File scanning method and device, electronic equipment and storage medium

Abstract

The invention provides a file scanning method and device, electronic equipment and a storage medium, and relates to the technical field of computer network security, and the method comprises the steps: obtaining attribute information of a target file in response to a scanning request for the target file; judging whether the target file is modified or not according to the attribute information; under the condition that it is determined that the target file is not modified, local cloud checking information of the target file is obtained from a local cache according to the attribute information; and scanning the target file according to the local cloud check information to obtain a scanning result representing the security state of the target file. A local cache mechanism is introduced, so that the dependence on the cloud can be effectively reduced. And when the to-be-detected file is not changed, the cloud check data is directly obtained from the local cache, and hash calculation does not need to be performed again, so that multiple hash calculation caused by re-obtaining the cloud check data from the cloud every time is avoided, and the file scanning efficiency is remarkably improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer network security, and in particular to a file scanning method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, network security threats such as computer viruses and malware are becoming increasingly serious, bringing huge security risks to individual users and enterprises. Related technologies usually outsource virus detection and analysis tasks to cloud servers. Users need to upload the files to be detected to the cloud server, which performs in-depth scanning and analysis and returns the detection results. This process relies on the powerful computing resources and real-time updated virus database of the cloud to effectively identify malicious code.

[0003] However, the traditional cloud query mechanism has significant defects in the file upload process. First, the file upload operation is often time-consuming and occupies a lot of network bandwidth, especially when the file is large or the network conditions are poor, which affects the user experience. Secondly, for querying and obtaining cloud query information in the cloud, each query needs to read the entire file content for hash calculation, which not only consumes the computer's CPU and I / O resources, but also prolongs the file scanning time, thereby affecting the overall performance of the system. Summary of the invention

[0004] The embodiments of the present disclosure provide a file scanning method, device, electronic device and storage medium, aiming to solve the problems existing in the above-mentioned background technology.

[0005] In order to solve the above technical problems, the present disclosure is implemented as follows: In a first aspect, an embodiment of the present disclosure provides a file scanning method, the method comprising: In response to a scan request for a target file, acquiring attribute information of the target file; According to the attribute information, determining whether the target file has been modified; When it is determined that the target file has not been modified, obtaining local cloud query information of the target file from a local cache according to the attribute information; The target file is scanned according to the local cloud query information to obtain a scanning result representing the security status of the target file.

[0006] Optionally, before obtaining the attribute information of the target file in response to the scan request for the target file, the method further includes: In response to a close event for the target file, determining whether the close event corresponds to a close operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud query information of the target file is deleted from the local cache.

[0007] Optionally, before responding to a close event for the target file and determining whether the close event corresponds to a close operation in a write mode, the method further includes: In response to a write event for the target file, obtaining a file name of the target file; Record the file name of the target file into the file list; The determining whether the closing event corresponds to a closing operation in a write mode includes: traversing the file list to check whether the file name of the target file is recorded in the file list; In a case where the file name of the target file is recorded in the file list, determining that the close event corresponds to a close operation in a write mode; In a case where the file name of the target file is not recorded in the file list, it is determined that the close event corresponds to a close operation in a non-write mode.

[0008] Optionally, judging whether the target file has been modified according to the attribute information includes: Parse the attribute information to obtain the file path, file modification time and file size of the target file; Determine a first value corresponding to the attribute information according to the file path, file modification time and file size of the target file; Acquire local attribute information in a local cache corresponding to the attribute information, and determine a second value corresponding to the local attribute information; comparing the first value and the second value; When the first value is not equal to the second value, determining that the target file is modified; When the first value is equal to the second value, it is determined that the target file has not been modified.

[0009] Optionally, the method further comprises: When it is determined that the target file has been modified, obtaining cloud query information of the target file from the server cloud; Based on the cloud query information, construct a corresponding MD5 hash value; The MD5 hash value is written into the local cache as the primary key of the cloud query information.

[0010] Optionally, scanning the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file includes: Determine the characteristic data corresponding to the target file according to the local cloud query information; Matching the characteristic data with a preset virus characteristic library; In the case where the feature data successfully matches the virus feature library, determining the security status of the target file as a malicious status and outputting a corresponding scanning result; In the case that the feature data and the feature library are not successfully matched, the security state of the target file is determined to be a safe state, and a corresponding scanning result is output.

[0011] Optionally, in response to a close event for the target file, determining whether the close event corresponds to a close operation in a write mode includes: Registering a Minifilter filter based on a Windows system, and specifying the target file in the Minifilter filter, wherein the Windows system includes a system kernel layer and an application layer; Responding to the close event through a Minifilter filter located in the system kernel layer, and determining whether the close event corresponds to a close operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, including: when it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, and the closing event is reported to the cache management module located at the application layer, and the cache management module is used to respond to the scan request to perform a file scan on the target file.

[0012] In a second aspect, an embodiment of the present disclosure provides a file scanning device, the device comprising: A response module, configured to obtain attribute information of a target file in response to a scan request for the target file; A judging module, used for judging whether the target file has been modified according to the attribute information; An acquisition module, configured to acquire local cloud query information of the target file from a local cache according to the attribute information when it is determined that the target file has not been modified; The scanning module is used to scan the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file.

[0013] Optionally, the device further comprises: A close response module, configured to respond to a close event for the target file and determine whether the close event corresponds to a close operation in a write mode; A deletion module is used to delete the local cloud query information of the target file from the local cache when it is determined that the closing event corresponds to a closing operation in a write mode.

[0014] Optionally, the device further comprises: A write response module, used for obtaining the file name of the target file in response to a write event for the target file; A recording module, used for recording the file name of the target file into a file list; Optionally, the closing response module includes: A traversal submodule, used for traversing the file list and checking whether the file name of the target file is recorded in the file list; A first closing operation determining submodule, configured to determine, when the file name of the target file is recorded in the file list, that the closing event corresponds to a closing operation in a write mode; The first closing operation determining submodule is used to determine, when the file name of the target file is not recorded in the file list, that the closing event corresponds to a closing operation in a non-writing mode.

[0015] Optionally, the judging module includes: A parsing submodule, used to parse the attribute information to obtain the file path, file modification time and file size of the target file; A first determination submodule, used to determine a first value corresponding to the attribute information according to a file path, a file modification time, and a file size of the target file; A second determination submodule, configured to obtain local attribute information in a local cache corresponding to the attribute information, and determine a second value corresponding to the local attribute information; A comparison submodule, configured to compare the first value with the second value; A third determining submodule, configured to determine that the target file is modified when the first value is not equal to the second value; The fourth determination submodule is used to determine that the target file has not been modified when the first value is equal to the second value.

[0016] Optionally, the device further comprises: A cloud-based cloud query information acquisition module is used to obtain the cloud-based cloud query information of the target file from the server cloud when it is determined that the target file has been modified; A construction module, used to construct a corresponding MD5 hash value based on the cloud query information; The writing module is used to write the MD5 hash value into the local cache as the primary key of the cloud query information.

[0017] Optionally, the scanning module includes: A fifth determination submodule, configured to determine feature data corresponding to the target file based on the local cloud query information; A matching submodule, used for matching the characteristic data with a preset virus characteristic library; a sixth determination submodule, configured to determine the security status of the target file as a malicious status and output a corresponding scanning result when the feature data successfully matches the virus feature library; The seventh determination submodule is used to determine the security status of the target file as a safe status and output a corresponding scanning result when the feature data and the feature library do not match successfully.

[0018] Optionally, the closing response module includes: A registration submodule, used for registering a Minifilter filter based on a Windows system and specifying the target file in the Minifilter filter, wherein the Windows system includes a system kernel layer and an application layer; A kernel layer judgment submodule, used to respond to the closing event through a Minifilter filter located in the kernel layer of the system, and determine whether the closing event corresponds to a closing operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, including: when it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, and the closing event is reported to the cache management module located at the application layer, and the cache management module is used to respond to the scan request to perform a file scan on the target file.

[0019] Optionally, the deletion module includes: The application layer scanning submodule is used to delete the local cloud query information of the target file from the local cache when it is determined that the closing event corresponds to a closing operation in the write mode, and report the closing event to the cache management module located at the application layer. The cache management module is used to respond to the scanning request to perform a file scan on the target file.

[0020] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a processor, a memory, and A computer program stored in the memory and capable of running on the processor implements the steps of a data backup method when the computer program is executed by the processor.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of a data backup method are implemented.

[0022] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects: The present disclosure introduces a local cache mechanism, which can effectively reduce dependence on the cloud. When the file to be detected has not been modified, the cloud query data is directly obtained from the local cache without the need to perform hash calculations again. It not only improves the speed of file scanning, but also reduces the occupation of system resources, ensuring the stability and fluency of the computer when scanning files. It is equivalent to using the cloud and local cache information as two data sources for cloud query information based on judgment conditions, avoiding multiple hash calculations caused by re-obtaining from the cloud each time, significantly improving the efficiency of file scanning, and reducing the consumption of computer CPU and I / O resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a schematic diagram of the steps of a file scanning method provided by an embodiment of the present disclosure; Figure 2 is a flow chart of writing monitoring and closing monitoring in an embodiment of the present disclosure; Figure 3 is a schematic diagram of the process of file scanning in an embodiment of the present disclosure; Figure 4 is a schematic diagram of an application architecture based on a Windows system according to an embodiment of the present disclosure; Figure 5 It is a structural block diagram of a file scanning device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0026] When scanning files for the purpose of virus detection, the related technology mainly relies on cloud-checking technology, which uploads the files to be detected to the cloud for scanning and analysis, usually involving calculating the MD5 hash value of the files, so as to perform feature matching and behavior analysis in the cloud. However, the file upload operation is time-consuming and occupies a large amount of network bandwidth. At the same time, the entire file content needs to be read for hash calculation each time, resulting in a significant increase in the computer's CPU and I / O resource consumption, and prolonged scanning time, thereby affecting user experience and system performance. The present disclosure aims to overcome the above-mentioned defects and proposes an efficient file scanning method. By introducing a local cache mechanism, the cloud and local cache information are used as two data sources, and based on the judgment condition of whether the file has been modified, the cloud-check data can be directly obtained from the local when the file has not been modified, avoiding repeated hash calculations and file uploads.

[0027] Figure 1 FIG. 1 is a schematic diagram of steps of a file scanning method provided by an embodiment of the present disclosure. Figure 1 As shown, the method includes: Step S101: in response to a scan request for a target file, acquiring attribute information of the target file.

[0028] The scan request is an instruction issued by a user or system to perform security detection and analysis on a specific file. The scan request can be initiated from a variety of sources. For example, a user can manually select a target file and request a scan through security software (such as antivirus software). Security software can also perform a comprehensive scan of the target file on a regular basis.

[0029] The attribute information refers to characteristic data related to the target file, which is used to determine the state of the target file and perform subsequent processing. In the embodiment of the present disclosure, the attribute information can be three element information of the target file (file path, file size and file modification time).

[0030] The present disclosure accesses the target file through the file system interface provided by the operating system. In the Windows system, the present disclosure may use functions in the Windows API (such as GetFileAttributesEx) to obtain attribute information of the target file.

[0031] Step S102: determining whether the target file has been modified according to the attribute information.

[0032] The current attribute information of the target file obtained in step S101 is compared with the attribute information previously stored in the local cache to determine whether the target file has been modified. For example, assuming that the attribute information includes a file path, if the file path changes, it means that the file may be moved to another location or renamed, which means that the status of the file has changed, which may be a manual operation by the user, program processing, or malware behavior.

[0033] Step S103, when it is determined that the target file has not been modified, local cloud query information of the target file is obtained from the local cache according to the attribute information.

[0034] When it is confirmed that the target file has not been modified, the file cloud query information of the target file, that is, the local cloud query information, is extracted from the local cache based on the attribute information obtained in step S101. The local cache is a storage mechanism for saving file-related information previously obtained from the cloud query server, which can quickly provide the security status and analysis results of the file without initiating a request to the cloud every time. Compared with the traditional method of calculating the hash value of the file and uploading the file each time, the present disclosure directly accesses the stored information through the local cache to efficiently obtain the file cloud query information.

[0035] Step S104, scanning the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file.

[0036] Analyze and evaluate the target file based on the local cloud query information obtained. After scanning, generate a scan result that represents the security status of the target file. The scan result can include the security status of the target file and a detailed report. The security status is represented by labels such as safe, risky, or malicious, which directly reflects the security of the target file. The detailed report contains information such as the analysis results of the target file, the type of threat detected, and the recommended treatment measures.

[0037] The present disclosure introduces a local cache mechanism, which can effectively reduce dependence on the cloud. When the file to be detected has not been modified, the cloud query data is directly obtained from the local cache without the need to perform hash calculations again. It not only improves the speed of file scanning, but also reduces the occupation of system resources, ensuring the stability and fluency of the computer when scanning files. It is equivalent to using the cloud and local cache information as two data sources for cloud query information based on judgment conditions, avoiding multiple hash calculations caused by re-obtaining from the cloud each time, significantly improving the efficiency of file scanning, and reducing the consumption of computer CPU and I / O resources.

[0038] In an optional implementation, step S103, according to the local cloud query information, scans the target file to obtain a scanning result representing the security status of the target file, which may specifically include the following steps: determining feature data corresponding to the target file according to the local cloud query information; matching the feature data with a preset virus feature library; when the feature data successfully matches the virus feature library, determining the security status of the target file as a malicious state, and outputting the corresponding scanning result; when the feature data does not successfully match the feature library, determining the security status of the target file as a safe state, and outputting the corresponding scanning result.

[0039] When scanning the target file in step S103, feature data of the target file is extracted from the local cache, and the feature data will be used for subsequent virus detection. The virus feature library is a database containing known malware features. Each malware has its own unique feature data (such as hash value, file name, behavior pattern, etc.), which are stored in the virus feature library for fast matching. The extracted feature data is compared with the data in the virus feature library. Specifically, the hash value of the target file is directly compared with the hash value in the virus feature library. In addition to the hash value, matching can also be performed based on other features of the file (such as file name, size, etc.). If the feature data successfully matches an entry in the virus feature library, the security status of the target file will be determined to be "malicious". In other words, the target file is identified as a known malware, and the corresponding scanning results will be output, including the file name, the detected malicious features, and the recommended treatment measures (such as isolation, deletion, etc.). On the contrary, if the feature data fails to match any entry in the virus feature library, the security status of the target file is determined to be "safe", indicating that the target file has not been identified as a known malware.

[0040] In the disclosed embodiment, the virus cloud engine used for file scanning is a cloud computing-based security technology that aims to detect and analyze malware through powerful computing power and a real-time updated virus feature library. Compared with traditional local scanning, the virus cloud engine is able to utilize larger data sets and computing resources to improve detection rates and reduce false alarm rates. It should be noted that if the user wishes to use other engines to achieve file scanning for different purposes, the method of the present disclosure can still be effectively applied. Since the design of this method allows integration with a variety of scanning engines, users can choose the right engine according to their needs, whether it is for specific types of malware detection, behavior analysis, or other security purposes. By adjusting the extraction, matching and processing processes of feature data, users can easily adapt to different scanning engines, thereby implementing personalized security protection strategies while maintaining efficient file scanning performance.

[0041] In an optional implementation, before obtaining the attribute information of the target file in response to the scan request for the target file, the method further includes: Step S201, in response to a close event for the target file, determining whether the close event corresponds to a close operation in a write mode.

[0042] Figure 2 This is a flow chart of writing monitoring and closing monitoring in the embodiment of the present disclosure, please refer to Figure 2 When the user or system performs a closing operation on the target file, the kernel monitoring engine captures the closing event. The closing event refers to the process in which the file is closed after the relevant operations (such as writing, reading, etc.) are performed after it is opened. Determine whether the closing event is caused by the operation in the write mode, specifically including checking the opening mode of the target file and determining whether the target file is opened in the write mode. If the target file is opened in the write mode, then when closing the file, this event needs to be recorded for subsequent processing.

[0043] Step S202, when it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud query information of the target file is deleted from the local cache.

[0044] If the judgment result of step S201 shows that the closing event does correspond to a closing operation in write mode, it is confirmed that the content of the target file may have been modified, so its cloud query information needs to be updated, that is, the local cloud query information of the target file is deleted from the local cache. This ensures that the latest file cloud query information can be obtained during the next file scan, rather than relying on outdated cache data.

[0045] The present disclosure can effectively manage file cloud query information and ensure that the local cache is updated or deleted in time after the file is written. This not only improves the accuracy of file scanning, but also enhances the security of the system and avoids potential risks caused by relying on outdated information.

[0046] In an optional implementation, before responding to a close event for the target file and determining whether the close event corresponds to a close operation in a write mode, the method further includes: Step S301: In response to a write event for the target file, obtain the file name of the target file.

[0047] See also Figure 2 When the target file is written, a write event is captured, which refers to an operation to modify the content of the target file, including adding, deleting or changing data in the file. After capturing the write event, the file name of the target file as the write object is extracted.

[0048] Step S302, recording the file name of the target file into a file list.

[0049] The target file name is recorded in a file list, which is used to track the file currently being written so that it can be searched and judged in subsequent closing events. By maintaining the file list, it is possible to effectively manage and monitor which files have been written recently.

[0050] In an optional implementation, the step S201 determines whether the closing event corresponds to a closing operation in a write mode, including steps S2011 to S2013: Step S2011, traverse the file list to check whether the file name of the target file is recorded in the file list.

[0051] When a close event is captured, the file list recorded above is traversed to check whether the target file's file name exists in the list. If the target file's file name is found in the file list, it means that the target file has undergone a write operation before being closed.

[0052] Step S2012: when the file name of the target file is recorded in the file list, determining that the close event corresponds to a close operation in a write mode.

[0053] If it is checked that the file name of the target file is recorded in the file list, it will be determined that the closing event corresponds to a closing operation in write mode, that is, the target file is written before closing, indicating that the content may have been modified.

[0054] Step S2013: if the file name of the target file is not recorded in the file list, determine that the close event corresponds to a close operation in a non-write mode.

[0055] On the contrary, if the target file name is not found, it will be determined that the closing event corresponds to a closing operation in non-write mode, that is, the target file did not undergo a write operation when it was closed, and the content remains unchanged. At this time, no operation is performed and the local cloud query information will not be deleted, because the content of the target file has not changed and the previous local cloud query information is still valid.

[0056] The present disclosure can effectively monitor the writing and closing events of files, ensuring that the local cache is updated or deleted in time after the file undergoes a writing operation, improving the accuracy of file scanning, ensuring that users can obtain the latest security information, and thus better protecting the system from potential security threats.

[0057] In an optional embodiment, judging whether the target file has been modified based on the attribute information includes: parsing the attribute information to obtain the file path, file modification time and file size of the target file; determining a first value corresponding to the attribute information based on the file path, file modification time and file size of the target file; obtaining local attribute information corresponding to the attribute information in a local cache, and determining a second value corresponding to the local attribute information; comparing the first value and the second value; if the first value is not equal to the second value, determining that the target file has been modified; if the first value is equal to the second value, determining that the target file has not been modified.

[0058] In step S102, first, the attribute information obtained from the target file is parsed, and the attribute information includes the file path, the file modification time and the file size, that is, the three elements of the target file. Among them, the file path is the complete path of the target file in the file system. The file modification time is the timestamp of the last modification of the target file. The file size is the byte size of the file.

[0059] According to the extracted file path, file modification time and file size, the three elements are combined into a unique identifier, which is a first value. The first value can be a hash value or other form of combined value to ensure that the current state of the target file can be uniquely identified.

[0060] Get the local attribute information of the target file from the local cache. The local attribute information has been stored when the target file was last scanned, and also contains three elements of information: file path, file modification time, and file size. Similar to the first value, the second value is generated using the local attribute information, which is also based on a combination of the file path, file modification time, and file size. Compare the first value and the second value to determine the status of the file. If the first value is not equal to the second value, it is determined that the target file has been modified, which means that at least one of the file's path, modification time, or size has changed, indicating that the file content may have been changed. If the first value is equal to the second value, it is determined that the target file has not been modified, indicating that the status of the target file remains unchanged, and the previous cloud query information is still valid.

[0061] Through the above steps, it is possible to effectively determine whether the target file has been modified. When scanning files, the status of the file can be accurately identified, so as to determine whether it is necessary to update the cloud check information or conduct further security checks, so as to provide users with more reliable file security detection services.

[0062] Figure 3 This is a schematic diagram of the process of file scanning in the embodiment of the present disclosure. Figure 3The ideas provided by the above-mentioned embodiments of the present disclosure are summarized. At the starting point of the process, prepare to perform a file scanning operation on the target file. Specify the target file and extract attribute information from the target file. Check the attribute information of the target file to determine whether the file has been modified. If the judgment result is "no" (that is, the file has not been modified), the cloud-based cloud query information of the target file will be directly obtained from the cloud server, that is, the cloud-based cloud query information of the file previously stored in the cloud will be used for quick query. If the judgment result is "yes" (that is, the file has been modified), after analyzing the cloud query information, delete the locally cached local cloud query information to avoid using outdated or inaccurate information. Based on the acquired cloud query information, detect the security status of the target file, and output the scan results to the user end. After completing the file scanning operation, the user can take corresponding measures based on the output scan results.

[0063] In an optional embodiment, the method also includes: when it is determined that the target file has been modified, obtaining cloud-based cloud query information of the target file from the server cloud; constructing a corresponding MD5 hash value based on the cloud-based cloud query information; and writing the MD5 hash value as the primary key of the cloud-based cloud query information into the local cache.

[0064] The cloud-based cloud-based information refers to the file cloud-based information obtained from the cloud. In this embodiment, the cloud-based cloud-based information is only used as a form of distinction from the local cloud-based information. In essence, it is the same as the local cloud-based information as the file cloud-based information. For ease of understanding, the following description is given here with examples of the situation where the cloud-based file cloud-based information is obtained. Suppose that the attribute information of the target file (for example, C:\Documents\example.txt) is monitored to have changed. Since the file has been modified, the latest cloud-based information needs to be obtained. Send a request to the cloud-based server to inquire about the latest security information about example.txt. The information returned by the cloud-based server may include the security status of the file (for example, safe, risky, or malicious), the MD5 hash value of the file (for example, d41d8cd98f00b204e9800998ecf8427e), or other relevant detection reports or information.

[0065] After obtaining the cloud query information, use the returned file content (or the current content of the file) to generate a new MD5 hash value. Assuming the file content is "Hello World", calculate the MD5 hash value of this content and get a new hash value (for example, fc3ff98e8c6a0d3087d515c0473f8677). The MD5 hash value will be used as the unique identifier of the file for subsequent security checks and comparisons. The newly generated MD5 hash value is used as the primary key and stored in the local cache together with the cloud query information. The local cache structure can be as follows: plaintext { "C:\\Documents\\example.txt": { "MD5": "fc3ff98e8c6a0d3087d515c0473f8677", "status": "Safe", "lastChecked": "2023-10-01 12:00:00" } } Through the above steps, when a file is modified, the latest cloud query information is obtained in time and stored in the local cache, ensuring that the latest information can be quickly accessed during the next scan, thereby improving the efficiency and accuracy of file scanning.

[0066] In an optional implementation, in response to a close event for the target file, determining whether the close event corresponds to a close operation in a write mode includes: registering a Minifilter filter based on a Windows system, and specifying the target file in the Minifilter filter, wherein the Windows system includes a system kernel layer and an application layer; responding to the close event through a Minifilter filter located in the system kernel layer, and determining whether the close event corresponds to a close operation in a write mode; Figure 4 is a schematic diagram of the application architecture of the embodiment of the present disclosure based on the Windows system, such as Figure 4 As shown, Minifilter is a filter driver framework provided by the Windows operating system, which allows developers to monitor, modify and intercept I / O operations at the file system level, including the system kernel layer and the application layer. It can operate between the kernel layer and the application layer, providing flexible file system control capabilities. In this disclosure, the Minifilter driver is responsible for registering and managing filters and capturing file I / O operations. The system kernel layer is responsible for responding to shutdown events and making status judgments. The application layer processing module performs corresponding operations (such as updating caches, recording logs, etc.) based on the judgment results.

[0067] During system initialization, developers need to write code to register a Minifilter filter. This process involves the following steps: defining the name and type of the filter, specifying the file system volume to be monitored (for example, the C: drive), registering the filter and connecting it to the operating system's file system driver.

[0068] When registering a Minifilter filter, the developer can specify the target file to be monitored (for example, C:\Documents\example.txt). In other words, the filter will specifically monitor all I / O operations related to the target file. In file operations, when the application completes writing or reading a file, it calls a close operation to release file resources. Minifilter filters are able to capture and respond to these close events. The Minifilter in the system kernel layer receives all I / O requests related to the specified file, including close requests.

[0069] When the Minifilter captures a close event, it determines whether the close event corresponds to a close operation in write mode. Specifically, when the file is written, the Minifilter can record the written file name and status in the PreOperation callback function of the IRP_MJ_WRITE (write request) operation. When the IRP_MJ_CLOSE (close request) operation is captured, the Minifilter checks in the PostOperation callback function whether the close event corresponds to the previously recorded write operation. If the file name corresponding to the close event is in the previously recorded write operation list, it can be determined that this is a close operation in write mode; otherwise, it can be determined as a close operation in non-write mode.

[0070] For example, suppose an application opens the C:\Documents\example.txt file for writing. During the write operation, the Minifilter records the status of the target file. When the application completes the write and closes the file, the Minifilter captures the close event and checks the status of the target file. If example.txt is found in the previous write record, the close event is determined to be a close operation in write mode; if not found, it is determined to be another type of close operation (for example, close in read mode).

[0071] In an optional embodiment, when it is determined that the close event corresponds to a close operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, including: when it is determined that the close event corresponds to a close operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, and the close event is reported to a cache management module located at the application layer, and the cache management module is used to respond to the scan request to perform a file scan on the target file.

[0072] During the file operation, the closing event monitored by the Windows system through the Minifilter filter is judged as a closing operation in write mode. At this time, the local cloud query information of the target file is deleted from the local cache.

[0073] Assume that the following information is stored in the local cache: plaintext { "C:\\Documents\\example.txt": { "MD5": "d41d8cd98f00b204e9800998ecf8427e", "status": "Safe", "lastChecked": "2023-10-01 12:00:00" } }When the close event is judged as a close operation in write mode, the local cloud query information of C:\\Documents\\example.txt will be deleted, and the updated cache will become empty or no longer contain the information of the target file. After the deletion operation is completed, the close event and its related information (for example, file name, operation type, etc.) will be reported to the cache management module at the application layer, which is responsible for handling cache management and responding to scan requests. The cache management module at the application layer will receive notification of the close event and can perform subsequent operations as needed, including updating the cache status, recording logs, and preparing new scan requests for the target file. When a new scan request arrives, the cache management module will check whether the target file cloud query information exists in the local cache. If the local cloud query information of the target file has been deleted, the cache management module will trigger a new cloud query process. The Windows system will initiate a request to the cloud query server to obtain the latest cloud query information to ensure that the target file can be accurately checked for security.

[0074] Figure 5 is a structural block diagram of a file scanning device provided by an embodiment of the present disclosure, such as Figure 5 As shown, the device comprises: A response module 401 is used to obtain attribute information of a target file in response to a scan request for the target file; A judging module 402, configured to judge whether the target file has been modified according to the attribute information; The acquisition module 403 is used to acquire the local cloud query information of the target file from the local cache according to the attribute information when it is determined that the target file has not been modified; The scanning module 404 is used to scan the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file.

[0075] In an optional embodiment, the device further comprises: A close response module, configured to respond to a close event for the target file and determine whether the close event corresponds to a close operation in a write mode; A deletion module is used to delete the local cloud query information of the target file from the local cache when it is determined that the closing event corresponds to a closing operation in a write mode.

[0076] In an optional embodiment, the device further comprises: A write response module, used for obtaining the file name of the target file in response to a write event for the target file; A recording module, used for recording the file name of the target file into a file list; In an optional implementation, the closing response module includes: A traversal submodule, used for traversing the file list and checking whether the file name of the target file is recorded in the file list; A first closing operation determining submodule, configured to determine, when the file name of the target file is recorded in the file list, that the closing event corresponds to a closing operation in a write mode; The first closing operation determining submodule is used to determine, when the file name of the target file is not recorded in the file list, that the closing event corresponds to a closing operation in a non-writing mode.

[0077] In an optional implementation, the judgment module includes: A parsing submodule, used to parse the attribute information to obtain the file path, file modification time and file size of the target file; A first determination submodule, used to determine a first value corresponding to the attribute information according to a file path, a file modification time, and a file size of the target file; A second determination submodule, configured to obtain local attribute information in a local cache corresponding to the attribute information, and determine a second value corresponding to the local attribute information; A comparison submodule, configured to compare the first value with the second value; A third determining submodule, configured to determine that the target file is modified when the first value is not equal to the second value; The fourth determination submodule is used to determine that the target file has not been modified when the first value is equal to the second value.

[0078] In an optional embodiment, the device further comprises: A cloud-based cloud query information acquisition module is used to obtain the cloud-based cloud query information of the target file from the server cloud when it is determined that the target file has been modified; A construction module, used to construct a corresponding MD5 hash value based on the cloud query information; The writing module is used to write the MD5 hash value into the local cache as the primary key of the cloud query information.

[0079] In an optional implementation, the scanning module includes: A fifth determination submodule, configured to determine feature data corresponding to the target file based on the local cloud query information; A matching submodule, used for matching the characteristic data with a preset virus characteristic library; a sixth determination submodule, configured to determine the security status of the target file as a malicious status and output a corresponding scanning result when the feature data successfully matches the virus feature library; The seventh determination submodule is used to determine the security status of the target file as a safe status and output a corresponding scanning result when the feature data and the feature library do not match successfully.

[0080] In an optional implementation, the closing response module includes: A registration submodule, used for registering a Minifilter filter based on a Windows system and specifying the target file in the Minifilter filter, wherein the Windows system includes a system kernel layer and an application layer; A kernel layer judgment submodule, used to respond to the closing event through a Minifilter filter located in the kernel layer of the system, and determine whether the closing event corresponds to a closing operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, including: when it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, and the closing event is reported to the cache management module located at the application layer, and the cache management module is used to respond to the scan request to perform a file scan on the target file.

[0081] In an optional implementation, the deletion module includes: The application layer scanning submodule is used to delete the local cloud query information of the target file from the local cache when it is determined that the closing event corresponds to a closing operation in the write mode, and report the closing event to the cache management module located at the application layer. The cache management module is used to respond to the scanning request to perform a file scan on the target file.

[0082] An embodiment of the present disclosure also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes in the above-mentioned file scanning method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0083] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process in the above-mentioned file scanning method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referred to each other.

[0084] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, devices, electronic devices, and storage media. Therefore, the embodiments of the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] The embodiments of the present disclosure are described with reference to the flowcharts and / or block diagrams of the methods and devices according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded into a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0086] Although the preferred embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present disclosure.

[0087] Finally, it should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "include..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements. The above is a detailed introduction to a file scanning method, device, electronic device and storage medium provided by the present disclosure. The principle and implementation method of the present disclosure are explained in this article using specific examples. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present disclosure; at the same time, for those of ordinary skill in the art, according to the idea of ​​the present disclosure, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present disclosure.

Claims

1. A file scanning method, characterized in that: The method comprises: In response to a scan request for a target file, acquiring attribute information of the target file; According to the attribute information, determining whether the target file has been modified; When it is determined that the target file has not been modified, obtaining local cloud query information of the target file from a local cache according to the attribute information; The target file is scanned according to the local cloud query information to obtain a scanning result representing the security status of the target file.

2. The method according to claim 1, characterized in that Before obtaining the attribute information of the target file in response to the scanning request for the target file, the method further includes: In response to a close event for the target file, determining whether the close event corresponds to a close operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud query information of the target file is deleted from the local cache.

3. The method according to claim 2, characterized in that In response to a close event for the target file, before determining whether the close event corresponds to a close operation in a write mode, the method further includes: In response to a write event for the target file, obtaining a file name of the target file; Record the file name of the target file into the file list; The determining whether the closing event corresponds to a closing operation in a write mode includes: traversing the file list to check whether the file name of the target file is recorded in the file list; In a case where the file name of the target file is recorded in the file list, determining that the close event corresponds to a close operation in a write mode; In a case where the file name of the target file is not recorded in the file list, it is determined that the close event corresponds to a close operation in a non-write mode.

4. The method according to claim 1, characterized in that: The determining, according to the attribute information, whether the target file has been modified includes: Parse the attribute information to obtain the file path, file modification time and file size of the target file; Determine a first value corresponding to the attribute information according to the file path, file modification time and file size of the target file; Acquire local attribute information in a local cache corresponding to the attribute information, and determine a second value corresponding to the local attribute information; comparing the first value and the second value; When the first value is not equal to the second value, determining that the target file is modified; When the first value is equal to the second value, it is determined that the target file has not been modified.

5. The method according to claim 1, characterized in that The method further comprises: When it is determined that the target file has been modified, obtaining cloud query information of the target file from the server cloud; Based on the cloud query information, construct a corresponding MD5 hash value; The MD5 hash value is written into the local cache as the primary key of the cloud query information.

6. The method according to claim 1, characterized in that Scanning the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file includes: Determine the characteristic data corresponding to the target file according to the local cloud query information; Matching the characteristic data with a preset virus characteristic library; In the case where the feature data successfully matches the virus feature library, determining the security status of the target file as a malicious status and outputting a corresponding scanning result; In the case that the feature data and the feature library are not successfully matched, the security state of the target file is determined to be a safe state, and a corresponding scanning result is output.

7. The method according to claim 2, characterized in that: The step of responding to a close event for the target file and determining whether the close event corresponds to a close operation in a write mode includes: Registering a Minifilter filter based on a Windows system, and specifying the target file in the Minifilter filter, wherein the Windows system includes a system kernel layer and an application layer; Responding to the close event through a Minifilter filter located in the system kernel layer, and determining whether the close event corresponds to a close operation in a write mode; When it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, including: when it is determined that the closing event corresponds to a closing operation in a write mode, the local cloud lookup information of the target file is deleted from the local cache, and the closing event is reported to the cache management module located at the application layer, and the cache management module is used to respond to the scan request to perform a file scan on the target file.

8. A document scanning device, characterized in that: The device comprises: A response module, configured to obtain attribute information of a target file in response to a scan request for the target file; A judging module, used for judging whether the target file has been modified according to the attribute information; An acquisition module, configured to acquire local cloud query information of the target file from a local cache according to the attribute information when it is determined that the target file has not been modified; The scanning module is used to scan the target file according to the local cloud query information to obtain a scanning result representing the security status of the target file.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images