scanning method provided in an embodiment of this application;

[0067] Figure 2 A flowchart illustrating yet another depth scanning method provided in an embodiment of this application;

[0068] Figure 3 This is a schematic diagram of the structure of a depth scanning device provided in an embodiment of this application;

[0069] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0070] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0071] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0072] Current firewall access control policies and security engines follow the principle of "match once, check multiple times." This means that when a connection matches an access control policy, security checks are performed based on the security policies referenced by the access control policy. Current firewall encrypted traffic inspection also needs to follow this principle. However, in the technical solution for encrypted traffic inspection, the proxy process and the scanning process are separated. The proxy process is responsible for proxying and decryption, while the scanning process is responsible for scanning. Each communication between the proxy process and the scanning process represents one security scan. In existing technologies, scanning typically involves establishing one HTTP connection and processing one request. If multiple requests are received simultaneously, processing becomes impossible, requiring disconnection and reconnection, which consumes considerable time. Improving scanning efficiency and reducing scanning time are urgent problems to be solved. Therefore, some embodiments of this application provide a deep scanning method. This method includes receiving a first message request sent by a client; determining a first scan state corresponding to the first message request based on the first message request; cyclically receiving an Nth message request sent by the client, where N is a natural number greater than 0 and N is the maximum number of connection requests in a single long connection; changing the first scan state to a second scan state after scanning a cached file; and sending the cached file corresponding to the first message request to the server when the second scan state is scan complete. This application embodiment adds a state machine that senses the scan state to maintain the state of the scanning service and corresponding operations. This allows processing multiple message requests within a single long connection and identifying each scan state, solving the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improving scanning efficiency, and reducing scanning time.

[0073] like Figure 1 As shown, an embodiment of this application provides a depth scanning method, the method comprising:

[0074] S101, Receive the first message request sent by the client;

[0075] Specifically, the client and server are connected to the gateway respectively. The client and server establish a connection via HTTP. The gateway is equipped with a proxy process and a scanning process. The proxy process receives the first message request sent by the client. This first message request is an HTTP (Hypertext Transfer Protocol) message request, and stores the cache file corresponding to the first message request.

[0076] S102. Determine the first scan state corresponding to the first message request according to the first message request;

[0077] Specifically, a state machine is added to the gateway. After receiving the first message request, the stored cache file is scanned and the first scan state corresponding to the first request message is recorded. For example, the first scan state can be unscanned, scanning in progress, or scan completed. The state machine records the first scan state.

[0078] S103. Continuously receive the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a single long connection;

[0079] During the current HTTP persistent connection process, the gateway receives multiple message requests.

[0080] S104. After the cache file scan is completed, change the first scan state to the second scan state;

[0081] Specifically, the gateway scans the cache file corresponding to the first message request. When the scan is complete, the state machine changes the first scan state to the second scan state, that is, changes the scanning status information to the scan completed status information.

[0082] S105. If the second scan status is "scan completed", send the cache file corresponding to the first message request to the server.

[0083] Specifically, when the second scan status is "scan completed", the gateway sends the cache file corresponding to the first message request to the server, and then processes the second message request. The status is judged in the above manner. When the status information is "scan completed", the cache file is sent to the server until the Nth message request is received, where N is a natural number greater than 0 and N is the maximum number of connection requests in a long connection. After the maximum number of connection requests is completed, the current connection is closed.

[0084] Some embodiments of this application add a state machine that senses the scanning state to maintain the state of the scanning service and the corresponding operations. This allows multiple message requests to be processed in a single long connection, and each scanning state to be identified. This solves the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improves scanning efficiency, and reduces scanning time.

[0085] Another embodiment of this application further supplements the description of the depth scanning method provided in the above embodiments.

[0086] Optionally, receiving the first message request sent by the client includes:

[0087] The proxy process receives the first HTTPS message request sent by the client.

[0088] The proxy process parses the first HTTPS message request, obtains the cache file, and stores the cache file in the database.

[0089] In some embodiments of this application, when the client and server are successfully connected, the proxy process receives the first HTTPS message request sent by the client, parses the first HTTPS message request to obtain a cache file, and stores the cache file in the database for subsequent scanning operations.

[0090] Optionally, based on the first message request, a first scan state corresponding to the first message request is determined, wherein the first scan state is scanning in progress, including:

[0091] Once the client and server connections are successful, the proxy process sends the first scan request to the scanning process. The proxy process records the sequence number of the current connection, determines the first scan status corresponding to the first message request, and sets the current connection to a no-data-send flag.

[0092] Some embodiments of this application maintain the status of the scanning service by recording the requested scanning status through a state machine.

[0093] Optionally, the method further includes:

[0094] When the proxy process receives a second HTTPS message request, it determines whether the current connection is being scanned.

[0095] If it is determined that the current connection is being scanned, the second HTTPS message request will not be processed.

[0096] In some embodiments of this application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If scanning is in progress, no new message requests are processed, thus solving the problem of system memory exhaustion caused by abnormal generation of zombie child processes in the scanning process during multiple requests from long connections.

[0097] Optionally, after scanning the cache files is complete, the first scan state is changed to the second scan state, including:

[0098] The agent process receives the scan results returned by the scanning process, modifies the current connection state to end the scan, and deletes the marker indicating that no data will be sent.

[0099] Some embodiments of this application receive the scan results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked "do not send data" flag. This allows new message requests to be processed, solving the problem of the scanning process abnormally generating zombie child processes and causing system memory exhaustion in long-connection multiple request scenarios.

[0100] Optionally, the method further includes:

[0101] The cache file will be deleted when the number of requests for the current connection reaches N.

[0102] In some embodiments of this application, when the number of requests for the current connection reaches the maximum value, the cache file is deleted to reduce memory usage.

[0103] Optionally, the method further includes:

[0104] The client and the proxy process perform a three-way handshake to establish a left-side connection, and the client and the proxy process perform an SSL handshake to establish a left-side SSL connection.

[0105] The proxy process performs a three-way handshake with the server to establish a right-side connection, and then performs an SSL handshake with the server to establish a right-side SSL connection.

[0106] Some embodiments of this application establish connections with the agent process through the client and server respectively, and perform subsequent scanning operations through the scanning process after the connection is successful.

[0107] like Figure 2 As shown in the embodiment of this application, a depth scanning method includes:

[0108] 1. The client and the proxy process perform a three-way handshake to establish a left-side connection.

[0109] 2. The client and the proxy process perform an SSL handshake to establish a left-side SSL connection.

[0110] 3. The proxy process performs a three-way handshake with the server to establish a right-side connection.

[0111] 4. The proxy process performs an SSL handshake with the server to establish an SSL connection on the right.

[0112] 5. The client sends the first HTTPS message to the proxy process.

[0113] 6. The proxy process parses the first HTTPS message, calls the file restoration module to cache the file locally, and initializes the scanning state of the connection.

[0114] 7. After the agent process caches the file, it sends the first scan request to the scanning process.

[0115] 8. After the proxy process sends a scan request, it records the scan sequence number of the first request on the current proxy connection, changes the scan status of the connection to scanning, sets the connection to a no-data-send flag, and begins processing other connection services.

[0116] 9. The client sends a second HTTPS message to the proxy process.

[0117] 10. When the proxy process receives a new event request, it finds that the current connection is being scanned and will not process the new request for the time being; it will process other business.

[0118] 11. The scanning process performs the first deep scan.

[0119] 12. The scanning process sends the scan results of the first request to the agent process.

[0120] 13. The agent process processes the first request based on the scan results, changes the connection status to scan complete, and clears the connection do not send data flag.

[0121] 14. If the scan result is not a block, the agent process will send the file requested for the first time to the server.

[0122] 15. The proxy process releases the resources requested in the first request and begins to receive and parse the data in the second request; it calls the file restoration module to cache the file locally and sets the connection scan status to the initial state.

[0123] 16. The agent process sends a second scan request to the scanning process.

[0124] 17. After the agent process sends a scan request, it records the scan sequence number of the second request on the current connection, changes the scan status of the connection to scanning, sets the connection to a no-data-send flag, and begins processing other connection services.

[0125] 18. The scanning process performs a second deep scan.

[0126] 19. The client sends a third request to the proxy process, repeating steps 10-18 until the number of requests reaches the maximum number of requests N for the proxy process's long connections.

[0127] 20. The scanning process returns the scan result of the Nth request to the agent process.

[0128] 21. The proxy process processes the Nth request based on the scan results, changes the connection status to scan complete, and clears the connection do not send data flag.

[0129] 22. If the scan result is not a block, the proxy process will send the file requested for the Nth time to the server.

[0130] 23. The proxy process detects that the number of requests for the current connection has reached the maximum value and releases the current connection.

[0131] The proxy process in this embodiment supports being aware of the current scanning status when processing HTTP services. The proxy process supports performing corresponding status processing based on the scanning status when processing HTTP long connection services. The proxy process uses a new blocking connection identifier to ensure that the connection can be reclaimed by the proxy timeout mechanism.

[0132] For example, the embodiments of this application can be applied to the encrypted traffic file antivirus function of firewall long connections, and the specific process is as follows:

[0133] 1) Configure a proxy policy in the firewall and configure an ACL to reference the antivirus security policy.

[0134] 2) When the encrypted data packet of the device matches the proxy policy and the ACL policy of the antivirus, the packet will be introduced into the proxy process.

[0135] 3) When the client makes its first request to the device (gateway), the proxy process on the gateway first performs SSL decryption on the encrypted data, then decodes the content and restores the file.

[0136] 4) The agent process informs the scanning process of the restored file path through the communication module.

[0137] 5) After receiving the first request information, the scanning process finds the file according to the file path and calls the antivirus engine to perform a scanning task on the file.

[0138] 6) When the client's second request arrives at the device, the proxy process will not process the second request directly, but will wait for the results of the first scan.

[0139] 7) After the antivirus engine completes the scan, it will notify the communication module of the scanning process of the first scan result request. The communication module of the scanning process will then send the scan result to the agent process.

[0140] 8) After receiving the scan results, the agent process performs subsequent processing based on the scan results. If the scan is allowed, the agent process calls the agent module to forward the task; if the scan is blocked, the agent process terminates the current task.

[0141] 9) After the agent process finishes processing the first scan result, it reads the content of the second request and repeats the operations from step 3 to step 8.

[0142] The embodiments of this application can solve the problem of deep scanning service failure in long-connection multiple request scenarios, the problem of scanning process abnormally generating zombie child processes leading to system memory exhaustion in long-connection multiple request scenarios, and the problem of proxy service not working due to proxy connection being occupied and unable to be released in long-connection multiple request scenarios.

[0143] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0144] Another embodiment of this application provides a depth scanning device for performing the depth scanning method provided in the above embodiments.

[0145] like Figure 3 The diagram shown is a structural schematic of a depth scanning device provided in an embodiment of this application. The depth scanning device includes a receiving module 301, a determining module 302, a looping module 303, a changing module 304, and a sending module 305, wherein:

[0146] The receiving module 301 is used to receive the first message request sent by the client;

[0147] The determining module 302 is used to determine the first scan state corresponding to the first message request based on the first message request;

[0148] The loop module 303 is used to repeatedly receive the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a single long connection;

[0149] Modification module 304 is used to change the first scan state to the second scan state after the cache file scan is completed;

[0150] The sending module 305 is used to send the cache file corresponding to the first message request to the server when the second scan state is scan completed.

[0151] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0152] Some embodiments of this application add a state machine that senses the scanning state to maintain the state of the scanning service and the corresponding operations. This allows multiple message requests to be processed in a single long connection, and each scanning state to be identified. This solves the problem of deep scanning service failure in scenarios with multiple requests over a long connection, improves scanning efficiency, and reduces scanning time.

[0153] This application provides another embodiment to further illustrate the depth scanning device provided in the above embodiments.

[0154] Optionally, the receiving module is used for:

[0155] The proxy process receives the first HTTPS message request sent by the client.

[0156] The proxy process parses the first HTTPS message request, obtains the cache file, and stores the cache file in the database.

[0157] In some embodiments of this application, when the client and server are successfully connected, the proxy process receives the first HTTPS message request sent by the client, parses the first HTTPS message request to obtain a cache file, and stores the cache file in the database for subsequent scanning operations.

[0158] Optionally, based on the first message request, a first scan state corresponding to the first message request is determined, wherein the first scan state is scanning in progress, including:

[0159] Once the client and server connections are successful, the proxy process sends the first scan request to the scanning process. The proxy process records the sequence number of the current connection, determines the first scan status corresponding to the first message request, and sets the current connection to a no-data-send flag.

[0160] Some embodiments of this application maintain the status of the scanning service by recording the requested scanning status through a state machine.

[0161] Optionally, the loop module is used for:

[0162] When the proxy process receives a second HTTPS message request, it determines whether the current connection is being scanned.

[0163] If it is determined that the current connection is being scanned, the second HTTPS message request will not be processed.

[0164] In some embodiments of this application, after receiving multiple message requests, the current operation of the current connection is determined to be scanning. If scanning is in progress, no new message requests are processed, thus solving the problem of system memory exhaustion caused by abnormal generation of zombie child processes in the scanning process during multiple requests from long connections.

[0165] Optionally, the module can be modified for:

[0166] The agent process receives the scan results returned by the scanning process, modifies the current connection state to end the scan, and deletes the marker indicating that no data will be sent.

[0167] Some embodiments of this application receive the scan results returned by the scanning process through a proxy process, modify the current connection state to end the scan, and delete the marked "do not send data" flag. This allows new message requests to be processed, solving the problem of the scanning process abnormally generating zombie child processes and causing system memory exhaustion in long-connection multiple request scenarios.

[0168] Optionally, the module is modified for:

[0169] The cache file will be deleted when the number of requests for the current connection reaches N.

[0170] In some embodiments of this application, when the number of requests for the current connection reaches the maximum value, the cache file is deleted to reduce memory usage.

[0171] Optionally, the module is modified for:

[0172] The client and the proxy process perform a three-way handshake to establish a left-side connection, and the client and the proxy process perform an SSL handshake to establish a left-side SSL connection.

[0173] The proxy process performs a three-way handshake with the server to establish a right-side connection, and then performs an SSL handshake with the server to establish a right-side SSL connection.

[0174] Some embodiments of this application establish connections with the agent process through the client and server respectively, and perform subsequent scanning operations through the scanning process after the connection is successful.

[0175] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0176] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0177] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the depth scanning methods provided in the above embodiments.

[0178] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the deep scanning methods provided in the above embodiments.

[0179] like Figure 4 As shown, some embodiments of this application provide an electronic device 400, which includes a memory 410, a processor 420, and a computer program stored in the memory 410 and executable on the processor 420. When the processor 420 reads the program from the memory 410 via a bus 430 and executes the program, it can implement the method of any embodiment of the depth scanning method described above.

[0180] Processor 420 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 420 may be a microprocessor.

[0181] Memory 410 can be used to store instructions executed by processor 420 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 420 of this disclosure embodiment can be used to execute instructions in memory 410 to implement the methods shown above. Memory 410 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0182] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0183] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0184] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method of deep scanning, characterized by, The method includes: Receive the first message request sent by the client; Based on the first message request, determine the first scan state corresponding to the first message request; The system continuously receives the Nth message request sent by the client, where N is a natural number greater than 0, and N is the maximum number of connection requests in a single long connection. After the cache file scan is complete, change the first scan state to the second scan state; If the second scan status is "scan completed", the cache file corresponding to the first message request will be sent to the server. The first message request sent by the receiving client includes: The proxy process receives the first HTTPS message request sent by the client. The proxy process parses the first HTTPS message request, obtains a cache file, and stores the cache file in the database; The step of determining the first scan state corresponding to the first message request includes: When the client and server successfully connect, the proxy process sends the first scan request to the scanning process. The proxy process records the sequence number of the current connection, determines the first scan status corresponding to the first message request, the first scan status is scanning in progress, and marks the current connection as not sending data. The method further includes: If the proxy process receives a second HTTPS message request, it determines whether the current connection is being scanned. If it is determined that the current connection is scanning, the second HTTPS message request will not be processed.

2. The depth scanning method of claim 1, wherein, The step of changing the first scan state to the second scan state after the cache file scan is completed includes: The proxy process receives the scan results returned by the scanning process, changes the current connection status to "scan completed", and deletes the marker indicating no data transmission.

3. The depth scanning method of claim 1, wherein, The method further includes: The cached file is deleted when the number of requests for the current connection reaches N.

4. The method of claim 1, wherein, The method further includes: The client and the proxy process perform a three-way handshake to establish a left-side connection; the client and the proxy process also perform an SSL handshake to establish a left-side SSL connection. The proxy process performs a three-way handshake with the server to establish a right-side connection, and then performs an SSL handshake with the server to establish a right-side SSL connection.

5. An electronic device, comprising: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the depth scanning method according to any one of claims 1-4.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the depth scanning method according to any one of claims 1-4.

7. A computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it can implement the depth scanning method according to any one of claims 1-4.

Images