Terminal shared directory construction method and device, equipment, medium and program product

Abstract

The embodiment of the invention provides a terminal shared directory construction method and device, equipment, a medium and a program product, and relates to the field of financial science and technology or other related fields. The method comprises the steps that a client side responds to user operation, obtains a terminal shared directory construction request, and carries out virus detection and sensitive information detection on shared resources to obtain a detection result. If the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result to a server, the server determines whether the terminal shared directory construction request is passed or not according to the terminal shared directory construction request and the sensitive information detection result, and if the terminal shared directory construction request is passed, the client sends the terminal shared directory construction request to the server; and if yes, the server constructs a terminal shared directory corresponding to the terminal shared directory construction request, so that the security of the terminal shared directory is improved.

Description

Technical Field

[0001] The present application relates to the field of financial technology or other related fields, and in particular to a method, device, equipment, medium and program product for constructing a terminal shared directory. Background Art

[0002] At present, resource sharing through terminal shared directories has been widely used in various industries. For systems using terminal shared directories, when a terminal in the system is attacked by a virus, the virus file may spread horizontally through the terminal shared directory, so that other terminals in the system are also attacked by the virus. However, the current control of terminal shared directories by disabling shared ports and services cannot meet the needs of users, so the terminal shared directories currently constructed have the problem of low security.

[0003] Therefore, how to improve the security of terminal shared directories is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a terminal shared directory construction method, device, equipment, medium and program product to solve the technical problem of low security of terminal shared directories.

[0005] In a first aspect, the present application provides a method for constructing a terminal shared directory, comprising:

[0006] In response to a user operation, obtaining a terminal shared directory construction request, wherein the terminal shared directory construction request includes shared resources and sharing permissions, wherein the sharing permissions include sharing user permissions, sharing resource operation permissions, and sharing time permissions;

[0007] Perform virus detection and sensitive information detection on the shared resource to obtain detection results, wherein the detection results include virus detection results and sensitive information detection results;

[0008] If the virus detection result is passed, the terminal shared directory construction request and the sensitive information detection result are uploaded to the server, so that the server builds a terminal shared directory according to the terminal shared directory construction request and the sensitive information detection result.

[0009] In a second aspect, the present application provides a method for constructing a terminal shared directory, comprising:

[0010] Receive a terminal shared directory construction request sent by a client, and a sensitive information detection result of a shared resource corresponding to the terminal shared directory construction request;

[0011] Determining whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result;

[0012] If passed, a terminal shared directory corresponding to the terminal shared directory construction request is constructed.

[0013] In a third aspect, the present application provides a terminal shared directory construction device, comprising:

[0014] An acquisition module, configured to acquire a terminal shared directory construction request in response to a user operation, wherein the terminal shared directory construction request includes shared resources and shared permissions, and the shared permissions include shared user permissions, shared resource operation permissions, and shared time permissions;

[0015] A processing module, used to perform virus detection and sensitive information detection on the shared resource to obtain detection results, wherein the detection results include virus detection results and sensitive information detection results;

[0016] The transceiver module is used to upload the terminal shared directory construction request and the sensitive information detection result to the server if the virus detection result is passed, so that the server can build a terminal shared directory according to the terminal shared directory construction request and the sensitive information detection result.

[0017] In a fourth aspect, the present application provides a terminal shared directory construction device, including:

[0018] A transceiver module, used for receiving a terminal shared directory construction request sent by a client, and a sensitive information detection result of a shared resource corresponding to the terminal shared directory construction request;

[0019] A processing module, configured to determine whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result;

[0020] The control module is used to construct a terminal shared directory corresponding to the terminal shared directory construction request if passed.

[0021] In a fifth aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0022] The memory stores computer-executable instructions;

[0023] The processor executes the computer-executable instructions stored in the memory to implement the method as described in the first aspect or the second aspect.

[0024] In a sixth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method as described in the first aspect or the second aspect.

[0025] In a seventh aspect, the present application provides a computer program product, which, when executed by a processor, is used to implement the method as described in the first aspect or the second aspect.

[0026] The terminal shared directory construction method, device, equipment, medium and program product provided by the present application, the client obtains the terminal shared directory construction request in response to the user operation, and the client performs virus detection and sensitive information detection on the shared resource to obtain the detection result. If the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result to the server, and the server determines whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result. If passed, the server constructs the terminal shared directory corresponding to the terminal shared directory construction request, thereby improving the security of the terminal shared directory. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0028] Figure 1 A schematic diagram of a scenario of a method for constructing a terminal shared directory provided in an embodiment of the present application;

[0029] Figure 2 A schematic diagram of a process for constructing a terminal shared directory provided in an embodiment of the present application;

[0030] Figure 3 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application;

[0032] Figure 5 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application;

[0033] Figure 6 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the structure of a terminal shared directory construction device provided in an embodiment of the present application;

[0035] Figure 8 A schematic diagram of the structure of another terminal shared directory construction device provided in an embodiment of the present application;

[0036] Fig. 9A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0037] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0038] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0039] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0040] In addition, this application involves conducting big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.

[0041] It should be noted that the terminal shared directory construction method, device, equipment, medium and program product provided in this application can be used in the field of financial technology or other fields, and can also be used in any field other than the field of financial technology or other fields. The application field of the terminal shared directory construction method, device, equipment, medium and program product in this application is not limited.

[0042] Currently, the shared directory function provides great convenience for transferring files between computers, and users have many usage needs. The existing and simple disabling of shared ports and services cannot meet the needs of users. Therefore, when opening a terminal shared directory, it is impossible to control the user scope and duration of the terminal shared directory, and it is also impossible to monitor the sensitivity and security of the content of the transferred files.

[0043] Therefore, how to improve the security of terminal shared directories is an urgent problem to be solved.

[0044] Figure 1 A schematic diagram of a scenario of a terminal shared directory construction method provided in an embodiment of the present application. Figure 1 As shown, the scenario includes: a server and a client.

[0045] The server is a terminal shared directory management server, which can be a terminal device with data processing functions, such as a computer, mobile phone and other computing devices with computing functions, or a server of a bank system, etc. The client can be a terminal device such as a computer, mobile phone, counter machine, etc., or an application or software running on these terminal devices.

[0046] The client can send a terminal shared directory construction request to the server according to the user's operation. The server reviews the terminal shared directory construction request and builds the terminal shared directory according to the review result of the terminal shared directory construction request, so that the server can share resources with other servers through the terminal shared directory.

[0047] In view of this, the present application provides a terminal shared directory construction method, in which the client obtains a terminal shared directory construction request in response to a user operation, and the client performs virus detection and sensitive information detection on the shared resources to obtain the detection result. If the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result to the server, and the server determines whether the terminal shared directory construction request is passed based on the terminal shared directory construction request and the sensitive information detection result. If passed, the server constructs a terminal shared directory corresponding to the terminal shared directory construction request, thereby improving the security of the terminal shared directory.

[0048] The execution subject of the terminal shared directory construction method provided in this application includes Figure 1 The server and client mentioned in the above, or the software or program code on the server and client that implements the terminal shared directory construction method.

[0049] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0050] Figure 2 A schematic diagram of a method for constructing a terminal shared directory provided in an embodiment of the present application. Figure 2 As shown, the method may include:

[0051] S201: The client obtains a terminal shared directory construction request in response to a user operation.

[0052] The terminal shared directory construction request includes shared resources and shared permissions. The shared permissions include shared user permissions, shared resource operation permissions, and shared time permissions. Shared resources are the content that users want to share in the terminal shared directory, which can be data resources such as files and folders. Sharing permissions include shared user permissions (i.e., which users can access shared resources), shared resource operation permissions (such as permissions for operations such as read, write, and delete), and shared time permissions (i.e., the effective time period of sharing).

[0053] Specifically, on the user interface of the client, the user can instruct the client to obtain or generate a terminal shared directory construction request through a specific operation (such as clicking a shared directory creation button and making relevant settings). For example, the client can construct a terminal shared directory construction request based on the shared resource information entered by the user on the interface (such as selecting the file or folder path to be shared through a file selector) and the set sharing permission information (such as selecting a sharing user, setting operation permissions, specifying a sharing time period, etc.).

[0054] Optionally, the client can restrict users to only select specific files for resource sharing, or restrict users to which files they cannot share resources (for example, limiting the sharing of system disks). The client can restrict sharing users, for example, limiting the sharing of files to everyone, or limiting the selection of specific users as sharing users.

[0055] Optionally, the sharing time permission may include a sharing start time and a sharing end time. When the sharing end time is reached, the terminal sharing directory is automatically closed.

[0056] Optionally, after the shared resource is selected, the client can restrict the creation, modification, deletion and other operations of the shared resource during the process of building the terminal shared directory.

[0057] S202: The client performs virus detection and sensitive information detection on the shared resources to obtain detection results.

[0058] The detection results include virus detection results and sensitive information detection results. Virus detection is used to check whether there are known virus programs or malicious codes in shared resources to prevent sharing of viruses and improve the security of terminal shared directories. Sensitive information detection is used to check whether shared resources contain sensitive content, such as personal privacy information, commercial secrets, or sensitive information customized according to actual needs.

[0059] In a possible implementation, the client can perform virus detection and sensitive information detection at the same time, and obtain the detection result of the shared resource according to the detection results of the virus detection and the sensitive information detection.

[0060] In another possible implementation, the client may first perform a virus detection. If the virus detection result indicates that there is no virus in the shared resource, the client may further perform a sensitive information detection to obtain a sensitive information detection result.

[0061] Specifically, virus detection can detect shared resources based on at least one of virus genes, virus feature information, virus behavior patterns, etc. For example, a matching score between the shared resource and at least one of virus genes, virus feature information, virus behavior patterns, etc. can be obtained by similarity matching, and then the virus detection result is determined based on the matching score.

[0062] Sensitive information detection can scan the file content in the shared resource word by word based on the sensitive information word library containing common sensitive information words (such as strings in the format of identity card numbers, strings in the format of bank card numbers, names of confidential projects within the company, etc.) to determine whether there is sensitive information, sensitive fields, etc., and use the matched sensitive information, sensitive fields, etc. as the sensitive information detection result. If no sensitive information, sensitive fields, etc. are matched, the sensitive information detection result can be specified content (such as specified indicators, logos, etc.) to prompt the server that there is no sensitive information in the shared resource.

[0063] S203: If the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result to the server.

[0064] Correspondingly, the server receives the terminal shared directory construction request sent by the client, and the sensitive information detection result of the shared resource corresponding to the terminal shared directory construction request.

[0065] If the virus detection result is that there is no virus, the virus detection result is considered to be passed. When the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result (including the detected sensitive information, sensitive fields, etc.) to the server through the connection between the client and the server, so that the server receives the terminal shared directory construction request and the sensitive information detection result sent by the client.

[0066] S204: The server determines whether the terminal shared directory construction request is approved according to the terminal shared directory construction request and the sensitive information detection result.

[0067] Specifically, the server may review the shared resources, shared permissions, and sensitive information detection results to determine whether the terminal shared directory construction request is valid based on the review results.

[0068] For shared resources, the server can review whether the shared resources are allowed to be shared (for example, determined by resource identifiers, resource types, etc.). Exemplarily, the server can maintain a whitelist of resource identifiers that are allowed to be shared. When receiving a shared resource in a terminal shared directory construction request, the server first extracts the identifier of the shared resource (for example, for a file resource, it can be a unique identifier of the file, such as a hash value or a specific file number). Then, the identifier is compared with the identifiers in the whitelist. If the identifier is in the whitelist, it means that the shared resource is allowed to be shared; if it is not in the whitelist, the review fails.

[0069] For sharing permissions, the server can review whether each specified sharing user in the sharing user permissions is in the legal user list. If any specified sharing user is not in the legal user list, the sharing user permissions will not be reviewed. The server can also review based on the permission scope of different shared resources. For example, for ordinary shared resources, only read and write operations are allowed, and execution operations are not allowed (if the shared resource is an executable file). Check whether the shared resource operation permission settings in the terminal shared directory construction request meet this specification. If not, the review will not pass. The server can also review whether the sharing time permissions conflict with the server's resource management policy. For example, the server may maintain or back up resources within a specific time period, and new sharing settings are not allowed during this time period. If the sharing time permissions conflict with this maintenance or backup time period, the review will not pass.

[0070] For sensitive information detection results, the server can, for example, review them based on the number and content of sensitive words / sensitive fields included. For example, if the number of sensitive words / sensitive fields is greater than or equal to the preset number, the review will fail; or if the content of sensitive words / sensitive fields includes preset sensitive words (such as high-risk sensitive words), the review will fail, etc.

[0071] S205: If approved, the server constructs a terminal shared directory corresponding to the terminal shared directory construction request.

[0072] Specifically, the server can create a new directory in the server's file system based on the shared resource information in the terminal's shared directory construction request (for example, create a subdirectory named after the shared resource name under a specific shared directory root path). Then, based on the shared user permissions in the shared permissions, grant access rights to the newly created directory to the specified user in the server's user permission management system (such as read, write, delete, etc., corresponding to the file system's operation permissions). Based on the shared time permissions, set a timer or use the server's time management module to record the start time and end time of the sharing, and automatically cancel the sharing or adjust the user permissions when the end time is reached.

[0073] In the terminal shared directory construction method provided in the embodiment of the present application, the client obtains a terminal shared directory construction request in response to a user operation, and the client performs virus detection and sensitive information detection on the shared resources to obtain the detection result. If the virus detection result is passed, the client uploads the terminal shared directory construction request and the sensitive information detection result to the server, and the server determines whether the terminal shared directory construction request is passed based on the terminal shared directory construction request and the sensitive information detection result. If passed, the server constructs a terminal shared directory corresponding to the terminal shared directory construction request, thereby improving the security of the terminal shared directory.

[0074] Next, how to perform virus detection and sensitive information detection on the shared resources and obtain the detection results in the aforementioned step S202 is described in detail. Figure 3 A flowchart of another method for constructing a terminal shared directory provided in an embodiment of the present application. Figure 3 As shown, the aforementioned step S202 may specifically include:

[0075] S301: The client performs virus detection on a shared resource and obtains a virus detection result.

[0076] If the virus detection result indicates that there is no virus in the shared resource, step S302 is executed; if the virus detection result indicates that there is a virus in the shared resource, step S304 can be optionally executed.

[0077] In a possible implementation, the files in the shared resource are matched according to the virus gene of the known virus and / or the virus characteristic information of the known virus, so as to realize virus detection. According to the matching result, it is determined whether there is a virus in the shared resource.

[0078] Another possible implementation is to match files in the shared resource according to historical behavior information of the shared resource and predefined virus behavior patterns to implement virus detection, and determine whether there is a virus in the shared resource according to the matching result.

[0079] Another possible implementation method is to perform virus detection on shared resources in combination with virus genes, virus feature information, and virus behavior patterns to obtain virus detection results.

[0080] S302: The client performs sensitive information detection on the shared resources and obtains sensitive information detection results.

[0081] Sensitive information detection can scan the file content in the shared resource word by word based on a sensitive information word library that contains common sensitive information words (such as strings in the format of identity card numbers, strings in the format of bank card numbers, names of confidential projects within the company, etc.) to determine whether there is sensitive information, sensitive fields, etc., and use the matched sensitive information, sensitive fields, etc. as the sensitive information detection result. If no sensitive information, sensitive fields, etc. are matched, the sensitive information detection result can be specified content (such as specified indicators, logos, etc.) to prompt the server that there is no sensitive information in the shared resource.

[0082] S303: The client generates a detection result based on the virus detection result and the sensitive information detection result.

[0083] The virus detection results and the sensitive information detection results are comprehensively considered to generate the detection results. For example, the virus detection results and the sensitive information detection results can be directly combined into the detection results. Alternatively, the detection scores can be determined according to the virus detection results and the sensitive information detection results, respectively, and the detection results can be generated according to the two detection scores, and the detection results can be expressed as the detection scores, etc.

[0084] S304: The client blocks network communications and isolates resources containing viruses.

[0085] Specifically, the client's network communication can be immediately blocked, and the resources containing the virus can be isolated (for example, transferred to a sandbox) to reduce the risk of the virus spreading.

[0086] S305: The client outputs a warning prompt.

[0087] The warning prompt is used to prompt that a virus exists in a shared resource, for example, "A virus exists in XX resource, please handle it in time".

[0088] The warning prompt may be output through a push message in the client, or the user may be reminded through text messages, phone calls, etc., and this application does not impose any restrictions on this.

[0089] In the terminal shared directory construction method provided in the embodiment of the present application, the client performs virus detection on the shared resources to obtain the virus detection result. If the virus detection result indicates that there is no virus in the shared resources, the client performs sensitive information detection on the shared resources to obtain the sensitive information detection result. The client generates a detection result based on the virus detection result and the sensitive information detection result, thereby improving the security of the terminal shared directory.

[0090] The following is an example of how to detect viruses by matching files in shared resources based on virus genes of known viruses and / or virus feature information of known viruses. Figure 4 A flowchart of another method for constructing a terminal shared directory provided in an embodiment of the present application is shown below. Figure 4 As shown, the aforementioned step S301 may specifically include:

[0091] S401: The client parses a shared resource to obtain the file content of the file included in the shared resource.

[0092] Specifically, for each file in the shared resource, the client can first determine the file type. Different parsing methods are determined according to different file types to obtain the file content. For example, if the file is a text file (such as .txt, .docx, etc.), the file can be opened directly in text reading mode, and the file content can be read line by line according to the corresponding encoding format (such as UTF-8, etc.), and all the read line contents can be combined as the file content. If the file is a binary file (such as .exe, .jpg, etc.), the file can be opened in binary reading mode. If it is an executable file, it can be parsed according to the format specification of the executable file (such as the PE format under Windows), and the file header, code segment, data segment and other parts of the content can be read.

[0093] S402: The client obtains virus genes of known viruses and / or virus feature information of known viruses.

[0094] Virus genes refer to unique code fragments in virus programs that can be used to accurately identify viruses. Virus signature information includes some specific attributes of the virus, such as file size ranges, specific byte sequences, certain function call patterns, etc. This information helps determine whether a file is infected by a virus.

[0095] The virus genes of known viruses and / or the virus feature information of known viruses can be obtained from the constructed virus library. For virus genes, the client reads the predefined virus gene code fragments corresponding to each known virus from the virus library. These fragments are analyzed and determined by security researchers and can uniquely identify the partial code of the virus. For virus feature information, the client can read various feature information of each known virus stored in the virus library. For example, for some viruses, their feature information may be a specific byte sequence at a specific offset position of the file, and the client can accurately obtain these byte sequences; for other viruses, it may be a specific function call sequence during the execution process, and the client can also read out this call sequence information.

[0096] S403: The client matches the file content with virus genes of known viruses and / or virus feature information of known viruses to obtain a first matching score.

[0097] If matching with virus genes, an exact matching algorithm can be used. For each code segment extracted from the shared resource file content (for executable files), the client compares it byte by byte with the virus gene code fragment of the known virus. If the number of identical bytes reaches a certain proportion of the total number of bytes of the virus gene code fragment (for example, 80%), the corresponding score (such as 0.8) is determined.

[0098] For matching with virus feature information, for example, taking byte sequence features as an example, the client can search the file content for parts that are identical to known virus feature byte sequences. Calculate the ratio of the number of matched bytes to the total number of bytes in the file. For example, if the number of matched bytes is 100 and the total number of bytes in the file is 1000, the ratio is 0.1. A score is obtained based on the predefined mapping relationship (e.g., when the ratio is 0.1, the corresponding score is 0.1). Taking complex features such as function call patterns as an example, the client can analyze the function call logic in the file content and compare it with the function call patterns of known viruses, and determine the score based on the degree of similarity of the comparison (e.g., complete similarity, partial similarity, etc.).

[0099] Finally, the score obtained by matching the virus gene and the score obtained by matching the virus feature information are combined according to a certain weight (for example, the virus gene matching score weight is 0.6, and the virus feature information matching score weight is 0.4) to obtain the first matching score. For example, if the virus gene matching score is 0.8 and the virus feature information matching score is 0.1, the first matching score is 0.52.

[0100] S404: The client determines a virus detection result according to the first matching score.

[0101] Optionally, the virus detection result may be whether a virus exists according to the first matching score, or may be the first matching score directly. When the virus detection result is whether a virus exists according to the first matching score, it is possible to distinguish whether a virus exists in the shared resource according to a preset score. For example, if the first matching score is greater than or equal to the preset score, the client determines that the virus detection result is "virus exists", indicating that the file in the shared resource may be infected by a virus. If the first matching score is less than the preset score, the client determines that the virus detection result is "virus does not exist", indicating that no signs of virus infection are found in the file in the shared resource.

[0102] The following is an example of combining virus genes, virus feature information, and virus behavior patterns to detect viruses on shared resources and obtain virus detection results. Figure 5 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application. Figure 5 As shown, the aforementioned step S301 may specifically include:

[0103] S501: The client parses a shared resource to obtain the file content of the file included in the shared resource.

[0104] S502: The client obtains virus genes of known viruses and / or virus feature information of known viruses.

[0105] S503: The client matches the file content with virus genes of known viruses and / or virus feature information of known viruses to obtain a first matching score.

[0106] Among them, the specific implementation methods of the aforementioned steps S501-S503 can refer to the signing steps S401-S403, which will not be repeated here.

[0107] S504: The client obtains historical behavior information of shared resources and predefined virus behavior patterns.

[0108] The historical behavior information of shared resources records the historical operation behavior of shared resources, including but not limited to the creation time, modification time, access frequency, interaction with other programs or files, etc. of the file, which is helpful for analyzing whether the shared resources have abnormal behavior. The predefined virus behavior pattern is a pattern pre-set based on the research on various virus behavior characteristics, such as frequent modification of key system files, abnormally large amounts of data transmission in a specific time period, etc., which is used for comparison with the historical behavior information of shared resources.

[0109] The client can obtain historical behavior information of shared resources by querying the local system log or a specific file operation record database. For example, the file creation date and time can be obtained by reading from the metadata of the file system or searching the corresponding file creation event record from the log, and the file modification record can be obtained to obtain the time of each file modification, the size range of the modification, and other information; the frequency of file access statistics can be determined by analyzing the number of access events to the file in the log, etc. At the same time, the client can also collect the interaction between the file and other programs or files, such as whether it is frequently called by a specific program, whether there is data interaction with a specific network address, etc.

[0110] To obtain predefined virus behavior patterns, the client can read from a pre-stored security policy file or virus behavior pattern library. This library contains various known virus behavior patterns, such as behavior pattern descriptions stored in a specific format. For example, if a virus behavior pattern is described as "a large number of write operations are performed on the system registry between 2 and 4 a.m., and the file size grows rapidly", the client will accurately read the various elements of these patterns, such as the time period of the operation, the object of the operation (system registry), the type of operation (large number of writes), and related accompanying features (rapid growth of file size).

[0111] S505: The client obtains a second matching score according to the historical behavior information of the shared resource and the virus behavior pattern.

[0112] The client can classify and compare the historical behavior information of shared resources with predefined virus behavior patterns. For example, for the element of "operation within a specific time period" in the virus behavior pattern, the client checks whether there are similar operation records within a specific time period in the historical behavior information of the shared resource. If so, a score is given based on the degree of match of the time range (e.g. 0.3 points for a complete match within a specific time period, and 0.1 points for a partial match).

[0113] For the object and type of operation, such as the virus behavior pattern of deleting key system files, you can check whether there is any deletion of key system files or similar dangerous operations in the historical behavior information of shared resources. If there is, give a score based on the similarity of the operation (for example, 0.4 points for exactly the same operation and 0.2 points for similar operations).

[0114] For accompanying features, such as the rapid growth of file size accompanied by specific operations in the virus behavior pattern, we can analyze whether there are similar file size changes and operations occurring at the same time in the historical behavior information of shared resources. If so, we will give a certain score according to the situation (such as 0.3 points for complete compliance and 0.1 points for partial compliance).

[0115] Finally, the client can add up the scores obtained by comparing each factor according to the pre-set weight to obtain the second matching score.

[0116] S506: The client determines, according to the second matching score, a target shared resource whose second matching score is greater than or equal to a preset score threshold.

[0117] The client compares the second matching score of each shared resource with the preset score threshold. If the second matching score of a shared resource is greater than or equal to the preset score threshold (eg, 0.2), the shared resource is determined as the target shared resource.

[0118] S507: The client obtains a virus detection result according to the second matching score of the target shared resource and the first matching score of the target shared resource.

[0119] Optionally, the client may set weights for the second matching score and the first matching score respectively, and perform weighted calculation on the second matching score and the first matching score according to the weights to obtain a virus detection result.

[0120] Alternatively, the client may directly use the second matching score and the first matching score as the virus detection result, or alternatively, use the sum of the second matching score and the first matching score as the virus detection result, etc.

[0121] Figure 6 A flowchart of another terminal shared directory construction method provided in an embodiment of the present application. Figure 6 As shown, the method may also include:

[0122] S601: The server obtains shared directory cleanup information.

[0123] The shared directory cleanup information includes the client to be cleaned up and the shared directory to be cleaned up. The client to be cleaned up refers to the client whose sharing permission for a specific shared directory needs to be revoked during the shared directory cleanup operation. The shared directory to be cleaned up refers to the directory that needs to be unshared on a specific client.

[0124] Optionally, the server can receive instructions from a system administrator to obtain shared directory cleanup information. For example, the system administrator enters relevant information in a predetermined format (such as "client ID: [unique identifier of the client to be cleaned], shared directory path: [full path of the shared directory to be cleaned]") in the user interface, and the server extracts the identifier of the client to be cleaned and the path information of the shared directory to be cleaned in response to the instructions entered by the system administrator.

[0125] Optionally, the server may also automatically generate shared directory cleanup information based on its own resource management policy. For example, the server periodically checks the usage of shared directories. When it finds that a shared directory has no access records for a period of time (such as 30 consecutive days) or exceeds a preset resource usage threshold (such as excessive disk space usage), the server will query the corresponding client information, mark the client as a client to be cleaned up, and determine the corresponding shared directory as a shared directory to be cleaned up, thereby generating shared directory cleanup information.

[0126] S602: The server generates a shared directory cleaning instruction according to the shared directory cleaning information.

[0127] After obtaining the shared directory cleaning information, the server encapsulates the shared directory cleaning information into a shared directory cleaning instruction according to the communication protocol agreed upon between the server and the client.

[0128] S603: The server sends a shared directory cleaning instruction to the client to be cleaned.

[0129] Correspondingly, the client to be cleaned receives the shared directory cleanup instruction from the server.

[0130] The shared directory cleaning instruction is used to instruct the client to be cleaned to cancel sharing of the shared directory to be cleaned.

[0131] S604: The client to be cleaned up cancels sharing of the shared directory to be cleaned up according to the shared directory cleanup instruction.

[0132] After receiving the shared directory cleaning instruction, the client to be cleaned cancels the sharing operation of the indicated shared directory to be cleaned according to the shared directory cleaning instruction. The shared directory to be cleaned may include one or more terminal shared directories currently shared by the client to be cleaned, or may directly include all terminal shared directories currently shared by the client to be cleaned.

[0133] Optionally, after receiving the shared directory cleaning instruction, the client to be cleaned can first verify whether the client identifier to be cleaned in the instruction is consistent with its own identifier (to prevent misoperation), and verify whether the shared directory path to be cleaned is a directory that exists locally and is being shared. If the verification is successful, the shared directory to be cleaned is unshared according to the shared directory cleaning instruction.

[0134] According to the method provided in the embodiment of the present application, the server obtains shared directory cleaning information, generates a shared directory cleaning instruction according to the shared directory cleaning information, and sends the shared directory cleaning instruction to the client to be cleaned. The client to be cleaned cancels the sharing of the shared directory to be cleaned according to the shared directory cleaning instruction, so as to implement a one-click cleaning strategy for the terminal shared directory, and can quickly interrupt the sharing when attacked, thereby further improving the security of the terminal shared directory.

[0135] Figure 7 A schematic diagram of the structure of a terminal shared directory construction device provided in an embodiment of the present application. Figure 8 As shown, the terminal shared directory construction device may include: an acquisition module 11, a processing module 12, and a transceiver module 13. In a possible implementation, it may also include: a control module 14 and an output module 15.

[0136] The acquisition module 11 is used to acquire a terminal shared directory construction request in response to a user operation, wherein the terminal shared directory construction request includes shared resources and shared permissions, and the shared permissions include shared user permissions, shared resource operation permissions, and shared time permissions.

[0137] The processing module 12 is used to perform virus detection and sensitive information detection on the shared resource to obtain detection results, which include virus detection results and sensitive information detection results.

[0138] The transceiver module 13 is used to upload the terminal shared directory construction request and the sensitive information detection result to the server if the virus detection result is passed, so that the server can build a terminal shared directory according to the terminal shared directory construction request and the sensitive information detection result.

[0139] Optionally, the processing module 12 is specifically configured to perform the virus detection on the shared resource to obtain the virus detection result. If the virus detection result indicates that there is no virus in the shared resource, the sensitive information detection is performed on the shared resource to obtain the sensitive information detection result. The detection result is generated based on the virus detection result and the sensitive information detection result.

[0140] Optionally, the processing module 12 is specifically used to parse the shared resource, obtain the file content of the file included in the shared resource, obtain the virus gene of the known virus and / or the virus feature information of the known virus, match the file content with the virus gene of the known virus and / or the virus feature information of the known virus, and obtain a first matching score. According to the first matching score, determine the virus detection result.

[0141] Optionally, the acquisition module 11 is further used to acquire historical behavior information of the shared resource and a predefined virus behavior pattern. The processing module 12 is further used to obtain a second matching score based on the historical behavior information of the shared resource and the virus behavior pattern. According to the second matching score, a target shared resource whose second matching score is greater than or equal to a preset score threshold is determined. According to the second matching score of the target shared resource and the first matching score of the target shared resource, the virus detection result is obtained.

[0142] Optionally, when the virus detection result indicates that there is a virus in the shared resource, the control module 14 is used to block network communication and isolate the resource containing the virus. The output module 15 is used to output a warning prompt, which is used to indicate that there is a virus in the shared resource.

[0143] Optionally, the transceiver module 13 is further configured to receive a shared directory cleaning instruction from the server, the shared directory cleaning instruction is used to instruct to cancel the sharing of the shared directory to be cleaned up. The control module 14 is further configured to cancel the sharing of the shared directory to be cleaned up according to the shared directory cleaning instruction.

[0144] The terminal shared directory construction device provided in the embodiment of the present application can execute the terminal shared directory construction method of the client in the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0145] Figure 8 This is a schematic diagram of another terminal shared directory construction device provided in an embodiment of the present application. Figure 8 As shown, the terminal shared directory construction device may include: a transceiver module 21 , a processing module 22 , and a control module 23 .

[0146] The transceiver module 21 is used to receive a terminal shared directory construction request sent by a client, and a sensitive information detection result of a shared resource corresponding to the terminal shared directory construction request.

[0147] The processing module 22 is used to determine whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result.

[0148] The control module 23 is configured to construct a terminal shared directory corresponding to the terminal shared directory construction request if the request is passed.

[0149] Optionally, the processing module 22 is further used to obtain shared directory cleaning information and generate a shared directory cleaning instruction based on the shared directory cleaning information. The shared directory cleaning information includes a client to be cleaned and a shared directory to be cleaned. The transceiver module 21 is further used to send the shared directory cleaning instruction to the client to be cleaned, and the shared directory cleaning instruction is used to instruct the client to be cleaned to cancel sharing of the shared directory to be cleaned.

[0150] The terminal shared directory construction device provided in the embodiment of the present application can execute the terminal shared directory construction method on the server side in the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0151] Fig. 9The structure diagram of an electronic device provided in an embodiment of the present application is shown in FIG. 1 , wherein the electronic device is used to execute the terminal shared directory construction method mentioned above. Fig. 9 As shown, the electronic device 900 may include: at least one processor 901 , a memory 902 , and a communication interface 903 .

[0152] The memory 902 is used to store programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions.

[0153] The memory 902 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0154] The processor 901 is used to execute the computer-executable instructions stored in the memory 902 to implement the method described in the above method embodiment. The processor 901 may be a CPU, or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0155] The processor 901 can communicate and interact with external devices through the communication interface 903. The external devices can be, for example, the aforementioned server, client, etc. In a specific implementation, if the communication interface 903, the memory 902, and the processor 901 are implemented independently, the communication interface 903, the memory 902, and the processor 901 can be interconnected through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc., but it does not mean that there is only one bus or one type of bus.

[0156] Optionally, in a specific implementation, if the communication interface 903, the memory 902 and the processor 901 are integrated on a chip, the communication interface 903, the memory 902 and the processor 901 can communicate through an internal interface.

[0157] The present application also provides a computer-readable storage medium, which may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes. Specifically, the computer-readable storage medium stores program instructions, and the program instructions are used for the methods in the above embodiments.

[0158] The present application also provides a program product, which includes an execution instruction, which is stored in a readable storage medium. At least one processor of a computing device can read the execution instruction from the readable storage medium, and at least one processor executes the execution instruction so that the computing device implements the terminal shared directory construction method.

[0159] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0160] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0161] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0162] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0163] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. Unless otherwise specified, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. Unless otherwise specified, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory (RRAM), a dynamic random access memory (DRAM), a static random access memory (SRAM), an enhanced dynamic random access memory (EDRAM), a high-bandwidth memory (HBM), a hybrid memory cube (HMC), etc.

[0164] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0165] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0166] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0167] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for constructing a terminal shared directory, characterized in that: include: In response to a user operation, obtaining a terminal shared directory construction request, wherein the terminal shared directory construction request includes shared resources and sharing permissions, wherein the sharing permissions include sharing user permissions, sharing resource operation permissions, and sharing time permissions; Perform virus detection and sensitive information detection on the shared resource to obtain detection results, wherein the detection results include virus detection results and sensitive information detection results; If the virus detection result is passed, the terminal shared directory construction request and the sensitive information detection result are uploaded to the server, so that the server builds a terminal shared directory according to the terminal shared directory construction request and the sensitive information detection result.

2. The method according to claim 1, characterized in that The performing virus detection and sensitive information detection on the shared resource to obtain the detection result includes: Performing the virus detection on the shared resource to obtain the virus detection result; If the virus detection result indicates that there is no virus in the shared resource, performing the sensitive information detection on the shared resource to obtain the sensitive information detection result; The detection result is generated according to the virus detection result and the sensitive information detection result.

3. The method according to claim 2, characterized in that The performing the virus detection on the shared resource to obtain the virus detection result includes: Parsing the shared resource to obtain the file content of the file included in the shared resource; Obtaining viral genes of known viruses and / or viral characteristic information of known viruses; Matching the file content with the virus gene of the known virus and / or the virus feature information of the known virus to obtain a first matching score; The virus detection result is determined according to the first matching score.

4. The method according to claim 3, characterized in that The method further comprises: Acquire historical behavior information of the shared resource and predefined virus behavior patterns; Obtaining a second matching score according to the historical behavior information of the shared resource and the virus behavior pattern; Determine, according to the second matching score, a target shared resource whose second matching score is greater than or equal to a preset score threshold; The virus detection result is obtained according to the second matching score of the target shared resource and the first matching score of the target shared resource.

5. The method according to claim 2, characterized in that: The method further comprises: If the virus detection result indicates that a virus exists in the shared resource, network communication is blocked and the resource containing the virus is isolated; Output a warning prompt, wherein the warning prompt is used to prompt that a virus exists in the shared resource.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Receiving a shared directory cleanup instruction from a server, wherein the shared directory cleanup instruction is used to instruct to cancel sharing of a shared directory to be cleaned up; According to the shared directory cleaning instruction, the shared directory to be cleaned up is unshared.

7. A method for constructing a terminal shared directory, characterized in that: include: Receive a terminal shared directory construction request sent by a client, and a sensitive information detection result of a shared resource corresponding to the terminal shared directory construction request; Determining whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result; If passed, a terminal shared directory corresponding to the terminal shared directory construction request is constructed.

8. The method according to claim 7, characterized in that The method further comprises: Acquire shared directory cleaning information, wherein the shared directory cleaning information includes a client to be cleaned and a shared directory to be cleaned; Generate a shared directory cleaning instruction according to the shared directory cleaning information; The shared directory cleaning instruction is sent to the client to be cleaned, where the shared directory cleaning instruction is used to instruct the client to be cleaned to cancel sharing of the shared directory to be cleaned.

9. A terminal shared directory construction device, characterized in that: include: An acquisition module, configured to acquire a terminal shared directory construction request in response to a user operation, wherein the terminal shared directory construction request includes shared resources and shared permissions, and the shared permissions include shared user permissions, shared resource operation permissions, and shared time permissions; A processing module, used to perform virus detection and sensitive information detection on the shared resource to obtain detection results, wherein the detection results include virus detection results and sensitive information detection results; The transceiver module is used to upload the terminal shared directory construction request and the sensitive information detection result to the server if the virus detection result is passed, so that the server can build a terminal shared directory according to the terminal shared directory construction request and the sensitive information detection result.

10. A terminal shared directory construction device, characterized in that: include: A transceiver module, used for receiving a terminal shared directory construction request sent by a client, and a sensitive information detection result of a shared resource corresponding to the terminal shared directory construction request; A processing module, configured to determine whether the terminal shared directory construction request is passed according to the terminal shared directory construction request and the sensitive information detection result; The control module is used to construct a terminal shared directory corresponding to the terminal shared directory construction request if passed.

11. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

13. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 8 when being executed by a processor.

Images