CN106295334A - Ile repair method and device - Google Patents

Abstract

The application discloses a method and a device for repairing files. Wherein, the method includes: obtaining a suspicious file with a first format uploaded by the requesting device; according to the grammatical characteristics of each field in the suspicious file, forming fields with the same grammatical characteristics into at least one field group; according to the grammatical characteristics of each field group, feature, to obtain the token sequence feature corresponding to each grammatical feature; according to the token sequence feature, determine the loophole in the at least one field group; replace the loophole with a preset repair code sequence, and obtain all the patched the at least one field group; and reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. This application solves the technical problem that the accuracy of bug repair is poor due to the implementation of the same set of Patch codes in the prior art.

Description

File restoration method and device

technical field

The present application relates to the field of the Internet, in particular, to a method and device for repairing files.

Background technique

With the rapid development of the Internet, the servers of various operators run a large number of web sites. Due to technical considerations, most of these web sites directly use open source or paid CMS (Content Management System, Content Management System) on the market. Construction of the website system. Because the source code of these CMSs is easy to obtain, they are often exploited by hackers. After discovering exploitable vulnerabilities, hackers will use their own ODAY (zero-day) vulnerabilities to attack web sites, and then obtain a large amount of business. material.

In the confrontation of web attack and defense, for traditional binary vulnerability files or website text file Patch (patch) technology, the existing technology generally adopts a unified method of replacing templates, that is, no matter how many types of vulnerability files or vulnerability codes there are Variants, the same set of Patch codes are used on the server side to implement vulnerability repair, which leads to poor accuracy of vulnerability repair and low system security.

For the above problems, no effective solution has been proposed yet.

Contents of the invention

The embodiment of the present application provides a file repair method and device to at least solve the technical problem of poor bug repair accuracy caused by using the same set of Patch codes in the prior art.

According to an aspect of the embodiment of the present application, a method for repairing a file is provided, including: obtaining a suspicious file in a first format uploaded by a requesting device; according to the grammatical features of each field in the suspicious file, combining at least one field group; according to the grammatical features of each field group, obtain the token sequence features corresponding to each grammatical feature; determine the loopholes in the above at least one field group according to the above token sequence features; replace the above loopholes with preset Repairing the code sequence to obtain the repaired at least one field group; reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

According to another aspect of the embodiment of the present application, there is also provided a file restoration method, including: sending a suspicious file in a first format to a file restoration device, wherein the above-mentioned file restoration device according to each field in the above-mentioned suspicious file Grammatical features, combining fields with the same grammatical features into at least one field group, obtaining the token sequence features corresponding to each grammatical feature according to the grammatical features of each field group, and determining the at least one field group in the above-mentioned at least one field group according to the above-mentioned token sequence features Vulnerability, replacing the above-mentioned vulnerability with a preset repair code sequence, obtaining the above-mentioned at least one field group after repair, and reorganizing the above-mentioned at least one field group after repair into a repair file with the above-mentioned first format corresponding to the above-mentioned suspicious file; Obtain a repair file in the first format corresponding to the suspicious file from the file repair apparatus.

According to another aspect of the embodiment of the present application, there is also provided a device for repairing a file, including: an acquisition unit, configured to acquire a suspicious file in the first format uploaded by the requesting device; The grammatical feature of the field is to form at least one field group with fields with the same grammatical feature; the first determination unit is used to obtain the token sequence feature corresponding to each grammatical feature according to the grammatical feature of each field group; the second determination unit uses According to the characteristics of the above-mentioned token sequence, the vulnerability in the above-mentioned at least one field group is determined; the repair unit is used to replace the above-mentioned hole with a pre-configured repair code sequence to obtain the repaired above-mentioned at least one field group; the reorganization unit is used for Reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

According to another aspect of the embodiment of the present application, there is also provided a requesting device, including: a third sending unit, configured to send the suspicious file in the first format to the file repairing device, wherein the above-mentioned file repairing device according to the above-mentioned For the grammatical features of each field in the suspicious file, the fields with the same grammatical features are formed into at least one field group, and according to the grammatical features of each field group, the token sequence features corresponding to each grammatical feature are obtained, and the above token sequence features are used to determine the above Vulnerabilities in at least one field group, replacing the above-mentioned holes with a preset repair code sequence, obtaining the repaired at least one field group, reorganizing the repaired at least one field group into a file corresponding to the above-mentioned suspicious file with the above-mentioned A recovery file in a format; a control unit configured to acquire a recovery file in the first format corresponding to the suspicious file from the file recovery device.

In this embodiment of the application, the suspicious file with the first format uploaded by the acquisition requesting device is used; according to the grammatical characteristics of each field in the suspicious file, fields with the same grammatical characteristics are formed into at least one field group; according to the grammatical characteristics of each field group features, to obtain the token sequence features corresponding to each grammatical feature; according to the token sequence features, determine the loopholes in at least one field group; replace the loopholes with the preset repair code sequence, and obtain at least one field group after repair; After at least one field group is reorganized into a repair file with the first format corresponding to the suspicious file, after the suspicious file is split according to the grammatical feature to obtain at least one field group, according to each grammatical feature corresponding token sequence feature and The repair code sequence is used to find and repair vulnerabilities, achieving the purpose of 1:1 automatic repair of vulnerabilities, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security, and further solving the problems caused by the use of the same system in the existing technology. The technical problem of poor accuracy of bug fixes caused by the implementation of Patch codes.

Description of drawings

The drawings described here are used to provide a further understanding of the application and constitute a part of the application. The schematic embodiments and descriptions of the application are used to explain the application and do not constitute an improper limitation to the application. In the attached picture:

Fig. 1 is a block diagram of the hardware structure of a computer terminal running a file detection method according to an embodiment of the present application;

FIG. 2 is a schematic flow diagram of an optional file repair method according to an embodiment of the present application;

FIG. 3 is a schematic flow diagram of another optional file repair method according to an embodiment of the present application;

FIG. 4 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

FIG. 5 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

FIG. 6 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

FIG. 7 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an optional file repair device according to an embodiment of the present application;

FIG. 9 is a schematic structural diagram of another optional file restoration device according to an embodiment of the present application;

FIG. 10 is a schematic structural diagram of an optional deduplication unit according to an embodiment of the present application;

FIG. 11 is a schematic structural diagram of another optional file restoration device according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram of another optional file restoration device according to an embodiment of the present application;

Fig. 13 is a schematic structural diagram of an optional request device according to an embodiment of the present application.

detailed description

In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiment of the application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the application. Obviously, the described embodiment is only It is an embodiment of a part of the application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the scope of protection of this application.

It should be noted that the terms "first" and "second" in the description and claims of the present application and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

Example 1

According to the embodiment of the present application, a method embodiment of a file repair method is also provided. It should be noted that the steps shown in the flow chart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and , although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

The method embodiment provided in Embodiment 1 of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking it running on a computer terminal as an example, FIG. 1 is a block diagram of the hardware structure of a computer terminal according to a method for repairing a file according to an embodiment of the present application. As shown in Figure 1, the computer terminal 10 may include one or more (only one is shown in the figure) processors 102 (the processors 102 may include but not limited to processing devices such as microprocessor MCU or programmable logic device FPGA, etc.) , a memory 104 for storing data, and a transmission device 106 for communication functions. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only a schematic diagram, and it does not limit the structure of the above-mentioned electronic device. For example, computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

The memory 104 can be used to store software programs and modules of application software, such as program instructions/modules corresponding to the file repair method in the embodiment of the present application, and the processor 102 executes various Functional application and data processing, that is, to realize the vulnerability detection method of the above-mentioned application program. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory that is remotely located relative to the processor 102 , and these remote memories may be connected to the computer terminal 10 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used to receive or transmit data via a network. The specific example of the above-mentioned network may include a wireless network provided by the communication provider of the computer terminal 10 . In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

Under the above operating environment, the present application provides a file restoration method as shown in FIG. 2 . FIG. 2 is a flow chart of a file repair method according to Embodiment 1 of the present application.

As shown in Figure 2, the file repair method may include the following implementation steps:

Step S202, obtaining a suspicious file in the first format uploaded by the requesting device.

In the above-mentioned step S202 of the present application, the requesting means may refer to an application program (such as a client) installed on the user equipment. The requesting means may regularly start scanning the user equipment according to the configuration of the server side. When suspicious files are found, Upload the suspicious file to the file repair device through a pre-configured channel. The requesting device can also be a computer terminal or similar computing device, which starts to scan its own disk files at regular intervals. Send to the file recovery device.

Wherein, after the file repairing device receives the suspicious file in the first format from the requesting device, it can analyze the suspicious file to realize the repairing of the suspicious file. The file repairing device can be, for example, an AliYunDun server.

Take AliYunDun (Alibaba Cloud Shield) as an example as the requesting device. AliYunDun is based on the network architecture of C/S (Client/Server, client/server). Each user device is equipped with an independent AliYunDun program, and through encrypted channels Keep a long connection with AliYunDun server. According to the configuration of the server, AliYunDun regularly downloads the latest AliVulfix (Cloud Shield subsidiary component) vulnerability fix program from the server to replace the local vulnerability fix program. According to the configuration of the server, AliYunDun can control the regular start of the AliVulfix vulnerability repair program, scan all the disk directories on the user device, and collect the files in the specified directory according to the configuration information sent by the server. For example, one of the configuration items is: / plus/mytag_js.php, AliVulfix will scan and report this suspicious file through the encryption of AliYunDun.

Step S204, according to the grammatical features of each field in the suspicious file, form fields with the same grammatical feature into at least one field group.

In the above-mentioned step S204 of the present application, after the file repairing device obtains the suspicious file, in order to take one-to-one targeted repair of the vulnerability and improve the repair efficiency, so as to prevent the hacker from using the time gap to invade the user device due to too long repair time, the file repair device According to the grammatical features of each field in the suspicious file, fields with the same grammatical feature can be combined into at least one field group.

Taking the AliYunDun server as the file repair device as an example, because most of the users on Alibaba Cloud are e-commerce and website users, users often make customized changes to their own website code files. Running, the AliYunDun server adopts a one-to-one targeted repair strategy. However, one-to-one repair will cause a problem. Received a large number of files with vulnerabilities, even after filtering, there are still a lot of files. Therefore, the AliYunDun server can parse the above suspicious files into a syntax tree structure.

In the embodiment of the present application, the file repairing device first needs to perform grammatical analysis on the suspicious file to determine the grammatical features of each field in the suspicious file, wherein the grammatical analysis refers to scanning the code into a container, and then the characters in the container Combining fields into various grammatical phrases based on lexical analysis. After determining the grammatical features of each field, the file repairing device can form at least one field group with fields with the same grammatical feature, and further, the file repairing device can parse at least one field group into a grammatical tree structure.

Step S206, according to the grammatical features of each field group, acquire token sequence features corresponding to each grammatical feature.

In the above step S206 of the present application, the token sequence feature may be pre-configured by the security operator, and the file repair device uses the token sequence feature corresponding to each grammatical feature to realize the search for loopholes.

Step S208, according to the characteristics of the token sequence, determine the loopholes in at least one field group.

In the above step S208 of the present application, after obtaining the token sequence features corresponding to each grammatical feature, the file repairing device can locate vulnerabilities in at least one field group according to the token sequence features.

Here is a popular example to illustrate, if there are one hundred people, the purpose is to determine the person whose eyeball color is blue, that is, the token sequence feature is "eyeball-blue", then follow the idea of the file restoration method provided by the embodiment of this application , we first group the various parts of the one hundred people, for example, the eyes of one hundred people are grouped into one group, the nose is grouped into one group, the mouth is grouped into one group, etc., then, according to the token sequence feature When searching for vulnerabilities, you only need to search in the eye group, without searching other parts, so as to improve the efficiency of finding vulnerabilities.

Optionally, according to the token sequence feature, determining the loophole in at least one field group includes: searching for fields identical to the token sequence feature in at least one field group, and determining the same field as the token sequence feature as a loophole.

In the embodiment of this application, the security operation personnel only need to configure the above-mentioned token sequence feature once, and the file repair device can automatically locate the vulnerability, which improves the time cost of security operation.

Step S210, replacing the vulnerability with a preset repair code sequence to obtain at least one field group after repair.

In the above step S210 of the present application, the preset repair code sequence may also be pre-configured by security operators. After the file repairing device determines the loophole in at least one field group according to the characteristics of the token sequence, it can obtain the preset repair code sequence, and then replace the loophole with the preset repair code sequence to realize the repair of the suspicious file.

The file repairing device in the embodiment of the present application adopts the 1:1 precise fixed-point repairing technology, that is, all suspicious files are directly modified based on the original file of the requesting device. Inconsistencies lead to the user's normal business logic being affected, or even unavailable. At the same time, security operators only need to configure a repair code sequence, and when the file repair device determines a vulnerability, replace the vulnerability with the preset repair code sequence to obtain at least one field group after repair.

Step S212, reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

In the above-mentioned step S212 of the present application, because in the above-mentioned file repairing process, the file repairing device splits the suspicious file with the first format into at least one field group according to the grammatical features of each field, so after obtaining the repaired at least one field group , the file repairing apparatus may follow the reverse process to reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

Optionally, reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file includes: according to the parent-child relationship of each field in the repaired at least one field group, the repaired at least one field group The group is reorganized into a repair file having a first format corresponding to the suspect file.

Take the AliYunDun server as an example for the file repair device. After the AliYunDun server parses the above-mentioned suspicious files into a syntax tree structure, locate the vulnerability according to the token sequence feature (token sequence feature), and then insert a preset repair code sequence into the syntax tree. Afterwards, rebuild the suspicious file, complete the repair of the vulnerability of the suspicious file, and obtain the above-mentioned repaired file.

In the file repair method provided by the embodiment of the present application, since the number of suspicious files may be tens of thousands, the entire process of the above file repair method can be automated through program code to realize the entire vulnerability repair. The entire process of automation from discovery to audit to repair can theoretically enable all user devices on the Alibaba Cloud network to repair a certain vulnerability within 20 minutes.

The file restoration method of the embodiment of the present application has at least the following technical effects:

1. Fix the loopholes precisely for each user's specific business;

2. The entire process of vulnerability repair is automated. Security operators only need to focus on vulnerability research and perform one configuration. Afterwards, the entire network repair action is fully automated;

3. Realize that all machines in the Alibaba Cloud network can repair a certain vulnerability within 20 minutes;

4. Use syntax trees to locate and repair vulnerabilities, which can avoid false positives caused by regular expressions and string searches, and have high accuracy and low false positive rates;

5. It does not affect the normal operation of the program to be repaired on the requesting device.

As can be seen from the above, in the solution provided by the above-mentioned embodiment 1 of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to token sequence features and repair code sequences corresponding to each grammatical feature. Repair achieves the purpose of 1:1 automatic repair of vulnerabilities, thus achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the problem of vulnerability repair caused by the implementation of the same set of Patch codes in the existing technology Technical issues with poor accuracy.

In an optional solution provided by the above-mentioned embodiments of the present application, as shown in FIG. 3 , when the number of suspicious files is at least two, after the above-mentioned step S202 obtains the suspicious file in the first format uploaded by the requesting device, According to the grammatical features of each field in the suspicious file in the above step S204, before forming fields with the same grammatical features into at least one field group, the file repair method may also include:

Step S302, extracting the meta information of each suspicious file, wherein the meta information includes the file path of the corresponding suspicious file and the message digest algorithm MD5, and the file path refers to the path of the suspicious file on the user equipment where the requesting device is located.

In the above step S302 of the present application, the number of suspicious files obtained by the file repairing device may be tens of thousands, and there may be some duplicate files. Therefore, when the number of suspicious files is at least two, the file repairing device Suspicious files can be deduplicated.

Then, when the number of suspicious files is at least two, the file restoration device can extract the meta information of each suspicious file, and save the meta information in the distributed fingerprint database. Wherein, the meta information may include a file path corresponding to the suspicious file and MD5 (Message Digest Algorithm, message digest algorithm). The file path refers to the path of the suspicious file on the user equipment where the requesting device is located.

Step S304, according to the file path and MD5, deduplication processing is performed on each suspicious file.

In the above step S304 of the present application, de-duplication processing refers to removing duplicate suspicious files. After extracting the file path and MD5 of each suspicious file, the file restoration device can judge whether there are duplicate files in each suspicious file according to the file path and MD5, and then perform deduplication processing on each suspicious file.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 4, the above-mentioned step S304, according to the file path and MD5, performing deduplication processing on each suspicious file may include:

Step S402, determining duplicate suspicious files among the suspicious files, wherein the duplicate suspicious files refer to files with the same file path and the same MD5.

In the above step S402 of this application, for how to deduplicate each suspicious file according to the file path and MD5, the method provided by the embodiment of this application is that the file repair device judges whether the file paths of each suspicious file are the same, and whether each suspicious file Whether the MD5 is the same, if the file path is the same and the MD5 is the same, it is determined to be a duplicate suspicious file.

For example, after the file repairing device extracts the file path and MD5 of each suspicious file, it is judged that the file paths of suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are the same and the MD5 is the same, then the file repairing device determines that the suspicious file 1. Suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files.

Step S404, retaining the first file among the repeated suspicious files, and deleting the repeated suspicious files except the first file, wherein the first file is any one of the repeated suspicious files.

In the above step S404 of the present application, after the file restoration device determines the duplicate suspicious files among the suspicious files, it needs to keep only one of the suspicious files, and delete other duplicate suspicious files to realize the deduplication process.

For example, after the file recovery device determines that suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files, any of the suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 can be retained. One file, for example, keep suspicious file 1, and then delete the duplicate suspicious files except suspicious file 1, that is, delete suspicious file 7, suspicious file 24 and suspicious file 30, so as to realize deduplication processing of suspicious files.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 5, the above-mentioned step S212, after reorganizing at least one field group after repair into a repair file with the first format corresponding to the suspicious file, the file repair Methods can also include:

Step S502, receiving the first request sent by the requesting device, the first request is used for downloading the updated vulnerability repair program.

In the above step S502 of the present application, the requesting device can regularly download the latest bug fix program according to the configuration, and further, the file repair device can receive the first request for downloading the updated bug fix program sent by the request device.

Take AliYunDun as the requesting device and AliYunDun server as the file repairing device as an example. Based on the C/S network architecture, AliYunDun maintains a persistent connection with the AliYunDun server through an encrypted channel. According to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. .

Step S504, sending the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes a repair file, so that the requesting device can repair the suspicious file according to the repair file.

In the above step S504 of the present application, after the file repairing device finishes repairing suspicious files, it will obtain a copy of the latest vulnerability repair program. For example, the form of the vulnerability repair program can be: {"filename":"/webapps/manager /WEB-INF/web.xml", "md5": "bc5ef661b746b0c55462353583a7eb34", "action": "delete"}; {"filename": "/webapps/manager/WEB-INF/web.xml", "md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. This latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5, after the requesting device has downloaded the updated vulnerability repair program, it can follow the above-mentioned Repair the file, and repair the suspicious file, for example, convert the suspicious file into the above-mentioned repaired file.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 6, the above-mentioned step S502 receives the first request sent by the requesting device, and the first request is used to download the updated vulnerability repair program before the file repair method Can also include:

Step S602, receiving a second request from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program.

In the above step S602 of the present application, since the requesting device regularly downloads the vulnerability repair program according to the configuration, the requesting device may first determine whether the updated vulnerability repair program is the latest.

Still taking AliYunDun as the requesting device and AliYunDun server as the file repairing device, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. Whether the MD5 of the repair program is the same as the MD5 of the AliVulfix vulnerability repair program downloaded on this machine before, if it is different, it means that the AliYunDun server has been modified and changed, and then re-download the latest AliVulfix vulnerability repair program to replace the local AliVulfix vulnerability repair program .

Step S604, sending the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device determines whether the updated vulnerability repair program is the same as the stored vulnerability repair program according to the MD5 of the updated vulnerability repair program, If they are the same, the requesting device initiates a first request.

Optionally, according to the MD5 of the updated vulnerability repair program, the requesting device determines whether the updated vulnerability repair program is the same as the stored vulnerability repair program may include: the requesting device obtains the MD5 of the stored vulnerability repair program; The device judges whether the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program; if the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program, then determine the updated bug fix program It is the same as the bug fix program stored on the requesting device; if the MD5 of the updated bug fix program is not the same as the stored bug fix program, it is determined that the updated bug fix program is different from the bug fix program stored on the requesting device. same.

Under the above operating environment, the present application also provides a file restoration method. The file repair method may include the following implementation steps:

Step S10, sending the suspicious file in the first format to the file repairing device, wherein the file repairing device forms fields with the same grammatical features into at least one field group according to the grammatical features of each field in the suspicious file, and according to each field group grammatical features, obtain the token sequence features corresponding to each grammatical feature, determine the loopholes in at least one field group according to the token sequence features, replace the loopholes with the preset repair code sequence, and obtain at least one field group after repair, The repaired at least one field group is reorganized into a repaired file having a first format corresponding to the suspicious file.

In the above-mentioned step S10 of the present application, the requesting means may refer to an application program (such as a client) installed on the user equipment. The requesting means may regularly start scanning the user equipment according to the configuration of the server side. When suspicious files are found, Upload the suspicious file to the file repair device through a pre-configured channel. The requesting device can also be a computer terminal or similar computing device, which starts to scan its own disk files at regular intervals. Send to the file recovery device.

Step S12, obtaining a repair file in the first format corresponding to the suspicious file from the file repair device.

Optionally, step S12 obtaining the repaired file in the first format corresponding to the suspicious file from the file repairing device includes:

Step S20, sending a first request to the file repairing device, where the first request is used to download the updated vulnerability repair program.

In the above step S20 of the present application, the requesting device can regularly download the latest vulnerability repairing program according to the configuration, and further, the file repairing device can receive the first request for downloading the updated vulnerability repairing program sent by the requesting device.

Take AliYunDun as the requesting device and AliYunDun server as the file repairing device as an example. Based on the C/S network architecture, AliYunDun maintains a persistent connection with the AliYunDun server through an encrypted channel. According to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. .

Step S22, receiving the updated vulnerability repair program returned by the file repair device, wherein the updated vulnerability repair program includes the repair file.

In the above-mentioned step S22 of the present application, after the file repairing device finishes repairing suspicious files, it will obtain a copy of the latest vulnerability repair program. For example, the form of the vulnerability repair program can be: {"filename":"/webapps/manager /WEB-INF/web.xml", "md5": "bc5ef661b746b0c55462353583a7eb34", "action": "delete"}; {"filename": "/webapps/manager/WEB-INF/web.xml", "md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. This latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5, after the requesting device has downloaded the updated vulnerability repair program, it can follow the above-mentioned Repair the file, and repair the suspicious file, for example, convert the suspicious file into the above-mentioned repaired file.

Optionally, in step S20, before sending the first request to the file repair device, the file repair method further includes:

Step S30, sending a second request to the file repairing device, where the second request is used to acquire the identification information of the updated vulnerability repair program.

In the above step S30 of the present application, since the requesting device regularly downloads the vulnerability repair program according to the configuration, the requesting device may first determine whether the updated vulnerability repair program is the latest.

Still taking AliYunDun as the requesting device and AliYunDun server as the file repairing device, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. Whether the MD5 of the repair program is the same as the MD5 of the AliVulfix vulnerability repair program downloaded on this machine before, if it is different, it means that the AliYunDun server has been modified and changed, and then re-download the latest AliVulfix vulnerability repair program to replace the local AliVulfix vulnerability repair program .

Step S32, receiving the MD5 of the updated vulnerability repair program returned by the file repair device.

Step S34, according to the MD5 of the updated bug fix program, it is judged whether the updated bug fix program is the same as the bug fix program stored in the requesting device, and if they are the same, the request device initiates a first request.

Optionally, according to the MD5 of the updated vulnerability repair program, the requesting device determines whether the updated vulnerability repair program is the same as the stored vulnerability repair program may include: the requesting device obtains the MD5 of the stored vulnerability repair program; The device judges whether the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program; if the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program, then determine the updated bug fix program It is the same as the bug fix program stored on the requesting device; if the MD5 of the updated bug fix program is not the same as the stored bug fix program, it is determined that the updated bug fix program is different from the bug fix program stored on the requesting device. same.

In an optional solution, taking AliYunDun as an example, in combination with Figure 7, the above-mentioned file repair method of this application is described:

Step A, AliYunDun is based on C/S network architecture, each user device is deployed with an independent AliYunDun program, and maintains a long-term connection with the AliYunDun server through an encrypted channel.

In the above step A of this application, AliYunDun is equivalent to the above-mentioned requesting device, and the AliYunDun server is equivalent to the above-mentioned file repairing device. The requesting device can regularly start scanning the user equipment according to the configuration on the server side. channel to upload the suspicious file.

Step B, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server.

In the above step B of this application, the criterion for judging whether it is the latest is to check whether the MD5 of the AliVulfix vulnerability repair program saved on the AliYunDun server is the same as the MD5 of the AliVulfix vulnerability repair program downloaded before on this machine. If they are different, it means that the AliYunDun server If a modification is made, re-download the latest AliVulfix vulnerability fix program to replace the local AliVulfix vulnerability fix program.

Since the requesting device regularly downloads the vulnerability repair program according to the configuration, the requesting device can first determine whether the updated vulnerability repair program is the latest, and the requesting device judges the updated vulnerability repair program and Whether the stored vulnerability repair program of the requesting device is the same may include: the requesting device obtains the MD5 of the stored vulnerability repair program; the requesting device judges whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; If the MD5 of the updated bug fix program is the same as the stored bug fix program, it is determined that the updated bug fix program is the same as the stored bug fix program; if the updated bug fix program’s MD5 is the same as the stored bug fix program If the MD5 of the bug fix program is different, it is determined that the updated bug fix program is different from the bug fix program stored in the requesting device.

When it is determined that the updated vulnerability repair program is different from the stored vulnerability repair program of the requesting device, the file repair device may receive the first request for downloading the updated vulnerability repair program sent by the requesting device, and send a request to the requesting device The updated vulnerability repair program, wherein the updated vulnerability repair program includes a repair file, so that the requesting device can repair the suspicious file according to the repair file.

Step C, according to the configuration of the AliYunDun server, the AliVulfix vulnerability repair program on the user device will be started and executed regularly.

In the above step C of this application, AliYunDun can regularly start scanning the user equipment according to the configuration of the server, and upload the suspicious file through the pre-configured channel when a suspicious file is found.

Step D, AliVulfix performs a full-disk traversal scan on all disk directories on the user's machine.

In the above step D of this application, the file in the specified directory is collected according to the configuration information issued by the AliYunDun server. For example, if there is a configuration item: /plus/mytag_js.php, then AliVulfix will scan and report this suspicious file through the encryption of AliYunDun.

In step E, the AliYunDun server extracts the meta information of the suspicious file after receiving the suspicious file reported by AliYunDun.

In the above step E of the present application, the number of suspicious files obtained by the file repairing device may be tens of thousands, and there may be some duplicate files. Therefore, when the number of suspicious files is at least two, the file repairing device Suspicious files can be deduplicated. Then, when the number of suspicious files is at least two, the file restoration device can extract the meta information of each suspicious file, and save the meta information in the distributed fingerprint database. Wherein, the meta information may include the file path and MD5 corresponding to the suspicious file, and the file path refers to the path of the suspicious file on the user equipment where the requesting device is located.

De-duplication processing refers to the removal of duplicate suspicious files. After extracting the file path and MD5 of each suspicious file, the file restoration device can judge whether there are duplicate files in each suspicious file according to the file path and MD5, and then perform deduplication processing on each suspicious file. For how to deduplicate each suspicious file according to the file path and MD5, the method provided by the embodiment of the present application is that the file restoration device judges whether the file path of each suspicious file is the same, and whether the MD5 of each suspicious file is the same, if the file If the path is the same and the MD5 is the same, it is determined to be a duplicate suspicious file.

For example, after the file repairing device extracts the file path and MD5 of each suspicious file, it is judged that the file paths of suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are the same and the MD5 is the same, then the file repairing device determines that the suspicious file 1. Suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files.

Optionally, after the file repairing device determines the duplicate suspicious files among the suspicious files, it needs to keep only one of the suspicious files, and delete other duplicate suspicious files to realize deduplication processing.

For example, after the file recovery device determines that suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files, any of the suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 can be retained. One file, for example, keep suspicious file 1, and then delete the duplicate suspicious files except suspicious file 1, that is, delete suspicious file 7, suspicious file 24 and suspicious file 30, so as to realize deduplication processing of suspicious files.

Optionally, after the AliYunDun server extracts the meta information of the suspicious file, it can store the meta information in a distributed fingerprint database.

In step F, the suspicious file is parsed into a token syntax tree structure.

In the above step F of this application, because most of the users on Alibaba Cloud are e-commerce and website users, users often make customized modifications to their own website code files. The server adopts a one-to-one targeted repair strategy. However, one-to-one repair will cause a problem. After the 1:1 repair is adopted, the server will receive a large number of There are still a lot of files with loopholes even after filtering. Therefore, the AliYunDun server can parse the above suspicious files into a syntax tree structure.

In the embodiment of the present application, the file repairing device first needs to perform grammatical analysis on the suspicious file to determine the grammatical features of each field in the suspicious file, wherein the grammatical analysis refers to scanning the code into a container, and then the characters in the container Combining fields into various grammatical phrases based on lexical analysis. After determining the grammatical features of each field, the file repairing device can form at least one field group with fields with the same grammatical feature, and further, the file repairing device can parse at least one field group into a grammatical tree structure.

In step G, the security operation personnel only need to configure the token sequence feature once to locate the loopholes in the file.

In the above step G of this application, the token sequence feature is equivalent to the above-mentioned token sequence feature, and the token sequence feature can be pre-configured by the security operator, and the file repair device uses the token sequence feature corresponding to each grammatical feature to realize the loophole lookup.

After obtaining the token sequence features corresponding to each grammatical feature, the file repairing device can locate vulnerabilities in at least one field group according to the token sequence features.

Here is a popular example to illustrate, if there are one hundred people, the purpose is to determine the person whose eyeball color is blue, that is, the token sequence feature is "eyeball-blue", then follow the idea of the file restoration method provided by the embodiment of this application , we first group the various parts of the one hundred people, for example, the eyes of one hundred people are grouped into one group, the nose is grouped into one group, the mouth is grouped into one group, etc., then, according to the token sequence feature When searching for vulnerabilities, you only need to search in the eye group, without searching other parts, so as to improve the efficiency of finding vulnerabilities.

Optionally, according to the token sequence feature, determining the loophole in at least one field group includes: searching for fields identical to the token sequence feature in at least one field group, and determining the same field as the token sequence feature as a loophole.

In the embodiment of this application, the security operation personnel only need to configure the above-mentioned token sequence feature once, and the file repair device can automatically locate the vulnerability, which improves the time cost of security operation.

In step H, the security operation personnel only need to configure a patch token sequence at the same time, which is used to insert the patch token sequence after locating the vulnerability.

In the above step H of this application, the patch token sequence is equivalent to the above-mentioned preset repair code sequence. Preset repair code sequences may also be preconfigured by security operations personnel. After the file repairing device determines the loophole in at least one field group according to the characteristics of the token sequence, it can obtain the preset repair code sequence, and then replace the loophole with the preset repair code sequence to realize the repair of the suspicious file.

The file repairing device in the embodiment of the present application adopts the 1:1 precise fixed-point repairing technology, that is, all suspicious files are directly modified based on the original file of the requesting device. Inconsistencies lead to the user's normal business logic being affected, or even unavailable. At the same time, security operators only need to configure a repair code sequence, and when the file repair device determines a vulnerability, replace the vulnerability with the preset repair code sequence to obtain at least one field group after repair.

Step I, after inserting the patch token sequence in the token syntax tree, rebuild the suspicious file, and complete the vulnerability repair of this file.

In the above step I of this application, after the AliYunDun server can parse the suspicious file into a syntax tree structure, locate the vulnerability according to the token sequence feature (token sequence feature), and then insert a preset repair code sequence in the syntax tree, and then Rebuild the suspicious file, complete the vulnerability repair of the suspicious file, and obtain the above-mentioned repaired file.

In the above-mentioned file repair process, the file repair device splits the suspicious file with the first format into at least one field group according to the grammatical features of each field, so after obtaining the repaired at least one field group, the file repair device can be used according to its Reversing the process, reorganizing at least one repaired field group into a repaired file in the first format corresponding to the suspicious file.

Optionally, reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file includes: according to the parent-child relationship of each field in the repaired at least one field group, the repaired at least one field group The group is reorganized into a repair file having a first format corresponding to the suspect file.

Step J, after completing the review of suspicious files, the AliYunDun server will get a copy of the latest vulnerability repair program.

In the above step J of the present application, after the file repairing device finishes repairing suspicious files, it will obtain a copy of the latest vulnerability repair program. For example, the form of the vulnerability repair program can be: {"filename":"/webapps/manager /WEB-INF/web.xml", "md5": "bc5ef661b746b0c55462353583a7eb34", "action": "delete"}; {"filename": "/webapps/manager/WEB-INF/web.xml", "md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. This latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5, after the requesting device has downloaded the updated vulnerability repair program, it can follow the above-mentioned Repair the file, and repair the suspicious file, for example, convert the suspicious file into the above-mentioned repaired file.

Step K, AliVulfix will pull the latest vulnerability rule base file from the AliYunDun server every time it starts running regularly, and perform repair operations (including deletion and replacement operations) on the corresponding matched files on the local machine during the full scan.

Step L, complete the vulnerability repair of the Alibaba Cloud user website script.

In the above step L of this application, the AliYunDun server receives the real CMS vulnerability files (that is, suspicious files) on the user's device from AliYunDun, and performs one-to-one targeted repair, which ensures the business compatibility after repair and before repair to the greatest extent. , so that the website business will not be unavailable due to vulnerability repair; the AliYunDun server adopts automatic auditing and automatic file repair based on the Token syntax tree, which greatly improves the processing speed; AliYunDun locates suspicious files based on file paths and MD5 to avoid Misoperation occurs and affects the user's website.

The file restoration method of the embodiment of the present application has at least the following technical effects:

1. Fix the loopholes precisely for each user's specific business;

2. The entire process of vulnerability repair is automated. Security operators only need to focus on vulnerability research and perform one configuration. Afterwards, the entire network repair action is fully automated;

3. Realize that all machines in the Alibaba Cloud network can repair a certain vulnerability within 20 minutes;

4. Using syntax trees to locate and repair vulnerabilities can avoid false positives caused by regular expressions and string searches, with high accuracy and low false positive rates.

As can be seen from the above, in the solution provided by the above-mentioned embodiment 1 of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to token sequence features and repair code sequences corresponding to each grammatical feature. Repair achieves the purpose of 1:1 automatic repair of vulnerabilities, thus achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the problem of vulnerability repair caused by the implementation of the same set of Patch codes in the existing technology Technical issues with poor accuracy.

It can be seen from this that there is a problem in the prior art that the accuracy of vulnerability repair caused by the implementation of the same set of Patch codes is poor. This application proposes a method for splitting the fields of suspicious files based on grammatical features, and then according to each grammatical feature Corresponding to the token sequence features and the repair code sequence, the loopholes are searched and repaired, and the purpose of 1:1 automatic repair of the loopholes is achieved, thereby achieving the technical effect of improving the accuracy of the loophole patching and system security.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by this application.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product in essence or the part that contributes to the prior art, and the computer software product is stored in a storage medium (such as ROM/RAM, disk, CD) contains several instructions to enable a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

Example 2

According to the embodiment of the present application, a device embodiment for implementing the above method embodiment is also provided. As shown in FIG. 8, the device includes:

Fig. 8 is a schematic structural diagram of a file restoration device according to an embodiment of the present application.

As shown in FIG. 8 , the apparatus for repairing a file may include an acquiring unit 802 , a processing unit 804 , a first determining unit 806 , a second determining unit 808 , a repairing unit 810 and a reorganizing unit 812 .

Wherein, the obtaining unit 802 is used to obtain the suspicious file with the first format uploaded by the requesting device; the processing unit 804 is used to combine the fields with the same grammatical characteristics into at least one field group according to the grammatical characteristics of each field in the suspicious file ; The first determining unit 806 is used to obtain the token sequence features corresponding to each grammatical feature according to the grammatical features of each field group; the second determining unit 808 is used to determine the at least one The loophole in the field group; the repairing unit 810 is used to replace the loophole with a pre-configured repair code sequence to obtain the repaired at least one field group; the reorganization unit 812 is used to replace the repaired at least one field group A field group is reorganized into a repair file having the first format corresponding to the suspect file.

As can be seen from the above, in the solution provided by the above-mentioned embodiment 1 of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to token sequence features and repair code sequences corresponding to each grammatical feature. Repair achieves the purpose of 1:1 automatic repair of vulnerabilities, thus achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the problem of vulnerability repair caused by the implementation of the same set of Patch codes in the existing technology Technical issues with poor accuracy.

It should be noted here that the acquisition unit 802, processing unit 804, first determination unit 806, second determination unit 808, repair unit 810, and reorganization unit 812 correspond to Step S202 to Step S212 in Embodiment 1, six The examples and application scenarios implemented by the modules and corresponding steps are the same, but are not limited to the content disclosed in the first embodiment above. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, as shown in FIG. 9 , the file restoration apparatus may further include: an extraction unit 902 and a deduplication unit 904 .

Wherein, the extracting unit 902 is used to extract the meta-information of each suspicious file, wherein the meta-information includes the file path corresponding to the suspicious file and the message digest algorithm MD5, and the file path refers to the file path of the suspicious file in the requesting device The path on the user equipment where it is located; the deduplication unit 904 is configured to perform deduplication processing on each suspicious file according to the file path and the MD5.

It should be noted here that the above-mentioned extraction unit 902 and deduplication unit 904 correspond to steps S302 to S304 in the first embodiment, and the examples and application scenarios implemented by this module are the same as those of the corresponding steps, but are not limited to the above-mentioned embodiment a public content. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, as shown in FIG. 10 , the deduplication unit 904 may include: a determining module 1002 and a processing module 1004 .

Wherein, the determination module 1002 is used to determine the repeated suspicious files among the suspicious files, wherein the repeated suspicious files refer to files with the same file path and the same MD5; the processing module 1004 is used to retain The first file among the repeated suspicious files is to delete the repeated suspicious files except the first file, wherein the first file is any one of the repeated suspicious files.

It should be noted here that the determination module 1002 and the processing module 1004 above correspond to steps S402 to S404 in the first embodiment, and the examples and application scenarios implemented by this module are the same as those of the corresponding steps, but are not limited to the first embodiment above What is disclosed. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, the first determining unit 806 is configured to perform the following steps to determine the loopholes in the at least one field group according to the characteristics of the token sequence: search for The field with the same feature as the token sequence is determined as the vulnerability.

Optionally, the reorganization unit 812 is configured to perform the following steps to reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file: according to the repaired the parent-child relationship of each field in the at least one field group, and reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

Optionally, as shown in FIG. 11 , the file restoration apparatus may further include: a first receiving unit 1102 and a first sending unit 1104 .

Wherein, the first receiving unit 1102 is used to receive the first request sent by the requesting device, and the first request is used to download the updated vulnerability repair program; the first sending unit 1104 is used to send the request to the requesting device The updated vulnerability repair program, wherein the updated vulnerability repair program includes the repair file, so that the requesting device can repair the suspicious file according to the repair file.

It should be noted here that the above-mentioned first receiving unit 1102 and first sending unit 1104 correspond to Step S502 to Step S504 in Embodiment 1, and the examples and application scenarios implemented by this module are the same as those of the corresponding steps, but are not limited to The content disclosed in the first embodiment above. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, as shown in FIG. 12 , the file repairing apparatus may further include: a second receiving unit 1202 and a second sending unit 1204 .

Wherein, the second receiving unit 1202 is configured to receive a second request sent from the requesting device, and the second request is used to obtain the identification information of the updated vulnerability repair program; the second sending unit 1204 is configured to sending the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges that the updated vulnerability repair program is compatible with the requesting device according to the MD5 of the updated vulnerability repair program Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request.

It should be noted here that the above-mentioned second receiving unit 1202 and second sending unit 1204 correspond to step S602 to step S604 in the first embodiment, and the examples and application scenarios implemented by this module are the same as those of the corresponding steps, but are not limited to The content disclosed in the first embodiment above. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, the requesting device, according to the MD5 of the updated vulnerability repair program, judging whether the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device may include: the requesting device obtains The MD5 of the stored vulnerability repair program; the requesting device judges whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; if the updated vulnerability repair program MD5 is the same as the MD5 of the stored vulnerability repair program, then it is determined that the updated vulnerability repair program is the same as the stored vulnerability repair program of the requesting device; if the MD5 of the updated vulnerability repair program is the same as the stored If the MD5 of the stored vulnerability repair program is different, it is determined that the updated vulnerability repair program is different from the stored vulnerability repair program of the requesting device.

According to the embodiment of the present application, a device embodiment for implementing the above method embodiment is also provided, as shown in FIG. 13 , the device includes:

Fig. 13 is a schematic structural diagram of a requesting device according to an embodiment of the present application.

As shown in FIG. 13 , the requesting device may include a third sending unit 1302 and a control unit 1304 .

Wherein, the third sending unit 1302 is configured to send the suspicious file with the first format to the file repairing device, wherein, the file repairing device converts fields with the same grammatical feature into Forming at least one field group, obtaining the token sequence features corresponding to each grammatical feature according to the grammatical features of each field group, determining the loopholes in the at least one field group according to the token sequence features, and replacing the loopholes For a preset repair code sequence, obtain the repaired at least one field group, and reorganize the repaired at least one field group into a repair file in the first format corresponding to the suspicious file; a control unit 1304. Acquire a repair file in the first format corresponding to the suspicious file from the file repair apparatus.

It should be noted here that the above-mentioned third sending unit 1302 and control unit 1304 correspond to Step S10 to Step S12 in Embodiment 1, and the examples and application scenarios realized by this module are the same as those of the corresponding steps, but are not limited to the above-mentioned implementation The content disclosed in Example 1. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in Embodiment 1, and can be realized by software or by hardware.

Optionally, the control unit 1304 is configured to perform the following steps to obtain the repair file in the first format corresponding to the suspicious file from the file repair device: sending a first request to the file repair device, the The first request is used for downloading an updated vulnerability repair program; receiving the updated vulnerability repair program returned by the file repair device, wherein the updated vulnerability repair program includes the repair file.

Optionally, the control unit 1304 is further configured to send a second request to the file repairing device, where the second request is used to acquire the identification information of the updated vulnerability repairing program; receive the file repairing device The returned MD5 of the updated bug fix program; according to the MD5 of the updated bug fix program, it is judged whether the updated bug fix program is the same as the bug fix program stored in the requesting device, if they are the same , the requesting device initiates the first request.

It can be seen from this that there is a problem in the prior art that the accuracy of vulnerability repair caused by the implementation of the same set of Patch codes is poor. This application proposes a method for splitting the fields of suspicious files based on grammatical features, and then according to each grammatical feature Corresponding to the token sequence features and the repair code sequence, the loopholes are searched and repaired, and the purpose of 1:1 automatic repair of the loopholes is achieved, thereby achieving the technical effect of improving the accuracy of the loophole patching and system security.

Example 3

The embodiment of the present application also provides a storage medium. Optionally, in this embodiment, the above-mentioned storage medium may be used to store the program code executed by the file repair method provided in the first embodiment above.

Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in the group of computer terminals in the computer network, or in any mobile terminal in the group of mobile terminals.

Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: obtaining a suspicious file in the first format uploaded by the requesting device; according to the grammatical features of each field in the suspicious file, Composing fields with the same grammatical features into at least one field group; according to the grammatical features of each field group, obtaining token sequence features corresponding to each grammatical feature; according to the token sequence features, determining vulnerabilities in the at least one field group ; Replace the vulnerability with a preset repair code sequence to obtain the repaired at least one field group; reorganize the repaired at least one field group into the first format corresponding to the suspicious file repair file.

Optionally, the storage medium is also configured to store program codes for performing the following steps: extracting meta information of each suspicious file, wherein the meta information includes a file path corresponding to the suspicious file and a message digest algorithm MD5, the file The path refers to the path of the suspicious file on the user equipment where the requesting device is located; according to the file path and the MD5, deduplication processing is performed on each suspicious file.

Optionally, the storage medium is also configured to store program codes for performing the following steps: determining duplicate suspicious files among the suspicious files, wherein the duplicate suspicious files refer to the same file path and the MD5 identical files; keep the first file in the repeated suspicious files, and delete the repeated suspicious files except the first file, wherein the first file is among the repeated suspicious files any of the .

Optionally, the storage medium is further configured to store program codes for performing the following steps: searching for a field identical to the token sequence feature in the at least one field group, and combining the field with the token sequence feature The same field is identified as the vulnerability.

Optionally, the storage medium is further configured to store a program code for performing the following steps: according to the parent-child relationship of each field in the at least one field group after the repair, the at least one field after repair The group is reorganized into a repair file in the first format corresponding to the suspect file.

Optionally, the storage medium is also configured to store program codes for performing the following steps: receiving a first request sent by the requesting device, the first request being used to download an updated vulnerability repair program; The device sends the updated vulnerability repair program, wherein the updated vulnerability repair program includes the repair file, so that the requesting device repairs the suspicious file according to the repair file.

Optionally, the storage medium is further configured to store program codes for performing the following steps: receiving a second request sent from the requesting device, the second request being used to obtain the identifier of the updated vulnerability repair program Information; send the MD5 of the updated vulnerability repair program to the requesting device, wherein, the requesting device judges that the updated vulnerability repair program is consistent with the updated vulnerability repair program according to the MD5 of the updated vulnerability repair program Whether the vulnerability repair programs stored by the requesting device are the same, and if they are the same, the requesting device initiates the first request.

Optionally, the storage medium is also configured to store program codes for performing the following steps: the requesting device acquires the MD5 of the stored vulnerability repair program; the requesting device judges the MD5 of the updated vulnerability repair program Whether the MD5 is the same as the MD5 of the stored bug fix program; if the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program, then it is determined that the updated bug fix program is the same as The bug fix program stored by the requesting device is the same; if the MD5 of the updated bug fix program is different from the MD5 of the stored bug fix program, then it is determined that the updated bug fix program is the same as the The requesting device has different stored bug fixes.

The serial numbers of the above embodiments of the present application are for description only, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present application, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed order information processing device can be implemented in other ways. Wherein, the device embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or can be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for enabling a computer device (which may be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk.

The above description is only the preferred embodiment of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present application, some improvements and modifications can also be made. These improvements and modifications are also It should be regarded as the protection scope of this application.

Claims (21)

1. A file repair method, characterized in that, comprising: obtaining a suspicious file in a first format uploaded by the requesting device; According to the grammatical features of each field in the suspicious file, the fields with the same grammatical features are formed into at least one field group; Obtain token sequence features corresponding to each grammatical feature according to the grammatical feature of each field group; determining vulnerabilities in the at least one field group according to the token sequence characteristics; replacing the vulnerability with a preset repair code sequence to obtain the repaired at least one field group; Reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. 2. The method according to claim 1, wherein, in the case that the number of the suspicious files is at least two, after the suspicious files in the first format uploaded by the acquisition requesting device, the For the grammatical features of each field in the suspicious file, the fields with the same grammatical features are formed into at least one field group; before, the method also includes: Extracting meta information of each suspicious file, wherein the meta information includes a file path corresponding to the suspicious file and a message digest algorithm MD5, the file path refers to the path of the suspicious file on the user equipment where the requesting device is located; According to the file path and the MD5, deduplication processing is performed on each suspicious file. 3. The method according to claim 2, wherein the deduplication processing of each suspicious file according to the file path and the MD5 comprises: Determining repeated suspicious files among the suspicious files, wherein the repeated suspicious files refer to files with the same file path and the same MD5; Retaining the first file among the repeated suspicious files, and deleting the repeated suspicious files except the first file, wherein the first file is any one of the repeated suspicious files. 4. The method according to claim 1, wherein, according to the token sequence characteristics, determining the loopholes in the at least one field group comprises: Searching the at least one field group for a field with the same feature as the token sequence, and determining the field with the same feature as the token sequence as the vulnerability. 5. The method according to claim 1, wherein said reorganizing said repaired at least one field into a repaired file corresponding to said suspicious file having said first format comprises: According to the parent-child relationship of each field in the repaired at least one field group, reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. 6. The method according to claim 1, characterized in that, after said repairing said at least one field group into a repaired file corresponding to said suspicious file having said first format, said Methods also include: receiving a first request sent by the requesting device, where the first request is used to download an updated vulnerability repair program; Sending the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes the repair file, so that the requesting device repairs the suspicious file according to the repair file. 7. The method according to claim 6, wherein before receiving the first request sent by the requesting device, the method further comprises: receiving a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program; sending the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges that the updated vulnerability repair program is compatible with the requesting device according to the MD5 of the updated vulnerability repair program Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request. 8. The method according to claim 7, wherein the requesting device judges the updated vulnerability repair program and the stored vulnerability repair program according to the MD5 of the updated vulnerability repair program. Are the procedures the same including: The requesting device obtains the MD5 of the stored vulnerability repair program; The requesting device judges whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; If the MD5 of the updated bug fix program is the same as the MD5 of the stored bug fix program, then determine that the updated bug fix program is the same as the stored bug fix program of the requesting device; If the MD5 of the updated bug fix program is different from the MD5 of the stored bug fix program, it is determined that the updated bug fix program is different from the stored bug fix program of the requesting device. 9. A file repair method, characterized in that, comprising: Sending the suspicious file with the first format to the file repairing device, wherein, according to the grammatical feature of each field in the suspicious file, the file repairing device forms fields with the same grammatical feature into at least one field group, and according to each field The grammatical feature of the group, obtain the token sequence feature corresponding to each grammatical feature, determine the loophole in the at least one field group according to the token sequence feature, replace the loophole with a preset repair code sequence, and get repaired After the at least one field group, reorganize the repaired at least one field group into a repair file with the first format corresponding to the suspicious file; Obtain a repair file in the first format corresponding to the suspicious file from the file repair apparatus. 10. The method according to claim 9, wherein said obtaining the repaired file in the first format corresponding to the suspicious file from the file repairing device comprises: Sending a first request to the file repairing device, the first request is used to download an updated vulnerability repair program; receiving the updated vulnerability repair program returned by the file repair device, wherein the updated vulnerability repair program includes the repair file. 11. The method according to claim 10, wherein before sending the first request to the file repairing device, the method further comprises: sending a second request to the file repairing device, where the second request is used to obtain the identification information of the updated vulnerability repair program; receiving the MD5 of the updated vulnerability repair program returned by the file repair device; According to the MD5 of the updated bug fix program, it is judged whether the updated bug fix program is the same as the bug fix program stored by the requesting device, and if they are the same, the request device initiates the first request. 12. A file restoration device, characterized in that it comprises: An acquisition unit, configured to acquire the suspicious file in the first format uploaded by the requesting device; A processing unit, configured to combine fields with the same grammatical features into at least one field group according to the grammatical features of each field in the suspicious file; The first determining unit is used to obtain token sequence features corresponding to each grammatical feature according to the grammatical feature of each field group; A second determining unit, configured to determine the loopholes in the at least one field group according to the token sequence characteristics; A repair unit, configured to replace the vulnerability with a pre-configured repair code sequence to obtain the repaired at least one field group; A recombination unit, configured to reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. 13. The device of claim 12, further comprising: An extracting unit, configured to extract meta-information of each suspicious file, wherein the meta-information includes a file path corresponding to the suspicious file and a message digest algorithm MD5, and the file path refers to the user's location where the suspicious file is located in the requesting device. the path on the device; The deduplication unit is configured to perform deduplication processing on each suspicious file according to the file path and the MD5. 14. The device according to claim 13, wherein the deduplication unit comprises: A determining module, configured to determine repeated suspicious files among the suspicious files, wherein the repeated suspicious files refer to files with the same file path and the same MD5; A processing module, configured to retain the first file among the repeated suspicious files, and delete the repeated suspicious files except the first file, wherein the first file is one of the repeated suspicious files any of the . 15. The device according to claim 12, wherein the first determining unit is configured to perform the following steps to determine the loopholes in the at least one field group according to the token sequence characteristics: Searching the at least one field group for a field with the same feature as the token sequence, and determining the field with the same feature as the token sequence as the vulnerability. 16. The device according to claim 12, wherein the reorganization unit is configured to perform the following steps to reorganize the repaired at least one field group into the first format corresponding to the suspicious file Repair file: According to the parent-child relationship of each field in the repaired at least one field group, reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. 17. The apparatus of claim 12, further comprising: a first receiving unit, configured to receive a first request sent by the requesting device, and the first request is used to download an updated vulnerability repair program; A first sending unit, configured to send the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes the repair file, so that the requesting device can perform the repair according to the repair file The suspicious files are repaired. 18. The apparatus of claim 17, further comprising: A second receiving unit, configured to receive a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program; The second sending unit is configured to send the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges the updated vulnerability according to the MD5 of the updated vulnerability repair program Whether the repair program is the same as the vulnerability repair program stored by the requesting device, and if they are the same, the requesting device initiates the first request. 19. A requesting device, characterized in that it comprises: The third sending unit is used to send the suspicious file with the first format to the file repairing device, wherein the file repairing device forms at least one field with the same grammatical feature according to the grammatical feature of each field in the suspicious file Field groups, according to the grammatical features of each field group, obtain the token sequence features corresponding to each grammatical feature, determine the loopholes in the at least one field group according to the token sequence features, and replace the loopholes with preset repair code sequence, obtain the at least one field group after repair, and reorganize the at least one field group after repair into a repair file with the first format corresponding to the suspicious file; A control unit, configured to acquire a repair file in the first format corresponding to the suspicious file from the file repair device. 20. The device according to claim 19, wherein the control unit is configured to perform the following steps to obtain a repair file in the first format corresponding to the suspicious file from the file repair device: Sending a first request to the file repairing device, the first request is used to download an updated vulnerability repair program; receiving the updated vulnerability repair program returned by the file repair device, wherein the updated vulnerability repair program includes the repair file. 21. The device according to claim 20, wherein the control unit is further configured to send a second request to the file repair device, and the second request is used to obtain the updated vulnerability repair program receiving the MD5 of the updated vulnerability repair program returned by the file repair device; according to the MD5 of the updated vulnerability repair program, it is determined that the updated vulnerability repair program and the requesting device have Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request.