Code file scanning method and device, equipment and storage medium

Abstract

The invention discloses a code file scanning method and device, equipment and a storage medium, and relates to the technical field of network security, and the code file scanning method comprises the steps: employing a received scanning signal, and carrying out the parallel scanning of a plurality of target code files stored in the storage equipment through a target coprocessor, character stream source codes in the target code files are converted into a plurality of corresponding target token streams; filtering the plurality of target token streams, and matching the hash values of the target tokens obtained after filtering with a preset risk rule base through a target coprocessor to obtain matching results corresponding to the plurality of target token streams; and analyzing the matching result to determine a vulnerability risk file in the plurality of target code files, and executing a corresponding target operation based on the risk level of the vulnerability risk file. Therefore, efficient and low-delay code security scanning can be realized while the storage performance is ensured through the design that the coprocessor is combined with the independent storage partitions.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a code file scanning method and device, equipment and a storage medium. BACKGROUND

[0002] With the increasing network security threats, the security scanning of code files becomes more and more important. However, the traditional code security scanning method usually relies on external code security scanning software or cloud services, and has problems such as high scanning delay, large occupation of system resources, dependence on network connection, etc. In addition, the existing storage is only a passive storage device and cannot actively identify potential risks of stored data, especially the security threats of code data. Moreover, the current code security scanning needs to deploy a separate code security scanning software and requires a scanning device with high configuration, and the scanning generally occurs in the software development process and is for source code scanning. If no software is purchased, the device performance is insufficient, and the code data cannot be effectively scanned after subsequent deployment to cope with potential security risks.

[0003] Therefore, there is an urgent need for a lightweight code security scanning scheme integrated in the internal storage device, which can automatically detect security risks when data is written while not affecting the normal storage function of the hard disk. SUMMARY

[0004] The present application provides a code file scanning method, device, equipment and storage medium, which can realize efficient and low-delay code security scanning while ensuring storage performance through the design of a coprocessor combined with an independent storage partition.

[0005] The present application provides a code file scanning method applied to a storage device, wherein the storage device is configured with a target coprocessor constructed based on a logic device; and the code file scanning method comprises the following steps. The received scanning signal is used to perform parallel scanning on a plurality of target code files saved in the storage device through the target coprocessor, so as to convert character stream source codes in the plurality of target code files into a plurality of corresponding target token streams; Each token in the plurality of target token streams is subjected to a filtering operation based on a preset filter, and the hash value of the target token obtained after the filtering is matched with a preset risk rule library through the target coprocessor, so as to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule library is a rule library preconfigured in the target coprocessor; The plurality of matching results are analyzed to determine a vulnerability risk file in the plurality of target code files and determine a risk level corresponding to the vulnerability risk file; The target operation includes any one of direct storage, scanning verification, and blocking and isolation.

[0006] The application further provides a code file scanning device applied to a storage device, wherein the storage device is configured with a target coprocessor constructed based on a logic device. The code conversion module is configured to utilize the received scanning signal and perform parallel scanning on a plurality of target code files stored in the storage device through the target coprocessor, so as to convert character stream source codes in the plurality of target code files into a plurality of target token streams. The risk matching module is configured to perform filtering operation on each token in the plurality of target token streams based on a preset filter, and match hash values of the target tokens obtained after the filtering with a preset risk rule library through the target coprocessor, so as to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule library is a rule library preconfigured in the target coprocessor. The risk level determination module is configured to analyze the plurality of matching results, so as to determine a vulnerability risk file in the plurality of target code files and determine a risk level corresponding to the vulnerability risk file. The risk file processing module is configured to perform a corresponding target operation on the vulnerability risk file based on the risk level; the target operation includes any one of direct storage, scanning verification, and blocking and isolation.

[0007] The application further provides an electronic device, which comprises a memory configured to store a computer program and a processor configured to execute the computer program to implement the steps of any one of the code file scanning methods.

[0008] The application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of any one of the code file scanning methods.

[0009] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any one of the code file scanning methods.

[0010] By the method of the present application, the received scanning signal can be utilized, and the target co-processor is used to perform parallel scanning on a plurality of target code files stored in the storage device to convert character stream source code in the plurality of target code files into a plurality of corresponding target token streams; each token in the plurality of target token streams is filtered based on a preset filter, and the target co-processor is used to match the hash value of the filtered target token with a preset risk rule library to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule library is a rule library pre-configured in the target co-processor; the plurality of matching results are analyzed to determine a vulnerability risk file in the plurality of target code files and a risk level corresponding to the vulnerability risk file; and a corresponding target operation is performed on the vulnerability risk file based on the risk level; wherein the target operation includes any one of direct storage, scanning verification, and blocking isolation of the file.

[0011] As can be seen, by the method of the present application, after the storage device receives the scanning signal, the co-processor in the storage device can be used to perform parallel processing on a plurality of target code files stored in the storage device to convert the code files into corresponding token streams, so that multiple code file blocks can be processed in parallel through parallel processing, the scanning throughput is improved, and the real-time detection requirement of the high-speed storage device is met. Then the tokens in the token stream can be filtered by a preset filter, and the target co-processor is used to match the hash value of the filtered target token with a preset risk rule library to determine a vulnerability risk file that exists a risk according to the matching result, and finally a corresponding processing can be performed according to the risk level corresponding to the vulnerability risk file, such as direct storage, scanning verification, and blocking isolation. In this way, the security scanning method accelerated by embedding the co-processor in the storage device can realize real-time scanning when the code is written. In the case that the storage user does not purchase an independent code security scanning software or even does not understand the code security, the security scanning of the code data is realized through the scheme of the present application, the potential security risk is avoided, and the vulnerability scanning accuracy is improved by setting the lexical analyzer and the filter. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0013] Figure 1 A code file scanning method flowchart provided by the embodiments of the present application; Figure 2A vulnerability identification process decomposition schematic diagram provided for an embodiment of the present application. Figure 3 A code file scanning method architecture diagram provided for an embodiment of the present application. Figure 4 A code file scanning device structure schematic diagram provided for an embodiment of the present application. DETAILED DESCRIPTION

[0014] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0015] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0016] Currently, the traditional code security scanning method usually relies on external code security scanning software or cloud services, which has problems such as high scanning delay, large occupation of system resources, dependence on network connection, etc. In addition, the existing storage is only a passive storage device, which cannot actively identify the potential risks of stored data, especially the security threats of code data. Moreover, the current code security scanning needs to deploy a separate code security scanning software, and needs a scanning device with high configuration. The scanning generally occurs in the software development process, and is for the scanning of source code. If no software is purchased, the device performance is insufficient, and after deployment, it cannot effectively scan the code data to cope with potential security risks.

[0017] In order to overcome the above technical problems, the present application discloses a code file scanning method, device, equipment and storage medium, which can realize efficient and low-delay code security scanning while ensuring storage performance through the design of coprocessor combined with independent storage partition.

[0018] In order to make those skilled in the art better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0019] The architecture of the code file scanning method mainly consists of three parts, a host interface layer, an acceleration layer, and a storage control layer. Among them, the code file received from the host system is stored based on the existing storage protocol; the acceleration layer integrates a coprocessor in the storage master to perform static code analysis, including lexical analysis and rule matching, and the coprocessor can be selected according to user needs. In the present application, the coprocessor uses an FPGA (Field-Programmable Gate Array) coprocessor to improve scanning efficiency; the storage control layer controls whether to enable the scanning function through storage management software and allocates an independent storage partition. The scanning result is fed back to the storage management software through a hard disk dedicated interface. According to the scanning result, the file is directly stored, scanned and verified, and any one of the blocking isolation processing.

[0020] Referring to Figure 1 As shown in the drawings, the embodiments of the present application provide a code file scanning method applied to a storage device, the storage device being configured with a target coprocessor constructed based on a logic device. In combination with the execution process of the code file scanning method, the method is described in detail, including: Step S11, using the received scanning signal, and performing parallel scanning on a plurality of target code files stored in the storage device through the target coprocessor, to convert character stream source code in the plurality of target code files into corresponding plurality of target token streams.

[0021] In this embodiment, the target coprocessor starts to scan and store the code file after receiving the scan signal sent by the storage device, so before starting the code file scanning, the scan signal needs to be generated first. Specifically, the target command set sent by the host needs to be detected; if the preset detection flag bit exists in the target command set, a plurality of target code files corresponding to the target command set are written into the local temporary check buffer area. It needs to be noted that the host triggers the stage by writing the file to the storage through the NVMe (Non-Volatile Memory Express) protocol, and the NVMe Command Set needs to include a custom SCAN_REQ flag bit. If the storage device detects the flag bit, the security scanning of the code file is triggered, and a plurality of code files corresponding to the command set are written into the local temporary check buffer area. Further, a temporary entry needs to be created for a plurality of target code files, and the state of the plurality of target code files is marked in the temporary entry to mark the plurality of target code files as a scanning state. At the same time, a scan signal needs to be generated and sent to the target coprocessor to perform security scanning on the plurality of target code files through the target coprocessor. It needs to be noted that the created temporary entry is created in the FTL (Flash Translation Layer) to record the file LBA (Logical Block Address) and the scanning state (Pending).

[0022] Further, after the storage device receives the scan signal, a plurality of target code files are read from the temporary check buffer area based on a preset data block size through a preset bus protocol, wherein the preset bus protocol is AXI (Advanced eXtensible Interface), and the preset data block size can be set according to the requirement, which is set to 4KB in this application. Therefore, the target coprocessor, i.e., the FPGA coprocessor, needs to read the file content from the DRAM (Dynamic Random Access Memory) buffer area through the AXI bus and process it in a 4KB block stream. Then, a plurality of target code files need to be analyzed in parallel based on a preset lexical analyzer to respectively disassemble the codes in the plurality of target code files to obtain a plurality of corresponding code units, and convert the plurality of code units into a plurality of corresponding target token streams.

[0023] The specific process of parallel analysis of the code files by the preset lexer is as follows: identifying a plurality of code syntax structures corresponding to a plurality of target code files, and determining a plurality of code lexical rules corresponding to the plurality of code syntax structures; loading the plurality of code lexical rules to the preset memory located in the target coprocessor; based on the preset lexer, and using the plurality of code lexical rules in the preset memory, performing syntax parsing on the plurality of target code files in parallel to obtain a plurality of code units corresponding to the plurality of target code files respectively. That is, the syntax structure of the code file needs to be identified, for example, if the code file is in the syntax of C language, the code lexical rules corresponding to the C language need to be determined, and then the code lexical rules corresponding to the C language are loaded to the preset memory of the target coprocessor, so as to parse the code file by the code lexical rules. It should be noted that the preset lexer (Lexer) can convert a source code character stream into a token stream (Token Stream), for example, if(x>5) is parsed into [KEYWORD_IF, DELIMITER_LPAREN, IDENTIFIER(x), OPERATOR_GT, NUMBER(5), DELIMITER_RPAREN], supports C, JAVA, Python, Go, JS and other languages, and the language types here are examples, and various development languages can be adapted according to actual needs.

[0024] In this way, the static analysis by the FPGA coprocessor has higher computing efficiency and lower delay than the traditional central processor software scanning, supports parallel processing of multiple code file blocks, improves scanning throughput, meets the real-time detection needs of high-speed storage devices, and the scanning task is executed by the FPGA coprocessor independently, which is physically / logically isolated from the storage host, avoiding occupying the host processor resources or affecting the normal storage read / write performance. And storing the code file through DRAM can reduce the interference of non-code data and improve the scanning accuracy.

[0025] Step S12, filtering each token in the plurality of target token streams based on a preset filter, and matching the hash value of the filtered target token with a preset risk rule library through the target coprocessor to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule library is a rule library pre-configured in the target coprocessor.

[0026] In this embodiment, before matching the token with the preset risk rule library, it is necessary to first construct the risk rule library. Specifically, it is necessary to convert the preset risk rules into a target hardware description language; save the target hardware description language to a preset memory of a target coprocessor, to generate a preset risk rule library in the preset memory based on the target hardware description language. It needs to be noted that the rule library is matched in real time through FPGA hardware acceleration, and supports dynamic security policy updating. The rule library mainly includes high-risk vulnerabilities, which can be set according to the CWE (Common Weakness Enumeration) Top vulnerability, stored in the FPGA BRAM (Block Random Access Memory), and supports firmware hot updating. Taking SQL (Structured Query Language) injection as an example, the detection rule is set as follows: # Parameterized query detection supporting multiple language variants pattern = r""" (?:mysql_query|pg_exec|sqlite3_exec)\s*\( \s*["'].*? # Start quote (?:%s|\{0\}) # String formatting placeholder (Python / C#) .*? # Intermediate arbitrary characters \b(?:OR\s+1=1|UNION\s+SELECT) # Attack signature .*?["'] # End quote \s*\) # Function closure """ % (r'%[ds]|{\d+}|\?') # Cover %s,?, {0}, etc. placeholders The above rule needs to be decomposed as follows: { "rule_id": "CWE-89-001", # 4-byte encoding "func_pattern": ["mysql_query", "pg_exec", "sqlite3_exec"], # Function name list "placeholder": ["%s", "{0}", "?"], # Placeholder type "attack_sig": ["OR 1=1", "UNION SELECT"], # Attack signature "action": "block" # Disposal method }; Then the above rules need to be mapped to FPGA hardware to convert them into hardware description language: module rule_storage ( input [5:0] rule_addr, output reg [191:0] rule_data / / 192 bits / rule ); always @(*) begin case(rule_addr) 0: rule_data = {32'h89_0001, 24'h6d7973, ...}; / / CWE-89-001 encoding endcase end endmodule.

[0027] As can be seen from the above example, for each rule, it is necessary to convert it into the corresponding language, and then save the converted hardware description language into the preset memory of the target coprocessor to build a preset risk rule library through the hardware description language corresponding to different rules. It should be noted that the matching rules can be hot-updated through the NVMe management interface or storage management software. In this way, the risks in the code can be accurately matched and identified through the constructed risk rule library, thereby improving the accuracy of code risk vulnerability identification in code file scanning.

[0028] Further, in the risk identification of the token stream, the token stream needs to be filtered first, specifically, a plurality of preset hash functions in the preset filter are used to perform parallel processing on each token in the plurality of target token streams to obtain a first hash value corresponding to the target token obtained after filtering in the plurality of target token streams. There are a large number of tokens in the code, but the security rules only care about a small number of dangerous functions, so the tokens need to be filtered. A space is allocated in the BRAM on the high-speed chip of the FPGA, all bits are initialized to 0, then three independent and high-efficiency hash functions are selected to perform parallel processing on each token in the plurality of target token streams, and each token is mapped to three different positions of the array. For example, the input token is "os.system", the position 42 is obtained after the calculation of the hash function 1 (h1), the position 789 is obtained after the calculation of the hash function 2 (h2), and the position 1023 is obtained after the calculation of the hash function 3 (h3), then the values of the three positions in the bit array are set to 1, then the preset risk rules in the preset risk rule library are calculated based on a plurality of preset hash functions in the preset filter to obtain a plurality of second hash values corresponding to each preset risk rule and the plurality of preset hash functions, and then the first hash value is matched with the plurality of second hash values. If the first hash value matches a target second hash value in the plurality of second hash values, a first matching result representing a matching success is generated. Specifically, if the values of the positions 42, 789 and 1023 in the second hash value corresponding to the preset risk rule are all 1, it is indicated that the token hits a certain risk rule. If the value of one of the three positions is 1, it is indicated that the token may hit a certain risk rule. Therefore, as long as one hash value matches, the token is retained. On the other hand, if the first hash value does not match the plurality of second hash values, a second matching result representing a matching failure is generated. For example, if the values of the positions 42, 789 and 1023 in the second hash value corresponding to the preset risk rule are all 0, it is indicated that the token does not hit any risk rule, and the token is safe, so the token can be eliminated. In this way, whether the token contains a vulnerability can be determined by calculating the hash value of the token, thereby effectively improving the accuracy of the security scanning.

[0029] It should be noted that the matching of the vulnerability can be summarized as three stages as shown in Figure 2 The first stage is to identify function calls to quickly locate sensitive function entries, the second stage is placeholder detection to identify code segments that may exist injection, and the third stage is attack feature matching to accurately capture malicious code patterns.

[0030] Step S13, analyze the plurality of matching results to determine the vulnerability risk files in the plurality of target code files, and determine the risk level corresponding to the vulnerability risk files.

[0031] In this embodiment, the plurality of matching results obtained need to be analyzed to determine the vulnerability risk files existing in the target code files, and at the same time, the risk level corresponding to the vulnerability risk files needs to be determined. Specifically, the code file corresponding to the first matching result in the plurality of matching results is taken as the vulnerability risk file, and the vulnerability type corresponding to the vulnerability risk file is determined. It needs to be noted that the FPGA coprocessor has a plurality of independent matching units, each of which is responsible for a specific type of vulnerability. For example, a unit is responsible for the vulnerability CWE-78, and another unit is responsible for the vulnerability CWE-79. In this way, it can be ensured that each type of vulnerability is detected by the most suitable hardware circuit. After detection and confirmation, each vulnerability needs to be matched with a preset risk level table to determine the risk level corresponding to the vulnerability type. It needs to be noted that the vulnerability risk level is divided into 0-4 levels, of which 0-2 levels correspond to the risk level of safety, and such vulnerabilities can be directly ignored, 3 level is suspicious level, and 4 level is high-risk level.

[0032] Further, the vulnerability risk metadata corresponding to the vulnerability risk file needs to be generated, the code position information of the vulnerability code in the vulnerability risk file needs to be determined, and then the vulnerability risk metadata of the vulnerability risk file is generated based on the code position information, the vulnerability type and the risk level, and the vulnerability risk metadata is written into the vulnerability risk file. The code position information represents the code line number of the vulnerability in the code risk file, the vulnerability type is the vulnerability code, and the risk level is the level corresponding to the vulnerability in the preset risk level table. It also needs to be noted that the vulnerability risk metadata also contains some other data, such as version identifier and tamper-proof verification identifier, and the metadata format of the vulnerability risk metadata is shown in Table 1, and Table 1 is as follows: Table 1 Metadata format of vulnerability risk metadata .

[0033] Step S14, performing a corresponding target operation on the vulnerability risk file based on the risk level; wherein the target operation includes any one of directly storing the file, scanning and verifying, and blocking and isolating.

[0034] In this embodiment, it is necessary to perform corresponding operations on the vulnerability risk file according to the risk level of the vulnerability. Specifically, the risk levels include the first level, the second level and the third level, where the first level corresponds to levels 0 to 2, the risk level is safe, and the target operation corresponding to the first level is to directly store the vulnerability risk file; the second level corresponds to level 3, the risk level is suspicious, and the corresponding target operation is to scan and verify the vulnerability risk file to determine whether to store the vulnerability risk file based on the verification results; the third level corresponds to level 4, the risk level is high risk, and the corresponding target operation is to block and isolate the vulnerability risk file and issue an alarm.

[0035] Specifically, for vulnerability risk files with a risk level of Level 2, the file is saved to a pre-set sandbox and the current load is determined to meet a pre-set low-load requirement. If so, the file undergoes a pre-set deep scan to reconfirm the target risk level for the vulnerabilities in the file. If the target risk level is Level 1, the file is directly stored. If the target risk level is Level 3, the file is blocked and isolated, and an alert is issued. Specifically, for Level 2 vulnerability risk files, the storage controller implements a delayed processing strategy, temporarily retaining the file data in the DRAM buffer but not writing it to disk, to avoid immediate interception of potentially false positives. The controller records the file hash and suspicious flags. During idle periods on the storage device, such as low-load I / O (Input / Output), a deep scan is triggered, reloading the file content and performing more complex static analysis, such as data flow tracing and implicit vulnerability detection. If the deep scan confirms a risk, the file is processed at Level 3, blocked and isolated, and an alert is issued. If it is a false positive, the file is processed at Level 1 and written to disk normally. On the other hand, for vulnerability risk files with a risk level of the third level, the vulnerability risk files need to be transferred to a preset isolation partition and blocked in real time to generate an alarm log corresponding to the vulnerability risk files. The host driver needs to be notified of the write failure via a PCIe MSI-X interrupt, and the file content needs to be copied from DRAM to the isolation area. The isolation area is an independent block reserved by the storage system and is only accessible to security administrators. After isolation is completed, an alarm log needs to be generated to notify the administrator of the high-risk vulnerability.

[0036] It can be seen that, by the method, after the storage device receives the scanning signal, the co-processor in the storage device can process the plurality of target code files stored in the storage device in parallel to convert the code files into corresponding token streams, so that a plurality of code file blocks can be processed in parallel by parallel processing, the scanning throughput is improved, and the real-time detection requirement of the high-speed storage device is met. Then the tokens in the token stream can be filtered by the preset filter, and the hash value of the target token obtained after filtering is matched with the preset risk rule library by the target co-processor, so as to determine the vulnerability risk file with risk according to the matching result, and finally the corresponding processing can be performed according to the corresponding risk level of the vulnerability risk file, such as direct storage, scanning verification and blocking isolation. In this way, on the one hand, the security scanning method accelerated by embedding the co-processor in the storage device can realize real-time scanning during code writing. In the case that the storage user does not purchase an independent code security scanning software or even does not understand the code security, the security scanning of the code data is realized by the scheme, and the potential security risk is avoided. On the other hand, the vulnerability type can be accurately identified by the set lexical analyzer and filter, and the accuracy of vulnerability scanning is improved. On the one hand, high-risk files are intercepted in real time during data writing to prevent them from polluting the storage system, and the scheme is not dependent on cloud killing or network connection and is suitable for isolated environment.

[0037] As a preferred embodiment, the scanning information corresponding to the plurality of target code files can be counted through a preset interface, and the scanning information is fed back to the upper application corresponding to the storage device. The scanning information includes the total number of files corresponding to the plurality of target code files, the number of files corresponding to each risk level, the vulnerability type and the scanning time consumption. The preset interface is S.M.A.R.T (Self-Monitoring Analysis And Reporting Technology, self-monitoring analysis and reporting technology interface), the scanning information can be injected into the S.M.A.R.T attribute, and the REST (Representational State Transfer, representational state transfer) or gRPC (Google Remote Procedure Call, high-performance remote procedure call protocol) interface is provided for the upper application to query.

[0038] As a preferred embodiment, as Figure 3As shown, the overall architecture of the code file scanning method is shown, wherein after the host interface layer receives the code file from the host system, the code file is stored based on the existing storage protocol, if it is detected that there is a detection flag bit in the target command set sent by the host, a plurality of target code files corresponding to the target command set are written to the local temporary inspection buffer, and the security scanning is triggered, then the code file needs to be analyzed in parallel by the lexical analyzer in the lexical analysis module to obtain the token stream corresponding to the code file, then the preset risk rule library in the rule matching module is matched with the tokens in the token stream to determine which tokens match the risk rules in the risk rule library successfully, then the code file matched successfully is taken as a vulnerability risk file, and the corresponding processing scheme needs to be determined according to the level of the vulnerability risk, for example, direct storage, scanning verification, and blocking isolation. Finally, the scanning information corresponding to a plurality of target code files can be counted through the preset interface, and the scanning information is fed back to the upper application of the storage device.

[0039] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment.

[0040] Referring to Figure 4 As shown, the embodiment of the present application also provides a code file scanning device, applied to a storage device, the storage device is configured with a target coprocessor constructed based on a logic device; wherein the code file scanning device comprises: The code conversion module 11 is configured to utilize the received scanning signal, and perform parallel scanning on a plurality of target code files stored in the storage device through the target coprocessor, so as to convert the character stream source code in the plurality of target code files into a plurality of corresponding target token streams; The risk matching module 12 is configured to perform filtering operation on each token in the plurality of target token streams based on a preset filter, and match the hash value of the filtered target token with a preset risk rule library through the target coprocessor, to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule library is a rule library preconfigured in the target coprocessor; The risk level determination module 13 is configured to analyze the plurality of matching results to determine a vulnerability risk file in the plurality of target code files, and determine the risk level corresponding to the vulnerability risk file; The risk file processing module 14 is configured to perform a corresponding target operation on the vulnerability risk file based on the risk level; wherein the target operation includes any one of direct storage, scanning verification and blocking isolation on the file.

[0041] Through the method, after the storage device receives the scanning signal, the plurality of target code files stored in the storage device can be processed in parallel by the coprocessor in the storage device to convert the code files into corresponding token streams, so that a plurality of code file blocks can be processed in parallel through parallel processing, the scanning throughput is improved, and the real-time detection requirement of the high-speed storage device is met. Then, the tokens in the token streams can be filtered through the preset filter, and the hash values of the target tokens obtained after filtering are matched with the preset risk rule library through the target coprocessor, so as to determine the vulnerability risk files with risks according to the matching results. Finally, the corresponding processing can be performed according to the corresponding risk levels of the vulnerability risk files, such as direct storage, scanning verification, and blocking isolation. In this way, through the security scanning method accelerated by embedding the coprocessor in the storage device, real-time scanning during code writing can be realized. In the case that the storage user does not purchase an independent code security scanning software or even does not understand code security, the safety scanning of code data can be realized through the scheme, potential security risks are avoided, and the vulnerability scanning accuracy is improved through the set lexical analyzer and filter.

[0042] In some embodiments, the code file scanning apparatus can further include: a command set detection unit configured to detect the target command set sent by the host; a file writing unit configured to write a plurality of target code files corresponding to the target command set into a local temporary checking buffer area if the preset detection flag bit exists in the target command set; a file marking unit configured to create temporary entries for the plurality of target code files and mark the states of the plurality of target code files in the temporary entries to mark the plurality of target code files as a to-be-scanned state; a signal generation unit configured to generate a scanning signal and send the scanning signal to the target coprocessor to perform security scanning on the plurality of target code files through the target coprocessor.

[0043] In some embodiments, the code conversion module 11 can specifically include: a file reading submodule configured to read the plurality of target code files from the temporary checking buffer area based on a preset data block size through a preset bus protocol if the target coprocessor receives the scanning signal; a code disassembling submodule configured to perform parallel analysis on the plurality of target code files based on a preset lexical analyzer to disassemble the codes in the plurality of target code files to obtain a plurality of corresponding code units; a code conversion submodule configured to convert the plurality of code units into a plurality of corresponding target token streams.

[0044] In some embodiments, the code disassembling submodule can specifically include: a rule determination unit configured to identify a plurality of code syntax structures corresponding to a plurality of target code files, and determine a plurality of code lexical rules corresponding to the plurality of code syntax structures; a rule loading unit configured to load the plurality of code lexical rules to a preset memory located at a target coprocessor; a syntax disassembling unit configured to perform syntax disassembling on the plurality of target code files in parallel based on a preset lexical analyzer and the plurality of code lexical rules in the preset memory, to obtain a plurality of code units corresponding to the plurality of target code files respectively.

[0045] In some embodiments, the code file scanning device can further include: a rule conversion unit configured to convert the preset risk rules into a target hardware description language; a rule library generation unit configured to save the target hardware description language to a preset memory of the target coprocessor, to generate a preset risk rule library in the preset memory based on the target hardware description language.

[0046] In some embodiments, the risk matching module 12 can specifically include: a first hash value calculation unit configured to perform parallel processing on each token in a plurality of target token streams by a plurality of preset hash functions in a preset filter, to obtain a first hash value corresponding to a target token obtained after filtering in the plurality of target token streams; a second hash value calculation unit configured to calculate a plurality of preset risk rules in a preset risk rule library based on the plurality of preset hash functions in the preset filter, to obtain a plurality of second hash values corresponding to each preset risk rule and the plurality of preset hash functions; a hash value matching unit configured to match the first hash value with the plurality of second hash values respectively; a first matching result generation unit configured to generate a first matching result representing a matching success if the first hash value matches a target second hash value in the plurality of second hash values; the target second hash value is any hash value in the plurality of second hash values; a second matching result generation unit configured to generate a second matching result representing a matching failure if the first hash value does not match any of the plurality of second hash values.

[0047] In some embodiments, the risk level determination module 13 can specifically include: a vulnerability type determination unit configured to take a code file corresponding to the first matching result in the plurality of matching results as a vulnerability risk file, and determine a vulnerability type corresponding to the vulnerability risk file; The risk matching unit is configured to match the vulnerability type with a preset vulnerability risk level table to determine a risk level corresponding to the vulnerability type.

[0048] In some embodiments, the code file scanning apparatus can further include: The position information determining unit is configured to determine code position information of the vulnerability code in the vulnerability risk file. The metadata writing unit is configured to generate vulnerability risk metadata of the vulnerability risk file based on the code position information, the vulnerability type, and the risk level, and write the vulnerability risk metadata into the vulnerability risk file.

[0049] In some embodiments, the risk level includes a first level, a second level, and a third level.

[0050] In some embodiments, the risk file processing module 14 can specifically include: The first processing submodule is configured to perform a target operation corresponding to the first level as directly storing the vulnerability risk file. The second processing submodule is configured to perform a target operation corresponding to the second level as scanning and verifying the vulnerability risk file to determine whether to store the vulnerability risk file according to a verification result. The third processing submodule is configured to perform a target operation corresponding to the third level as blocking and isolating the vulnerability risk file and generating an alarm.

[0051] In some embodiments, the first processing submodule can specifically include: The condition judging unit is configured to save the vulnerability risk file to a preset sandbox and judge whether a current load satisfies a preset low load condition. The file scanning unit is configured to perform a preset deep scanning on the vulnerability risk file to reconfirm a target risk level corresponding to the vulnerability in the vulnerability risk file if the current load satisfies the preset low load condition. The first operation unit is configured to directly store the vulnerability risk file if the target risk level is the first level. The second operation unit is configured to block and isolate the vulnerability risk file and generate an alarm if the target risk level is the third level.

[0052] In some embodiments, the third processing submodule can specifically include: The file transferring unit is configured to transfer the vulnerability risk file to a preset isolated partition. The alarm unit is configured to block the vulnerability risk file in real time and generate an alarm log corresponding to the vulnerability risk file.

[0053] In some embodiments, the code file scanning apparatus can further include: The information feedback unit is configured to count scanning information corresponding to the target code files through a preset interface, and feed back the scanning information to an upper application corresponding to the storage device; the scanning information includes total file numbers corresponding to the target code files, file numbers corresponding to each risk level, vulnerability types, and scanning time consumption. The features of the embodiments of the code file scanning device can be referred to the related descriptions of the embodiments of the code file scanning method, which will not be repeated here.

[0054] The embodiments of the present application also provide an electronic device, including a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the code file scanning method embodiments.

[0055] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the code file scanning method embodiments when running.

[0056] In an example embodiment, the computer readable storage medium described above can include but is not limited to: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0057] The embodiments of the present application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the steps in any of the code file scanning method embodiments.

[0058] The embodiments of the present application also provide another computer program product, which includes a non-volatile computer readable storage medium, and the non-volatile computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps in any of the code file scanning method embodiments.

[0059] The skilled person can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0060] The above describes in detail a code file scanning method, device, equipment and storage medium provided by the present application. The principles and implementation manners of the present application are described by applying specific examples, and the above example description is only applicable to help understand the method and core idea of the present application. It should be pointed out that, for ordinary skilled persons in the technical field, some improvements and modifications can be made to the present application without departing from the principles of the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A code file scanning method, characterized in that: Applied to a storage device, wherein the storage device is configured with a target coprocessor constructed based on a logic device; wherein the method comprises: Using the received scanning signal, the target coprocessor performs parallel scanning on a plurality of target code files stored in the storage device to convert character stream source codes in the plurality of target code files into a plurality of corresponding target token streams; performing a filtering operation on each token in the plurality of target token streams based on a preset filter, and matching, by the target coprocessor, a hash value of the target token obtained after filtering with a preset risk rule base to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule base is a rule base preconfigured in the target coprocessor; Analyzing the plurality of matching results to determine vulnerability risk files in the plurality of target code files, and determining risk levels corresponding to the vulnerability risk files; A corresponding target operation is performed on the vulnerability risk file based on the risk level; wherein the target operation includes any one of directly storing, scanning and verifying, and blocking and isolating the file.

2. The code file scanning method according to claim 1, characterized in that: Before the method utilizes the received scanning signal and performs parallel scanning on the plurality of target code files stored in the storage device by the target coprocessor to convert the character stream source codes in the plurality of target code files into corresponding plurality of target token streams, the method further includes: Detecting the target command set received from the host; If a preset detection flag exists in the target command set, writing a number of target code files corresponding to the target command set into a local temporary check buffer; Creating temporary entries for the plurality of object code files, and marking the status of the plurality of object code files in the temporary entries, so as to mark the plurality of object code files as being in a state to be scanned; A scan signal is generated and sent to a target coprocessor, so as to perform a security scan on the target code files through the target coprocessor.

3. The code file scanning method according to claim 2, characterized in that: The method utilizes the received scanning signal and performs parallel scanning on the plurality of target code files stored in the storage device by the target coprocessor to convert the character stream source codes in the plurality of target code files into corresponding plurality of target token streams, including: If the target coprocessor receives the scan signal, the target code files are read from the temporary check buffer based on a preset data block size through a preset bus protocol; Performing parallel analysis on the target code files based on a preset lexical analyzer to respectively decompose the codes in the target code files to obtain corresponding code units; The plurality of code units are converted into corresponding plurality of target token streams.

4. The code file scanning method according to claim 3, characterized in that: The method of performing parallel analysis on the target code files based on a preset lexical analyzer to respectively decompose the codes in the target code files to obtain corresponding code units includes: Identifying a plurality of code grammatical structures corresponding to the plurality of target code files, and determining a plurality of code lexical rules corresponding to the plurality of code grammatical structures; Loading the plurality of code lexical rules into a preset memory located in the target coprocessor; Based on a preset lexical analyzer and using the plurality of code lexical rules in the preset memory, the plurality of target code files are grammatically decomposed in parallel to obtain a plurality of code units corresponding to the plurality of target code files respectively.

5. The code file scanning method according to claim 4, characterized in that: Before filtering each token in the plurality of target token streams based on a preset filter and matching the hash value of the target token obtained after filtering with a preset risk rule base through the target coprocessor to obtain a plurality of matching results corresponding to the plurality of target token streams, the method further includes: Converting preset risk rules into target hardware description language; The target hardware description language is saved to the preset memory of the target coprocessor, so as to generate a preset risk rule base in the preset memory based on the target hardware description language.

6. The code file scanning method according to claim 1, characterized in that: The filtering operation is performed on each token in the plurality of target token streams based on a preset filter, and the hash value of the target token obtained after filtering is matched with a preset risk rule library by the target coprocessor to obtain a plurality of matching results corresponding to the plurality of target token streams, including: Processing each token in the plurality of target token streams in parallel using a plurality of preset hash functions in the preset filters to obtain first hash values ​​corresponding to target tokens obtained after filtering in the plurality of target token streams; Based on the plurality of preset hash functions in the preset filter, calculating the preset risk rules in the preset risk rule library to obtain a plurality of second hash values ​​corresponding to each preset risk rule and the plurality of preset hash functions; Matching the first hash value with the plurality of second hash values ​​respectively; If the first hash value matches a target second hash value among the plurality of second hash values, a corresponding first matching result indicating a successful match is generated; the target second hash value is any hash value among the plurality of second hash values; If the first hash value does not match any of the second hash values, a second matching result indicating a matching failure is generated.

7. The code file scanning method according to claim 6, characterized in that: The analyzing the plurality of matching results to determine vulnerability risk files in the plurality of target code files and determining risk levels corresponding to the vulnerability risk files includes: Using the code file corresponding to the first matching result among the plurality of matching results as a vulnerability risk file, and determining the vulnerability type corresponding to the vulnerability risk file; The vulnerability type is matched with a preset vulnerability risk level table to determine the risk level corresponding to the vulnerability type.

8. The code file scanning method according to claim 7, characterized in that: Before performing the corresponding target operation on the vulnerability risk file based on the risk level, the method further includes: Determine code location information of the vulnerability code in the vulnerability risk file; Vulnerability risk metadata of the vulnerability risk file is generated based on the code location information, the vulnerability type, and the risk level, and the vulnerability risk metadata is written into the vulnerability risk file.

9. The code file scanning method according to any one of claims 1 to 8, characterized in that: The risk levels include the first level, the second level and the third level; wherein, the target operation corresponding to the first level is to directly store the vulnerability risk file; the target operation corresponding to the second level is to scan and verify the vulnerability risk file to determine whether to store the vulnerability risk file based on the verification result; the target operation corresponding to the third level is to block and isolate the vulnerability risk file and issue an alarm.

10. The code file scanning method according to claim 9, characterized in that: Scanning and verifying the vulnerability risk file to determine whether to store the vulnerability risk file based on the verification result includes: Saving the vulnerability risk file to a preset sandbox and determining whether the current load meets a preset low load condition; If the current load satisfies the preset low load condition, performing a preset depth scan on the vulnerability risk file to reconfirm the target risk level corresponding to the vulnerability in the vulnerability risk file; If the target risk level is the first level, directly storing the vulnerability risk file; If the target risk level is the third level, the vulnerability risk file is blocked and isolated, and an alarm is issued.

11. The code file scanning method according to claim 9, characterized in that: Block and isolate the vulnerability risk files and issue an alarm, including: Transferring the vulnerability risk file to a preset isolation partition; The vulnerability risk file is blocked in real time, and an alarm log corresponding to the vulnerability risk file is generated.

12. The code file scanning method according to claim 9, characterized in that: Also includes: Collecting scan information corresponding to the plurality of target code files through a preset interface, and feeding the scan information back to an upper layer application corresponding to the storage device; The scanning information includes the total number of files corresponding to the target code files, the number of files corresponding to each risk level, the vulnerability type, and the scanning time.

13. A code file scanning device, characterized in that: Applied to a storage device, wherein the storage device is configured with a target coprocessor constructed based on a logic device; wherein the apparatus comprises: a code conversion module, configured to utilize the received scanning signal and perform parallel scanning on a plurality of target code files stored in the storage device through the target coprocessor, so as to convert character stream source codes in the plurality of target code files into a plurality of corresponding target token streams; a risk matching module configured to filter each token in the plurality of target token streams based on a preset filter, and match the hash value of the target token obtained after filtering with a preset risk rule base through the target coprocessor to obtain a plurality of matching results corresponding to the plurality of target token streams; the preset risk rule base is a rule base preconfigured in the target coprocessor; a risk level determination module, configured to analyze the plurality of matching results to determine vulnerability risk files among the plurality of target code files, and determine risk levels corresponding to the vulnerability risk files; The risk file processing module is used to perform corresponding target operations on the vulnerability risk file based on the risk level; wherein the target operation includes any one of direct storage, scanning and verification, and blocking and isolation of the file.

14. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the code file scanning method according to any one of claims 1 to 12 when executing the computer program.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the code file scanning method according to any one of claims 1 to 12 are implemented.

Images