KR101157903B1 - System and method for scanning large-scale directories - Google Patents

Abstract

PURPOSE: A system and a method for scanning large-scale directories are provided to prevent the generation of stack overflow or out-of memory in the processing of bulk directory. CONSTITUTION: In case a non-saved lower directory among lower directories of a target directory exists, a directory information storage module determines whether an empty entry exists in primary memory devices(206,208). In case the empty entry exists, the module stores selected lower directory information in the empty entry(210). In case a directory information file set as an output mode exists, the module stores selected lower directory information in directory information files(212,214).

Description

SYSTEM AND METHOD FOR SCANNING LARGE-SCALE DIRECTORIES}

The present invention relates to a technique for effectively navigating a directory within a system regardless of its capacity.

With the development of hardware, large file systems have become commonplace, and the number of directories and files existing in one system is increasing exponentially. In addition, the growth of these directories and files has also increased the need to detect malicious code that affects the system.

Due to its characteristics, a detection program such as malicious code needs to continuously handle the entire target directory of the detection target system. In general, as a directory handling method, a handling method using a recursive call is used. The recursive approach uses the entire directory of the target system, for example, by recursively calling each subdirectory from the top directory of the target system. This method has the advantage that it can be easily applied to any directory structure without having to store the entire directory structure of the target system. However, if the directory structure to be detected is large and deep, that is, if a large directory is to be processed, too much directory information can accumulate in the memory area, leading to stack overflow or out of memory. There is a problem that occurs. In addition, continuous function calls affect overall detection performance.

One way to handle directories without using recursive calls is to use a loop (while loop or for loop). In this method, however, the directory structure of the target system must be stored in advance. For this purpose, if the directory structure is stored in memory, stack overflow or out-of-memory may occur according to the directory capacity. In order to prevent this, a method of storing a directory structure in the form of a file in an auxiliary storage device such as a hard disk, rather than a main memory device such as a memory, may be considered. This is very falling.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to provide a new directory search technique that can be easily applied to a large directory while minimizing the dependency of an auxiliary storage device such as a hard disk when searching a directory. have.

A directory search method according to an embodiment of the present invention for solving the above problems is a method for searching a directory of a target system in a directory search system including a main memory device and an auxiliary storage device, in the directory search system, A first step of selecting one target directory among directories in the target system; In the directory search system, selecting one of sub-directories of the selected target directory; Determining, by the directory search system, whether an empty entry exists in a directory information area of the main memory device; In the directory search system, if the empty entry exists, the selected subdirectory information is stored in the empty entry, and if the empty entry does not exist, the selected subdirectory information is stored in the auxiliary storage device. A fourth step of storing in a directory information file; And a fifth step of repeating the second to fourth steps until all subdirectories of the target directory are selected in the directory search system.

On the other hand, the directory search system according to an embodiment of the present invention for solving the above problems, the target directory selection module for selecting one directory of the directory of the target system as a target directory; A subdirectory extraction module for extracting subdirectory information of the selected target directory; And determining whether an empty entry exists in the directory information area of the main memory device included in the directory search system, and when the empty entry exists, storing the subdirectory information in the empty entry, and when the empty entry does not exist. And a directory information storage module for storing the sub directory information in a directory information file of an auxiliary storage device included in the directory search system.

According to an exemplary embodiment of the present invention, since recursive calling is not used when searching a directory, stack overflow or out-of-memory may be prevented even when processing a large directory. In addition, since only a certain area of the main memory is used regardless of the directory capacity, excessive use of the capacity of the main memory can be prevented, and at the same time, minimizing the dependence of the auxiliary storage device, the detection performance is reduced even in a large directory detection. It can be minimized.

1 is a block diagram illustrating a directory search system according to an embodiment of the present invention.
2 is a flowchart illustrating a directory search and directory information storage method according to an embodiment of the present invention.
3 is a flowchart illustrating a detailed configuration of selecting a target directory in the directory search method according to an embodiment of the present invention.
4 illustrates a directory structure of a target system for explaining a specific directory search process in the directory search system.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. However, this is merely an example and the present invention is not limited thereto.

In the following description, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

The technical spirit of the present invention is determined by the claims, and the following embodiments are merely means for efficiently explaining the technical spirit of the present invention to those skilled in the art.

1 is a block diagram illustrating a directory search system 100 according to an embodiment of the present invention. In the present invention, the directory search system 100 is a system for searching the directory structure of the target system. The target system may be, for example, a web server or an application server, and the directory search system 100 sequentially searches directories in the web server or application server, and includes malicious or harmful code such as a web shell or a virus. It may be a system for detecting whether or not.

As shown, the directory search system 100 according to an embodiment of the present invention includes a main memory 102, an auxiliary memory 104, a target directory selection module 106, a subdirectory extraction module 108, and a directory. The information storage module 110 is included.

The main memory device 102 is a space in which directory information obtained while the directory search system 100 searches a directory of the target system is primarily stored. Since the main memory device 102 frequently stores and searches directory information, it is preferable to use a volatile memory such as DRAM, which is very fast. In order to store the directory information, a predetermined space in the main memory device 102 is allocated to the directory information area. The directory information area is a space in which directory information of the target system is stored by the directory information storage module 110 to be described later. In this case, the directory information is information for identifying a specific directory in the target system, and may include a path of the corresponding directory or a hash value thereof.

The directory information area in the main memory device 102 has a fixed size, and when there are no more entries to store directory information in the directory information area, the directory information storage module 110 stores the auxiliary directory for the new directory information. Configured to store on device 104. That is, the present invention maximizes the speed of the main memory device 102 for storing and searching directory information while fixing the size of the area (directory information area) allocated for storing the directory information of the main memory device 102. Thereby overly expanding the directory information area in memory to prevent disruption to other operations in the system. At the same time, in the case of the overflowed directory information, the auxiliary storage device 104 is appropriately utilized to prevent the occurrence of a memory overflow in advance, and the related configuration will be described in detail below.

The auxiliary storage device 104 is a space in which information exceeding the capacity allocated to the main memory device 102 is secondarily stored among the directory information obtained by the directory search system 100 searching the directory of the target system. The auxiliary storage device 104 may be configured of, for example, a nonvolatile storage medium such as a hard disk. That is, a storage medium having a larger capacity than the main memory 102 but slower than the main memory 102 may be used as the auxiliary memory 104.

If the directory storage area included in the main memory 102 becomes full while the directory search system 100 searches the target directory, the directory search system 100 stores a file for storing directory information in the auxiliary storage 104. Create a directory information file. One or more such directory information files may be generated inside the auxiliary storage device 104 and may have two modes.

Output mode: This mode can only write directory information, and cannot read directory information. All directory information files generated by the directory search system 100 are set to an output mode by default.

-Input mode: A mode in which directory information cannot be written, and only directory information can be read for processing a previously stored directory. In this case, the read directory information is deleted. The directory information file set in the first output mode is converted to the input mode when the directory information should be read, and the directory information file is deleted after reading all the stored directory information.

The target directory selecting module 106 is a module for selecting one directory among the directories of the target system as the target directory. When searching the first directory for the target system, the target directory selecting module 106 selects the highest directory among the search target directories of the target system as the first target directory, and thereafter, the directory stored in the directory information area of the main memory device 102. Or one of the directories stored in the directory information file of the auxiliary storage device 104 is selected as the target directory.

The subdirectory extraction module 108 extracts subdirectory information of the selected target directory.

The directory information storage module 110 is a module for storing the sub directory information extracted by the sub directory extraction module 108. The directory information storage module 110 primarily determines whether an empty entry exists in the directory information area of the main memory device 102, and if there is an empty entry, stores directory information in the empty entry. However, if an empty entry does not exist, the subdirectory information is stored in the directory information file of the auxiliary storage device 104 included in the directory search system.

2 is a flowchart illustrating a directory search and directory information storage method 200 according to an embodiment of the present invention.

First, when the target directory is selected by the target directory selecting module 106 (202), the subdirectory extracting module 108 searches the subdirectories of the selected target directory and selects an unstored directory among the searched subdirectories ( 204, 206). If there are no subdirectories not stored in the main memory 102 or the auxiliary memory 104 among the subdirectories of the target directory, all the subdirectories of the target directory have been scanned. This process is repeated for subdirectories of the target directory.

On the other hand, if there is an unsaved subdirectory among the subdirectories of the target directory, the directory information storage module 110 determines whether an empty entry exists in the directory information area of the main memory 102 (208), and 206. If the empty entry exists, the selected subdirectory information is stored in the empty entry (210).

On the other hand, if the empty entry does not exist as a result of the determination in step 206, the directory information storage module 110 stores the selected subdirectory information in a directory information file of the auxiliary storage device 104, especially a directory information file set to an output mode. do.

In detail, the directory information storage module 110 determines whether or not a directory information file set in an output mode exists in the auxiliary storage device 104 (operation 212). If the directory information file set to the output mode exists, the directory information storage module 110 stores the selected subdirectory information in the directory information file (214).

However, if there is no directory information file set in the output mode, the directory information storage module 110 generates a new directory information file in the auxiliary storage device 104 and sets the generated directory information file in the output mode. After that, the selected subdirectory information is stored in the generated directory information file (212).

The storing of subdirectories of the target directory, that is, steps 208 to 216 are repeated until all the subdirectories of the selected target directory are selected. After all the subdirectories are stored, the new target directory is selected by selecting the new target directory. Is repeated. Through this process, all directories of the target system can be sequentially searched.

3 is a flowchart illustrating a detailed configuration of selecting a target directory 202 in the directory search method according to an embodiment of the present invention.

First, the target directory selecting module 106 searches the directory information area of the main memory device 102 to determine whether there is directory information previously stored in the directory information area (300).

If, as a result of the determination in step 300, there is already stored directory information, the target directory selecting module 106 extracts one directory information among directory information stored in the directory information area (302), and the directory extracted in step 302. A directory corresponding to the information is selected as the target directory (304).

On the contrary, in the case where the previously stored directory information does not exist, the target directory selecting module 106 extracts the directory information from the directory information file of the auxiliary storage device 104.

Specifically, the target directory selecting module 106 determines whether or not a directory information file set to an input mode exists among directory information files stored in the auxiliary storage device 104 (306).

If the directory information file set to the input mode exists, the target directory selection module 106 extracts directory information from the directory information file (308), and converts the directory corresponding to the directory information extracted in step 308 into the target directory. (304).

However, if the directory information file set to the input mode does not exist in the auxiliary storage device 104, the target directory selecting module 106 determines whether or not the directory information file set to the output mode exists (310). If present, the directory information file set to the output mode is reset to the input mode (312). In this case, as described above, the directory information file reset to the input mode can no longer add directory information, and can only read pre-stored directory information. Then, the target directory selecting module 106 extracts directory information from the directory information file changed to the input mode (308), and selects the extracted directory as the target directory (304).

If the directory information file set to the output mode does not exist in step 310, the target directory selecting module 106 determines that all directories of the target system have been searched and ends the search process.

Hereinafter, a specific directory search process in the directory search system 100 described above will be described as an example. For example, assume that the target system has a directory structure as shown in FIG. That is, the top directory D1 is located, D2, D3, and D4 exist as subdirectories of D1, and D5, D6, and D7 exist as subdirectories of D3. For the sake of understanding, assume that the directory information area in the main memory device 102 has only one entry (directory information storage space). In the case of the directory information file generated in the auxiliary storage device 104, there is no capacity limitation, and it is assumed that directory information can be added as necessary.

First, when searching the first target directory, the target directory selecting module 106 selects the highest directory D1 among the target directories as the target directory D, and stores information about D2, D3, and D4, which are subdirectories of D1. In this case, the first subdirectory D2 is stored in the directory information area M of the main memory 102. However, in the case of D3 and D4, since there is no longer an entry to be stored in the directory information area M of the main memory device, the directory information storage module 110 stores the first directory information file O1 of the output mode in the auxiliary storage device 104. Create and store the information of D3 and D4 in the generated file. In this case, the directory information stored in the directory information area M and the first directory information file O1 is as follows.

1.Destination directory (D): D1

Directory information area (M): D2

First directory information file (O1): D3, D4

Next, the target directory selecting module 106 extracts D2, which is a directory stored in the directory information area M, and selects the next target directory.

2.D: D2

M: none

O1: D3, D4

Next, since the directory stored in the directory information area M does not exist, the target directory selecting module 106 changes the output mode directory information file O1 to the input mode I1, and extracts the directory D3 therefrom. To select the next target directory.

3.D: D3

M: none

(Change from O1-> input mode (I1)): D4

Next, the subdirectory extraction module 108 extracts subdirectory information D5, D6, and D7 of the target directory D3, and the directory information storage module 110 stores the extracted information. At this time, the first subdirectory D5 is stored in the directory information area M of the main memory device 102. However, in the case of D3 and D4, since there are no more entries to be stored in the directory information area M of the main memory device, the directory information storage module 110 determines whether the directory information file of the output mode exists in the auxiliary storage device 104. . In this case, since only the directory information file I1 of the input mode exists in the auxiliary storage device 104, the directory information storage module 110 generates the directory information file O2 of the new output mode and generates the generated directory information file ( Information of D6 and D7 is stored in O2).

4.D: D3

M: D5

I1: D4

Second directory information file (O2): D6, D7

Next, the target directory selecting module 106 extracts D5, which is a directory stored in the directory information area M, and selects the next target directory.

5.D: D5

M: none

I1: D4

O2: D6, D7

Then, since the directory stored in the directory information area M does not exist, the target directory selecting module 106 extracts the directory D4 from the input mode directory information file I1 and selects the next target directory. At this time, I1 is deleted because no more stored directories remain.

6.D: D4

M: none

I1: delete

O2: D6, D7

Next, the target directory selecting module 106 changes O2 to the input mode I2 and sequentially reads the stored directories D6 and D7 and selects the target directory. After D7 is selected as the target directory, I2 is deleted because there are no more directories left in I2, and directory search is terminated because there are no more directories to detect.

7.D: D6

M: none

O2-> I2: D7

8.D: D7

M: none

I2: delete

Meanwhile, an embodiment of the present invention may include a computer readable recording medium including a program for performing the methods described herein on a computer. The computer-readable recording medium may include a program command, a local data file, a local data structure, or the like, alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those skilled in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floppy disks, and magnetic media such as ROMs, And hardware devices specifically configured to store and execute program instructions. Examples of program instructions may include machine language code such as those generated by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be construed as limiting the scope of the present invention. I will understand.

Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

100: directory navigation system
102: main memory
104: auxiliary memory
106: destination directory selection module
108: subdirectory extraction module
110: directory information storage module

Claims (15)

A directory search system comprising a main memory device and an auxiliary memory device, the method for searching a directory of a target system, comprising:
In the directory search system, a target directory of one of the directories in the target system is selected, and if there is directory information previously stored in the directory information area of the main memory device, one of the directories stored in the directory information area is selected. Selecting one of the directories stored in the directory information file set to an input mode of the auxiliary storage device as the target directory if not present;
In the directory search system, selecting one of sub-directories of the selected target directory;
Determining, by the directory search system, whether an empty entry exists in a directory information area of the main memory device;
In the directory search system, if the empty entry exists, the selected subdirectory information is stored in the empty entry, and if the empty entry does not exist, the selected subdirectory information is stored in the auxiliary storage device. A fourth step of storing in a directory information file set to an output mode; And
And a fifth step of repeating the second to fourth steps until all subdirectories of the target directory are selected in the directory search system.
delete The method according to claim 1,
In the fourth step, when there is no directory information file set to an output mode in the auxiliary storage device, a new directory information file is generated in the auxiliary storage device, and the generated directory information file is output to the output mode. Directory search method.
The method according to claim 1,
The first step may include: determining whether the directory information previously stored in the directory information area of the main memory device exists;
A first step of extracting one directory information among the directory information stored in the directory information area when there is already stored directory information as a result of the determination in step 1-1; And
And a first to third step of selecting a directory corresponding to the directory information extracted in steps 1-2 as the target directory.
The method of claim 4,
A first to third step of extracting directory information of one of directories stored in a directory information file set to an input mode of the auxiliary storage device when there is no previously stored directory information as a result of the determination in the first-first step; And
And a first to fourth step of selecting a directory corresponding to the directory information extracted in steps 1-3 as the target directory.
delete The method according to claim 5,
In the step 1-3, if the directory information file set in the input mode does not exist in the auxiliary storage device, the directory information file set in the output mode is reset to the input mode.
A computer-readable recording medium having recorded thereon a program for performing the method according to any one of claims 1 and 3 to 5 on a computer.
A directory search system for searching a directory on a target system,
Selecting one target directory among directories in the target system, and when there is directory information previously stored in the directory information area of the main memory device included in the directory search system, selecting one directory among the directories stored in the directory information area; A target directory selecting module that selects one of the directories stored in the directory information file set as an input mode of the auxiliary storage device included in the directory search system as the target directory, if the target directory is selected;
A subdirectory extraction module for extracting subdirectory information of the selected target directory; And
It is determined whether an empty entry exists in the directory information area of the main memory device, and if the empty entry exists, the subdirectory information is stored in the empty entry, and if the empty entry does not exist, the subdirectory information is stored in the auxiliary information. A directory search system including a directory information storage module for storing in a directory information file set to an output mode of a storage device.
delete The method according to claim 9,
The directory information storage module generates a new directory information file in the auxiliary storage device and outputs the generated directory information file when there is no directory information file set in an output mode in the auxiliary storage device. Directory search system, set to mode.
delete delete delete The method according to claim 9,
And the target directory selecting module resets the directory information file set in the output mode to the input mode when the directory information file set in the input mode does not exist in the auxiliary storage device.

Images