Encryption testing method and related device

Abstract

The present application provides an encryption testing method and a related device, the method being applied to the field of file ransomware encryption testing. The encryption testing method comprises: obtaining a file to be tested, and determining character-level data features of all characters or some of the characters in said file, wherein some of the characters can be obtained by sampling said file; and on the basis of the character-level data features of all characters or some of the characters, determining whether there is an encrypted character in said file, if yes, indicating that said file is encrypted, and if not, indicating that said file is not encrypted. The method provided by the present application realizes character-level encryption testing, can be applied to a scenario where one or more characters in a file to be tested are encrypted, can also be applied to a scenario where part of content in a file to be tested is encrypted or all of the content is encrypted, and has strong applicability and a wide application range.

Description

A method and related device for detecting encryption

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on March 27, 2024, with application number 202410371181.2 and application name “A Method for Encryption Detection and Related Devices”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of file encryption detection, and in particular to an encryption detection method and related devices. Background Art

[0003] With the continuous advancement of informatization, data centers, computing centers, and supercomputing centers are rapidly developing and expanding. The total amount of data produced and stored globally has exploded. Manufacturers and storage device users are facing data security challenges brought about by this explosive growth, as well as financial security risks resulting from data leaks. Therefore, how to prevent and detect ransomware attacks has become a key concern.

[0004] In the face of ransomware attacks on file encryption operations, current detection methods include: detecting based on abnormal input / output (I / O) of file data and the corresponding file content. Specifically, the corresponding abnormal file is determined based on the abnormal IO, and then the content in the corresponding abnormal file is globally or locally sampled, and the reduction rate feature or entropy value feature of the sample data is calculated. The reduction rate feature or entropy value feature is analyzed to determine whether the file is encrypted.

[0005] In the above-mentioned file encryption detection method, when only part or a small amount of content in a file is encrypted, the data reduction rate feature or entropy value feature is not obvious, and it is difficult to detect whether the file is encrypted. Summary of the Invention

[0006] The present application provides an encryption detection method and related devices. The method provided by the present application realizes the detection of character-level encryption. It can be applied to scenarios where one or more characters in the file to be detected are encrypted, and can also be applied to scenarios where part of the content in the file to be detected is encrypted or all of the content is encrypted. It has strong applicability and a wide range of applications.

[0007] In a first aspect, the present application provides an encryption detection method, comprising: obtaining character-level data features of all or part of the characters in a file to be detected; and determining whether the file to be detected is encrypted based on the character-level data features of all or part of the characters.

[0008] It can be seen that the present application provides an encryption detection method, which extracts character-level data features from the file to be detected and determines whether the file to be detected is encrypted based on the character-level data features. The encryption detection method of the present application can realize character-level encryption detection. When the encrypted content in the file to be detected is small or part of the content is encrypted, encryption detection can be realized and accurate detection results can be obtained. Of course, when the encrypted content in the file to be detected is large or all of the content is encrypted, the method of the present application can also realize encryption detection and obtain accurate results. The encryption detection method provided by the present application has a wide range of applications and strong applicability.

[0009] Based on the first aspect, in a possible implementation method, determining whether the file to be detected is encrypted based on all or part of the character-level data features includes: determining the character-level data features that belong to unprintable characters in all or part of the character-level data features; determining whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

[0010] The present application method is implemented based on the detection of unprintable characters. Most of the characters in a normal, unencrypted file are printable characters, and only a very small number of characters are unprintable characters. For example, special characters such as control characters and line feed characters in the file are unprintable characters. In the case where a file is encrypted by ransomware, the encrypted characters in the file are changed from printable characters to unprintable characters, but the character-level data features corresponding to the encrypted characters are different from the character-level data features of normal unprintable characters (such as control characters, line feed characters, etc.). The present application method utilizes this point, first extracts the character-level data features of all or part of the characters in the file to be detected, and then determines the character-level data features of all or part of the characters that belong to unprintable characters in the character-level data features, and then determines whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

[0011] Based on the first aspect, in a possible implementation method, determining whether the file to be detected is encrypted is based on the character-level data features of the unprintable characters, including: establishing a statistical model based on the character-level data features of the unprintable characters, the statistical model is used to extract features from the character-level data features of the unprintable characters; inputting the statistical model into a classifier to determine whether the file to be detected is encrypted.

[0012] The method of the present application extracts features of the character-level data features of the unprintable characters by establishing a statistical model of the character-level data features of the unprintable characters, thereby determining whether there are encrypted characters in the file to be detected based on the features of the character-level data features of the unprintable characters, wherein the features of the character-level data features corresponding to the encrypted characters are different from the features of the character-level data features of normal unprintable characters (such as control characters, line feed characters, etc.). By establishing a statistical model based on the character-level data features of the unprintable characters, the statistical model is used to further extract features from the character-level data features of the unprintable characters, and determining whether the file to be detected is encrypted based on the features extracted by the statistical model, compared to directly classifying according to the character-level data features of the unprintable characters to determine whether the file to be detected is encrypted, the detection accuracy of the present application scheme is higher and the results are more accurate.

[0013] Based on the first aspect, in a possible implementation, the statistical model is used to count the distribution of each character-level data feature in the character-level data features of unprintable characters, and the distribution of each character-level data feature includes one or more of the number and position of each character-level data feature.

[0014] The statistical model can be used to calculate the distribution of character-level data features of unprintable characters, such as the quantity distribution and position distribution of each character data feature.

[0015] Based on the first aspect, in a possible implementation method, determining the character-level data features that belong to unprintable characters in all or part of the character-level data features includes: determining the character-level data features that belong to printable characters in all or part of the character-level data features according to the type of the file to be detected, thereby determining the character-level data features that belong to unprintable characters in all or part of the character-level data features.

[0016] It can be understood that after the file to be detected and the type of the file to be detected are determined, the character set of the file to be detected and the printable characters in the character set are determined. When the encoding rules are determined, the character-level data features of the printable characters are determined. In addition to the character-level data features of the printable characters, all or part of the character-level data features are the character-level data features of the unprintable characters.

[0017] Based on the first aspect, in a possible implementation, the file to be detected includes one or more of a virtual machine file, a container file, a database file, and a database management file.

[0018] Based on the first aspect, in a possible implementation, the method is applied to a scenario where the file to be detected is partially encrypted, where the partial encryption includes character-level encryption.

[0019] The method of the present application is implemented based on character-level data features and can be applied to scenarios where one or more characters in the file to be detected are encrypted, or to scenarios where part of the content in the file to be detected is encrypted or all of the content is encrypted.

[0020] In a second aspect, the present application provides an encryption detection device, comprising:

[0021] An acquisition module is used to obtain all or part of the character-level data features of the file to be detected;

[0022] The determination module is used to determine whether the file to be detected is encrypted based on all or part of the character-level data features.

[0023] Based on the second aspect, in a possible implementation, the determination module is used to: determine character-level data features belonging to unprintable characters among all or part of the character-level data features; and determine whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

[0024] Based on the second aspect, in a possible implementation, the determination module is used to: establish a statistical model based on the character-level data features of unprintable characters, and the statistical model is used to extract features of the character-level data features of unprintable characters; input the statistical model into the classifier to determine whether the file to be detected is encrypted.

[0025] Based on the second aspect, in a possible implementation, the statistical model is used to count the distribution of each character-level data feature in the character-level data features of unprintable characters, and the distribution of each character-level data feature includes one or more of the number and position of each character-level data feature.

[0026] Based on the second aspect, in a possible implementation method, the determination module is used to: determine the character-level data features that belong to printable characters among all or part of the character-level data features according to the type of the file to be detected, thereby determining the character-level data features that belong to unprintable characters among all or part of the character-level data features.

[0027] Based on the second aspect, in a possible implementation, the file to be detected includes one or more of a virtual machine file, a container file, a database file, and a database management file.

[0028] The functional modules of the second aspect are used to implement the method of the first aspect and any possible implementation manner of the first aspect.

[0029] In a third aspect, the present application provides a computing device cluster comprising at least one computing device, wherein the at least one computing device comprises a memory and a processor, and the processor in the at least one computing device is used to execute instructions stored in the memory in the at least one computing device to implement the above-mentioned first aspect and any possible implementation method of the first aspect.

[0030] In a fourth aspect, the present application provides a computer storage medium comprising program instructions. When the program instructions are executed on a computing device cluster, the computing device cluster executes the above-mentioned first aspect and any possible implementation method of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] FIG1 is a flow chart of an encryption detection method provided by the present application;

[0032] FIG2 is a flow chart of a method for determining all or part of character-level data features of a file to be detected provided by the present application;

[0033] FIG3 is a schematic diagram of a scenario provided by this application;

[0034] FIG4 is a schematic diagram of a system architecture provided by this application;

[0035] FIG5 is a schematic diagram of the structure of a computing device provided by the present application;

[0036] FIG6 is a schematic diagram of the structure of a computing device cluster provided by the present application;

[0037] FIG7 is a schematic diagram of the structure of another computing device cluster provided in this application. DETAILED DESCRIPTION

[0038] The present application provides an encryption detection method, which can be applied to scenarios where part of the content in a file to be detected is encrypted by ransomware, such as scenarios where part of the fields in a database file are encrypted, or scenarios where part of the content in a virtual machine file is encrypted, wherein the encryption of part of the content includes the encryption of one or more characters in the file to be detected.

[0039] See Figure 1, which is a flow chart of an encryption detection method provided by this application. The method can be applied to a computing device, which can be a server, a virtual machine, a container, etc. The computing device can also be a storage security integrated device located on a device in a distributed storage device cluster, a centralized storage device cluster, a homogeneous storage device cluster, or a heterogeneous storage device cluster. The method includes, but is not limited to, the following description.

[0040] S101: Obtain a file to be detected.

[0041] The file to be detected can be any one or more of a database file, a database management file, a virtual machine file, and a container file. For example, a database file can be a file including one or more tables in a database. A database management file refers to a file in a database management system. A database management system refers to a system for managing the reading and writing of files in a database. A virtual machine file refers to one or more files in a virtual machine file system. A virtual machine file system is a file that contains a virtual machine operating system and related configurations, including a virtual machine operating system, application software, configuration information, etc. Through the virtual machine file, a virtual machine can be created, started, paused, resumed, and shut down on a host machine. A container file refers to one or more files in a container file system. The file to be detected can also be other files, which is not limited in this application.

[0042] S102: Obtain all or part of the character-level data features of the file to be detected.

[0043] Character-level data features refer to features obtained by extracting, representing, or encoding characters in a file to be detected using characters as basic units.

[0044] This step may include two steps as shown in FIG2 . FIG2 is a flow chart of a method for determining all or part of the character-level data features of a file to be detected provided by the present application. The method includes but is not limited to the description below.

[0045] S1021. Determine the type of the file to be detected.

[0046] The type of the file to be detected can be a database file type, a database management file type, a virtual machine file type, a container file type, etc. Specifically, for a database file, it can also be a Chinese database file type, an English database file type, a MySQL file type, an Oracle file type, etc. When the file to be detected is a virtual machine file, it can also be a specific virtual machine file type, etc.

[0047] In one implementation, the type of the file to be detected can be determined based on one or more of its suffix format and target location. Different types of files to be detected typically have different suffix formats. For example, a database file may have a suffix format of .sql, .bak, or .mdf, while a virtual machine file may have a suffix format of .vmdk, .vib, or .vbk. Different types of files to be detected also have different target locations. For example, a database file's target location is typically xxx / mysql / xxx. Therefore, the type of the file to be detected can be determined based on one or more of its suffix format and target location.

[0048] In one implementation, a third-party detection library can be used to determine the type of the file to be detected. The third-party detection library provides a function module for detecting the file type. The file to be detected is input into the third-party detection library, which then identifies the magic word and suffix format of the file to be detected and determines the type of the file to be detected.

[0049] Typically, the test is not performed directly on the file to be tested. Instead, the file to be tested is backed up, a backup file is obtained, and the backup file is tested. There are many ways to back up the file to be tested, for example, you can directly create a copy of the file to be tested to obtain a backup file, or you can use backup software to back up the file to be tested to obtain a backup file, etc. This application does not limit the method of obtaining the backup file. The type of the file to be tested can be determined by testing the backup file's suffix format and target location, or the backup file can be input into a third-party testing library to determine the type of the file to be tested.

[0050] S1022: Determine all or part of the character-level data features according to the type of the file to be detected.

[0051] The file to be detected includes printable characters and unprintable characters. Printable characters refer to characters that can be displayed in text. These characters can be displayed by printing or display devices. Printable characters include letters, numbers, punctuation marks and some special symbols. Unprintable characters refer to characters that cannot be displayed directly in text. These characters will not be printed or displayed on display devices. In this application, unprintable characters include some normal unprintable characters and encrypted characters. Normal unprintable characters include line breaks, control characters, etc. Encrypted characters refer to characters encrypted by ransomware in the file to be encrypted.

[0052] The character-level data features of the file to be detected include the character-level data features of the printable characters and the character-level data features of the unprintable characters contained in the file to be detected. The character-level data features refer to the code points occupied by the characters. For example, if the ASCII encoding method is used, the range of printable characters is from space (ASCII code 32) to tilde (ASCII code 126). That is, the code point occupied by the printable character space is 32, and the code point occupied by the tilde is 126. The code points corresponding to the printable characters range from 32 to 126 (expressed in decimal).

[0053] If the files to be detected are different, the character sets contained in the files to be detected are different. For example, when the files to be detected are database files and when the files to be detected are virtual machine files, the character sets they contain are different. For another example, when the files to be detected are Chinese database files and when the files to be detected are English database files, the character sets they contain are different. If the character sets are different, the scope of the printable characters contained in the files to be detected is different. If the files to be detected are different, the encoding method or encoding rule adopted may also be different. For example, the encoding rule adopted for the Chinese database file is different from the encoding rule adopted for the English database file. According to the encoding method or encoding rule, the character set is encoded, and the character-level data features of the printable characters obtained are different, and the character-level data features of the unprintable characters are also different. Therefore, it is necessary to determine the character-level data features of each character in the files to be detected according to the type of the files to be detected.

[0054] After the file to be detected is determined, the character set is determined. Based on the type of the file to be detected, an encoding rule or encoding method is determined. The determined encoding rule or encoding method is used to encode each character in the file to be detected, and character-level data features of all characters in the file to be detected are obtained. Among them, the encoding rule of the file to be detected can adopt commonly used encoding rules, such as ASCII, Unicode Transformation Format-8-bit (UTF-8), UTF-16, etc., or can be set by the user. This application does not limit the encoding rule.

[0055] After determining the character-level data features of all characters in the file to be detected, the subsequent steps can directly process the character-level data features of all characters to determine whether the file to be detected is encrypted; or the file to be detected can be sampled or the character-level data features of all characters in the file to be detected can be sampled to obtain partial character-level data features, and the partial character-level data features obtained after sampling can be processed to determine whether the file to be detected is encrypted. Among them, a multi-step sampling method can be adopted. For example, the character-level data features of all characters in the file to be detected can be sampled multiple times, and multiple character-level data features can be sampled each time. The step sizes used in the multiple samplings are different. Alternatively, the character-level data features of all characters in the file to be detected can be sampled once, and the step sizes used in the single sampling are different. Multi-step sampling ensures the randomness of the sample.

[0056] S103: Determine character-level data features that are unprintable characters among all or part of the character-level data features.

[0057] After the file to be detected and the type of the file to be detected are determined, the character set is also determined. After the character set is determined, the printable characters included in the character set are also determined. For example, for an English database file, the range of printable characters in the English database is determined, and the range of code points corresponding to the printable characters in the English database is also determined; similarly, for a Chinese database, the range of printable characters in the Chinese database is determined, and the range of code points corresponding to the printable characters in the Chinese database is also determined; and so on. Therefore, based on the code point range corresponding to the printable characters, it is possible to determine the character-level data features that belong to printable characters in all (unsampled) or part (sampled) character-level data features, thereby determining that the remaining ones are character-level data features that belong to unprintable characters. In one example, when an English database file is encoded using a certain encoding rule, the code point range corresponding to the printable characters in the English database file is 20 to 7E (20 to 7E is expressed in hexadecimal), and the code point range corresponding to the unprintable characters is 7F to FF (7F to FF is expressed in hexadecimal).

[0058] The character-level data features of the unprintable characters include the character-level data features of normal unprintable characters and the character-level data features of encrypted characters.

[0059] S104: Establish a statistical model based on the character-level data features of the unprintable characters, where the statistical model is used to extract features from the character-level data features of the unprintable characters.

[0060] After determining the character-level data features of the unprintable characters, a statistical model is established based on the character-level data features of the unprintable characters. The statistical model is used to extract features from the character-level data features of the unprintable characters, that is, to extract features from the code points corresponding to the unprintable characters.

[0061] In one example, a statistical model is used to count the distribution of each character-level data feature in the character-level data features of unprintable characters, that is, the distribution of the code points corresponding to each unprintable character, and the distribution of the code points corresponding to each unprintable character includes one or more of the number and position distribution of each code point. For example, how many code points are 7F, how many code points are FF, at which positions the code points with code points 7F are distributed, and at which positions the code points with code points FF are distributed. The distribution of each character-level data feature can be represented by a histogram or a chi-square distribution graph, or by a key-value pair, or by a list. This application does not limit the specific form of the statistical model. The statistical model can also be used to extract other features in the character-level data features of unprintable characters, which is not limited in this application.

[0062] Although the file to be detected also includes a small number of unprintable characters, such as control characters and line feed characters in the file, the character-level data features corresponding to the encrypted characters are different from the character-level data features of normal unprintable characters (such as control characters and line feed characters). Therefore, the method of the present application can determine whether there are encrypted characters in the file to be detected by extracting the features of the character-level data features of the unprintable characters. If so, the file to be detected is encrypted. If not, the file to be detected is not encrypted.

[0063] S105: Input the statistical model into the classifier to determine whether the file to be detected is encrypted.

[0064] The statistical model is input into the classifier, and the classifier classifies the file according to the statistical model to determine whether the file to be detected is encrypted. The output results include encrypted and unencrypted.

[0065] In one implementation, the number of normal unprintable characters is relatively small, and therefore the number of character-level data features (code points) of normal unprintable characters is relatively small. Therefore, the classifier can calculate the percentage of the number of each character-level data feature (each code point) to the total number of all character-level data features in the statistical model based on the number of each character-level data feature. If the percentage of the number of a certain character-level data feature exceeds a set threshold, the character-level data feature is considered to be the character-level data feature corresponding to the encrypted character, and it is determined that the file to be detected is encrypted.

[0066] In one implementation, the position distribution of normal non-printable characters is relatively discrete / scattered. Therefore, the classifier can be based on the position distribution of each character-level data feature (each code point). If there are multiple character-level data features of non-printable characters in the statistical model that are continuous in position, for example, if the number of consecutive character-level data features of non-printable characters exceeds a threshold number, it is determined that the file to be detected is encrypted.

[0067] In one implementation, a classifier can be trained first, and the trained classifier can be used to classify the statistical model to determine whether the file to be detected is encrypted. The classifier training method includes: obtaining a certain number of samples, the samples including character-level data features of some printable characters and character-level data features of some unprintable characters, wherein the character-level data features of unprintable characters include character-level data features of normal unprintable characters and character-level data features of encrypted characters; statistically modeling the samples to obtain a statistical model, in which the distribution of character-level data features of printable characters and the distribution of character-level data features of unprintable characters are statistically analyzed, and the distribution includes the quantity distribution and position distribution of each character-level data feature; training the classifier according to the distribution of character-level data features of printable characters and the distribution of character-level data features of unprintable characters in the statistical model, and finally obtaining a trained classifier after multiple rounds of training. In particular, when training the classifier, a supervised training method or an unsupervised training method can be used.

[0068] The classifier can also be trained through other machine learning methods, which is not limited in this application.

[0069] The above steps describe a statistical model established based on the character-level data features of unprintable characters, which is then input into a classifier for classification to determine whether the file to be detected is encrypted. Alternatively, a statistical model can be established based on all or part of the character-level data features, where the statistical model is used to calculate the distribution of the character-level data features of each printable character and the distribution of the character-level data features of each unprintable character. Classification is then performed based on this statistical model to determine whether the file to be detected is encrypted.

[0070] Referring to Figure 3, Figure 3 is a schematic diagram of a scenario provided by the present application. A computing device obtains Backup File 1 and Backup File 2, wherein Backup File 1 and Backup File 2 are both backup files. First, the computing device identifies the backup files according to the suffix format, target location, or magic word, and determines the type of the file to be detected File 1 corresponding to Backup File 1 and the type of the file to be detected File 2 corresponding to Backup File 2, respectively, and obtains that the type of the file to be detected File 1 corresponding to Backup File 1 is an Oracle database file and the type of the file to be detected File 2 corresponding to Backup File 2 is a MySQL database file; then, the computing device performs multi-step sampling and encoding on Backup File 1 and Backup File 2 respectively, and obtains character-level data features of some characters of Backup File 1 and character-level data features of some characters of Backup File 2; then, based on the character-level data features of some characters of Backup File 1 and the character-level data features of some characters of Backup File 2, statistical modeling and classification are performed, and finally it is determined that File 1 is not encrypted and File 2 is encrypted.

[0071] Optionally, when it is determined that the file to be detected is encrypted, the computing device may issue an alarm to prompt the user that the file to be detected is encrypted.

[0072] The encryption detection method provided by the present application is implemented based on character-level data features. Therefore, it can be applied to scenarios where the character-level content of the file to be detected is encrypted by ransom, and it can also be applied to scenarios where part of the content or all of the content in the file to be detected is encrypted by ransom. For example, it can be applied to scenarios where some fields in a database file are encrypted by ransom. By establishing a statistical model based on the character-level data features of unprintable characters, the statistical model is used to further extract features from the character-level data features of unprintable characters, and determining whether the file to be detected is encrypted based on the features extracted by the statistical model, compared to directly classifying according to the character-level data features of unprintable characters to determine whether the file to be detected is encrypted, the detection accuracy of the present application solution is higher and the results are more accurate.

[0073] The above are method embodiments provided in this application. The following introduces device embodiments corresponding to the method embodiments.

[0074] Refer to Figure 4, which is a schematic diagram of a system architecture provided by this application. The system includes a storage device 400 and a computing device 500. The storage device 400 can be a database or a server, and the computing device 500 is an encryption detection device. The storage device 400 stores files to be detected. The computing device 500 can obtain the files to be detected from the storage device 400 and detect the files to be detected to determine whether the files to be detected are encrypted.

[0075] The computing device 500 is described in detail below.

[0076] The computing device 500 includes: an acquisition module 510 for acquiring all or part of the character-level data features of the file to be detected; and a determination module 520 for determining whether the file to be detected is encrypted based on all or part of the character-level data features.

[0077] In a possible implementation, the determination module 520 is configured to: determine character-level data features belonging to unprintable characters among all or part of the character-level data features; and determine whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

[0078] In a possible implementation, the determination module 520 is used to: establish a statistical model based on the character-level data features of the unprintable characters, the statistical model being used to extract features from the character-level data features of the unprintable characters; and input the statistical model into a classifier to determine whether the file to be detected is encrypted.

[0079] In a possible implementation, the statistical model is used to calculate the distribution of each character-level data feature in the character-level data features of the unprintable characters, and the distribution of each character-level data feature includes one or more of the number and position of each character-level data feature.

[0080] In a possible implementation, the determination module 520 is used to: determine the character-level data features belonging to printable characters in all or part of the character-level data features according to the type of the file to be detected, thereby determining the character-level data features belonging to unprintable characters in all or part of the character-level data features.

[0081] In a possible implementation, the file to be detected includes one or more of a virtual machine file, a container file, a database file, and a database management file.

[0082] Wherein, both the acquisition module 510 and the determination module 520 can be implemented by software or by hardware. For example, the implementation of the determination module 520 is described below using the determination module 520 as an example. Similarly, the implementation of the acquisition module 510 can refer to the implementation of the acquisition module 510.

[0083] As an example of a software functional unit, the module 520 can be determined to include code running on a computing device. The computing device can be a computing device in a cloud service, wherein the computing device can be, for example, a server, a virtual machine, a container, etc., or a storage security integrated machine. Furthermore, the computing device can be one or more. For example, the module 520 can be determined to include code running on multiple computing devices. It should be noted that the multiple computing devices used to run the code can be distributed in the same region or in different regions. Furthermore, the multiple computing devices used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Generally, a region can include multiple availability zones AZ.

[0084] Similarly, the multiple computing devices used to run the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0085] As an example of a hardware functional unit, determination module 520 may include at least one computing device. Alternatively, determination module 520 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0086] The multiple computing devices included in the determination module 520 can be distributed in the same region or in different regions. The multiple computing devices included in the determination module 520 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the determination module 520 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0087] It should be noted that, in other embodiments, the determination module 520 can be used to execute any step in an encryption detection method, and the acquisition module 510 can be used to execute any step in an encryption detection method. The steps that the acquisition module 510 is responsible for implementing can be specified as needed. By implementing different steps in an encryption detection method respectively by the acquisition module 510 and the determination module 520, all functions of the computing device 500 can be realized.

[0088] Referring to Figure 5 , Figure 5 is a schematic diagram of the structure of a computing device 600 provided in this application. Computing device 600 can be, for example, a server, a virtual machine, a container, etc. Computing device 600 can also be a storage security integrated machine. Computing device 600 includes: a bus 602, a processor 604, a memory 606, and a communication interface 608. The processor 604, the memory 606, and the communication interface 608 communicate with each other via bus 602. It should be understood that this application does not limit the number of processors and memories in computing device 600.

[0089] Bus 602 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG5 shows a single bus line, but this does not imply a single bus or type of bus. Bus 602 may include a path for transmitting information between various components of computing device 600 (e.g., memory 606, processor 604, and communication interface 608).

[0090] The processor 604 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0091] The memory 606 may include volatile memory, such as random access memory (RAM). The processor 604 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0092] The memory 606 stores executable program code, and the processor 604 executes the executable program code to respectively implement the functions of the aforementioned acquisition module 510 and determination module 520, thereby implementing an encryption detection method. In other words, the memory 606 stores instructions for executing an encryption detection method.

[0093] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 600 and other devices or a communication network.

[0094] The present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, a virtual machine, or a container, such as a central server, an edge server, or a sidecar container.

[0095] As shown in Figure 6, Figure 6 is a structural diagram of a computing device cluster provided in this application, wherein the computing device cluster includes at least one computing device 600, and the memory 606 in one or more computing devices 600 in the computing device cluster may store the same instructions for executing an encryption detection method.

[0096] In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster may also store partial instructions for executing an encryption detection method. In other words, the combination of one or more computing devices 600 can be used to jointly execute instructions for an encryption detection method.

[0097] When at least one computing device in the computing device cluster is configured as computing device 500, the memories 606 in different computing devices 600 in the computing device cluster may store different instructions, each for executing a portion of the functions of computing device 500. In other words, the instructions stored in the memories 606 in different computing devices 600 may implement the functions of one or more of the acquisition module 510 and the determination module 520.

[0098] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. The network can be a wide area network or a local area network, etc. Figure 7 shows a structural diagram of another computing device cluster. As shown in Figure 7, two computing devices 600A and 600B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 606 in the computing device 600A stores instructions for the functions of the acquisition module 510, and the computing device 600A is used to obtain character-level data features of all or part of the characters in the file to be detected. The memory 606 in the computing device 600B stores instructions for the functions of the execution determination module 520, and the computing device 600B is used to determine the character-level data features of all or part of the character-level data features that belong to unprintable characters, and establish a statistical model based on the character-level data features of the unprintable characters, wherein the statistical model is used to extract features of the character-level data features of the unprintable characters; the computing device 600B is also used to determine whether the file to be detected is encrypted based on the statistical model.

[0099] It should be understood that the functions of computing device 600A shown in FIG7 may also be performed by multiple computing devices 600, or a computing device cluster may include multiple computing devices having the same functions as computing device 600A. Similarly, the functions of computing device 600B may also be performed by multiple computing devices 600, or a computing device cluster may include multiple computing devices having the same functions as computing device 600B.

[0100] The embodiment of the present application also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to the connection method of the computing device cluster described in Figures 6 and 7. The difference is that the memory 606 in one or more computing devices 600 in the computing device cluster can store different instructions for executing an encryption detection method. In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster can also respectively store partial instructions for executing an encryption detection method. In other words, a combination of one or more computing devices 600 can jointly execute instructions for executing an encryption detection method.

[0101] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored on any available medium. When the computer program product is run on at least one computing device, the computer program product causes the at least one computing device to perform an encryption detection method.

[0102] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device or a computing device cluster to execute an encryption detection method.

[0103] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An encryption detection method, characterized in that: include: Obtain all or part of the character-level data features of the file to be detected; Determine whether the file to be detected is encrypted based on all or part of the character-level data features.

2. The method according to claim 1, characterized in that The determining whether the file to be detected is encrypted based on all or part of the character-level data features includes: determining character-level data features belonging to unprintable characters among all or part of the character-level data features; Determine whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

3. The method according to claim 2, characterized in that The determining whether the file to be detected is encrypted according to the character-level data features of the unprintable characters includes: Establishing a statistical model based on the character-level data features of the unprintable characters, wherein the statistical model is used to extract features from the character-level data features of the unprintable characters; The statistical model is input into a classifier to determine whether the file to be detected is encrypted.

4. The method according to claim 3, characterized in that The statistical model is used to calculate the distribution of each character-level data feature in the character-level data features of the unprintable characters, and the distribution of each character-level data feature includes one or more of the quantity and position of each character-level data feature.

5. The method according to any one of claims 2 to 4, characterized in that Determining the character-level data features that are unprintable characters among all or part of the character-level data features includes: According to the type of the file to be detected, character-level data features belonging to printable characters in all or part of the character-level data features are determined, thereby determining character-level data features belonging to unprintable characters in all or part of the character-level data features.

6. The method according to any one of claims 1 to 5, characterized in that The files to be detected include one or more of virtual machine files, container files, database files, and database management files.

7. The method according to any one of claims 1 to 6, characterized in that The method is applied to a scenario where the file to be detected is partially encrypted, and the partial encryption includes character-level encryption.

8. An encryption detection device, characterized in that: include: An acquisition module is used to obtain all or part of the character-level data features of the file to be detected; The determination module is used to determine whether the file to be detected is encrypted based on all or part of the character-level data features.

9. The device according to claim 8, characterized in that The determining module is used for: determining character-level data features belonging to unprintable characters among all or part of the character-level data features; Determine whether the file to be detected is encrypted based on the character-level data features of the unprintable characters.

10. The device according to claim 9, characterized in that The determining module is used for: Establishing a statistical model based on the character-level data features of the unprintable characters, wherein the statistical model is used to extract features from the character-level data features of the unprintable characters; The statistical model is input into a classifier to determine whether the file to be detected is encrypted.

11. The device according to claim 10, characterized in that The statistical model is used to calculate the distribution of each character-level data feature in the character-level data features of the unprintable characters, and the distribution of each character-level data feature includes one or more of the quantity and position of each character-level data feature.

12. The device according to any one of claims 9 to 11, characterized in that The determining module is used for: According to the type of the file to be detected, character-level data features belonging to printable characters in all or part of the character-level data features are determined, thereby determining character-level data features belonging to unprintable characters in all or part of the character-level data features.

13. The device according to any one of claims 8 to 12, characterized in that The files to be detected include one or more of virtual machine files, container files, database files, and database management files.

14. A computing device cluster, characterized in that: The method comprises at least one computing device, wherein the at least one computing device comprises a memory and a processor, and the processor in the at least one computing device is configured to execute instructions stored in the memory in the at least one computing device to implement the method according to any one of claims 1 to 7.

15. A computer storage medium, characterized in that The method comprises program instructions, and when the program instructions are executed on a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 7.

Images