FTP-based communication method, communication device, electronic device and storage medium

Abstract

The invention relates to the technical field of communication, and discloses an FTP-based communication method, communication equipment, electronic equipment and a computer readable storage medium. The FTP-based communication method comprises the steps that a target communication message transmitted in a target session is acquired, virus detection is performed on the target communication message, the target session is a session constructed based on FTP, and the target session comprises a control connection channel and a data connection channel; and in response to a virus file detected in the target communication message, cutting off the control connection channel and the data connection channel. The FTP-based communication method, the communication equipment, the electronic equipment and the computer readable storage medium provided by the invention have the advantage of improving the security during data communication based on the FTP.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, communication equipment, electronic equipment and computer-readable storage medium based on FTP. Background Art

[0002] FTP, short for File Transfer Protocol, controls bidirectional file transfers, allowing users to upload and download files to and from a remote host through client programs. Enterprises often provide clients with a dedicated FTP server to facilitate the exchange of large files, such as design drawings up to several hundred megabytes. FTP can also serve as a backup server for corporate files, allowing remote backup of critical applications like databases. Due to the widespread use of FTP servers in enterprises, many hackers and virus attackers attempt to exploit them, using them as a springboard to spread Trojans and viruses. Summary of the Invention

[0003] In view of this, it is necessary to provide a communication method, communication device, electronic device and computer-readable storage medium based on FTP to improve the security of data communication based on FTP.

[0004] In order to solve the above problems, the present application provides an FTP-based communication method, including: obtaining a target communication message transmitted in a target session, and performing virus detection on the target communication message, wherein the target session is a session constructed based on FTP, and the target session includes a control connection channel and a data connection channel; in response to detecting a virus file in the target communication message, cutting off the control connection channel and the data connection channel.

[0005] In an optional embodiment, the target session is a breakpoint-resume session, and the virus detection of the target communication message includes: obtaining a target file identifier in the target communication message; determining whether the target file identifier exists in a preset virus identifier library, the preset virus identifier library including several virus file identifiers of virus files; in response to the presence of the target file identifier in the preset virus identifier library, determining that a virus file is detected in the target communication message. For the target session constructed by breakpoint resumption, during its communication process, the target file identifier in the target communication message is obtained, and the target file identifier is compared with the virus file in the preset virus identification library to determine whether the target file identifier exists in the preset virus identification library. If the target file identifier exists in the preset virus identification library, it means that there is a virus in the target communication message. At this time, interrupting the target session can reduce the possibility of virus transmission during the communication process of the target session. Since the target file identifier of the target communication message will not be affected by the integrity of the target communication message, the determination of whether there is a virus in the target communication message based on the target file identifier in this application will not be affected by breakpoint resumption, thereby improving the accuracy of the detection result of whether there is a virus in the target communication message in the breakpoint resumption function, and solving the problems of low virus detection capability and high virus transmission risk in the breakpoint resumption function.

[0006] In an optional embodiment, the FTP-based communication method further includes: in response to detecting a virus file in the target communication message, entering a virus file identifier of the virus file into a preset virus identifier library.

[0007] In an optional embodiment, before obtaining the target file identifier in the target communication message, the FTP-based communication method further includes: for any real-time session, determining whether the real-time session is the breakpoint resume session based on the communication instruction for initiating message transmission in the real-time session.

[0008] In an optional embodiment, obtaining the target file identifier in the target communication message includes: obtaining the IP address of the sender of the target communication message, and / or obtaining the file name of the target communication message.

[0009] In an optional embodiment, the virus detection of the target communication message includes: calculating the target MD5 value of the target communication message, and determining whether the target MD5 value exists in a preset virus MD5 library, wherein the preset virus MD5 library includes the MD5 value of the virus file; if the target MD5 value exists in the preset virus MD5 library, it is determined that a virus file is detected in the target communication message.

[0010] The present application also provides a communication device, including: a message acquisition module, the message acquisition module is used to acquire a target communication message transmitted in a target session, the target session is a session constructed based on FTP, and the target session includes a control connection channel and a data connection channel; a virus detection module, the virus detection module is used to perform virus detection on the target communication message; and a communication module, the communication module is used to cut off the control connection channel and the data connection channel in response to detecting a virus file in the target communication message.

[0011] In an optional embodiment, the virus detection module includes an identifier extraction submodule and an identifier comparison submodule; in response to the target session being a breakpoint resume session, the identifier extraction submodule is used to obtain the target file identifier in the target communication message, and the identifier comparison submodule is used to determine whether the target file identifier exists in a preset virus identifier library, and the preset virus identifier library includes several virus file identifiers of virus files; in response to the target file identifier existing in the preset virus identifier library, it is determined that a virus file is detected in the target communication message.

[0012] The present application also provides an electronic device, including a memory and a processor, wherein the memory is used to store programs; the processor is coupled to the memory and is used to execute the programs stored in the memory to implement the FTP-based communication method as described above.

[0013] The present application also provides a computer-readable storage medium for storing computer-readable programs or instructions, which, when executed by a processor, can implement the aforementioned FTP-based communication method.

[0014] The beneficial effects of this application are: Compared with the related art, in the FTP-based communication method provided by the present application, when a virus file is detected in the target communication message, the control connection channel and the data connection channel in the target session constructed based on FTP are simultaneously cut off. Compared with the related art of only cutting off the data connection channel, cutting off the control connection channel at the same time can completely close the target session for transmitting the virus file, thereby avoiding the subsequent transmission of the virus file after the data connection channel is rebuilt based on the control connection channel, thereby improving the security of data communication based on FTP. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] FIG1 is a flow chart of a communication method based on FTP provided in one embodiment of the present application; Figure 2 A flowchart of a method for constructing a preset virus identification library in an FTP-based communication method provided in one embodiment of the present application; Figure 3A flow chart of a method for performing virus detection on real-time communication messages using MD5 values ​​in an FTP-based communication method provided in one embodiment of the present application; Figure 4 A flowchart of a method for constructing a virus identification library according to an embodiment of the present application; Figure 5 A schematic diagram of the structure of a communication device provided in one embodiment of the present application; Figure 6 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0016] The preferred embodiments of the present application are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of the present application and are used together with the embodiments of the present application to illustrate the principles of the present application, and are not used to limit the scope of the present application.

[0017] Resumable data transfer is a technology that allows data transfers (such as downloads and file uploads) to resume from the point where they were interrupted, rather than starting from the beginning, after being paused due to network outages, device failures, or program crashes. By recording the location of the data being transferred (the breakpoint), it skips the completed portion when resuming the transfer, significantly improving transfer efficiency and reducing wasted time and bandwidth.

[0018] Since virus detection in the prior art during communication is usually performed on the entire text of the transmitted file, while during breakpoint resume transmission, only a partial file is transmitted, resulting in reduced accuracy of virus detection.

[0019] To solve the above technical problems, please refer to Figure 1 A specific embodiment of the present application discloses a communication method based on FTP, which specifically includes the following steps: Step S101: obtaining a target communication message transmitted in a target session, where the target session is a session constructed based on FTP, and the target session includes a control connection channel and a data connection channel.

[0020] Step S102: Perform virus detection on the target communication message.

[0021] Step S103: In response to detecting a virus file in the target communication message, the control connection channel and the data connection channel are cut off.

[0022] Compared with related technologies, in the FTP-based communication method provided in this embodiment, when a virus file is detected in the target communication message, the control connection channel and the data connection channel in the target session established based on FTP are simultaneously cut off. Compared with the related technology of only cutting off the data connection channel, cutting off the control connection channel at the same time can completely close the target session for transmitting the virus file, thereby avoiding the subsequent transmission of the virus file after the data connection channel is rebuilt based on the control connection channel, thereby improving the security of data communication based on FTP.

[0023] In some embodiments of the present application, a session in step S101 is a continuous, orderly interaction process established between two or more communication devices (e.g., terminal devices, servers, applications, etc.) to complete a specific task. An FTP-based session is one in which the session establishment and communication process complies with relevant FTP protocol standards.

[0024] FTP utilizes a client-server architecture, achieving functional separation through two independent connection channels: a control channel and a data channel, ensuring efficient command control and data transfer. The control channel is used to transmit FTP commands (such as logging in, listing files, switching directories, etc.) and server responses. It remains open throughout the entire FTP session. The data channel is used to transmit actual file data, directory listings, and other content. It is established only when data transfer is needed and closed after the transfer is complete. Throughout the FTP session, as long as the control channel remains open, both parties can communicate and negotiate through it. Based on the negotiation results, a data transfer channel is then established for specific file transfers. Therefore, in the related art, even if a virus file is detected in a session's messages, only the data transfer channel is closed, leaving the control channel intact. This allows the data transfer channel to be reestablished later for virus file transfers. In this embodiment, severing the control channel also completely closes the target session transmitting the virus file, preventing subsequent virus file transfers after the data connection channel is reestablished via the control channel, thereby improving the security of FTP-based data communications.

[0025] For further information, please refer to Figure 2 When the target session is a resumable session, the virus detection on the target communication message in step S102 may specifically include: Step S201: Obtain the target file identifier in the target communication message.

[0026] Step S202: Determine whether the target file identifier exists in the preset virus identifier library.

[0027] Step S203: In response to the target file identifier existing in the preset virus identifier library, it is determined that a virus file is detected in the target communication message.

[0028] For the target session constructed by breakpoint resumption, during its communication process, the target file identifier in the target communication message is obtained, and the target file identifier is compared with the virus file in the preset virus identification library to determine whether the target file identifier exists in the preset virus identification library. If the target file identifier exists in the preset virus identification library, it means that there is a virus in the target communication message. At this time, interrupting the target session can reduce the possibility of virus transmission during the communication process of the target session. Since the target file identifier of the target communication message will not be affected by the integrity of the target communication message, the determination of whether there is a virus in the target communication message based on the target file identifier in this application will not be affected by breakpoint resumption, thereby improving the accuracy of the detection result of whether there is a virus in the target communication message in the breakpoint resumption function, and solving the problems of low virus detection capability and high virus transmission risk in the breakpoint resumption function.

[0029] FTP also supports resumable transfers. This means that if a file transfer is interrupted due to some reason (such as a network failure or server downtime), the FTP client can resume the file transfer from the interrupted point after the connection is restored, without having to start over. A resumable transfer session is a session established between two or more communicating devices based on this feature.

[0030] Furthermore, multiple real-time sessions can be established between communication devices. These multiple real-time sessions can include resumable transfer sessions established using the resumable transfer function, as well as other types of sessions established using other methods. Before step S201, whether the real-time session is a resumable transfer session can also be determined based on the communication instruction used to initiate message transmission within the real-time session. Specifically, before a file transfer is initiated within a real-time session, a communication instruction is sent to indicate the specific file to be transferred and the file transfer method. For example, in a resumable transfer session based on the FTP communication protocol, communication terminals use the command REST XXXX (where XXXX is the resume transfer start byte, which indicates the position of the byte that has already been transferred before the resuming) to negotiate that the file transfer will be resumed starting at byte XXXX of the file. Therefore, in an application scenario based on the FTP communication protocol, by detecting whether the communication instruction used to initiate message transmission within the real-time session is a REST instruction, the real-time session can be determined to be a resumable transfer session, i.e., the target session, if the communication instruction is a REST instruction. Conversely, if the communication instruction is not a REST instruction, the real-time session can be determined to be not a resumable transfer session, i.e., not the target session.

[0031] In embodiments of the present application, the target file identifier is specifically the file identifier of the file transmitted by the target communication message, which is a set of information or symbols used to uniquely or specifically identify a file. The form and function of the file identifier vary in different scenarios. In some embodiments of the present application, the target file identifier can specifically be, for example, the IP address of the sender of the target communication message and / or the file name of the target communication message. The aforementioned use of the IP address and / or file name as the target file identifier is merely a specific example of the target file identifier in some embodiments of the present application. In other embodiments of the present application, the target communication message can also be other identifiers such as a file handle, a physical block address, or a volume serial number.

[0032] In an embodiment of the present application, the virus identification library preset in step S202 includes several virus file identifications corresponding to virus files. The virus file identification can be a pre-stored virus file identification, that is, a virus file identification that has been stored before communication. Or in some embodiments of the present application, please refer to Figure 3 , you can also build a preset virus identification library based on the following steps.

[0033] Step S301: obtaining real-time communication messages transmitted in a real-time session, and performing virus detection on the real-time communication messages.

[0034] Step S302: In response to detecting a virus file in the real-time communication message, the real-time session is interrupted, and the virus file identifier of the virus file is entered into a preset virus identifier library.

[0035] By performing virus detection on real-time sessions, the virus file identifiers of the detected virus files are entered into a preset virus identifier library, so that the virus file identifiers in the preset virus identifier library are continuously added and updated during the communication process, making the preset virus identifier library more compatible with the current communication process. A more compatible preset virus identifier library can further improve the accuracy of virus detection on the target session.

[0036] In step S301, the real-time communication message can be specifically tested for viruses using the MD5 value. Figure 4 , specifically including the following steps.

[0037] Step S401: Calculate the real-time MD5 value of the real-time communication message.

[0038] Step S402: Determine whether there is a real-time MD5 value in the preset virus MD5 database. If so, execute step S403; if not, execute step S404.

[0039] Step S403: Determine whether a virus file is detected in the real-time communication message.

[0040] Step S404: Determine that no virus file is detected in the real-time communication message.

[0041] The MD5 value is the result of computing the real-time communication message using the MD5 Message-Digest Algorithm. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. The preset virus MD5 library is a pre-set database of MD5 values ​​for multiple known virus files. The preset virus MD5 library contains the MD5 values ​​of virus files. The real-time MD5 value of the real-time communication message is compared with the MD5 values ​​of known virus files in the preset virus MD5 library. If the real-time MD5 value of the real-time communication message matches the MD5 value of any known virus file, meaning the real-time MD5 value exists in the preset virus MD5 library, the presence of the corresponding virus in the real-time communication message can be determined.

[0042] It is understood that the aforementioned virus detection by calculating the MD5 value is merely an example of a specific method for virus detection in this embodiment. In some other embodiments of the present application, virus identification may also be performed based on other characteristics of the virus file, such as by comparing the code sequence in the file with the signature code in the virus database.

[0043] Furthermore, in some embodiments of the present application, while determining whether the target file identifier exists in the preset virus identification library in step S202, the target MD5 value of the target communication message can also be calculated simultaneously to determine whether the target MD5 value exists in the preset virus MD5 library, which includes the MD5 value of the virus file; if the target MD5 value exists in the preset virus MD5 library, it is determined that a virus file is detected in the target communication message. By calculating the target MD5 value of the target communication message and comparing the target MD5 value with the MD5 value of the virus file in the preset virus MD5 library, it is possible to further determine whether the target communication message includes a virus file through the target MD5 value. By detecting the virus file in the target communication message in these two ways, the accuracy of the virus detection result can be further improved.

[0044] Please refer to Figure 5An embodiment of the present application also provides a communication device, including: a message acquisition module 501, the message acquisition module 501 is used to acquire a target communication message transmitted in a target session, the target session is a session constructed based on FTP, and the target session includes a control connection channel and a data connection channel; a virus detection module 502, the virus detection module 502 is used to perform virus detection on the target communication message; and a communication module 503, the communication module 503 is used to cut off the control connection channel and the data connection channel in response to detecting a virus file in the target communication message.

[0045] Specifically, in an embodiment of the present application, the communication device may be a communication device located between two or more communicating communication terminals (e.g., a client and a server) and running a firewall. Specifically, the communication device may send an interruption request to each of the two or more communicating communication terminals (e.g., a client and a server) via the communication module 503 to interrupt the target session.

[0046] Furthermore, in this embodiment, the virus detection module 502 includes an identifier extraction submodule 5021 and an identifier comparison submodule 5022; in response to the target session being a breakpoint resume session, the identifier extraction submodule 5021 is used to obtain the target file identifier in the target communication message, and the identifier comparison submodule 5022 is used to determine whether the target file identifier exists in a preset virus identifier library, which includes several virus file identifiers of virus files; in response to the presence of the target file identifier in the preset virus identifier library, it is determined that a virus file is detected in the target communication message.

[0047] Please refer to Figure 6 The present invention also provides an electronic device. The electronic device 600 includes a processor 601 , a memory 602 , and a display 603 . Figure 6 Only some of the components of the electronic device 600 are shown, but it should be understood that implementation of all of the shown components is not required, and more or fewer components may be implemented instead.

[0048] In some embodiments, the processor 601 may be a central processing unit (CPU), a microprocessor, or other data processing chip, configured to execute program codes or process data stored in the memory 602, such as the FTP-based communication method or the virus identification library construction method of the present invention.

[0049] In some embodiments, processor 601 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, processor 601 may be local or remote. In some embodiments, processor 601 may be implemented on a cloud platform. In one embodiment, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an on-premises cloud, a multi-cloud, or any combination thereof.

[0050] In some embodiments, the memory 602 may be an internal storage unit of the electronic device 600, such as a hard disk or memory of the electronic device 600. In other embodiments, the memory 602 may also be an external storage device of the electronic device 600, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 600.

[0051] Furthermore, the memory 602 may include both an internal storage unit of the electronic device 600 and an external storage device. The memory 602 is used to store application software installed in the electronic device 600 and various data.

[0052] In some embodiments, the display 603 can be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display 603 is used to display information on the electronic device 600 and to display a visual user interface. Components 601-603 of the electronic device 600 communicate with each other via a system bus.

[0053] In one embodiment, when the processor 601 executes the communication program in the memory 602, the following steps may be implemented: Obtaining a target communication message transmitted in a target session, and obtaining a target file identifier in the target communication message, wherein the target session is a breakpoint-resume transmission session; Determine whether the target file identifier exists in a preset virus identifier library, where the preset virus identifier library includes several virus file identifiers of virus files; In response to the target file identification existing in the preset virus identification library, the target session is interrupted.

[0054] Alternatively, you can implement: Build and initialize virus identification library; Acquire real-time communication messages transmitted in a real-time session and perform virus detection on the real-time communication messages; In response to detecting a virus file in the real-time communication message, a virus file identifier of the virus file is entered into an initialized virus identifier library.

[0055] It should be understood that, when the processor 601 executes the communication program or the virus identification library construction program in the memory 602 , in addition to the above functions, it can also implement other functions. For details, please refer to the description of the corresponding method embodiment above.

[0056] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 600 mentioned. The electronic device 600 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, or the like. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft, or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 600 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0057] Accordingly, an embodiment of the present application also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, it can implement the steps or functions of the FTP-based communication method and / or virus identification library construction method provided in the above-mentioned method embodiments.

[0058] Those skilled in the art will appreciate that all or part of the process flow of the above-described method embodiment can be implemented by instructing related hardware (such as a processor, controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0059] The above are only preferred specific implementation methods of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed in this application should be covered by the scope of protection of the present application.

Claims

1. A communication method based on FTP, characterized in that: include: Obtaining a target communication message transmitted in a target session, and performing virus detection on the target communication message, wherein the target session is a session constructed based on FTP and includes a control connection channel and a data connection channel; In response to detecting a virus file in the target communication message, the control connection channel and the data connection channel are cut off.

2. The FTP-based communication method according to claim 1, wherein: The target session is a breakpoint-resume session, and the virus detection on the target communication message includes: Obtaining a target file identifier in the target communication message; Determining whether the target file identifier exists in a preset virus identifier library, wherein the preset virus identifier library includes several virus file identifiers of virus files; In response to the target file identifier existing in the preset virus identifier library, it is determined that a virus file is detected in the target communication message.

3. The FTP-based communication method according to claim 1, wherein: The FTP-based communication method further comprises: In response to detecting a virus file in the target communication message, a virus file identifier of the virus file is entered into a preset virus identifier library.

4. The FTP-based communication method according to claim 2, wherein: Before obtaining the target file identifier in the target communication message, the FTP-based communication method further includes: For any real-time session, whether the real-time session is the breakpoint-resume session is determined according to the communication instruction for initiating message transmission of the real-time session.

5. The FTP-based communication method according to claim 2, wherein: The obtaining of the target file identifier in the target communication message includes: Obtain the IP address of the sender of the target communication message, and / or obtain the file name of the target communication message.

6. The FTP-based communication method according to claim 1, wherein: The performing virus detection on the target communication message includes: Calculating a target MD5 value of the target communication message and determining whether the target MD5 value exists in a preset virus MD5 library, wherein the preset virus MD5 library includes MD5 values ​​of virus files; If the target MD5 value exists in the preset virus MD5 library, it is determined that a virus file is detected in the target communication message.

7. A communication device, characterized in that: include: A message acquisition module, configured to acquire a target communication message transmitted in a target session, wherein the target session is a session constructed based on FTP and includes a control connection channel and a data connection channel; A virus detection module, configured to perform virus detection on the target communication message; The communication module is used to cut off the control connection channel and the data connection channel in response to detecting a virus file in the target communication message.

8. The communication device according to claim 7, wherein: The virus detection module includes an identification extraction submodule and an identification comparison submodule; In response to the target session being a breakpoint-resume session, the identifier extraction submodule is used to obtain the target file identifier in the target communication message, and the identifier comparison submodule is used to determine whether the target file identifier exists in a preset virus identifier library, where the preset virus identifier library includes several virus file identifiers of virus files; in response to the target file identifier existing in the preset virus identifier library, it is determined that a virus file is detected in the target communication message.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein, Memory, used to store programs; A processor is coupled to the memory, and is configured to execute a program stored in the memory to implement the FTP-based communication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the FTP-based communication method as claimed in any one of claims 1 to 7.

Images