A tamper detection method for electronic archives

Abstract

The application relates to the technical field of data security protection, and discloses a tamper detection method for electronic archives, which comprises the following steps: intercepting data writing by using a file system micro-filter driver, extracting a request descriptor sequence containing a time stamp, a logical block address and a single write length, and storing the request descriptor sequence into a feature buffer area; calculating a time increment variance to determine a time sequence dispersion index, and calculating an address jump frequency ratio to determine a spatial discontinuity index; adjusting a safety time threshold value according to the number of suspended tasks in a current file queue, and dynamically generating an adjustment threshold value; comparing the indexes with the threshold value, dividing out mutual exclusion judgment shunts, triggering a first blocking instruction or a second verification instruction, and driving a safety state machine to migrate to a control closed loop. The application eliminates bus blockage and computing power transient overload caused by full-scan, accurately identifies and avoids hidden rewriting of metadata changes, and balances data security protection strength and system throughput performance.

Description

Technical Field

[0001] This invention relates to a method for detecting tampering in electronic records, belonging to the field of data security protection technology. Background Technology

[0002] In digital data processing systems composed of processors and storage devices, ensuring the authenticity and integrity of electronic archives is a crucial security task. Existing solutions typically monitor file status at the application layer and use cryptographic hash comparisons and periodic scans for verification. After an application initiates data writing, the data first enters the memory page cache and is then written to the physical sector corresponding to the logical block address by the block device driver. Existing protection mechanisms largely rely on this call process, triggering verification through upper-layer notifications such as file write closure. However, when a large number of electronic archives are written concurrently at high speed, these mechanisms have significant limitations. Covert malicious rewriting behavior may bypass standard file system call interfaces and directly modify specific storage sectors using file system micro-filter drivers or memory-mapped files. In this case, metadata such as file modification time and size remains unchanged, and traditional verification mechanisms cannot detect anomalies because they do not receive trigger signals. At the same time, multi-threaded ransomware can utilize multi-core processors to perform a large number of encryption and rewriting operations in parallel. Due to the detection delay in conventional solutions, data corruption often occurs before abnormal behavior is identified.

[0003] To reduce detection latency, the industry typically improves by shortening the scan cycle or reducing the granularity of hash check blocks. However, the finer the check block granularity, the more exponentially the management overhead of related metadata increases. Frequently reading all data for verification increases processor load and disk bandwidth consumption, causing bus communication blockage and reducing system throughput. These problems not only exist in traditional application-layer scanning solutions, but even when using trapping methods based on storage master control protocols at the storage layer, if the detection process cannot be dynamically adjusted according to the concurrent task load, protection bottlenecks will still occur. For example, the Chinese invention patent with authorization announcement number CN119830280B... A ransomware trapping and identification method based on a storage master control protocol is disclosed. This method identifies unauthorized encryption behavior by pre-setting logical sectors and comparing differences in memory snapshots over multiple rounds. When electronic files are written at high speed and concurrently, this solution needs to obtain a snapshot of the host memory and frequently perform cross-level snapshot difference comparisons. Faced with continuous high-concurrency data streams, system scheduling tasks and large-scale computations will increase intensively in a short period of time. Since the comparison process cannot be adjusted according to the depth of the running queue, it will further aggravate bus communication blockage and may confuse abnormal writes with normal writes due to queuing delays, causing normal processes to be mistakenly blocked. This makes it difficult to meet the low-latency protection requirements in high-throughput environments.

[0004] Therefore, the technical problem to be solved by this invention is how to utilize the temporal and spatial characteristics of the I / O request sequence formed during the interaction of the kernel-level file system driver to adaptively identify low-frequency covert tampering behavior and high-frequency destructive writing behavior in electronic files while ensuring bus throughput, and to have a security state machine perform hierarchical responses. Summary of the Invention

[0005] To address the problems in the background art, the technical solution of the present invention is as follows: A method for detecting tampering in electronic archives, comprising the following steps:

[0006] Step S101: Obtain the security classification label of the target electronic file and allocate the corresponding digital sampling window. Capture the I / O request queue sequence in the underlying file system within the digital sampling window and convert the I / O request queue sequence into a continuous data stream.

[0007] Step S102: Extract the temporal dispersion index and spatial discontinuity index from the data stream, read the number of pending tasks in the current file I / O submission queue, and perform discretization gradient calibration on the standard load safety time threshold based on the number of pending tasks and the system smoothing constant to generate a dynamically adjusted threshold.

[0008] Step S103: Compare the temporal dispersion index with the dynamic adjustment threshold, and compare the spatial discontinuity index with the preset security space threshold; when the temporal dispersion index is less than the dynamic adjustment threshold and the spatial discontinuity index is greater than the preset security space threshold, determine that the current I / O has multi-threaded parallel encryption behavior and output a first-level real-time blocking instruction; when the temporal dispersion index is continuously greater than the dynamic adjustment threshold and shows a long-tail distribution, the spatial discontinuity index is 0, and the length of data written in a single application triggers an unexpected spatial expansion of the tail boundary of the target electronic file, determine that the current I / O meets the covert tampering characteristics and output a second-level incremental differential verification instruction.

[0009] Step S104: Drive the operating system's security state machine to migrate to the corresponding control loop according to the first-level real-time blocking instruction or the second-level incremental differential verification instruction, and implement security isolation for the write permissions of the underlying file system through the control loop.

[0010] Preferably, step S104, which involves driving the operating system's security state machine to migrate to the corresponding control loop based on a first-level real-time blocking instruction or a second-level incremental differential verification instruction, includes the following sub-steps: Step S1041, in response to a first-level real-time blocking instruction, directly rewrite the operating system's process scheduling descriptor, suspend the abnormal process, and block the underlying queue write operation; Step S1042, in response to a second-level incremental differential verification instruction, distribute a lightweight differential hash verification operator, perform targeted retrieval of only locally damaged sectors and complete single-point hash differential comparison, and call the underlying block device log recovery record to perform in-situ overwriting.

[0011] Preferably, step S102, which involves extracting the temporal dispersion index and spatial discontinuity index from the data stream, includes the following sub-steps: Step S1021, performing a sliding window slice on the continuous data stream, calculating the difference sequence between the submission timestamps of two adjacent I / O request groups, and obtaining the variance of the difference sequence, using the variance as the temporal dispersion index; Step S1022, parsing the target sector physical address of each group of I / O requests in the data stream, calculating the absolute jump span of the target sector physical address between adjacent requests; when the absolute jump span exceeds 512 sectors, using the proportion of the excess count value to the total number of requests as the spatial discontinuity index.

[0012] Preferably, step S101, which involves obtaining the security classification label of the target electronic file and allocating a corresponding digital sampling window, includes the following sub-steps: Step S1011, reading the security classification metadata of the target electronic file in the operating system security subsystem and identifying the security classification label as Top Secret, Confidential, and Secret; Step S1012, when the security classification label is Top Secret, allocating a digital sampling window with a duration of 60 seconds and raising the scheduling priority of the incremental hash verification operator to the highest level; when the security classification label is not Top Secret, allocating a digital sampling window with a duration of 10 seconds.

[0013] Preferably, step S1042, which involves distributing a lightweight differential hash verification operator to perform targeted retrieval of locally damaged sectors and complete single-point hash differential comparison, includes the following sub-steps: Step S10421, based on the secondary incremental differential verification instruction, constructing a lightweight differential hash verification operator that only includes the addressing range of locally modified sectors; Step S10422, calling the lightweight differential hash verification operator to read the tail boundary sector data triggered by unexpected spatial expansion, calculating the current hash value and performing a single-point differential comparison with the baseline hash value of the target electronic archive's historical registration to determine the damaged data block.

[0014] Preferably, step S1042, which involves calling the underlying block device log recovery record to perform in-situ overwrite, includes the following sub-steps: Step S10423, read the underlying block device log and retrieve the block device backup data of the last historical security period before the tampering of the damaged data block; Step S10424, use the block device backup data to directly rewrite the physical track content of the damaged data block, and complete the in-situ data rollback under the file system driver.

[0015] Preferably, when the length of data written in a single request triggers an unexpected spatial expansion of the tail boundary of the target electronic file, the length of data in the single write request is greater than 4096B, and the destination write address of the request exceeds the actual tail boundary of the target electronic file recorded in the file metadata.

[0016] Preferably, when it is determined that the current I / O has multi-threaded parallel encryption behavior, within a sliding observation window with a duration of less than 5ms, the multiple sets of parallel I / O requests exhibit uniform surface dispersion in time distribution, while the logical block numbers pointed to by each set of requests exhibit completely discontinuous random jumps in spatial distribution.

[0017] Preferably, when capturing the I / O request queue sequence in the underlying file system within the digital sampling window, a low-level filter driver is deployed between the virtual file system layer and the block device driver layer of the operating system. The filter driver intercepts and captures the real-time file I / O request packet queue and extracts the process identifier, physical sector offset, and write length from each file I / O request packet.

[0018] Compared with the prior art, the beneficial effects of the present invention are:

[0019] 1. By directly capturing I / O requests that have not been written to disk at the file system level and analyzing the time interval and address jump of adjacent requests, minor modifications and abnormal rewrites can be transformed into identifiable behavioral characteristics. Therefore, even if the file modification time, file size and other metadata have not changed, the system can still detect abnormal writes, reduce the reliance on file closing notifications and static full scans, and improve the ability to detect covert tampering of electronic archives.

[0020] 2. By calibrating and dynamically adjusting the threshold based on the number of pending tasks in the current file I / O submission queue, the judgment boundary can be adjusted according to the system load. During high-concurrency archiving and normal intensive writing, it can reduce the feature confusion between normal and abnormal requests, reduce the possibility of legitimate processes being mistakenly blocked, and maintain the required data security protection strength while maintaining system throughput, taking into account both the accuracy of tamper detection and data processing efficiency.

[0021] 3. By setting independent processing paths for high-frequency parallel encryption and low-frequency covert tampering, corresponding handling methods can be adopted for different anomalies. For high-frequency destructive writes, the first-level real-time blocking instruction can suspend the abnormal process in time and block subsequent writes in the underlying queue. For local, low-frequency tampering, the second-level incremental differential verification instruction only calls the lightweight differential hash verification operator to check the affected sectors. After completing the single-point hash differential comparison, the block device log recovery record is used to implement in-situ overwriting. This can both limit the continuous abnormal writes in time and avoid repeated verification and recovery of all archive data, realizing a combination of active blocking and local incremental rollback. Attached Figure Description

[0022] Figure 1 This is a flowchart of the tamper detection process based on I / O request queues according to the present invention;

[0023] Figure 2 This is a schematic diagram of the tamper detection structure based on the feature buffer of the present invention.

[0024] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0026] A method for detecting tampering in electronic records includes the following steps:

[0027] Step S101: Obtain the security classification label of the target electronic file and allocate the corresponding digital sampling window. Capture the I / O request queue sequence in the underlying file system within the digital sampling window and convert the I / O request queue sequence into a continuous data stream.

[0028] Step S102: Extract the temporal dispersion index and spatial discontinuity index from the data stream, read the number of pending tasks in the current file I / O submission queue, and perform discretization gradient calibration on the standard load safety time threshold based on the number of pending tasks and the system smoothing constant to generate a dynamically adjusted threshold.

[0029] Step S103: Compare the temporal dispersion index with the dynamic adjustment threshold, and compare the spatial discontinuity index with the preset security space threshold; when the temporal dispersion index is less than the dynamic adjustment threshold and the spatial discontinuity index is greater than the preset security space threshold, determine that the current I / O has multi-threaded parallel encryption behavior and output a first-level real-time blocking instruction; when the temporal dispersion index is continuously greater than the dynamic adjustment threshold and shows a long-tail distribution, the spatial discontinuity index is 0, and the length of data written in a single application triggers an unexpected spatial expansion of the tail boundary of the target electronic file, determine that the current I / O meets the covert tampering characteristics and output a second-level incremental differential verification instruction.

[0030] Step S104: Drive the operating system's security state machine to migrate to the corresponding control loop according to the first-level real-time blocking instruction or the second-level incremental differential verification instruction, and implement security isolation for the write permissions of the underlying file system through the control loop.

[0031] Preferably, step S104, which involves driving the operating system's security state machine to migrate to the corresponding control loop based on a first-level real-time blocking instruction or a second-level incremental differential verification instruction, includes the following sub-steps: Step S1041, in response to a first-level real-time blocking instruction, directly rewrite the operating system's process scheduling descriptor, suspend the abnormal process, and block the underlying queue write operation; Step S1042, in response to a second-level incremental differential verification instruction, distribute a lightweight differential hash verification operator, perform targeted retrieval of only locally damaged sectors and complete single-point hash differential comparison, and call the underlying block device log recovery record to perform in-situ overwriting.

[0032] Preferably, step S102, which involves extracting the temporal dispersion index and spatial discontinuity index from the data stream, includes the following sub-steps: Step S1021, performing a sliding window slice on the continuous data stream, calculating the difference sequence between the submission timestamps of two adjacent I / O request groups, and obtaining the variance of the difference sequence, using the variance as the temporal dispersion index; Step S1022, parsing the target sector physical address of each group of I / O requests in the data stream, calculating the absolute jump span of the target sector physical address between adjacent requests; when the absolute jump span exceeds 512 sectors, using the proportion of the excess count value to the total number of requests as the spatial discontinuity index.

[0033] Preferably, step S101, which involves obtaining the security classification label of the target electronic file and allocating a corresponding digital sampling window, includes the following sub-steps: Step S1011, reading the security classification metadata of the target electronic file in the operating system security subsystem and identifying the security classification label as Top Secret, Confidential, and Secret; Step S1012, when the security classification label is Top Secret, allocating a digital sampling window with a duration of 60 seconds and raising the scheduling priority of the incremental hash verification operator to the highest level; when the security classification label is not Top Secret, allocating a digital sampling window with a duration of 10 seconds.

[0034] Preferably, step S1042, which involves distributing a lightweight differential hash verification operator to perform targeted retrieval of locally damaged sectors and complete single-point hash differential comparison, includes the following sub-steps: Step S10421, based on the secondary incremental differential verification instruction, constructing a lightweight differential hash verification operator that only includes the addressing range of locally modified sectors; Step S10422, calling the lightweight differential hash verification operator to read the tail boundary sector data triggered by unexpected spatial expansion, calculating the current hash value and performing a single-point differential comparison with the baseline hash value of the target electronic archive's historical registration to determine the damaged data block.

[0035] Preferably, step S1042, which involves calling the underlying block device log recovery record to perform in-situ overwrite, includes the following sub-steps: Step S10423, read the underlying block device log and retrieve the block device backup data of the last historical security period before the tampering of the damaged data block; Step S10424, use the block device backup data to directly rewrite the physical track content of the damaged data block, and complete the in-situ data rollback under the file system driver.

[0036] Preferably, when the length of data written in a single request triggers an unexpected spatial expansion of the tail boundary of the target electronic file, the length of data in the single write request is greater than 4096B, and the destination write address of the request exceeds the actual tail boundary of the target electronic file recorded in the file metadata.

[0037] Preferably, when it is determined that the current I / O has multi-threaded parallel encryption behavior, within a sliding observation window with a duration of less than 5ms, the multiple sets of parallel I / O requests exhibit uniform surface dispersion in time distribution, while the logical block numbers pointed to by each set of requests exhibit completely discontinuous random jumps in spatial distribution.

[0038] Preferably, when capturing the I / O request queue sequence in the underlying file system within the digital sampling window, a low-level filter driver is deployed between the virtual file system layer and the block device driver layer of the operating system. The filter driver intercepts and captures the real-time file I / O request packet queue and extracts the process identifier, physical sector offset, and write length from each file I / O request packet.

[0039] Example 1: When the system kernel receives a file access request for a target electronic file, it needs to simultaneously handle processor load fluctuations caused by high-concurrency data import, high-density rewriting by multi-threaded parallel ransomware, and covert micro-modifications at the block device level. Since some modifications do not trigger changes in file metadata modification time, static hash scanning is difficult to identify the corresponding writes before the data is written to disk. To address this, a file system micro-filter driver (hereinafter referred to as the filter driver) is deployed between the virtual file system layer and the block device driver layer of the operating system. The filter driver intercepts the file access request stream of the target electronic file and reads the security metadata of the target electronic file in the operating system's security subsystem to obtain the security label. When the security label is top secret, a digital sampling window with a duration of 60 seconds is allocated, and the scheduling priority of the incremental hash verification operator is raised to the highest level. This incremental hash verification operator is a two-level incremental differential verification path. The system uses a lightweight differential hash verification operator called via a path; when the security level label is not top secret, a digital sampling window with a duration of 10 seconds is allocated; to avoid requests accumulating all at once within the digital sampling window, the filter driver refreshes the dynamic circular feature buffer in batches, with refresh cycles of 60ms for top secret files and 10ms for non-top secret files. Both 60ms and 10ms are feature buffer refresh cycles and are not considered as the duration of the digital sampling window; under high load conditions where the system's transient write concurrency rate exceeds 5000 times / s, the preset total number of discrete samples is 32, and the time required to fill the dynamic circular feature buffer with a sample sequence is approximately 6.4ms; with a 60ms refresh cycle, approximately 300 consecutive write requests can be captured per refresh cycle, and the filter driver accordingly refreshes the feature buffer cyclically within the digital sampling window and continuously captures the I / O request queue sequence in the underlying file system.

[0040] The filter driver intercepts write operations that have not yet been written to disk, captures the real-time file I / O request packet queue, and extracts the process identifier and the current request timestamp from each file I / O request packet. Physical sector offset and length of data written in a single request After converting the physical sector offset to the byte address corresponding to the physical address of the target sector, it is then... The process identifier is written to the feature buffer along with the corresponding request descriptor for subsequent location of the process initiating the abnormal write. The filter driver pushes the above data into the dynamic circular feature buffer according to the request capture order, forming an I / O request queue sequence, and organizes this sequence into a continuous data stream. The data processing module periodically reads this data stream and processes it according to the continuity. The time series dispersion index is calculated using the difference value of this request. Spatial discontinuity index ,in, The preset total number of discrete samples corresponds to the queue depth of the dynamic circular feature buffer; the data processing module calculates the continuous samples within the sliding time window. Time increment variance of each write request, time series dispersion index The calculation formula is: ,in, It is a time series dispersion index; Indicates the sequential number of the write request within the current slide window; The difference in timestamps between two consecutive write requests; The data processing module calculates the arithmetic mean of all timestamp differences within the current sliding time window; it also calculates the change in spatial span between adjacent write intervals. The calculation formula is as follows: ,in, This represents the change in spatial span. The byte address corresponding to the physical address of the target sector for the current write request; The byte address corresponding to the physical address of the target sector of the immediately preceding write request; The length of the data written in the preceding write request, and the change in spatial span. Used to determine whether adjacent write intervals are continuous; calculates spatial discontinuity index. At that time, the data processing module calculates the absolute value of the difference between the physical addresses of the target sectors of adjacent requests and converts it into the number of sectors as the absolute jump span; when the absolute jump span exceeds 512 sectors, it counts once, and then assigns this count value to the current... The proportion of the total number of requests is used as an indicator of spatial discontinuity. Spatial discontinuity index It is a dimensionless value that is greater than or equal to 0 and less than or equal to 1.

[0041] The arbitration module reads the number of pending tasks in the current file I / O submission queue. Based on the number of suspended tasks and system pacing constant Standard load safe time threshold Perform discretized gradient calibration to generate dynamically adjusted thresholds. The calculation formula is as follows: ,in, The standard load safe time threshold is expressed as the corresponding time increment variance value; To dynamically adjust the threshold; The system damping constant is a dimensionless constant. This represents the number of pending tasks in the current file I / O submission queue; the arbitration module will use the timing dispersion index. With dynamically adjusted threshold Comparison, and at the same time, spatial discontinuity index With the preset safe space threshold Comparison, safe space threshold The security space threshold was set to 0.50 during system initialization. The spatial discontinuity index reflects the proportion of requests with an absolute jump span exceeding 512 sectors to the total number of discrete samples, and its value ranges from 0.00 to 1.00. When the security space threshold is below 0.10, address interleaving caused by normal multi-task concurrency is easily judged as multi-threaded parallel encryption behavior. When the security space threshold is above 0.80, abnormal requests with local continuous write characteristics may not trigger blocking. During the on-site pre-calibration stage, random normal write streams of different densities were injected into the system, and the upper limit of index fluctuation under normal concurrent conditions was measured to be 0.35. Based on this, the security space threshold was determined to be 0.50.

[0042] Time series dispersion index Less than the dynamic adjustment threshold And spatial discontinuity index Greater than the safe space threshold At that time, the arbitration module extracts a sliding observation window with a duration of less than 5ms within the digital sampling window to check the temporal and spatial distribution of multiple sets of parallel I / O requests. When multiple sets of requests are distributed within the sliding observation window and are not concentrated at the same submission time, the time distribution shows uniform surface dispersion. When the logical block numbers corresponding to each set of requests show completely discontinuous random jumps in spatial distribution, the system determines that the current I / O has multi-threaded parallel encryption behavior and outputs a level one real-time blocking instruction. When the timing dispersion index within multiple consecutive sliding time windows... All are greater than the dynamic adjustment threshold Furthermore, if large index values ​​exceeding this threshold consistently appear at the end of the window sequence, the index sequence is determined to exhibit a long-tail distribution; based on this, when the spatial discontinuity index... A value of 0 indicates the length of data written in a single request. If the value is greater than 4096B and the destination write address of the request exceeds the actual file tail boundary recorded in the file metadata of the target electronic file, the current I / O is determined to meet the covert tampering characteristics, and a two-level incremental differential verification instruction is output.

[0043] Upon receiving a Level 1 real-time blocking instruction or a Level 2 incremental differential verification instruction, the control module drives the operating system's security state machine to migrate to the corresponding control loop. The security state machine, using a finite state machine data structure at the operating system kernel level, internally sets up three mutually exclusive state entities: a normal monitoring state, a Level 1 real-time blocking state, and a Level 2 incremental verification state. During system kernel initialization, the security subsystem allocates a state variable storage area for the security state machine in dedicated memory space. After the arbitration module outputs the corresponding instruction, the control loop calls the state transition function to modify the state variables and activates the control function bound to the target state. In response to a Level 1 real-time blocking instruction, the control module retrieves the corresponding process from the operating system's process control block linked list based on the process identifier stored in the feature buffer, locates the process scheduler descriptor, writes the process running state field to a preset unschedulable suspended state value, and removes the process scheduler descriptor from the executable ready queue. The operating system kernel scheduler stops allocating processor time slices to the process during subsequent clock interrupt cycles, simultaneously blocks write operations to the underlying queue, and sets the target electronic file handle to a read-only state, thereby implementing secure isolation of write permissions to the underlying file system.

[0044] Upon responding to the secondary incremental differential verification command, the control module triggers the incremental differential verification module. It constructs a lightweight differential hash verification operator that only includes the addressing range of the partially modified sectors, based on the sector addresses involved in the unexpected space expansion. When the target electronic file enters a protected state, the security subsystem calculates and registers the baseline hash value according to the sector addressing range, and associates and saves each baseline hash value with its corresponding sector address. When a legitimate write operation is completed and the security state machine maintains normal monitoring, the baseline hash value of the corresponding sector is updated. The lightweight differential hash verification operator directionally reads the tail boundary sector data triggered by the unexpected space expansion, calculates the current hash value, and performs a single-point hash differential comparison with the baseline hash value historically registered in the target electronic file to identify the damaged data block. The underlying block device log recovery record associates and saves the sector address, write order, block device backup data before the write, and security status flag. The next historical security cycle is the record period in which the most recent write verification was completed before the tampering occurred, and the security state machine maintained a normal monitoring state. The control module retrieves the block device log recovery record of this historical security cycle based on the sector address of the damaged data block and reads the corresponding block device backup data. The block device driver locates the corresponding physical track according to the address mapping of the damaged data block, commits an overwrite write, and directly writes the block device backup data into the physical track content of the damaged data block, completing the in-situ data rollback under the file system driver. The protection architecture, consisting of a filter driver, a data processing module, an arbitration module, and a control module, restricts abnormal writes during the kernel scheduling phase before the data is written to disk, and performs incremental verification and in-situ rollback on locally damaged data. While maintaining the throughput performance of the operating system bus, the tamper detection latency is controlled within the microsecond range, maintaining the integrity and security of the stored data.

[0045] Example 2: The test platform consists of a file system micro-filtering driver layer, a feature buffer, and a state machine control module. The file system micro-filtering driver layer intercepts standard file access request streams, forming a sequence of raw request descriptors composed of discrete I / O requests. To simulate queuing delays and intermodulation interference caused by process scheduling under high-concurrency multitasking conditions, a random concurrent request sequence is superimposed on the input data stream as an environmental disturbance source. Each request descriptor contains the current request timestamp. The logical block start address of the target storage sector and the length of data written in a single application The samples are written to the dynamic circular feature buffer in the order they arrive as requested; the preset total number of discrete samples... Due to limitations in the depth of the dynamic circular feature buffer and the timeliness of the sliding processing, its value needs to balance response latency and processor computational load. When the transient write concurrency rate exceeds 5000 times / s, an excessively large total number of samples will prolong the feature extraction time and increase the number of pending requests in the buffer. To avoid I / O requests accumulating under high load conditions, this embodiment uses a preset total number of discrete samples. Set it to 32.

[0046] In the normal operating condition test of the sample group of this invention, the environmental disturbance source is continuously input, and the standard load safe time threshold is expressed as the time increment variance. Set to 5.0ms², after a multi-threaded parallel rewrite operation occurs, the file system micro-filter driver layer intercepts the write operations of data not yet written to disk, forming an original time-series feature queue in a dynamic circular feature buffer. The data processing module reads the timestamps of 32 consecutive write requests. Logical block start address and the length of data written The timestamp difference between adjacent write requests was calculated. The measured timestamp difference ranged from 0.12ms to 0.45ms. After processing according to the calculation relationship of the time series dispersion index, the time series dispersion index was obtained. The value is 0.0325ms². For the same group of 32 write requests, the data processing module calculates the absolute jump span based on the physical address of the target sector of adjacent requests. Among the 32 requests, 28 requests have an absolute jump span exceeding 512 sectors. The spatial discontinuity index is obtained from the proportion of this count to the total number of requests. The value is 0.8750. To observe the index fluctuations between consecutive sliding windows, the system also performs an exponentially weighted moving average on the spatial discontinuity index of the current window: the current window's 0.8750 is included with a current weight of 0.40 and combined with the index decay values ​​of the previous three historical windows to obtain a smoothed observation result of 0.8752. The arbitration module still uses the 0.8750 directly calculated for the current window as the spatial discontinuity index. Participation in safe space threshold The comparison and smoothing of observations are only used to suppress transient jitter in cross-window displays.

[0047] Number of pending tasks in the current file I / O commit queue The threshold is set to 0, and then dynamically adjusted based on the discretized gradient calibration relationship. Maintaining a value of 5.0 ms², at this point, the time series dispersion index... Less than the dynamic adjustment threshold Spatial discontinuity index Greater than the safe space threshold The arbitration module determines that the current I / O has multi-threaded parallel encryption behavior and outputs a level-one real-time blocking command within 1.15μs. The control module locates the abnormal process based on the process identifier in the request descriptor, rewrites the corresponding process scheduling descriptor, and suspends the process. Under this condition, the file protection success rate is 99.45%. Under the same input request flow and environmental disturbance conditions, the first missing part of the control group without the security time threshold calibration mechanism cannot adjust the dynamic adjustment threshold according to the number of suspended tasks. The judgment boundary remains fixed when the concurrent load changes, and the tamper detection latency increases to 145.26ms. The second missing part of the control group without the spatial discontinuity index judges only based on the time distribution and cannot distinguish between normal concurrent writes and random jumps in logical block addresses. Its false alarm rate increases to 14.62%. The above comparison results reflect the impact of the suspended task number feedback and the spatial discontinuity index on the judgment latency and false alarm rate, respectively.

[0048] To verify the preset total number of discrete samples Performance changes after deviating from the working range, set to 256, resulted in increased computational latency for the data processing module under high-concurrency write streams due to the increased number of data feature points to be extracted and processed per sliding window. As the number of malicious encryption threads increased from 4 to 32, the overall tampering blocking latency increased from 4.18ms to 89.62ms. When processor bandwidth approached saturation, the latency growth rate leveled off, and further increasing the sample depth did not bring a corresponding improvement in blocking timeliness. The preset total number of discrete samples... When set to 2, the feature samples within a single sliding window are insufficient to mitigate process scheduling latency jitter caused by environmental disturbances; under normal high-concurrency import and archiving operations, the time-series dispersion index... Random fluctuations occurred, with the false alarm rate of the system changing from 0.15% under normal conditions to 22.45%. This result indicates that a small total number of samples can cause single scheduling jitter to directly affect the calculation results of the time series dispersion index.

[0049] Within the parameter working window used in the sample group of this invention, the number of malicious encryption threads was set to 4, 16, and 32, respectively, and the first-level real-time blocking response delay was 1.15μs, 1.52μs, and 2.34μs, respectively. The number of damaged blocks in the target electronic file was controlled within the range of 1, 2, and 4 physical tracks, respectively. As the number of malicious encryption threads increased, the blocking response delay and the number of damaged blocks increased synchronously, maintaining a continuous monotonic relationship. The original temporal feature queue captured by the file system micro-filtering driver layer was analyzed by the temporal dispersion index. Spatial discontinuity index After joint processing, the abnormal rewriting actions that were not written to disk are converted into behavioral data that can be compared by the arbitration module; the number of suspended tasks. Participate in dynamic adjustment threshold The calibration adjusts the decision boundary according to the load changes of the file I / O submission queue, thereby reducing bus congestion and detection lag caused by full scan.

[0050] Example 3: The storage driver layer continuously receives concurrent file access requests during the electronic archive archiving and security classification control process. These include multi-threaded parallel rewrite requests and modification requests that directly affect the block device. Some underlying modification actions do not change the metadata modification time recorded in the file system. Static file verification has a detection lag, and abnormal writes may change the data in the electronic archive storage sector before the disk is written. The filter driver intercepts the file access request stream of the target electronic archive, reads the security classification metadata of the target electronic archive in the operating system security subsystem, and identifies its security classification label. When the security classification label is top secret, a digital sampling window with a duration of 60 seconds is allocated; when the security classification label is not top secret, a digital sampling window with a duration of 10 seconds is allocated. The filter driver captures the I / O request queue sequence in the underlying file system within the corresponding digital sampling window and controls the acquisition scale and data bus load through the duration of the digital sampling window.

[0051] When capturing the I / O request queue sequence, the filter driver extracts the process identifier and the current request timestamp from the file I / O request packets. Physical sector offset, logical block number, and length of data written in a single request. And obtain the byte address corresponding to the physical address of the target sector based on the physical sector offset. The aforementioned data is pushed into a lock-free circular queue in the feature buffer according to the order of request arrival, forming a continuous data stream and an original time-series feature queue. The data processing module periodically reads this queue, calculates the timestamp difference between adjacent requests and the change in storage address space span, and then, based on the continuous... The time series dispersion index is calculated using the difference value of this request. Spatial discontinuity index The data processing module calculates the consecutive values ​​in the lock-free circular queue. The variance of the timestamp difference between each write request yields the time-series dispersion index. The calculation relationship is as follows: ,in, It is a time series dispersion index; This represents the preset total number of discrete samples and the corresponding queue depth of the feature buffer; The difference in timestamps between two consecutive write requests; The data processing module calculates the spatial span variation based on the differences between timestamps within the digital sampling window; it calculates the arithmetic mean of the differences between timestamps within adjacent writing intervals. The calculation relationship is as follows: ,in, This represents the change in spatial span. The byte address corresponding to the physical address of the target sector for the current write request; The byte address corresponding to the physical address of the target sector immediately preceding the write request; Calculate the spatial discontinuity index for the length of the write data in the preceding write request. At that time, the data processing module calculates the absolute jump span of the target sector physical address between adjacent requests; when the absolute jump span exceeds 512 sectors, it counts once, and then uses the proportion of this count value to the total number of current requests as the spatial discontinuity index. This indicator is a dimensionless value that is greater than or equal to 0 and less than or equal to 1.

[0052] The arbitration module reads the number of pending tasks in the current file I / O submission queue. Based on the number of suspended tasks and system pacing constant For standard load safe time threshold Discretized gradient calibration is performed to obtain a dynamically adjusted threshold. The calculation relationship is as follows: ,in, To dynamically adjust the threshold; The standard load safe time threshold; This is the system stagnation constant; This represents the number of pending tasks in the current file I / O submission queue; the arbitration module uses an event-driven approach to handle timing dispersion metrics. With dynamically adjusted threshold Comparison, and at the same time, spatial discontinuity index With safety space threshold Comparison, time series dispersion index Less than the dynamic adjustment threshold And spatial discontinuity index Greater than the safe space threshold When the arbitration module observes the distribution of parallel I / O requests within a sliding observation window kernel lasting less than 5ms, and multiple requests exhibit uniform surface dispersion in temporal distribution while their logical block numbers exhibit completely discontinuous random jumps in spatial distribution, it determines that the current I / O has multi-threaded parallel encryption behavior and outputs a Level 1 real-time blocking instruction. The control module responds to the Level 1 real-time blocking instruction by locating the process scheduler descriptor corresponding to the abnormal process based on the process identifier, suspending the process and removing it from the executable ready queue. Simultaneously, it blocks the underlying queue write operation, sets the target electronic file handle to read-only, and the operating system's security state machine transitions to the Level 1 real-time blocking state. Furthermore, it implements secure isolation of write permissions on the underlying file system through the corresponding control loop.

[0053] Time series dispersion index Continuously greater than the dynamically adjusted threshold It exhibits a long-tailed distribution and spatial discontinuity index. Equal to 0, length of data written in a single request If the value is greater than 4096 bytes and the destination write address of the request exceeds the actual file tail boundary recorded in the file metadata of the target electronic file, it is determined that an unexpected space expansion has occurred at the tail boundary of the target electronic file. Based on this, the arbitration module determines that the current I / O meets the characteristics of covert tampering, outputs a secondary incremental differential verification instruction, and drives the operating system's security state machine to transition to the secondary incremental verification state. The control module responds to the secondary incremental differential verification instruction, triggering the incremental differential verification module to distribute a lightweight differential hash verification operator to the target storage area. This operator only performs targeted searches within the addressing range of locally modified sectors, reads the tail boundary sector data triggered by the unexpected space expansion, calculates the current hash value, and compares it with the baseline hash value historically registered by the target electronic file. Single-point hash differential comparison is used to identify damaged data blocks. After identifying the damaged data blocks, the control module reads the underlying block device log, retrieves the block device backup data of the last historical security period before the tampering occurred, and then uses the block device backup data to directly rewrite the physical track content of the damaged data block, completing the in-situ data rollback under the file system driver and restoring the damaged file content. The protection architecture, consisting of a filter driver, data processing module, arbitration module, and control module, drives the security state machine migration based on the spatiotemporal characteristics of captured I / O requests, restricts abnormal writes before data is written to disk, and performs incremental verification and in-situ rollback on locally damaged data, maintaining the integrity of electronic file storage data while maintaining the throughput performance of the operating system bus.

[0054] Example 4: This example combines Figures 1 to 2 This describes a method for detecting tampering in electronic records, such as... Figure 1As shown, the method includes steps S101, S102, S103, and S104; Step S101 obtains the security classification label of the target electronic file and allocates a corresponding digital sampling window, captures the I / O request queue sequence in the underlying file system within the digital sampling window, and converts the I / O request queue sequence into a continuous data stream; Step S102 extracts the temporal dispersion index and spatial discontinuity index from the data stream, reads the number of pending tasks in the current file I / O submission queue, performs discretization gradient calibration on the standard load safety time threshold based on the number of pending tasks and the system smoothing constant, and generates a dynamically adjusted threshold; Step S103 compares the temporal dispersion index with... The threshold is dynamically adjusted, and the spatial discontinuity index is compared with the preset security space threshold. If the temporal dispersion is less than the dynamically adjusted threshold and the spatial discontinuity is greater than the security space threshold, it is determined that there is multi-threaded parallel encryption behavior, and a first-level real-time blocking instruction is output. If the temporal dispersion has a long tail distribution and is continuously greater than the adjustment threshold, the spatial discontinuity is 0, and the single write length triggers unexpected space expansion, it is determined that it meets the characteristics of covert tampering, and a second-level incremental differential verification instruction is output. Step S104 drives the operating system's security state machine to migrate to the corresponding control loop according to the first-level real-time blocking instruction or the second-level incremental differential verification instruction, and implements security isolation of the write permissions of the underlying file system through the control loop.

[0055] like Figure 2As shown, the operating system security subsystem outputs classified metadata, while the operating system process outputs a file access request stream. Both the classified metadata and the file access request stream are input into the filter driver for interception and processing. The request descriptor sequence generated after the filter driver interception and processing is transmitted and stored in a dynamic circular feature buffer. The dynamic circular feature buffer outputs the original temporal feature queue and sends it to the feature index data extraction. The feature index data extraction solves the original temporal feature queue and generates temporal dispersion and spatial discontinuity. The temporal dispersion and spatial discontinuity are used as the basis for judgment and input into the arbitration comparison and flow division judgment. In addition, the file I / O submission queue provides the number of suspended tasks to the dynamic threshold gradient calibration. After the dynamic threshold gradient calibration completes the calculation based on the number of suspended tasks, it outputs the dynamically adjusted threshold. The dynamically adjusted threshold is also input into the arbitration comparison and diversion judgment to execute the comparison logic. When the arbitration comparison and diversion judgment meets the first-level blocking condition, a first-level real-time blocking instruction is output. The first-level real-time blocking instruction triggers process scheduling rewriting blocking, and then performs state modification operations on the process control block linked list through process scheduling descriptor rewriting. When the arbitration comparison and diversion judgment meets the second-level verification condition, a second-level incremental differential verification instruction is output. The second-level incremental differential verification instruction activates lightweight hash differential verification. Lightweight hash differential verification performs comparison analysis on the data and outputs the damaged data block to the block device log in-situ rollback. At this time, the underlying block device log provides block device backup data to the block device log in-situ rollback. The block device log in-situ rollback combines the damaged data block and the block device backup data to perform the rollback and overwrite of the underlying physical content.

[0056] Example 5: When deploying for the first time in a new architecture environment, perform an on-site pre-calibration to determine the standard load safe time threshold. and system pacing constant After obtaining explicit authorization from the user, the control module controls the throughput simulation mechanism to send a write request stream at a rate of 1000 times / second to the filter driver. The filter driver intercepts this request stream and extracts the current request timestamp from each file I / O request packet. The byte address corresponding to the physical address of the target sector and the length of data written in a single application The data is then written to the feature buffer in the order of arrival of the requests; the data processing module reads 32 consecutive requests, calculates the timestamp difference between adjacent requests, and obtains the time series dispersion index accordingly. The initial measurement value, at which point the number of pending tasks in the current file I / O submission queue is determined. Keep it at 0, then set the standard load safety time threshold. Set it to 3 times the initial measurement value, so that the standard load safety time threshold and the time series dispersion index use the same dimension, and form the initial judgment boundary under the standard load state without suspended tasks.

[0057] Complete the standard load safety time threshold After calibration, the system changes the thread concurrency density, reducing the number of suspended tasks. The processor is adjusted to 10 and 100 respectively, and records the number of suspended tasks at each load gradient. Dynamically adjust threshold The results of the determination were used, with a false alarm rate of ≥99.9% as the boundary constraint; during fitting, the number of suspended tasks under each load gradient was considered. and dynamically adjusted threshold As input data, a least squares method is used for polynomial curve fitting; the polynomial coefficients are adjusted stepwise according to the residuals between each discrete point and the fitted curve until the sum of squared residuals reaches the preset minimum convergence criterion; the system determines the system smoothing constant based on the calibration relationship between the fitted curve and the dynamically adjusted threshold. The data is then stored in the feature buffer. After completing the on-site pre-calibration, the arbitration module reads the real-time changing number of suspended tasks during operation. Combined with standard load safe time threshold and system pacing constant Generate dynamically adjusted thresholds When high-frequency discrete mutation writes occur, the threshold is dynamically adjusted according to the load changes of the file I / O submission queue, so that the in-situ suspension time window of the abnormal process is kept within the microsecond range.

[0058] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for detecting tampering in electronic archives, characterized in that, Includes the following steps: Step S101: Obtain the security classification label of the target electronic file and allocate the corresponding digital sampling window. Capture the I / O request queue sequence in the underlying file system within the digital sampling window and convert the I / O request queue sequence into a continuous data stream. Step S102: Extract temporal dispersion and spatial discontinuity indices from the data stream. Specifically, the continuous data stream is sliced ​​using a sliding window. The difference sequence between the submission timestamps of two adjacent I / O request groups is calculated, and the variance of the difference sequence is used as the temporal dispersion index. The target sector physical address of each I / O request group in the data stream is analyzed, and the absolute jump span between adjacent requests is calculated. When the absolute jump span exceeds 512 sectors, the proportion of the excess count to the total number of requests is used as the spatial discontinuity index. The number of pending tasks in the current file I / O submission queue is read. Based on the number of pending tasks and the system smoothing constant, a discretized gradient calibration is performed on the standard load safety time threshold to generate a dynamically adjusted threshold. The calculation formula is as follows: ,in, The standard load safe time threshold is expressed as the corresponding time increment variance value; To dynamically adjust the threshold; The system damping constant is a dimensionless constant. This represents the number of pending tasks in the current file I / O commit queue. Step S103: Compare the temporal dispersion index with the dynamic adjustment threshold, and compare the spatial discontinuity index with the preset security space threshold; when the temporal dispersion index is less than the dynamic adjustment threshold and the spatial discontinuity index is greater than the preset security space threshold, determine that the current I / O has multi-threaded parallel encryption behavior and output a first-level real-time blocking instruction; when the temporal dispersion index is continuously greater than the dynamic adjustment threshold and shows a long-tail distribution, the spatial discontinuity index is 0, and the length of data written in a single application triggers an unexpected spatial expansion of the tail boundary of the target electronic file, determine that the current I / O meets the covert tampering characteristics and output a second-level incremental differential verification instruction. Step S104: Drive the operating system's security state machine to migrate to the corresponding control loop according to the first-level real-time blocking instruction or the second-level incremental differential verification instruction, and implement security isolation for the write permissions of the underlying file system through the control loop.

2. The method for detecting tampering in electronic archives according to claim 1, characterized in that, Step S104, which drives the operating system's security state machine to migrate to the corresponding control loop according to the first-level real-time blocking instruction or the second-level incremental differential verification instruction, includes the following sub-steps: Step S1041, when responding to the first-level real-time blocking instruction, directly rewrite the operating system's process scheduling descriptor, suspend the abnormal process, and block the underlying queue write operation; Step S1042, when responding to the second-level incremental differential verification instruction, distribute the lightweight differential hash verification operator, only perform targeted retrieval of locally damaged sectors and complete single-point hash differential comparison, and call the underlying block device log recovery record to perform in-situ overwriting.

3. The method for detecting tampering in electronic archives according to claim 1, characterized in that, Step S101, which involves obtaining the security classification label of the target electronic file and allocating a corresponding digital sampling window, includes the following sub-steps: Step S1011, read the security classification metadata of the target electronic file in the operating system security subsystem, and identify the security classification label as Top Secret, Confidential, and Secret; Step S1012, when the security classification label is Top Secret, allocate a digital sampling window with a duration of 60 seconds, and raise the scheduling priority of the incremental hash verification operator to the highest level; when the security classification label is not Top Secret, allocate a digital sampling window with a duration of 10 seconds.

4. The method for detecting tampering in electronic archives according to claim 2, characterized in that, Step S1042 involves distributing a lightweight differential hash verification operator to perform targeted retrieval of locally damaged sectors and complete single-point hash differential comparison, including the following sub-steps: Step S10421: Based on the secondary incremental differential verification instruction, construct a lightweight differential hash verification operator that only includes the addressing range of locally modified sectors; Step S10422: Call the lightweight differential hash verification operator to read the tail boundary sector data triggered by unexpected spatial expansion, calculate the current hash value, and perform a single-point differential comparison with the baseline hash value of the target electronic archive's historical registration to determine the damaged data block.

5. The method for detecting tampering in electronic archives according to claim 2, characterized in that, The in-situ overwrite of the underlying block device log recovery record in step S1042 includes the following sub-steps: Step S10423, read the underlying block device log and retrieve the block device backup data of the last historical security period before the tampering of the damaged data block; Step S10424, use the block device backup data to directly rewrite the physical track content of the damaged data block and complete the in-situ data rollback under the file system driver.

6. The method for detecting tampering in electronic archives according to claim 1, characterized in that, When a single write request triggers an unexpected spatial expansion of the target electronic file's tail boundary, the data length in the single write request is greater than 4096B, and the requested destination write address exceeds the actual file tail boundary recorded in the target electronic file's file metadata.

7. The method for detecting tampering in electronic archives according to claim 1, characterized in that, When it is determined that the current I / O has multi-threaded parallel encryption behavior, within a sliding observation window with a duration of less than 5ms, multiple sets of parallel I / O requests exhibit uniform surface dispersion in time distribution, while the logical block numbers pointed to by each set of requests exhibit completely discontinuous random jumps in spatial distribution.

8. The method for detecting tampering in electronic archives according to claim 1, characterized in that, When capturing the I / O request queue sequence in the underlying file system within the digital sampling window, a low-level filter driver is deployed between the virtual file system layer and the block device driver layer of the operating system. The filter driver intercepts and captures the real-time file I / O request packet queue and extracts the process identifier, physical sector offset, and write length from each file I / O request packet.

Images