Anti-virus scanning method and device, computer equipment and storage medium

Abstract

The invention relates to an anti-virus scanning method and device, computer equipment and a storage medium. The method comprises the following steps: a client sends a file access request to a storage node; in response to the received file access request, the storage node obtains an anti-virus attribute of an accessed file; judging whether the accessed file meets an anti-virus scanning condition or not according to the file anti-virus attribute; in response to the fact that the accessed file meets the anti-virus scanning condition, the storage node sends an accessed file path to an anti-virus server; the anti-virus server analyzes the path of the accessed file and scans the accessed file; and the anti-virus server obtains a scanning result and updates the anti-virus attribute of the accessed file. By adopting the method, repeated scanning can be reduced, and system performance is improved.

Description

Technical Field

[0001] The present application relates to the field of scanning technology, and in particular to an anti-virus scanning method, device, computer equipment and storage medium. Background Art

[0002] Current computer storage systems have certain limitations in anti-virus scanning methods. Taking the existing distributed storage system as an example, when a client accesses a file in a shared directory through a client, if the accessed file in the storage system contains a virus, the client cannot intercept the file when opening the shared directory, which can easily cause the virus to spread from the storage system to the client, resulting in an expansion of the virus coverage area and affecting system security.

[0003] The current technology mainly relies on third-party antivirus servers to intercept viruses when performing antivirus scanning. The storage system obtains file access requests and sends the requests to the third-party antivirus server. After receiving the request, the third-party antivirus server performs antivirus scanning on the file. This method triggers antivirus scanning when any accessed file is opened or closed, causing the file to be scanned repeatedly in a short period of time, affecting the performance of the storage system. Summary of the invention

[0004] Based on this, it is necessary to provide an anti-virus scanning method, device, computer equipment and storage medium that can reduce repeated scanning and improve storage system performance in response to the above technical problems.

[0005] In one aspect, an antivirus scanning method is provided, the method comprising:

[0006] The client sends a request to access the file to the storage node;

[0007] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0008] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0009] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0010] The antivirus server parses the accessed file path and scans the accessed file;

[0011] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0012] In one embodiment, the method further includes: configuring an antivirus server cluster before the client sends a file access request to a storage node, including:

[0013] The server creates a shared protocol account and a shared protocol account directory, and edits the shared protocol account directory configuration;

[0014] The client creates a storage directory and mounts the shared protocol account directory to the storage directory;

[0015] The user accesses the sharing agreement account directory through the storage directory according to the sharing agreement account;

[0016] In response to the user accessing the shared protocol account directory, the client sends a file access request to the storage node.

[0017] In one embodiment, the file access request includes an open request and a close request.

[0018] In response to the accessed file satisfying the antivirus scanning condition, triggering an antivirus scan according to the antivirus scanning mode;

[0019] If the antivirus scanning mode is the shutdown request scanning mode, the antivirus scanning is triggered when the client sends the shutdown request;

[0020] If the antivirus scanning mode is an open and close request scanning mode, the antivirus scanning is triggered when the client sends the open request and the close request;

[0021] The open request is a synchronous request, and the close request is an asynchronous request.

[0022] In one of the embodiments, storing the anti-virus attribute of the accessed file in the storage file system includes:

[0023] The antivirus attributes of the accessed file and the basic attributes of the accessed file are stored in the storage file system.

[0024] The storage node obtains the anti-virus attribute of the accessed file through the file system interface.

[0025] The antivirus attributes of the accessed file include the previous file scanning result, the previous file scanning time, and the previous file hash value.

[0026] In one embodiment, determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the accessed file includes:

[0027] When the file access request is an open request, determine whether the previous file scan time exceeds a time threshold:

[0028] If the previous file scanning time exceeds the time threshold, the scan of the accessed file will be started;

[0029] If the previous file scan time does not exceed the time threshold, the hash value of the currently accessed file is obtained, and it is determined whether the previous file hash value has changed compared with the currently accessed file hash value:

[0030] If the previous file hash value is different from the currently accessed file hash value, the accessed file scan will be started;

[0031] If the hash value of the previous file does not change compared to the hash value of the currently accessed file, determine whether the previous file scan result is safe:

[0032] If the previous file scan result is unsafe, the scan of the accessed file will be started;

[0033] If the previous file scanning result is safe, the client is allowed to open the accessed file;

[0034] When the file access request is a close request, determining whether the accessed file has been modified and / or saved;

[0035] If the accessed file is modified and saved, the accessed file scanning is started when the accessed file is closed;

[0036] If the accessed file has not been modified or saved, no scanning of the accessed file is performed when the accessed file is closed;

[0037] Before the accessed file scanning is started, the scanning strategy of the accessed file is matched.

[0038] According to the scanning strategy matched by the accessed file, scanning of the accessed file is started,

[0039] The hash value of the currently accessed file is stored in the basic attributes of the accessed file.

[0040] In one embodiment, before the antivirus server parses the accessed file path, it includes:

[0041] The antivirus scanning filter sends the accessed file path to the Internet Content Adaptation Protocol client;

[0042] The Internet Content Adaptation Protocol client receives the accessed file path, encapsulates the accessed file path into a first Internet Content Adaptation Protocol message, and sends the first Internet Content Adaptation Protocol message to the antivirus server;

[0043] The antivirus server obtains the accessed file path through the first Internet Content Adaptation Protocol message.

[0044] In one embodiment, updating the antivirus attribute of the accessed file includes:

[0045] The antivirus server encapsulates the scanning result into a second Internet Content Adaptation Protocol message, and sends the second Internet Content Adaptation Protocol message to the storage node;

[0046] The storage node obtains the scanning result through the second Internet Content Adaptation Protocol message, stores the scanning result in the storage file system, and determines whether the scanning result is normal:

[0047] If the scanning result is normal, the client is allowed to open the accessed file;

[0048] If the scanning result is abnormal, the client is prohibited from opening the accessed file.

[0049] On the other hand, an anti-virus scanning device is provided, the device comprising:

[0050] Access module, used by the client to send a file access request to the storage node;

[0051] An acquisition module, configured to, in response to receiving the file access request, enable the storage node to acquire the antivirus attribute of the accessed file;

[0052] A judgment module, used for judging whether the accessed file meets the anti-virus scanning condition according to the anti-virus attribute of the file;

[0053] A sending module, configured to, in response to the accessed file satisfying the antivirus scanning condition, send the accessed file path by the storage node to the antivirus server;

[0054] A scanning module, used for the antivirus server to parse the accessed file path and scan the accessed file;

[0055] The updating module is used for the antivirus server to obtain the scanning result and update the antivirus attribute of the accessed file.

[0056] In another aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0057] The client sends a request to access the file to the storage node;

[0058] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0059] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0060] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0061] The antivirus server parses the accessed file path and scans the accessed file;

[0062] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0063] In another aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0064] The client sends a request to access the file to the storage node;

[0065] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0066] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0067] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0068] The antivirus server parses the accessed file path and scans the accessed file;

[0069] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0070] The above-mentioned antivirus scanning method, device, computer equipment and storage medium realize efficient and accurate file antivirus scanning through the collaboration between the storage node and the antivirus server. First, the storage node obtains the antivirus attribute of the accessed file based on the received file access request and determines whether scanning is required. This process can avoid unnecessary scanning and reduce resource waste. When the accessed file meets the scanning conditions, the storage node only needs to send the file path to the antivirus server without transmitting the entire file, which improves the performance and response speed of the system. The antivirus server scans the file according to the file path and updates the antivirus attribute of the file in time, so that subsequent access can be judged based on the latest security information. This solution effectively improves the security of file access, while reducing unnecessary repeated scanning and reducing the scanning burden of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1An application environment diagram of an anti-virus scanning method in an embodiment;

[0072] Figure 2 A schematic diagram of a flow chart of an anti-virus scanning method in an embodiment;

[0073] Figure 3 A timing diagram of an anti-virus scanning method in one embodiment;

[0074] Figure 4 is a structural block diagram of an anti-virus scanning device in an embodiment;

[0075] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0077] The anti-virus scanning method provided in this application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0078] In one embodiment, Figure 2 As shown, an anti-virus scanning method is provided, which is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0079] Step S201: The client sends a file access request to a storage node.

[0080] The clients include SMB clients, enterprise servers, virtual machines, and file sharing services. SMB stands for Server Message Block, and SMB is mainly used as a network communication protocol.

[0081] Specifically, a customer accesses a shared file through a client. After receiving an access request, the client initiates an access request for the accessed file and sends the access request to a storage node.

[0082] Step S203: In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file.

[0083] Specifically, the samba subsystem in the storage node obtains the anti-virus attribute of the accessed file by accessing the storage file system.

[0084] Step S205, judging whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0085] Specifically, the file antivirus attribute is an extended attribute of the file, including the last scan time, the last scan result, the last hash value, etc. If the scan time interval is too long, the accessed file may carry a virus, but it is not prudent to judge only by time conditions, because time may change suddenly due to unexpected circumstances. To prevent this situation, it is more accurate to introduce a comparison of hash values ​​to judge whether the file has been modified.

[0086] Step S207, in response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0087] Specifically, the antivirus server includes antivirus software for performing scanning operations.

[0088] Step S209, the antivirus server parses the accessed file path and scans the accessed file;

[0089] Specifically, after the antivirus server parses the accessed file path, it scans the stored file through CIFS. According to the CIFS content, the scanning process performs opening and reading operations on the scanned file.

[0090] Among them, CIFS refers to Common Internet File System.

[0091] Step S211: the antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0092] Specifically, after the antivirus server finishes scanning, it sends the scanning result to the storage file system so that the result can be obtained when the file is accessed next time.

[0093] In the above antivirus scanning method, efficient and accurate file antivirus scanning is achieved through the collaboration between the storage node and the antivirus server. First, the storage node obtains the antivirus properties of the accessed file based on the received file access request and determines whether scanning is required. This process can avoid unnecessary scanning and reduce resource waste. When the accessed file meets the scanning conditions, the storage node only needs to send the file path to the antivirus server without transmitting the entire file, which improves the performance and response speed of the system. The antivirus server scans the file according to the file path and updates the antivirus properties of the file in a timely manner, so that subsequent access can be judged based on the latest security information. This solution effectively improves the security of file access, while reducing unnecessary repeated scanning and reducing the scanning burden of the system.

[0094] In one embodiment, before the client sends a file access request to a storage node, configuring an antivirus server cluster includes:

[0095] The server creates a shared protocol account and a shared protocol account directory, and edits the shared protocol account directory configuration;

[0096] The client creates a storage directory and mounts the shared protocol account directory to the storage directory;

[0097] The user accesses the sharing agreement account directory through the storage directory according to the sharing agreement account;

[0098] In response to the user accessing the shared protocol account directory, the client sends a file access request to the storage node.

[0099] Among them, Samba applies the SMB communication protocol to the Linux system, forming the Samba software, which can be used for direct file sharing and print sharing between Linux and Windows systems.

[0100] Specifically, the shared protocol account directory can be mounted manually or automatically.

[0101] This solution achieves an efficient combination of file access and antivirus scanning by configuring an antivirus server cluster and using a shared protocol account directory. First, the server creates a shared protocol account and a shared directory and configures them to ensure the security of access control and file sharing. The client mounts the shared protocol account directory to enable users to access remote storage files like local directories. In this way, when a user accesses the shared protocol account directory, the client automatically sends a file access request to the storage node. Through this mechanism, the system can perform unified security management when a file access request is initiated to ensure that files do not spread malware during sharing and transmission. Clustered antivirus servers can achieve load balancing and improve scanning efficiency. The overall solution not only simplifies the integration of file sharing and antivirus scanning, but also improves the security of data access and system performance. It is particularly suitable for file sharing and security management in large network environments.

[0102] In one embodiment, the file access request includes an open request and a close request.

[0103] In response to the accessed file satisfying the antivirus scanning condition, triggering an antivirus scan according to the antivirus scanning mode;

[0104] If the antivirus scanning mode is the shutdown request scanning mode, the antivirus scanning is triggered when the client sends the shutdown request;

[0105] If the antivirus scanning mode is an open and close request scanning mode, the antivirus scanning is triggered when the client sends the open request and the close request;

[0106] The open request is a synchronous request, and the close request is an asynchronous request.

[0107] Specifically, when the access request is an open request, the client is allowed to open the accessed file only after the scanning operation is completed and the scanning result is safe; when the access request is a close request, the client is allowed to close the accessed file without completing the scanning operation, and the execution of the close operation does not need to wait for the scanning result.

[0108] Specifically, the antivirus scanning mode is configurable. In the closed scanning mode, antivirus scanning is only allowed to be triggered when the client file is closed; when the request scanning mode is turned on and off, antivirus scanning may be triggered when the client opens and closes the file.

[0109] This solution achieves flexible control over the file access process by setting different antivirus scanning modes, significantly improving the security and efficiency of the system. File access requests are divided into open requests and close requests, and antivirus scanning is triggered only when the scanning conditions are met to avoid unnecessary scanning. The diversification of scanning modes (close request scanning mode and open-close request scanning mode) enables the system to be optimized according to actual needs. If the close request scanning mode is adopted, the scan is triggered when the file is closed, which effectively reduces the burden of real-time scanning and improves the access speed. The open-close request scanning mode ensures that the file is virus-checked when it is opened and closed, which is suitable for high-security scenarios. In addition, the open request is a synchronous request to ensure that the scan is completed before the file is opened to ensure real-time performance; the close request is an asynchronous request to avoid blocking operations and improve user experience. Overall, this solution balances performance and security through a flexible scanning mechanism, which is particularly suitable for scenarios with concurrent access by multiple users.

[0110] In one embodiment, storing the anti-virus attribute of the accessed file in the storage file system includes:

[0111] The antivirus attributes of the accessed file and the basic attributes of the accessed file are stored in the storage file system.

[0112] The storage node obtains the anti-virus attribute of the accessed file through the file system interface.

[0113] The antivirus attributes of the accessed file include the previous file scanning result, the previous file scanning time, and the previous file hash value.

[0114] Specifically, the file system interface may be a Lib interface, such as Figure 3 The figure shows the timing diagram of the scanning method implementation, and the anti-virus properties are obtained through the Lib interface.

[0115] This solution achieves efficient file security management and antivirus scanning by uniformly storing the antivirus attributes and basic attributes of the accessed files in the file system. The storage node directly obtains these antivirus attributes through the file system interface, including the previous file scan result, scan time and hash value, so that it can quickly determine whether the file needs to be rescanned. This method avoids repeated scanning, reduces the occupation of system resources, and improves the efficiency of file access. The hash value of the previous scan can also be used to determine whether the file has been modified. By comparing it with the current hash value, the file or file block that needs to be scanned can be accurately located. This deep integration of attributes with the file system reduces external management overhead, ensures real-time monitoring of file security in a distributed storage environment, and effectively improves the performance and security of the system. It is particularly suitable for scenarios with large-scale file storage and frequent access.

[0116] In one embodiment, judging whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the accessed file includes:

[0117] When the file access request is an open request, determine whether the previous file scan time exceeds a time threshold:

[0118] If the previous file scanning time exceeds the time threshold, the scan of the accessed file will be started;

[0119] If the previous file scan time does not exceed the time threshold, the hash value of the currently accessed file is obtained, and it is determined whether the previous file hash value has changed compared with the currently accessed file hash value:

[0120] If the previous file hash value is different from the currently accessed file hash value, the accessed file scan will be started;

[0121] If the hash value of the previous file does not change compared to the hash value of the currently accessed file, determine whether the previous file scan result is safe:

[0122] If the previous file scan result is unsafe, the scan of the accessed file will be started;

[0123] If the previous file scanning result is safe, the client is allowed to open the accessed file;

[0124] When the file access request is a close request, determining whether the accessed file has been modified and / or saved;

[0125] If the accessed file is modified and saved, the accessed file scanning is started when the accessed file is closed;

[0126] If the accessed file has not been modified or saved, no scanning of the accessed file is performed when the accessed file is closed;

[0127] Before the accessed file scanning is started, the scanning strategy of the accessed file is matched.

[0128] According to the scanning strategy matched by the accessed file, scanning of the accessed file is started,

[0129] The hash value of the currently accessed file is stored in the basic attributes of the accessed file.

[0130] Specifically, the time threshold is configurable, and the time threshold can be adjusted according to factors such as system pressure and file access frequency. The threshold can be manually configured or adaptively adjusted by the system.

[0131] Specifically, Samba contains an AvScan filter module, i.e., an antivirus scanning filter, which intercepts access requests and checks whether a scanning task is configured for the accessed file, including scanning directories and scanning policies. If a scanning task is configured, the scanning policy is matched, involving matching factors such as file type, file size, and current time, to confirm whether the file needs to be scanned. If it meets the scanning policy, the file path is sent to the antivirus server through the Internet Content Adaptation Protocol thread.

[0132] Specifically, scanning by hash value comparison can also be an incremental scanning method, that is, dividing the file into multiple blocks of the same size (for example, 4KB or 8KB per block), and calculating a hash value for each block separately to track local changes in the file content. The file block size can be adjusted according to the file size or the actual application scenario. The smaller the block, the more accurate the local changes detected. When the file is scanned, the hash value of each block is stored in the basic attributes of the file. When the file is accessed again and needs to be scanned, the hash value of each block is recalculated and compared with the hash value stored last time. If the hash value of each block has changed, it means that the content of the block has changed, and the block is marked as "modified". Virus scanning is performed on the blocks with changed hash values, and the entire file is no longer scanned.

[0133] This solution greatly improves the efficiency and accuracy of antivirus scanning through incremental scanning. Dividing the file into multiple blocks of the same size (such as 4KB or 8KB) and calculating the hash value for each block separately can accurately track local changes in the file. During the first scan, the system stores the hash value of each block for subsequent comparison. When the file is accessed again, it only needs to recalculate the hash value of each block and compare it with the previously stored value. If the hash value of a block changes, it means that the content of the block has been modified. The system only scans these "modified" blocks for viruses without scanning the entire file. This not only reduces unnecessary repeated scanning, but also speeds up the scanning process, which is particularly suitable for large files or frequently modified files. By properly adjusting the block size, a balance can be achieved between accuracy and performance, ensuring that the system improves overall efficiency while maintaining high security.

[0134] This solution intelligently determines whether a file needs to be rescanned based on the antivirus attributes and hash value changes in the file access request, thereby achieving accurate and efficient antivirus management. When the client sends a request to open a file, the system first checks the previous scan time and the set time threshold, and determines whether the file is safe based on the file hash value change and the last scan result, thereby avoiding unnecessary scanning. By comparing the hash values, the system can accurately detect whether the file has been modified, reduce repeated scans, and improve performance. In addition, when a request to close a file is issued, the system only scans the file if it has been modified and saved, further reducing the scanning workload. This mechanism based on policy matching and dynamic judgment of file attributes greatly improves the security and efficiency of file access, and is particularly suitable for large-scale file access and storage scenarios. By integrating the stored file hash value with the antivirus attributes, the system implements a more intelligent and resource-saving antivirus process.

[0135] In one embodiment, before the antivirus server parses the accessed file path, it includes:

[0136] The antivirus scanning filter sends the accessed file path to the Internet Content Adaptation Protocol client;

[0137] The Internet Content Adaptation Protocol client receives the accessed file path, encapsulates the accessed file path into a first Internet Content Adaptation Protocol message, and sends the first Internet Content Adaptation Protocol message to the antivirus server;

[0138] The antivirus server obtains the accessed file path through the first Internet Content Adaptation Protocol message.

[0139] The Internet Content Adaptation Protocol message may be an Icap message, that is, a message format that the antivirus server can recognize. The message transmission between the antivirus server and the storage node needs to encapsulate the message into the Icap format, and complete the information acquisition through parsing.

[0140] This solution improves the file path parsing and scanning efficiency of the antivirus server by introducing the Internet Content Adaptation Protocol (ICAP) client and message encapsulation mechanism. First, the antivirus scanning filter sends the accessed file path to the ICAP client, and the client encapsulates the path into the first ICAP message and then transmits it to the antivirus server. This encapsulation and transmission method standardizes the transmission of file path information and ensures the reliability and compatibility of the communication process. The antivirus server obtains the file path by parsing the ICAP message, which reduces the complexity of the data transmission process, avoids direct file transmission, and improves the performance of the system. In addition, through this protocolized approach, the system can easily expand and adapt to different types of antivirus services, support multi-server cluster deployment, and ensure a stable antivirus scanning process during high concurrent access.

[0141] In one embodiment, updating the antivirus attribute of the accessed file includes:

[0142] The antivirus server encapsulates the scanning result into a second Internet Content Adaptation Protocol message, and sends the second Internet Content Adaptation Protocol message to the storage node;

[0143] The storage node obtains the scanning result through the second Internet Content Adaptation Protocol message, stores the scanning result in the storage file system, and determines whether the scanning result is normal:

[0144] If the scanning result is normal, the client is allowed to open the accessed file;

[0145] If the scanning result is abnormal, the client is prohibited from opening the accessed file.

[0146] Specifically, when the access request is a close request, the accessed file can be closed without waiting for the scan result, depending on whether the open request is a synchronous request and the close request is an asynchronous request.

[0147] This solution efficiently updates antivirus scanning results through the Internet Content Adaptation Protocol (ICAP) and optimizes file access management. After the scan is completed, the antivirus server encapsulates the scan results into ICAP messages and transmits them to the storage node. The storage node obtains the scan results through ICAP message parsing and stores them in the file system. At the same time, the storage node determines the file access rights based on the scan results: if the result is normal, the client is allowed to open the file; if the result is abnormal, access is prohibited, ensuring the security of the file. Especially when the close request is an asynchronous request, the client can close the file without waiting for the scan result, which improves the user experience and system response speed. This combination of synchronous and asynchronous requests not only ensures the security of file access, but also reduces unnecessary waiting time. It is suitable for large-scale file access and complex network storage environments.

[0148] It should be understood that although Figure 2-4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-4 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0149] In one embodiment, Figure 4 As shown, an anti-virus scanning device is provided, including: an access module 21, an acquisition module 22, a judgment module 23, a sending module 24, a scanning module 25 and an update module 26, wherein:

[0150] Access module 21, used for the client to send a file access request to the storage node;

[0151] An acquisition module 22, configured to, in response to receiving the file access request, enable the storage node to acquire the antivirus attribute of the accessed file;

[0152] A judgment module 23, used to judge whether the accessed file meets the anti-virus scanning condition according to the anti-virus attribute of the file;

[0153] A sending module 24, configured to, in response to the accessed file satisfying the antivirus scanning condition, send the accessed file path by the storage node to the antivirus server;

[0154] A scanning module 25, used for the antivirus server to parse the accessed file path and scan the accessed file;

[0155] The updating module 26 is used for the antivirus server to obtain the scanning result and update the antivirus attribute of the accessed file.

[0156] In one embodiment, the device access module 21 is used for the client to send a file access request to the storage node.

[0157] Before the client sends a file access request to the storage node, an antivirus server cluster is configured, including:

[0158] The server creates a shared protocol account and a shared protocol account directory, and edits the shared protocol account directory configuration;

[0159] The client creates a storage directory and mounts the shared protocol account directory to the storage directory;

[0160] The user accesses the sharing agreement account directory through the storage directory according to the sharing agreement account;

[0161] In response to the user accessing the shared protocol account directory, the client sends a file access request to the storage node;

[0162] The file access request includes an open request and a close request.

[0163] In response to the accessed file satisfying the antivirus scanning condition, triggering an antivirus scan according to the antivirus scanning mode;

[0164] If the antivirus scanning mode is the shutdown request scanning mode, the antivirus scanning is triggered when the client sends the shutdown request;

[0165] If the antivirus scanning mode is an open and close request scanning mode, the antivirus scanning is triggered when the client sends the open request and the close request;

[0166] The open request is a synchronous request, and the close request is an asynchronous request.

[0167] In one embodiment, the device acquisition module 22 is used for the storage node to acquire the anti-virus attribute of the accessed file in response to receiving the file access request.

[0168] The anti-virus attributes of the accessed files are stored in the storage file system, including:

[0169] The antivirus attributes of the accessed file and the basic attributes of the accessed file are stored in the storage file system.

[0170] The storage node obtains the anti-virus attribute of the accessed file through the file system interface.

[0171] The antivirus attributes of the accessed file include the previous file scanning result, the previous file scanning time, and the previous file hash value.

[0172] In one embodiment, the device judgment module 23 is used to judge whether the accessed file meets the anti-virus scanning condition according to the anti-virus attribute of the file.

[0173] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the accessed file includes:

[0174] When the file access request is an open request, determine whether the previous file scan time exceeds a time threshold:

[0175] If the previous file scanning time exceeds the time threshold, the scan of the accessed file will be started;

[0176] If the previous file scan time does not exceed the time threshold, the hash value of the currently accessed file is obtained, and it is determined whether the previous file hash value has changed compared with the currently accessed file hash value:

[0177] If the previous file hash value is different from the currently accessed file hash value, the accessed file scan will be started;

[0178] If the hash value of the previous file does not change compared to the hash value of the currently accessed file, determine whether the previous file scan result is safe:

[0179] If the previous file scan result is unsafe, the scan of the accessed file will be started;

[0180] If the previous file scanning result is safe, the client is allowed to open the accessed file;

[0181] When the file access request is a close request, determining whether the accessed file has been modified and / or saved;

[0182] If the accessed file is modified and saved, the accessed file scanning is started when the accessed file is closed;

[0183] If the accessed file has not been modified or saved, no scanning of the accessed file is performed when the accessed file is closed;

[0184] Before the accessed file scanning is started, the scanning strategy of the accessed file is matched.

[0185] According to the scanning strategy matched by the accessed file, scanning of the accessed file is started,

[0186] The hash value of the currently accessed file is stored in the basic attributes of the accessed file.

[0187] In one embodiment, the device scanning module 25 is used for the antivirus server to parse the accessed file path and scan the accessed file.

[0188] Before the antivirus server parses the accessed file path, it includes:

[0189] The antivirus scanning filter sends the accessed file path to the Internet Content Adaptation Protocol client;

[0190] The Internet Content Adaptation Protocol client receives the accessed file path, encapsulates the accessed file path into a first Internet Content Adaptation Protocol message, and sends the first Internet Content Adaptation Protocol message to the antivirus server;

[0191] The antivirus server obtains the accessed file path through the first Internet Content Adaptation Protocol message.

[0192] In one embodiment, the device update module 26 is used for the antivirus server to obtain the scanning result and update the antivirus attribute of the accessed file.

[0193] The updating of the anti-virus attribute of the accessed file includes:

[0194] The antivirus server encapsulates the scanning result into a second Internet Content Adaptation Protocol message, and sends the second Internet Content Adaptation Protocol message to the storage node;

[0195] The storage node obtains the scanning result through the second Internet Content Adaptation Protocol message, stores the scanning result in the storage file system, and determines whether the scanning result is normal:

[0196] If the scanning result is normal, the client is allowed to open the accessed file;

[0197] If the scanning result is abnormal, the client is prohibited from opening the accessed file.

[0198] For the specific definition of the antivirus scanning device, please refer to the definition of the antivirus scanning method above, which will not be repeated here. Each module in the above antivirus scanning device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0199] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an anti-virus scanning method is implemented.

[0200] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0201] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0202] The client sends a request to access the file to the storage node;

[0203] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0204] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0205] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0206] The antivirus server parses the accessed file path and scans the accessed file;

[0207] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0208] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0209] The client sends a request to access the file to the storage node;

[0210] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0211] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0212] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0213] The antivirus server parses the accessed file path and scans the accessed file;

[0214] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0215] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0216] The client sends a request to access the file to the storage node;

[0217] In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file;

[0218] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file;

[0219] In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server;

[0220] The antivirus server parses the accessed file path and scans the accessed file;

[0221] The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

[0222] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0223] Before the client sends a file access request to the storage node, an antivirus server cluster is configured, including:

[0224] The server creates a shared protocol account and a shared protocol account directory, and edits the shared protocol account directory configuration;

[0225] The client creates a storage directory and mounts the shared protocol account directory to the storage directory;

[0226] The user accesses the sharing agreement account directory through the storage directory according to the sharing agreement account;

[0227] In response to the user accessing the shared protocol account directory, the client sends a file access request to the storage node;

[0228] The file access request includes an open request and a close request.

[0229] In response to the accessed file satisfying the antivirus scanning condition, triggering an antivirus scan according to the antivirus scanning mode;

[0230] If the antivirus scanning mode is the shutdown request scanning mode, the antivirus scanning is triggered when the client sends the shutdown request;

[0231] If the antivirus scanning mode is an open and close request scanning mode, the antivirus scanning is triggered when the client sends the open request and the close request;

[0232] The open request is a synchronous request, and the close request is an asynchronous request.

[0233] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0234] The anti-virus attributes of the accessed files are stored in the storage file system, including:

[0235] The antivirus attributes of the accessed file and the basic attributes of the accessed file are stored in the storage file system.

[0236] The storage node obtains the anti-virus attribute of the accessed file through the file system interface.

[0237] The antivirus attributes of the accessed file include the previous file scanning result, the previous file scanning time, and the previous file hash value.

[0238] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0239] Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the accessed file includes:

[0240] When the file access request is an open request, determine whether the previous file scan time exceeds a time threshold:

[0241] If the previous file scanning time exceeds the time threshold, the scan of the accessed file will be started;

[0242] If the previous file scan time does not exceed the time threshold, the hash value of the currently accessed file is obtained, and it is determined whether the previous file hash value has changed compared with the currently accessed file hash value:

[0243] If the previous file hash value is different from the currently accessed file hash value, the accessed file scan will be started;

[0244] If the hash value of the previous file does not change compared to the hash value of the currently accessed file, determine whether the previous file scan result is safe:

[0245] If the previous file scan result is unsafe, the scan of the accessed file will be started;

[0246] If the previous file scanning result is safe, the client is allowed to open the accessed file;

[0247] When the file access request is a close request, determining whether the accessed file has been modified and / or saved;

[0248] If the accessed file is modified and saved, the accessed file scanning is started when the accessed file is closed;

[0249] If the accessed file has not been modified or saved, no scanning of the accessed file is performed when the accessed file is closed;

[0250] Before the accessed file scanning is started, the scanning strategy of the accessed file is matched.

[0251] According to the scanning strategy matched by the accessed file, scanning of the accessed file is started,

[0252] The hash value of the currently accessed file is stored in the basic attributes of the accessed file.

[0253] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0254] Before the antivirus server parses the accessed file path, it includes:

[0255] The antivirus scanning filter sends the accessed file path to the Internet Content Adaptation Protocol client;

[0256] The Internet Content Adaptation Protocol client receives the accessed file path, encapsulates the accessed file path into a first Internet Content Adaptation Protocol message, and sends the first Internet Content Adaptation Protocol message to the antivirus server;

[0257] The antivirus server obtains the accessed file path through the first Internet Content Adaptation Protocol message.

[0258] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0259] The updating of the anti-virus attribute of the accessed file includes:

[0260] The antivirus server encapsulates the scanning result into a second Internet Content Adaptation Protocol message, and sends the second Internet Content Adaptation Protocol message to the storage node;

[0261] The storage node obtains the scanning result through the second Internet Content Adaptation Protocol message, stores the scanning result in the storage file system, and determines whether the scanning result is normal:

[0262] If the scanning result is normal, the client is allowed to open the accessed file;

[0263] If the scanning result is abnormal, the client is prohibited from opening the accessed file.

[0264] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0265] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0266] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An anti-virus scanning method, characterized in that: include: The client sends a request to access the file to the storage node; In response to receiving the file access request, the storage node obtains the anti-virus attribute of the accessed file; Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the file; In response to the accessed file satisfying the antivirus scanning condition, the storage node sends the accessed file path to the antivirus server; The antivirus server parses the accessed file path and scans the accessed file; The antivirus server obtains the scanning result and updates the antivirus attribute of the accessed file.

2. The method according to claim 1, characterized in that Before the client sends a file access request to the storage node, an antivirus server cluster is configured, including: The server creates a shared protocol account and a shared protocol account directory, and edits the shared protocol account directory configuration; The client creates a storage directory and mounts the shared protocol account directory to the storage directory; The user accesses the sharing agreement account directory through the storage directory according to the sharing agreement account; In response to the user accessing the shared protocol account directory, the client sends a file access request to the storage node.

3. The method according to claim 2, characterized in that The file access request includes an open request and a close request. In response to the accessed file satisfying the antivirus scanning condition, triggering an antivirus scan according to the antivirus scanning mode; If the antivirus scanning mode is the shutdown request scanning mode, the antivirus scanning is triggered when the client sends the shutdown request; If the antivirus scanning mode is an open and close request scanning mode, the antivirus scanning is triggered when the client sends the open request and the close request; The open request is a synchronous request, and the close request is an asynchronous request.

4. The method according to claim 1, characterized in that: The anti-virus attributes of the accessed files are stored in the storage file system, including: The antivirus attributes of the accessed file and the basic attributes of the accessed file are stored in the storage file system. The storage node obtains the anti-virus attribute of the accessed file through the file system interface. The antivirus attributes of the accessed file include the previous file scanning result, the previous file scanning time, and the previous file hash value.

5. The method according to claim 4, characterized in that Determining whether the accessed file meets the antivirus scanning condition according to the antivirus attribute of the accessed file includes: When the file access request is an open request, determine whether the previous file scan time exceeds a time threshold: If the previous file scanning time exceeds the time threshold, the scan of the accessed file will be started; If the previous file scan time does not exceed the time threshold, the hash value of the currently accessed file is obtained, and it is determined whether the previous file hash value has changed compared with the currently accessed file hash value: If the previous file hash value is different from the currently accessed file hash value, the accessed file scan will be started; If the hash value of the previous file does not change compared to the hash value of the currently accessed file, determine whether the previous file scan result is safe: If the previous file scan result is unsafe, the scan of the accessed file will be started; If the previous file scanning result is safe, the client is allowed to open the accessed file; When the file access request is a close request, determining whether the accessed file has been modified and / or saved; If the accessed file is modified and saved, the accessed file scanning is started when the accessed file is closed; If the accessed file has not been modified or saved, no scanning of the accessed file is performed when the accessed file is closed; Before the accessed file scanning is started, the scanning strategy of the accessed file is matched. According to the scanning strategy matched by the accessed file, scanning of the accessed file is started, The hash value of the currently accessed file is stored in the basic attributes of the accessed file.

6. The method according to claim 1, characterized in that Before the antivirus server parses the accessed file path, it includes: The antivirus scanning filter sends the accessed file path to the Internet Content Adaptation Protocol client; The Internet Content Adaptation Protocol client receives the accessed file path, encapsulates the accessed file path into a first Internet Content Adaptation Protocol message, and sends the first Internet Content Adaptation Protocol message to the antivirus server; The antivirus server obtains the accessed file path through the first Internet Content Adaptation Protocol message.

7. The method according to claim 6, characterized in that The updating of the anti-virus attribute of the accessed file includes: The antivirus server encapsulates the scanning result into a second Internet Content Adaptation Protocol message, and sends the second Internet Content Adaptation Protocol message to the storage node; The storage node obtains the scanning result through the second Internet Content Adaptation Protocol message, stores the scanning result in the storage file system, and determines whether the scanning result is normal: If the scanning result is normal, the client is allowed to open the accessed file; If the scanning result is abnormal, the client is prohibited from opening the accessed file.

8. An anti-virus scanning device, characterized in that: The device comprises: Access module, used by the client to send a file access request to the storage node; An acquisition module, configured to, in response to receiving the file access request, enable the storage node to acquire the antivirus attribute of the accessed file; A judgment module, used for judging whether the accessed file meets the anti-virus scanning condition according to the anti-virus attribute of the file; A sending module, configured to, in response to the accessed file satisfying the antivirus scanning condition, send the accessed file path by the storage node to the antivirus server; A scanning module, used for the antivirus server to parse the accessed file path and scan the accessed file; The updating module is used for the antivirus server to obtain the scanning result and update the antivirus attribute of the accessed file.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images