IOS backup password cracking and data recovery system

Abstract

The invention discloses an iOS backup password cracking and data recovery system. The method comprises the following steps: extracting metadata reference information of a backup file package; performing multi-layer progressive verification on the backup file package based on the metadata reference information; the online feature database obtains and stores effective backup passing rates and abnormal backup interception rates corresponding to the annotation samples with different backup characteristics under different dynamic threshold set conditions and cracking results and efficiency coefficients corresponding to the annotation samples with different backup characteristics under different cracking algorithm conditions; outputting a dynamic threshold set in the multi-layer progressive verification process based on the online feature database; building a cracking algorithm matching model based on the online feature database, and outputting a cracking algorithm of the backup file package when the multi-layer progressive verification of the backup file package is passed; and cracking and file recovery are performed on the backup file package based on a cracking algorithm, and online feedback is performed on a cracking result and a file recovery result, so that the target of maximizing a data recovery value under a controllable risk is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security and recovery, in particular to an iOS backup password cracking and data recovery system. BACKGROUND

[0002] Chinese patent CN102750495A discloses an iPhone mobile phone encrypted backup file cracking and restoring system, which comprises a GUI module, a password cracking module, a restoring backup file module and a viewing keychain module. The GUI module is a graphical user interface for user interaction with the device. The password cracking module is associated with the GUI module and is used to crack encrypted files to obtain the cracking password. The restoring backup file module receives the cracking password and restores the encrypted backup file. The viewing keychain module receives the cracking password and views the data stored in the keychain.

[0003] With the improvement of the security of the iOS system, its backup files usually use high-strength encryption algorithms (such as AES-256 combined with PBKDF2 key derivation). If the user forgets the backup password, important data cannot be accessed. In the process of obtaining key information from the encrypted backup file to provide a basis for subsequent cracking, the prior art often ignores confirming whether the backup file has been tampered with, and directly performs cracking operations, resulting in that if the backup is tampered with (such as key documents are replaced, transaction records are deleted), the recovered data cannot reflect the true situation, the password cracking result is invalid, and the maliciously tampered backup may contain viruses, malicious plug-ins or backdoor programs. After restoring such a backup, the device may be remotely controlled, further stealing the data of the current device (such as bank information, biometric data), or causing the device to crash, data loss and other problems. SUMMARY

[0004] In order to solve the above technical problems, the purpose of the present application is to provide an iOS backup password cracking and data recovery system, which comprises a cloud, and the cloud is communicatively connected with a file input module, a multi-layer progressive verification module, an online feature database, a dynamic threshold estimation module, a cracking matching module and a cracking feedback module. The file input module is used to receive a backup file package provided by a user, extract metadata reference information of the backup file package, and perform core file determination on each file in the backup file package. The multi-layer progressive verification module is used to perform FileID verification, Size verification, hash verification and final fault tolerance verification on the backup file package based on the metadata reference information, and obtain a multi-layer progressive verification result of the backup file package. The online feature database is used to obtain and store the effective backup pass rate and abnormal backup interception rate of the labeled sample corresponding to different backup features under different dynamic threshold sets, and the cracking result and efficiency coefficient of the labeled sample corresponding to different backup features under different cracking algorithms; The dynamic threshold estimation module is used to construct a dynamic threshold estimation model based on the online feature database, and output the dynamic threshold set in the final fault tolerance verification process; The cracking matching module is used to construct a cracking algorithm matching model based on the online feature database, and output the cracking algorithm of the backup file package when the multi-layer progressive verification of the backup file package passes; The cracking feedback module is used to crack and recover files based on the cracking algorithm of the backup file package, and to feed back the cracking result and file recovery result online.

[0005] Further, the metadata reference information includes a backup global verification value (the top layer hash value of the entire backup file package, generated based on the Hash calculation of all files in the file-level metadata list) and a file-level metadata list. The file-level metadata list includes entry information of all files in the backup file package, and each file entry information includes: FileID: unique file identifier (such as abc123...), Hash: SHA-1 hash value of file content (used to verify file integrity), Size: original file size (in unencrypted state), and ProtectionClass: file encryption level (such as Complete indicating full encryption).

[0006] Further, the process of determining the core file includes: Obtain the functional attributes of each file in the file-level metadata list, select the ProtectionClass and functional attributes of each file in the file-level metadata list as evaluation indexes, set file recovery constraint conditions by the user, set index weights of the evaluation indexes according to the file recovery constraint conditions, and obtain a membership matrix of each file for a preset importance level through fuzzy comprehensive evaluation; Obtain the importance level of each file according to the membership matrix and the index weight, preset an importance level threshold, and mark the file with an importance level greater than the importance level threshold as a core file.

[0007] Further, the process of performing FileID verification and Size verification on the backup file package based on the metadata reference information includes: Based on the file-level metadata list, the FileID of each file in the backup file package is traversed. If the FileID included in the missing file-level metadata list is missing in the backup file package, it is determined whether the file corresponding to the missing FileID is a core file. If yes, it is determined that the backup is damaged, and the user is prompted to resubmit the backup file package. If not, the file corresponding to the missing FileID is marked as an abnormal file. Subsequently, based on the file-level metadata list, the Size of each non-abnormal file in the backup file package is traversed. The Size of each non-abnormal file in the backup file package is compared with the Size of each non-abnormal file in the file-level metadata list. The Size deviation value of each non-abnormal file is obtained. A preset deviation threshold (based on historical Size deviation value rules, such as ±1024 bytes) is set. If there is a non-abnormal file in the backup file package whose Size deviation value is greater than the deviation threshold, the non-abnormal file is marked as an abnormal file. It is determined whether the abnormal file is a core file. If yes, it is determined that the backup is damaged, and the user is prompted to resubmit the backup file package. If not, a hash check is performed.

[0008] Further, the process of performing a hash check includes: The encrypted content (at this time, the password has not been cracked, only the original data after encryption is verified) of each non-abnormal file (named by FileID) in the backup file package is read. The SHA-1 hash value of the encrypted content is obtained. Based on the FileID of each non-abnormal file, the corresponding Hash of each non-abnormal file in the file-level metadata list is retrieved. The SHA-1 hash value of each non-abnormal file is compared with the corresponding Hash of each non-abnormal file in the file-level metadata list for consistency. If the SHA-1 hash value of a non-abnormal file does not match the corresponding Hash of the non-abnormal file in the file-level metadata list, it is determined whether the non-abnormal file is a core file. If yes, it is determined that the backup is damaged. If not, the non-abnormal file is marked as an abnormal file.

[0009] Further, the process of performing a final fault tolerance check includes: The proportion N% of the number of abnormal files to the total number of files in the backup file package and the proportion S% of the total size of abnormal files to the total size of the backup file package are calculated. The encrypted content (at this time, the password has not been cracked, only the original data after encryption is verified) of each file (named by FileID) in the backup file package is read. Hash operation is performed on the encrypted content. The SHA-1 hash value of all non-abnormal files in the backup file package is obtained. The SHA-1 hash values of all non-abnormal files are sorted according to the FileID of all non-abnormal files and spliced into a string. The Hash of the string is obtained. The dynamic threshold set is obtained, and the dynamic threshold set includes an abnormal file dynamic proportion threshold, an abnormal file size dynamic proportion threshold, and a hash string difference threshold. If N% is less than the abnormal file dynamic proportion threshold and S% is less than the abnormal file size dynamic proportion threshold, the hash of the string is compared with the backup global check value, the hash string difference is obtained, and it is determined whether the hash string difference is less than the hash string difference threshold. If it is less than, it indicates that the file list and metadata of the entire backup are not tampered with (ensuring that no files are added / removed or metadata is modified), and it is determined that the multi-layer progressive check passes. All files exist, the size matches, the hash chain is complete, and it is determined that the backup is not tampered with, and the subsequent cracking process can be entered. If it is not less than, it indicates that the backup is tampered with as a whole (such as malicious programs adding files or modifying metadata reference information), and it is determined that the multi-layer progressive check does not pass, and the user is prompted to provide the backup again. If N% is greater than or equal to the abnormal file dynamic proportion threshold or S% is greater than or equal to the abnormal file size dynamic proportion threshold, it is determined that the multi-layer progressive check does not pass, and the user is prompted to provide the backup again.

[0010] Further, the process of obtaining the effective backup pass rate and the abnormal backup interception rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold sets and the cracking result and efficiency coefficient corresponding to the labeled sample of different backup characteristics under different cracking algorithms includes: A labeled sample set is constructed, and feature extraction is performed on the labeled sample set to obtain the backup characteristics corresponding to different labeled samples in the labeled sample set. The backup characteristics include backup attribute features, abnormal features, and hash difference features. A plurality of different dynamic threshold sets are constructed, and multi-layer progressive checks are performed on the labeled samples of different backup characteristics in the labeled sample set based on different dynamic threshold sets. The multi-layer progressive check result corresponding to the labeled sample of different backup characteristics under different dynamic threshold sets is obtained. The effective backup pass rate (the probability that a normal backup sample is not misjudged as a hash check failure) and the abnormal backup interception rate (the probability that an abnormal backup sample is judged as a hash check failure) corresponding to the labeled sample of different backup characteristics under different dynamic threshold sets are obtained according to the multi-layer progressive check result. Different cracking algorithms are called from a preset algorithm library to crack the labeled samples of different backup characteristics, and the cracking result (cracking success or failure) and efficiency coefficient (obtained from the cracking time and cracking resource occupation) corresponding to the labeled sample of different backup characteristics under different cracking algorithms are obtained.

[0011] Further, a dynamic threshold estimation model is constructed based on an online feature database, and the process of outputting the dynamic threshold set in the final fault tolerance check process includes: The effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples of different backup characteristics under different dynamic threshold sets in the online feature database are taken as the training set and the verification set, the training set (80%) and the verification set (20%), 5-fold cross-validation is adopted to avoid overfitting, the maximum sum of effective backup pass rate and abnormal backup interception rate is taken as the objective function, and the model parameters (such as learning rate, batch size, and regularization coefficient) are optimized, the dynamic threshold estimation model is tested through the verification set until the preset requirements are met, and the trained dynamic threshold estimation model is output. The backup file package is checked for feature extraction, the backup characteristics of the backup file package are obtained, and the backup characteristics are input into the dynamic threshold estimation model. The dynamic threshold set corresponding to the current backup file package is output according to the dynamic threshold estimation model.

[0012] Further, the cracking algorithm matching model is constructed based on the online feature database, and the process of outputting the cracking algorithm of the backup file package includes: The cracking algorithm matching model is constructed based on the online feature database, the cracking results and efficiency coefficients corresponding to the labeled samples of different backup characteristics under different cracking algorithms in the online feature database are taken as the training data, the cracking results and efficiency coefficients are used to set the objective function of the cracking algorithm matching model, the training data is used to train the cracking algorithm matching model, and the trained cracking algorithm matching model is obtained. The backup characteristics of the backup file package are input into the cracking algorithm matching model, and the cracking algorithm of the backup file package is output according to the cracking algorithm matching model (such as PBKDF2 cracking algorithm for high iteration number iOS16 backup).

[0013] Further, the process of cracking and file recovery of the backup file package based on the cracking algorithm and online feedback of the cracking result and file recovery result includes: The non-abnormal files in the backup file package are cracked by the cracking algorithm of the backup file package, and the cracking result and efficiency coefficient (if the cracking result is cracking failure, the efficiency coefficient is zero by default) are obtained. If the cracking result is cracking success, a decryption key is generated, the non-abnormal files in the backup file package are decrypted according to the decryption key, and the mirror recovery file of the non-abnormal files in the backup file package is generated; The mirror recovery file of the non-abnormal files in the backup file package is sent to the user, the user judges the mirror recovery file, and generates a judgment result, the judgment result includes effective backup and abnormal backup; The cracking result and efficiency coefficient corresponding to the cracking algorithm of the backup file package, the determination result, the backup characteristics and the dynamic threshold set are uploaded to the online feature database, the online feature database updates the effective backup pass rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold set conditions in real time according to the determination result, and the dynamic threshold estimation model and the cracking algorithm matching model update the model parameters by acquiring the effective backup pass rate and the abnormal backup interception rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold set conditions and the cracking result and efficiency coefficient corresponding to the labeled sample of different backup characteristics under different cracking algorithm conditions in the online feature database.

[0014] Compared with the prior art, the application has the beneficial effects that: 1. The essence of the multi-layer progressive verification module is to guarantee the authenticity and recoverability of the user's key data, rather than to pursue file zero loss. The loss of non-core files (such as cache and redundant resources) usually does not affect password cracking (which depends on the encryption parameter file) and core data recovery (which depends on the database of address book and short message). Therefore, through the logic of core priority + fault tolerance verification: the integrity of the core file is the bottom line - when the core file is lost or tampered with, the backup loses its recovery value and must be terminated; the loss of non-core files is an optional item - through dynamic hash chain reconstruction and risk quantification, the loss is tolerated within a controllable range, and the recovery process of core data is prioritized.

[0015] This strategy not only avoids the misjudgment of effective backups due to excessive strict verification, but also ensures the reliability of the recovery result through core data verification, balances rigor and practicality, and achieves the goal of maximizing data recovery value under controllable risk.

[0016] 2. Apple may update the encryption algorithm with each generation of iOS system (such as upgrading from SHA-1 to SHA-256), and existing technologies need to manually upgrade the algorithm library, which lags behind in compatibility. The present application records the cracking results of new algorithms on various backups in real time through the online feature database, dynamically updates the preset algorithm library combined with user feedback, significantly shortens the adaptation period of the system to new iOS versions, and ensures that the cracking ability is synchronized with system upgrades. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 The principle diagram of the iOS backup password cracking and data recovery system of the embodiments of the present application. DETAILED DESCRIPTION

[0018] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0019] like Figure 1 As shown, the iOS backup password cracking and data recovery system includes a cloud, and the cloud communication connection is connected to a file input module, a multi-layer progressive verification module, an online feature database, a dynamic threshold estimation module, a crack matching module and a crack feedback module; The file input module is used to receive the backup file package provided by the user, extract the metadata benchmark information of the backup file package, and perform core file determination on each file in the backup file package; The multi-layer progressive verification module is used to perform FileID verification, Size verification, Hash verification and final fault tolerance verification on the backup file package based on the metadata benchmark information to obtain the multi-layer progressive verification results of the backup file package; The online feature database is used to obtain and store the effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples of different backup characteristics under different dynamic threshold sets, as well as the cracking results and efficiency coefficients corresponding to the labeled samples of different backup characteristics under different cracking algorithms; The dynamic threshold estimation module is used to build a dynamic threshold estimation model based on the online feature database and output the dynamic threshold set in the final fault-tolerance verification process; The cracking matching module is used to build a cracking algorithm matching model based on the online feature database. When the multi-layer progressive verification of the backup file package passes, the cracking algorithm of the backup file package is output; The cracking feedback module is used to crack the backup file package and restore the files based on the cracking algorithm, and provide online feedback on the cracking results and file recovery results.

[0020] It should be further explained that, during the specific implementation process, the file input module manually imports the backup file package (including core files such as .mbdb.manifest) through the user, and then extracts the backup root directory file in the backup file package. This file contains the "digital fingerprint" of the entire backup and is the basis for verification. The backup global verification value and file-level metadata list of the backup are extracted from the backup root directory file.

[0021] It needs to be further explained that, in the specific implementation process, the metadata reference information includes a backup global check value (the top-level hash value of the entire backup file package, generated based on the Hash calculation of all files in the file-level metadata list) and a file-level metadata list, the file-level metadata list includes entry information of all files in the backup file package, and the entry information of each file includes: FileID, a unique file identifier (such as abc123...), Hash, a SHA-1 hash value of the file content (used to check the file integrity), Size, the original size of the file (in an unencrypted state), and ProtectionClass, the file encryption level (such as Complete indicating full encryption).

[0022] It needs to be further explained that, in the specific implementation process, the core file determination process includes: Obtaining the functional attributes of each file in the file-level metadata list, selecting the ProtectionClass and the functional attributes (including storing all contact information, recording short message content, call records and timestamps, storing browser cache, application temporary data, application built-in pictures, system default ringtone, etc.) of each file in the file-level metadata list as evaluation indexes, setting the index weight of the evaluation indexes according to the file recovery constraint condition set by the user (such as the user setting "restore only photos and contacts" through the system interaction interface, and the corresponding type of file automatically increasing the index weight), obtaining the membership degree matrix of each file for the preset importance level through the fuzzy comprehensive evaluation of the existing technology; According to the membership degree matrix and the index weight, obtaining the importance level of each file, presetting an importance level threshold, and marking the files with an importance level greater than the importance level threshold as core files.

[0023] It needs to be further explained that, in the specific implementation process, the process of obtaining the importance level of each file according to the membership degree matrix and the index weight includes: Obtaining the fuzzy comprehensive evaluation matrix of the evaluation indexes by fusing the index weight of the evaluation indexes and the membership degree matrix through a formula, obtaining the membership degree of each file for different importance levels according to the fuzzy comprehensive evaluation matrix, selecting the highest importance level corresponding to the highest membership degree of each file, and taking the highest importance level corresponding to the highest membership degree of each file as the importance level of each file; The formula is: ; Wherein, is the fuzzy comprehensive evaluation matrix of the evaluation indexes, is the index weight of the evaluation indexes, is the membership degree matrix, represents the multiplication of the elements in the corresponding positions of the weight matrix and the membership matrix of the evaluation index, is a weighting parameter for controlling the balance between the weight matrix and the membership matrix in the fuzzy comprehensive evaluation matrix of the evaluation index.

[0024] It should be further explained that, in the specific implementation process, the process of performing FileID checking and Size checking on the backup file package based on the metadata reference information includes: Based on the file-level metadata list, the FileID of each file in the backup file package is traversed. If the FileID included in the file-level metadata list is missing in the backup file package, it is determined whether the file corresponding to the missing FileID is a core file. If yes, it is determined that the backup is damaged, and the user is prompted to resubmit the backup file package. If not, the file corresponding to the missing FileID is marked as an abnormal file. Subsequently, based on the file-level metadata list, the Size of each non-abnormal file in the backup file package is traversed. The Size of each non-abnormal file in the backup file package is compared with the Size of each non-abnormal file in the file-level metadata list, and the Size deviation value of each non-abnormal file is obtained. A preset deviation threshold value (based on historical Size deviation value rules, such as ±1024 bytes) is set. If there is a non-abnormal file in the backup file package whose Size deviation value is greater than the deviation threshold value, the non-abnormal file is marked as an abnormal file. It is determined whether the abnormal file is a core file. If yes, it is determined that the backup is damaged, and the user is prompted to resubmit the backup file package. If not, a hash check is performed.

[0025] It should be further explained that, in the specific implementation process, the process of performing the hash check includes: The encrypted content of each non-abnormal file (named by FileID) in the backup file package is read (the password has not been cracked at this time, only the original data after encryption is checked), the SHA-1 hash value of the encrypted content is obtained, the Hash corresponding to each non-abnormal file in the file-level metadata list is retrieved based on the FileID of each non-abnormal file, and consistency comparison is performed between the SHA-1 hash value of each non-abnormal file and the Hash corresponding to each non-abnormal file in the file-level metadata list. If there is a non-abnormal file whose corresponding SHA-1 hash value and Hash corresponding to the non-abnormal file in the file-level metadata list are inconsistent, it is determined whether the non-abnormal file is a core file. If yes, it is determined that the backup is damaged, and the user is prompted to resubmit the backup file package. If not, the non-abnormal file is marked as an abnormal file.

[0026] It should be further explained that, in the specific implementation process, the process of performing the final fault tolerance check includes: The proportion N% of the number of abnormal files in the total number of files in the backup file package and the proportion S% of the total size of the abnormal files in the total size of the backup file package are counted, the encrypted content (at this time, the password has not been cracked, only the original data after encryption is verified) of each file (named with FileID) in the backup file package is read, a hash operation is performed on the encrypted content to obtain the SHA-1 hash value of all non-abnormal files in the backup file package, the SHA-1 hash values of all non-abnormal files are sorted according to the FileIDs of all non-abnormal files to splice a string, and the Hash of the string is obtained; A dynamic threshold set is obtained, the dynamic threshold set includes an abnormal file dynamic proportion threshold, an abnormal file size dynamic proportion threshold, and a hash string difference threshold (the threshold of the application is obtained by software simulation of a large amount of data to obtain a threshold closest to the real situation, and the threshold size is set by a person skilled in the art according to the actual situation or obtained by a large amount of data simulation), if N% is less than the abnormal file dynamic proportion threshold and S% is less than the abnormal file size dynamic proportion threshold, the Hash of the string is compared with the backup global verification value to obtain the hash string difference, and it is determined whether the hash string difference is less than the hash string difference threshold, if it is less than, it indicates that the file list and metadata of the entire backup are not tampered with (ensuring that no file is added / removed or metadata is modified), and it is determined that the multi-layer progressive verification passes, all files exist, the size matches, and the hash chain is complete, and it is determined that the backup is not tampered with, and the subsequent cracking process can be entered; if it is not less than, it indicates that the backup is tampered with as a whole (such as malicious programs adding files or modifying metadata reference information), and it is determined that the multi-layer progressive verification does not pass, and the user is prompted to provide the backup again. If N% is greater than or equal to the abnormal file dynamic proportion threshold or S% is greater than or equal to the abnormal file size dynamic proportion threshold, it is determined that the multi-layer progressive verification does not pass, and the user is prompted to provide the backup again.

[0027] The multi-layer progressive verification is essentially to protect the authenticity and recoverability of the user's key data, rather than to pursue "file zero loss". The loss of non-core files (such as cache and redundant resources) usually does not affect password cracking (depending on the encryption parameter file) and core data recovery (depending on the database of address book and short message). Therefore, the system uses the logic of "core priority + fault tolerance verification": The integrity of the core file is the "bottom line" - when the core file is missing or tampered with, the backup loses its recovery value and must be terminated; The loss of non-core files is an "optional item" - through dynamic hash chain reconstruction and risk quantification, the loss is tolerated within a controllable range, and the recovery process of the core data is prioritized.

[0028] This strategy not only avoids the misjudgment of effective backups due to overly strict verification (such as "all or nothing"), but also ensures the reliability of the recovery results through core data verification, balancing "rigor" and "practicality", and achieving the goal of "maximizing data recovery value under controllable risk".

[0029] It should be further explained that, in the specific implementation process, the process of obtaining the effective backup pass rate and abnormal backup interception rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold set conditions and the cracking result and efficiency coefficient corresponding to the labeled sample of different backup characteristics under different cracking algorithm conditions includes: The labeled sample set includes: Normal backup samples: Collect 100,000+ real backup data of users (authorized by users), covering different iOS versions (iOS9 to the latest version), device types (iPhone / iPad), storage capacity (16GB to 1TB), and backup content (including a large number of media files / system data-based, etc.).

[0030] Abnormal backup samples: Non-core file missing samples: generated by manually deleting cache, log, redundant media, etc. (missing proportion from 1% to 50% gradient change); Core file missing samples: delete Manifest.plist, address book database and other core files to generate (simulate fatal missing); Tampered backup samples: modify part of the file content (such as replace photos, tamper with SMS) and recalculate the local hash to simulate malicious tampering scenarios.

[0031] Label 2 types for each sample (used for model learning "threshold reasonableness"): Effectiveness label: 1 (backup valid, core data can be completely recovered), 0 (backup invalid, core data tampered or missing); Risk label: probability of backup tampering (annotated by manual audit, such as 0.1% for low risk and 20% for high risk); Feature extraction is performed on the labeled sample set to obtain backup characteristics corresponding to different labeled samples in the labeled sample set. The backup characteristics include backup attribute features (basic attributes: iOS version (such as 16.5), device model (such as iPhone14), total file number (total_files), total size (total_size), salt value length, iteration number, hash algorithm type; core file proportion: core file number / total file number, core file size / total size), abnormal features (the proportion of the number of abnormal files in the total number of files in the labeled sample and the proportion of the total size of the abnormal files in the total size of the labeled sample), and hash difference features (the string edit distance between the Hash of the labeled sample string and the backup global check value of the labeled sample); A plurality of different dynamic threshold sets are constructed, and the labeled samples in the labeled sample set are subjected to multi-layer progressive verification based on the different dynamic threshold sets. The multi-layer progressive verification results corresponding to the labeled samples of different backup features under different dynamic threshold sets are obtained. The effective backup pass rate (the probability that a normal backup sample is not misjudged as failing the hash verification) and the abnormal backup interception rate (the probability that an abnormal backup sample is judged as failing the hash verification) of the labeled samples of different backup features under different dynamic threshold sets are obtained according to the multi-layer progressive verification results. Different cracking algorithms are called from the preset algorithm library to crack the labeled samples of different backup features, and the cracking results (cracking success or failure) and efficiency coefficients (obtained from the cracking time and cracking resource occupation) of the labeled samples of different backup features under different cracking algorithms are obtained.

[0032] It should be further noted that, in the specific implementation process, the process of constructing a dynamic threshold estimation model based on the online feature database and outputting the dynamic threshold set in the final fault tolerance verification process includes: The effective backup pass rate and the abnormal backup interception rate of the labeled samples of different backup features under different dynamic threshold sets in the online feature database are used as the training set and the validation set. The training set (80%) and the validation set (20%) are used for 5-fold cross-validation to avoid overfitting. The objective function is maximized to optimize the model parameters (such as learning rate, batch size, and regularization coefficient). The dynamic threshold estimation model is tested by the validation set until it meets the preset requirements, and the trained dynamic threshold estimation model is output. The objective function of the dynamic threshold estimation model is: ; Wherein, is the objective function value (the maximum objective function value is required for training the dynamic threshold estimation model), is the effective backup pass rate, Abnormal backup interception rate; Obtaining backup characteristics of the backup file package, inputting the backup characteristics into a dynamic threshold estimation model, and outputting a dynamic threshold set corresponding to the backup file package according to the dynamic threshold estimation model.

[0033] It should be further explained that, in the specific implementation process, the process of constructing a cracking algorithm matching model based on the online feature database and outputting the cracking algorithm of the backup file package includes: Based on the online feature database, the cracking algorithm matching model is constructed, the cracking results and efficiency coefficients of different backup characteristics under different cracking algorithms in the online feature database are used as training data, the objective function of the cracking algorithm matching model is set based on the cracking results and efficiency coefficients, the training data is used to train the cracking algorithm matching model, and the trained cracking algorithm matching model is obtained. The objective function of the cracking algorithm matching model is: ; ; Wherein, the objective function value (the maximum objective function value is required to train the cracking algorithm matching model), the cracking result, the efficiency coefficient; The backup characteristics of the backup file package are input into the cracking algorithm matching model, and the cracking algorithm of the backup file package is output according to the cracking algorithm matching model (such as PBKDF2 cracking algorithm for high iteration number iOS16 backup).

[0034] It should be further explained that, in the specific implementation process, the process of cracking and file recovery of the backup file package based on the cracking algorithm and online feedback of the cracking result and file recovery result includes: The non-anomalous files in the backup file package are cracked by the cracking algorithm of the backup file package, and the cracking result and efficiency coefficient are obtained (if the cracking result is cracking failure, the efficiency coefficient is zero by default), if the cracking result is cracking success, the decryption key is generated, the non-anomalous files in the backup file package are decrypted according to the decryption key, and the mirror recovery file of the non-anomalous files in the backup file package is generated; The mirror recovery file of the non-anomalous files in the backup file package is sent to the user, the user judges the mirror recovery file, and generates a judgment result, the judgment result includes valid backup and abnormal backup; The cracking result and efficiency coefficient corresponding to the cracking algorithm of the backup file package, the determination result, the backup characteristics and the dynamic threshold set are uploaded to the online feature database, the online feature database updates the effective backup pass rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold set conditions in real time according to the determination result, and the dynamic threshold estimation model and the cracking algorithm matching model update the model parameters by acquiring the effective backup pass rate and the abnormal backup interception rate corresponding to the labeled sample of different backup characteristics under different dynamic threshold set conditions and the cracking result and efficiency coefficient corresponding to the labeled sample of different backup characteristics under different cracking algorithm conditions in the online feature database.

[0035] The above embodiments are only used to illustrate the technical method of the present application, not to limit it. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical method of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical method of the present application.

Claims

1. iOS backup password cracking and data recovery system, characterized by: The cloud includes a file input module, a multi-layer progressive verification module, an online feature database, a dynamic threshold estimation module, a crack matching module, and a crack feedback module. The file input module is used to receive the backup file package provided by the user, extract the metadata benchmark information of the backup file package, and perform core file determination on each file in the backup file package; The multi-layer progressive verification module is used to perform FileID verification, Size verification, Hash verification and final fault tolerance verification on the backup file package based on the metadata benchmark information to obtain the multi-layer progressive verification results of the backup file package; The online feature database is used to obtain and store the effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples of different backup characteristics under different dynamic threshold sets, as well as the cracking results and efficiency coefficients corresponding to the labeled samples of different backup characteristics under different cracking algorithms; The dynamic threshold estimation module is used to build a dynamic threshold estimation model based on the online feature database and output the dynamic threshold set in the final fault-tolerance verification process; The cracking matching module is used to build a cracking algorithm matching model based on the online feature database. When the multi-layer progressive verification of the backup file package passes, the cracking algorithm of the backup file package is output; The cracking feedback module is used to crack the backup file package and restore the files based on the cracking algorithm, and provide online feedback on the cracking results and file recovery results.

2. The iOS backup password cracking and data recovery system according to claim 1, characterized in that: The metadata baseline information includes the backup global checksum and the file-level metadata list. The file-level metadata list includes the entry information of all files in the backup file package. The entry information of each file includes: FileID, Hash, Size, and ProtectionClass.

3. The iOS backup password cracking and data recovery system according to claim 2, characterized in that: The core document determination process includes: The functional attributes of each file in the file-level metadata list are obtained, the ProtectionClass and functional attributes of each file in the file-level metadata list are selected as evaluation indicators, the file recovery constraints are set by the user, the indicator weights of the evaluation indicators are set according to the file recovery constraints, the membership matrix of each file for the preset importance level is obtained through fuzzy comprehensive evaluation, the importance level of each file is obtained according to the membership matrix and the indicator weight, the importance level threshold is preset, and the files whose corresponding importance level is greater than the importance level threshold are marked as core files.

4. The iOS backup password cracking and data recovery system according to claim 3, characterized in that: The process of verifying the FileID and Size of the backup file package based on the metadata baseline information includes: Based on the file-level metadata list, the FileID of each file in the backup file package is traversed. If the FileID included in the file-level metadata list is missing in the backup file package, it is determined whether the file corresponding to the missing FileID is a core file. If so, the backup is determined to be damaged. If not, the file corresponding to the missing FileID is marked as an abnormal file. Then, based on the file-level metadata list, the size of each non-abnormal file in the backup file package is traversed to obtain the size deviation value of each non-abnormal file. A deviation threshold is preset. If the size deviation value of a non-abnormal file in the backup file package is greater than the deviation threshold, the non-abnormal file is marked as an abnormal file, and it is determined whether the abnormal file is a core file. If so, the backup is determined to be damaged. If not, a hash check is performed.

5. The iOS backup password cracking and data recovery system according to claim 4, characterized in that: The hash verification process includes: Read the encrypted content of each non-abnormal file in the backup file package, obtain the SHA-1 hash value of the encrypted content, retrieve the Hash corresponding to each non-abnormal file in the file-level metadata list based on the FileID of each non-abnormal file, and compare the SHA-1 hash value of each non-abnormal file with the Hash corresponding to each non-abnormal file in the file-level metadata list for consistency. If the SHA-1 hash value corresponding to a non-abnormal file is inconsistent with the Hash corresponding to the non-abnormal file in the file-level metadata list, determine whether the non-abnormal file is a core file. If so, determine that the backup is damaged. If not, mark the non-abnormal file as an abnormal file.

6. The iOS backup password cracking and data recovery system according to claim 5, characterized in that: The process of performing the final fault-tolerance check includes: Count the percentage (N%) of abnormal files in the total number of files in the backup file package and the percentage (S%) of the total size of abnormal files in the backup file package. Obtain the SHA-1 hash values ​​of all non-abnormal files in the backup file package. Sort the SHA-1 hash values ​​of all non-abnormal files by their FileIDs and concatenate them into a string to obtain the hash of the string. Obtain a dynamic threshold set, which includes a dynamic abnormal file ratio threshold, a dynamic abnormal file size ratio threshold, and a hash string difference threshold. If N% is less than the dynamic abnormal file ratio threshold and S% is less than the dynamic abnormal file size ratio threshold, compare the string hash with the backup global checksum value to obtain the hash string difference. Determine whether the hash string difference is less than the hash string difference threshold. If so, determine that the multi-layer progressive verification has passed. If not, determine that the multi-layer progressive verification has failed. If N% is greater than or equal to the abnormal file dynamic ratio threshold or S% is greater than or equal to the abnormal file size dynamic ratio threshold, then the multi-layer progressive verification is determined to have failed.

7. The iOS backup password cracking and data recovery system according to claim 6, characterized in that: The process of obtaining the effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples with different backup characteristics under different dynamic threshold sets, and the cracking results and efficiency coefficient corresponding to the labeled samples with different backup characteristics under different cracking algorithms includes: Constructing a labeled sample set, performing feature extraction on the labeled sample set, and obtaining backup features corresponding to different labeled samples in the labeled sample set, wherein the backup features include backup attribute features, anomaly features, and hash difference features; Construct several different dynamic threshold sets, perform multi-layer progressive verification on the labeled samples with different backup characteristics in the labeled sample set based on the different dynamic threshold sets, obtain the multi-layer progressive verification results corresponding to the labeled samples with different backup characteristics under the conditions of different dynamic threshold sets, and obtain the effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples with different backup characteristics under the conditions of different dynamic threshold sets based on the multi-layer progressive verification results; Different cracking algorithms are called from the preset algorithm library to crack the labeled samples with different backup characteristics, and the cracking results and efficiency coefficients corresponding to the labeled samples with different backup characteristics under different cracking algorithm conditions are obtained.

8. The iOS backup password cracking and data recovery system according to claim 7, characterized in that: The process of building a dynamic threshold estimation model based on the online feature database and outputting the dynamic threshold set for the final fault-tolerance verification process includes: The effective backup pass rate and abnormal backup interception rate corresponding to the labeled samples of different backup characteristics under different dynamic threshold sets in the online feature database are used as the training set and validation set. The objective function is to maximize the sum of the effective backup pass rate and the abnormal backup interception rate. The model parameters are optimized and the dynamic threshold estimation model is tested on the validation set until it meets the preset requirements. The trained dynamic threshold estimation model is then output. The verification process feature extraction is performed on the current backup file package to obtain the backup characteristics of the backup file package, the backup characteristics are input into the dynamic threshold estimation model, and the dynamic threshold set corresponding to the current backup file package is output according to the dynamic threshold estimation model.

9. The iOS backup password cracking and data recovery system according to claim 8, characterized in that: The process of building a cracking algorithm matching model based on the online feature database and outputting the cracking algorithm for the backup file package includes: A cracking algorithm matching model is constructed based on an online feature database. The cracking results and efficiency coefficients corresponding to the labeled samples with different backup characteristics under different cracking algorithm conditions in the online feature database are used as training data. The objective function of the cracking algorithm matching model is set based on the cracking results and efficiency coefficients. The cracking algorithm matching model is trained using the training data to obtain a trained cracking algorithm matching model. The backup characteristics of the backup file package are input into the cracking algorithm matching model, and the cracking algorithm of the backup file package is output according to the cracking algorithm matching model.

10. The iOS backup password cracking and data recovery system according to claim 9, characterized in that: The process of cracking the backup file package and restoring the files based on the cracking algorithm and providing online feedback on the cracking results and file recovery results includes: The non-abnormal files in the backup file package are cracked using the backup file package cracking algorithm to obtain the cracking result and efficiency coefficient. If the cracking result is successful, a decryption key is generated, and the non-abnormal files in the backup file package are decrypted according to the decryption key to generate a mirror image recovery file of the non-abnormal files in the backup file package; Sending the image recovery file of the non-abnormal files in the backup file package to the user, the user judges the image recovery file and generates a judgment result, which includes a valid backup and an abnormal backup; The cracking results and efficiency coefficients, judgment results, backup characteristics and dynamic threshold sets corresponding to the cracking algorithm of the backup file package are uploaded to the online feature database.

Images