Mirror image scanning method and device and electronic equipment

Abstract

The embodiment of the invention provides a mirror image scanning method and device and electronic equipment. The mirror image scanning method comprises the steps of obtaining a to-be-detected file in mirror image files; splitting the to-be-detected file into a plurality of batches, and generating scanning subtasks corresponding to the batches; for each batch of scanning sub-tasks, triggering a calculation unit to load a scanning rule corresponding to the scanning sub-tasks, and executing calculation corresponding to the scanning sub-tasks according to the scanning rule, the calculation unit being realized through a function calculation FC service; and merging the calculation results corresponding to the scanning sub-tasks to obtain a mirror image scanning result. The scanning performance is improved, and the scanning time consumption is reduced.

Description

Technical Field

[0001] The present application relates to the field of cloud security, and more specifically, to a mirror scanning method, device, and electronic device. Background Art

[0002] Solutions for container image security, particularly static scanning of image artifacts, are relatively mature. Static scanning scans various files contained within an image to identify potential risks. As scanning capabilities grow and the number of scanning rules increases, the requirements for computing power and server capabilities are also increasing.

[0003] However, the coupling of execution scripts and rules, and the coupling of business modules and calculation modules in the scanning solution make the scanning time too long and the performance poor. Summary of the Invention

[0004] The present application provides a mirror scanning method, device and electronic device, and provides an independent computing unit with elastic computing power based on a serverless architecture, which improves scanning performance and reduces scanning time.

[0005] In a first aspect, the present application provides a mirror scanning method, comprising:

[0006] Get the file to be detected in the image file;

[0007] Splitting the files to be inspected into multiple batches and generating scanning subtasks corresponding to each batch;

[0008] For each batch of scanning subtasks, trigger the computing unit to load the scanning rules corresponding to the scanning subtasks and perform the calculations corresponding to the scanning subtasks according to the scanning rules, wherein the computing unit is implemented by the Function Compute (FC) service;

[0009] The calculation results corresponding to the scanning subtasks are merged to obtain a mirror scanning result.

[0010] In one implementation, obtaining the file to be detected in the image file includes:

[0011] Obtain the image file from the image library;

[0012] A pre-filtering rule is obtained, and the image file is screened based on the pre-filtering rule to determine the file to be detected.

[0013] In one implementation, after obtaining the file to be detected in the image file, the method further includes:

[0014] The file to be detected is transferred to an intermediate storage space outside the service server.

[0015] In one implementation, dividing the files to be inspected into multiple batches and generating scanning subtasks corresponding to each batch includes:

[0016] According to the pre-configured concurrency strategy, the files to be detected are divided into multiple batches, and scanning subtasks corresponding to each batch are generated.

[0017] In one implementation, for each batch of scanning subtasks, triggering the computing unit to load the scanning rule corresponding to the scanning subtask and performing the calculation corresponding to the scanning subtask according to the scanning rule includes:

[0018] For each batch of scanning subtasks, the input component of the computing unit is called to trigger the execution computing component of the computing unit, and the scanning rules corresponding to the scanning subtask are loaded through the execution computing component. The calculation corresponding to the scanning subtask is performed according to the scanning rules, and the calculation result corresponding to the scanning subtask is output through the output component of the computing unit.

[0019] In one implementation, merging the calculation results corresponding to the scanning subtasks to obtain a mirror scan result includes:

[0020] Distribute the calculation results corresponding to each of the scanning subtasks to the recheck engine corresponding to the scanning subtask, and add asynchronous-to-synchronous flags to some or all of the scanning subtasks;

[0021] After obtaining the re-inspection results corresponding to all scanning subtasks with asynchronous-to-synchronous flags added thereto, the re-inspection results are merged to obtain the mirror scan result.

[0022] In one implementation, the re-inspection result includes the name of the detection item corresponding to the scanning subtask, the detection result, and the detection time.

[0023] In a second aspect, the present application provides a mirror scanning device, comprising:

[0024] The acquisition module is used to obtain the file to be detected in the image file;

[0025] A splitting module is used to split the files to be detected into multiple batches and generate scanning subtasks corresponding to each batch;

[0026] A calculation module is configured to trigger a calculation unit to load a scanning rule corresponding to each batch of scanning subtasks, and perform calculations corresponding to the scanning subtasks according to the scanning rule, wherein the calculation unit is implemented by a Function Compute (FC) service;

[0027] The synchronization module is used to merge the calculation results corresponding to the scanning subtasks to obtain a mirror scanning result.

[0028] In one implementation, the acquisition module is configured to:

[0029] Obtain the image file from the image library;

[0030] A pre-filtering rule is obtained, and the image file is screened based on the pre-filtering rule to determine the file to be detected.

[0031] In one implementation, the acquisition module is configured to:

[0032] The file to be detected is transferred to an intermediate storage space outside the service server.

[0033] In one implementation, the splitting module is used to:

[0034] According to the pre-configured concurrency strategy, the files to be detected are divided into multiple batches, and scanning subtasks corresponding to each batch are generated.

[0035] In one implementation, the calculation module is configured to:

[0036] For each batch of scanning subtasks, the input component of the computing unit is called to trigger the execution computing component of the computing unit, and the scanning rules corresponding to the scanning subtask are loaded through the execution computing component. The calculation corresponding to the scanning subtask is performed according to the scanning rules, and the calculation result corresponding to the scanning subtask is output through the output component of the computing unit.

[0037] In one implementation, the synchronization module is configured to:

[0038] Distribute the calculation results corresponding to each of the scanning subtasks to the recheck engine corresponding to the scanning subtask, and add asynchronous-to-synchronous flags to some or all of the scanning subtasks;

[0039] After obtaining the re-inspection results corresponding to all scanning subtasks with asynchronous-to-synchronous flags added thereto, the re-inspection results are merged to obtain the mirror scan result.

[0040] In one implementation, the re-inspection result includes the name of the detection item corresponding to the scanning subtask, the detection result, and the detection time.

[0041] In a third aspect, the present application provides an electronic device, comprising: a memory and a processor;

[0042] The memory is used to store computer programs;

[0043] The processor is configured to execute a computer program stored in the memory, and when the computer program is run, the processor is enabled to execute the method according to the first aspect.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the method described in the first aspect.

[0045] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which implements the method described in the first aspect when executed by a processor.

[0046] The image scanning method, device, and electronic device provided in the present application split the files to be detected in the image file into multiple batches and generate scanning subtasks corresponding to each batch; for each batch of scanning subtasks, trigger the computing unit implemented based on the FC service to load the scanning rules corresponding to the scanning subtask, and perform the calculation corresponding to the scanning subtask according to the scanning rules, thereby achieving a complete splitting of the business code and the computing logic, and the splitting of the computing script and the scanning rules. By utilizing the independent computing unit based on the FC service with computing power and elastic scalability, the most performance-consuming computing steps in the scanning are split into multiple concurrent tasks, thereby comprehensively improving the performance of the scanning process. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] Figure 1 This is a schematic diagram of the architecture of a mirror scanning solution provided in an embodiment of the present application;

[0049] Figure 2 This is a flow chart of a mirror scanning method provided in an embodiment of the present application;

[0050] Figure 3 Schematic diagram of the structure of a mirror scanning device provided in an embodiment of the present application;

[0051] Figure 4 It is a schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0053] The following describes the terms used in the embodiments of the present application.

[0054] Computing unit: It has only three parts: input, output, and calculation. It is independent of the business system, does not participate in business logic, and is only responsible for performing complex calculations (regular matching, format verification). It is a stateless module.

[0055] Serverless architecture is a cloud computing architecture model that enables developers to build and run applications on cloud platforms without having to manage the underlying server infrastructure. The cloud platform automatically handles application deployment, scaling, and management, allocating and releasing resources based on application needs. This architecture model can provide higher development efficiency and lower operating costs, while also offering high scalability and elasticity.

[0056] Function Computing (FC) is a cloud computing service model that enables developers to write and deploy application code in a serverless manner. In Function Computing, developers simply write function code and upload it to the cloud platform, eliminating the need to worry about server management and maintenance. When a request triggers a function, the cloud platform automatically allocates resources to execute the function and returns the results.

[0057] Asynchronous scanning: Many detection items in image scanning require rechecking by downstream engines. Therefore, the detection items are gradually returned to the cloud after the scan is completed.

[0058] Traditional image scanning solutions typically include the following components: rule management, rule execution, and data aggregation and reporting. Rule execution involves image extraction, decompression, file traversal, and rule matching, which involves numerous regular expression operations. To ensure scanning performance, multi-threaded streaming processing is typically used. However, this approach presents the following issues:

[0059] 1. High coupling makes migration difficult: Execution scripts and rules are coupled, business code and computing logic are coupled, and image data needs to be stored locally on the business server. This makes it difficult to be compatible with the complex multi-cloud environment of hybrid cloud and affects scanning performance.

[0060] 2. Scanning performance bottleneck: Limited by the performance of a single business server and the upper limit of the number of concurrent threads, the scanning time of traditional image scanning is difficult to reduce. As the number of rules increases, the scanning time will also increase accordingly.

[0061] 3. High stability risk: Since local business servers need to perform a large number of regular expression calculations, they put a lot of pressure on the CPU. When the query-per-second (QPS) rate reaches its peak, multi-threaded concurrent regular expression calculations will cause the CPU usage to reach 100%.

[0062] 4. High idle cost: To cope with peak scan QPS, high-specification CPUs, memory, and large-capacity hard drives are required. These configurations have extremely low utilization rates during low scan QPS periods, resulting in significant resource idle costs.

[0063] 5. Unstable timeliness of results: The scanning results of most detection items need to be rechecked by the recheck engine. Currently, asynchronous detection result reporting is mostly adopted. That is, the recheck results are asynchronously reported after the recheck of each detection item is completed, and the timeliness of the results is unstable.

[0064] In view of this, a mirror scanning solution is proposed in the embodiment of the present application, referring to Figure 1 As shown in the architecture diagram, the core of this solution is to completely separate the business code and computing logic, establish independent computing units with computing power and elastic scalability, split the most performance-intensive computing steps in scanning into multiple concurrent tasks, and use the cloud scanner to adapt the input and output of the computing units and task scheduling. The details are as follows:

[0065] 1. The computing unit of the Serverless architecture has the following characteristics:

[0066] The computing unit is implemented through the FC service, using a base image to initialize the FC computing instance, with the elastic ability to create and destroy it in seconds. The base image is a model obtained by abstracting various risk types that need to be detected and scanned.

[0067] The computing unit consists of three logical units: a unified format input component, an execution computing component, and a unified format output component. Each computing unit is unaware of business data and does not rely on any business environment.

[0068] Rules and calculation scripts are separated, rules can be operated independently, and calculation scripts can be fully reused.

[0069] 2. Cloud scanner, with the following features:

[0070] The cloud scanner supports independent operation of scanning rules, which take effect in real time.

[0071] The cloud scanner supports free configuration of concurrency, splitting the scanning task of a single image into multiple scanning subtasks based on the number of files in a single batch, the number of scanning rules, etc. The scanning subtasks are executed in parallel and finally summarized into a complete image scanning result.

[0072] The cloud scanner realizes the asynchronous conversion of results to synchronous one. After sending the calculation results of the scanning subtask to the downstream engine, the re-inspection results reported by the downstream engine are unified and merged. The cloud scanner performs the task status flow to realize the synchronous simulation of the asynchronous process.

[0073] Figure 2 This is a flow chart of a mirror scanning method provided by an embodiment of the present application. The execution subject of this method is a cloud scanner. Figure 2 As shown, the method includes:

[0074] S201: Obtain a file to be detected in an image file.

[0075] Optional, see Figure 1 In this architecture, the cloud scanner retrieves image files from the image repository, obtains pre-filtering rules, and uses these pre-filtering rules to filter the image files to determine the files to be detected. For example, the pre-filtering rules include filtering for file size, path, and string. After decompressing the image file, the cloud scanner removes useless files based on the pre-filtering rules, thereby reducing the computational complexity of the image scan.

[0076] Optionally, after obtaining the file to be detected in the mirror file, the method of the embodiment of the present application may further include: transferring the file to be detected to an intermediate storage space outside the service server.

[0077] For example, the files to be detected are stored in the Object Storage Service (OSS) space, thereby avoiding occupation of the business server.

[0078] S202: Split the files to be detected into multiple batches, and generate scanning subtasks corresponding to each batch.

[0079] Optionally, according to the pre-configured concurrency strategy, the files to be detected are divided into multiple batches, and scanning subtasks corresponding to each batch are generated. For example, different scanning subtasks can correspond to the same or different detection items, such as vulnerability detection, limit detection, binary file detection, etc. Among them, the concurrency strategy can be determined by the user based on the number of files to be detected, scanning rules, etc., and can support free configuration. For example, the concurrency strategy can indicate the number of scanning subtasks that can be executed in parallel. For example, there are 10,000 files to be detected, and the files to be detected are divided into 100 batches, with 100 files in each batch.

[0080] S203 . For each batch of scanning subtasks, trigger the computing unit to load the scanning rules corresponding to the scanning subtasks, and perform the calculation corresponding to the scanning subtasks according to the scanning rules. The computing unit is implemented through the FC service.

[0081] Each scan subtask is executed by a computing unit instance, and multiple computing unit instances can execute different scan subtasks in parallel.

[0082] For each batch of scanning subtasks, the input component of the computing unit is called to trigger the execution computing component of the computing unit. The scanning rules corresponding to the scanning subtask are loaded through the execution computing component, and the calculation corresponding to the scanning subtask is performed according to the scanning rules. The calculation results corresponding to the scanning subtask are then output through the output component of the computing unit.

[0083] The input component of the computing unit needs to obtain input parameters and input files. The input parameters may include file indexes and scan rule indexes. The input files can be retrieved from the intermediate storage space based on the input parameters. The computing execution component can download the scanning rules corresponding to the scanning subtask from the independently operated scanning rules based on the scan rule index.

[0084] S204: Merge the calculation results corresponding to the scanning subtasks to obtain a mirror scan result.

[0085] By merging the calculation results of multiple scanning subtasks, asynchronous results can be simulated as synchronous.

[0086] In the scenario of re-inspection through the re-inspection engine, the calculation results corresponding to each scanning subtask are distributed to the re-inspection engine corresponding to the scanning subtask, and an asynchronous-to-synchronous flag is added to some or all of the scanning subtasks; after obtaining the re-inspection results corresponding to all scanning subtasks with the asynchronous-to-synchronous flag added, the re-inspection results are merged to obtain the mirrored scanning results, realizing the unified synchronization state simulation of the time nodes of the scanning task status and the data reflow status.

[0087] Optionally, the recheck results returned by the recheck engine include the name of the detection item corresponding to the scan subtask, the detection result, and the detection time. The cloud scanner merges the above results returned by each recheck engine to complete the synchronization status change of the scan.

[0088] The image scanning method provided in the embodiments of the present application completely separates business code and computing logic, separates computing scripts and scanning rules, establishes an independent computing unit based on FC services with computing power and elastic scalability, and splits the most performance-intensive computing steps in the scan into multiple concurrent tasks. This comprehensively improves the performance of the image scanning process, reduces scanning time, and facilitates porting to multi-cloud environments.

[0089] The use of independent computing units decouples computing power from business logic, resolving multiple issues such as high coupling, performance risks, and high costs. Independent computing units offer the flexibility to be created and destroyed in seconds. Through concurrent multi-task splitting, they maximize parallel processing and achieve high-performance scanning. Furthermore, independent computing units are only responsible for computing the current task and do not consume the CPU of the cloud-based business server. The CPU and storage space within the computing unit can be fully utilized without incurring other stability risks. Since cloud-based business servers no longer require complex computations, CPU and storage configurations can be appropriately reduced, saving costs. Under the pay-as-you-go model, they are fully utilized during peak periods, and no additional fees are incurred when idle.

[0090] Furthermore, by decoupling computing from business processes, scanning rules are processed within the business process, while actual computing is performed in independent computing units. When scanning rules need to be changed or upgraded, only the changes to the rules are required, and the modifications take effect immediately, eliminating the need for cumbersome development and release processes. This enables efficient iteration and real-time upgrades.

[0091] In addition, the cloud-based scanning and downstream recheck engine realize synchronous state simulation of asynchronous processing results, unifying the time nodes of scanning task status and data reflow status, and realizing the unification of status and result invalidation.

[0092] Figure 3 This is a schematic diagram of the structure of a mirror scanning device provided in an embodiment of the present application. Figure 3 As shown, the mirror scanning device 300 includes:

[0093] The acquisition module 301 is used to obtain the file to be detected in the image file;

[0094] The splitting module 302 is used to split the files to be detected into multiple batches and generate scanning subtasks corresponding to each batch;

[0095] The calculation module 303 is used to trigger the calculation unit to load the scanning rules corresponding to the scanning subtasks for each batch, and perform the calculation corresponding to the scanning subtask according to the scanning rules. The calculation unit is implemented by the Function Compute (FC) service.

[0096] The synchronization module 304 is used to merge the calculation results corresponding to the scanning subtasks to obtain a mirror scanning result.

[0097] In one implementation, the acquisition module 301 is configured to:

[0098] Get the image file from the image library;

[0099] Obtain pre-filtering rules, and filter the image files based on the pre-filtering rules to determine the files to be detected.

[0100] In one implementation, the acquisition module 301 is configured to:

[0101] Transfer the file to be tested to an intermediate storage space outside the business server.

[0102] In one implementation, the splitting module 302 is configured to:

[0103] According to the pre-configured concurrency strategy, the files to be detected are divided into multiple batches, and scanning subtasks corresponding to each batch are generated.

[0104] In one implementation, the calculation module 303 is configured to:

[0105] For each batch of scanning subtasks, the input component of the computing unit is called to trigger the execution computing component of the computing unit. The scanning rules corresponding to the scanning subtask are loaded through the execution computing component, and the calculation corresponding to the scanning subtask is performed according to the scanning rules. The calculation results corresponding to the scanning subtask are then output through the output component of the computing unit.

[0106] In one implementation, the synchronization module 304 is configured to:

[0107] Distribute the calculation results corresponding to each scanning subtask to the recheck engine corresponding to the scanning subtask, and add asynchronous to synchronous flags for some or all of the scanning subtasks;

[0108] After obtaining the re-inspection results corresponding to all scanning subtasks with asynchronous-to-synchronous flags added, the re-inspection results are merged to obtain a mirror scan result.

[0109] In one implementation, the re-inspection result includes the name of the detection item corresponding to the scanning subtask, the detection result, and the detection time.

[0110] The device of the embodiment of the present application can be used to execute the mirror scanning method in the aforementioned embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0111] Figure 4 Schematic block diagram of an electronic device provided in an embodiment of the present application. Figure 4 As shown, the electronic device 400 may include at least one processor 401 for implementing the mirror scanning method provided in the embodiment of the present application.

[0112] Optionally, the electronic device 400 further includes at least one memory 402 for storing program instructions and / or data. The memory 402 is coupled to the processor 401. Coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 401 may operate in conjunction with the memory 402. The processor 401 may execute program instructions stored in the memory 402. At least one of the at least one memory may be included in the processor.

[0113] Optionally, the electronic device 400 further includes a communication interface 403 for communicating with other devices via a transmission medium, thereby enabling the electronic device 400 to communicate with other devices. The communication interface 403 may be, for example, a transceiver, an interface, a bus, a circuit, or a device capable of implementing transceiver functions. The processor 401 may utilize the communication interface 403 to transmit and receive data and / or information, and to implement the methods provided in the embodiments of the present application. For details, please refer to the detailed description in the preceding embodiments, which will not be repeated here.

[0114] The specific connection medium between the processor 401, the memory 402 and the communication interface 403 is not limited in the embodiment of the present application. Figure 4 In the embodiment, the processor 401, the memory 402 and the communication interface 403 are connected via a bus 404. The bus 404 is Figure 4 The connections between the other components are shown in bold lines, which are only for illustration and not intended to be limiting. The bus can be divided into address bus, data bus, control bus, etc. Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0115] It should be understood that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method embodiment can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-mentioned processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above-mentioned method.

[0116] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0117] The present application also provides a computer-readable storage medium storing a computer program (also referred to as code or instruction). When the computer program is executed by a processor, the computer executes the method in any of the aforementioned embodiments.

[0118] The present application also provides a computer program product, including a computer program, which implements the method in any of the aforementioned embodiments when executed by a processor.

[0119] The terms "unit," "module," and the like used in this specification may be used to refer to a computer-related entity, hardware, firmware, a combination of hardware and software, software, or software in execution.

[0120] Those skilled in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. In the several embodiments provided in this application, it should be understood that the disclosed devices, equipment, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not performed. In addition, the coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, and can be electrical, mechanical, or other forms.

[0121] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0122] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0123] In the above-described embodiments, the functions of each functional unit can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (program) are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0124] If this function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0125] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0126] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A mirror scanning method, characterized in that: include: Get the file to be detected in the image file; Splitting the files to be inspected into multiple batches and generating scanning subtasks corresponding to each batch; For each batch of scanning subtasks, trigger the computing unit to load the scanning rules corresponding to the scanning subtasks and perform the calculations corresponding to the scanning subtasks according to the scanning rules, wherein the computing unit is implemented by the Function Compute (FC) service; The calculation results corresponding to the scanning subtasks are merged to obtain a mirror scanning result.

2. The method according to claim 1, characterized in that The step of obtaining the file to be detected in the image file includes: Obtain the image file from the image library; A pre-filtering rule is obtained, and the image file is screened based on the pre-filtering rule to determine the file to be detected.

3. The method according to claim 1, characterized in that After obtaining the file to be detected in the image file, the method further includes: The file to be detected is transferred to an intermediate storage space outside the service server.

4. The method according to any one of claims 1 to 3, characterized in that The step of dividing the files to be detected into multiple batches and generating scanning subtasks corresponding to each batch includes: According to the pre-configured concurrency strategy, the files to be detected are divided into multiple batches, and scanning subtasks corresponding to each batch are generated.

5. The method according to any one of claims 1 to 3, characterized in that The scanning subtask for each batch triggers the computing unit to load the scanning rule corresponding to the scanning subtask and perform the calculation corresponding to the scanning subtask according to the scanning rule, including: For each batch of scanning subtasks, the input component of the computing unit is called to trigger the execution computing component of the computing unit, and the scanning rules corresponding to the scanning subtask are loaded through the execution computing component. The calculation corresponding to the scanning subtask is performed according to the scanning rules, and the calculation result corresponding to the scanning subtask is output through the output component of the computing unit.

6. The method according to any one of claims 1 to 3, characterized in that The merging of the calculation results corresponding to the scanning subtasks to obtain a mirror scanning result includes: Distribute the calculation results corresponding to each of the scanning subtasks to the recheck engine corresponding to the scanning subtask, and add asynchronous-to-synchronous flags to some or all of the scanning subtasks; After obtaining the re-inspection results corresponding to all scanning subtasks with asynchronous-to-synchronous flags added thereto, the re-inspection results are merged to obtain the mirror scan result.

7. The method according to claim 6, characterized in that The re-inspection result includes the name of the detection item corresponding to the scanning subtask, the detection result and the detection time.

8. A mirror scanning device, characterized in that: include: The acquisition module is used to obtain the file to be detected in the image file; A splitting module is used to split the files to be detected into multiple batches and generate scanning subtasks corresponding to each batch; A calculation module is configured to trigger a calculation unit to load a scanning rule corresponding to each batch of scanning subtasks, and perform calculations corresponding to the scanning subtasks according to the scanning rule, wherein the calculation unit is implemented by a Function Compute (FC) service; The synchronization module is used to merge the calculation results corresponding to the scanning subtasks to obtain a mirror scanning result.

9. An electronic device, characterized in that: include: memory and processor; The memory is used to store computer programs; The processor is configured to execute a computer program stored in the memory, and when the computer program is executed, the processor is enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images