CN106295334B - Ile repair method and device - Google Patents

Abstract

The present application discloses a file repairing method and device. Wherein, the method includes: acquiring a suspicious file with a first format uploaded by a requesting device; according to the grammatical features of each field in the suspicious file, forming at least one field group of fields with the same grammatical feature; according to the grammar of each field group feature, obtain the token sequence feature corresponding to each grammatical feature; determine the vulnerability in the at least one field group according to the token sequence feature; replace the vulnerability with a preset repair code sequence, and obtain the repaired at least one field group; reorganizing the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file. The present application solves the technical problem that the accuracy of vulnerability repair is poor due to the implementation of the same patch code in the prior art.

Description

File repair method and device

technical field

The present application relates to the field of the Internet, and in particular, to a file repairing method and device.

Background technique

With the rapid development of the Internet, a large number of web sites are running on the servers of various operators. For technical reasons, most of these web sites directly use the open source or paid CMS (Content Management System) on the market. The construction of the website system. These CMSs are often exploited by hackers due to their easy access to source code. After discovering exploitable vulnerabilities, hackers will use their own ODAY (zero-day) vulnerabilities to attack web sites, thereby obtaining a large number of commercial material.

In the confrontation of web attack and defense, for traditional binary vulnerability files or website text file Patch (patch) technology, the prior art generally adopts a unified method of replacing templates, that is, regardless of the number of vulnerability files or vulnerability codes. Variants, the same patch code is used on the server side to implement vulnerability repair, which leads to the problem of poor vulnerability repair accuracy and low system security.

For the above problems, no effective solution has been proposed yet.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a file repairing method and device, so as to at least solve the technical problem of poor accuracy of vulnerability repairing due to the implementation of the same patch code in the prior art.

According to an aspect of the embodiments of the present application, a file repairing method is provided, which includes: acquiring a suspicious file with a first format uploaded by a requesting device; according to the grammatical features of each field in the suspicious file, forming fields with the same grammatical features at least one field group; according to the grammatical feature of each field group, obtain the token sequence feature corresponding to each grammatical feature; according to the above token sequence feature, determine the loophole in the above at least one field group; replace the above loophole with a preset Repair the code sequence to obtain the repaired at least one field group; and reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file.

According to another aspect of the embodiments of the present application, there is also provided a file repairing method, comprising: sending a suspicious file having a first format to a file repairing device, wherein the file repairing device according to the file repairing device according to each field in the suspicious file Grammatical features, the fields with the same grammatical features are formed into at least one field group, and according to the grammatical features of each field group, the token sequence features corresponding to each grammatical feature are obtained, and according to the above token sequence features, determine the at least one field group. Vulnerability, replace the above-mentioned vulnerability with a preset repair code sequence, obtain the above-mentioned at least one field group after repair, and reorganize the above-mentioned at least one field group after repair into a repair file corresponding to the above-mentioned suspicious file and having the above-mentioned first format; A repaired file in the first format corresponding to the suspicious file is obtained from the file repairing device.

According to another aspect of the embodiments of the present application, there is also provided a file repairing device, including: an obtaining unit, configured to obtain a suspicious file with a first format uploaded by a requesting device; a processing unit, configured to The grammatical features of the fields, the fields with the same grammatical features are formed into at least one field group; the first determination unit is used to obtain the token sequence feature corresponding to each grammatical feature according to the grammatical feature of each field group; the second determination unit, with According to the above token sequence features, the loopholes in the above at least one field group are determined; the repair unit is used to replace the above loopholes with a pre-configured repair code sequence to obtain the above-mentioned at least one field group after repair; the reorganization unit is used for The repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file.

According to another aspect of the embodiments of the present application, a requesting device is further provided, including: a third sending unit, configured to send a suspicious file having a first format to a file repairing device, wherein the file repairing device according to the above The grammatical feature of each field in the suspicious file, the fields with the same grammatical feature are formed into at least one field group, and according to the grammatical feature of each field group, the token sequence feature corresponding to each grammatical feature is obtained, and the above token sequence feature is determined according to the above token sequence feature. For loopholes in at least one field group, replace the above loopholes with a preset repair code sequence, obtain the above-mentioned at least one field group after repair, and reorganize the above-mentioned at least one field group after repair into a file corresponding to the above-mentioned suspicious file with the above-mentioned No. A repair file in a format; a control unit, configured to obtain a repair file in the first format corresponding to the suspicious file from the file repair device.

In the embodiment of the present application, the suspicious file with the first format uploaded by the acquisition request device is adopted; according to the grammatical features of each field in the suspicious file, fields with the same grammatical features are formed into at least one field group; according to the grammar of each field group feature, obtain the token sequence feature corresponding to each grammatical feature; determine the vulnerability in at least one field group according to the token sequence feature; replace the vulnerability with a preset repair code sequence to obtain at least one field group after repair; The last at least one field group is reorganized into a repaired file with the first format corresponding to the suspicious file. After at least one field group is obtained by splitting the suspicious file according to the grammatical features, the corresponding token sequence features and The code sequence is repaired to find and repair the loopholes, so as to achieve the purpose of automatically repairing the loopholes at a ratio of 1:1, thereby achieving the technical effect of improving the accuracy of loophole repairing and system security, and solving the problem of using the same technology in the prior art. The technical problem of poor accuracy of vulnerability repair caused by the implementation of a set of Patch codes.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

1 is a block diagram of a hardware structure of a computer terminal for running a file detection method according to an embodiment of the present application;

2 is a schematic flowchart of an optional file restoration method according to an embodiment of the present application;

3 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

4 is a schematic flowchart of another optional file restoration method according to an embodiment of the present application;

5 is a schematic flowchart of another optional file restoration method according to an embodiment of the present application;

6 is a schematic flowchart of another optional file restoration method according to an embodiment of the present application;

7 is a schematic flowchart of another optional file repair method according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an optional file restoration apparatus according to an embodiment of the present application;

9 is a schematic structural diagram of another optional file restoration apparatus according to an embodiment of the present application;

10 is a schematic structural diagram of an optional deduplication unit according to an embodiment of the present application;

11 is a schematic structural diagram of another optional file restoration apparatus according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram of another optional file restoration apparatus according to an embodiment of the present application;

FIG. 13 is a schematic structural diagram of an optional requesting apparatus according to an embodiment of the present application.

Detailed ways

In order to make those skilled in the art better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only The embodiments are part of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the scope of protection of the present application.

It should be noted that the terms "first", "second", etc. in the description and claims of the present application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having" and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed Rather, those steps or units may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

Example 1

According to the embodiments of the present application, a method embodiment of a file repairing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and , although a logical order is shown in the flowcharts, in some cases steps shown or described may be performed in an order different from that herein.

The method embodiment provided in Embodiment 1 of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking running on a computer terminal as an example, FIG. 1 is a hardware structural block diagram of a computer terminal of a file repair method according to an embodiment of the present application. As shown in FIG. 1 , the computer terminal 10 may include one or more (only one is shown in the figure) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) , memory 104 for storing data, and transmission means 106 for communication functions. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only a schematic diagram, which does not limit the structure of the above electronic device. For example, the computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

The memory 104 may be used to store software programs and modules of application software, such as program instructions/modules corresponding to the file repair method in the embodiments of the present application. The processor 102 executes various software programs and modules by running the software programs and modules stored in the memory 104. Function application and data processing, namely, to realize the above-mentioned vulnerability detection method of the application program. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, memory 104 may further include memory located remotely from processor 102, which may be connected to computer terminal 10 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

Transmission means 106 are used to receive or transmit data via a network. A specific example of the above-mentioned network may include a wireless network provided by a communication provider of the computer terminal 10 . In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF) module, which is used for wirelessly communicating with the Internet.

Under the above operating environment, the present application provides a file repairing method as shown in FIG. 2 . FIG. 2 is a flowchart of a file restoration method according to Embodiment 1 of the present application.

As shown in Figure 2, the file repairing method may include the following implementation steps:

Step S202, obtaining a suspicious file in the first format uploaded by the requesting device.

In the above step S202 of the present application, the requesting device may refer to an application program (such as a client) installed on the user equipment, and the requesting device may periodically start scanning the user equipment according to the configuration of the server, and when a suspicious file is found, Upload the suspicious file to the file restoration device through a pre-configured channel. The requesting device can also be a computer terminal or a similar computing device, which regularly starts to scan its own disk file. Sent to the file restoration device.

Wherein, after receiving the suspicious file in the first format from the requesting device, the file repairing device can parse the suspicious file to repair the suspicious file. The file repairing device can be, for example, an AliYunDun server.

Take AliYunDun (Alibaba Cloud Shield) as the requesting device as an example. AliYunDun is based on the C/S (Client/Server, client/server) network architecture. Each user device is deployed with an independent AliYunDun program, which is encrypted through an encrypted channel. Keep a long connection with the AliYunDun server. According to the configuration of the server, AliYunDun regularly downloads the latest AliVulfix (a cloud shield accessory component) vulnerability repair program from the server to replace the local vulnerability repair program. According to the configuration of the server, AliYunDun can control the AliVulfix vulnerability repair program to start regularly, perform a full-disk traversal scan of all disk directories on the user device, and collect files in the specified directory according to the configuration information issued by the server. For example, one of the configuration items is: / plus/mytag_js.php, AliVulfix will scan and report this suspicious file through AliYunDun encryption.

Step S204, according to the grammatical features of each field in the suspicious file, the fields with the same grammatical feature are formed into at least one field group.

In the above step S204 of the present application, after acquiring the suspicious file, the file repairing device performs one-to-one targeted repairs on the vulnerability and improves the repairing efficiency, so as to prevent the hacker from using the time gap to invade the user equipment due to the excessively long repairing time. According to the grammatical characteristics of each field in the suspicious file, fields with the same grammatical characteristics can be formed into at least one field group.

Take the file repair device as the AliYunDun server as an example, because most of the users on Alibaba Cloud are e-commerce and website users, and users often make customized modifications to their website code files, in order to ensure that the vulnerability repair does not affect the normal operation of these user websites In operation, the AliYunDun server adopts a one-to-one targeted repair strategy. However, one-to-one repair will cause a problem. After a 1:1 repair, under the number of hundreds of thousands of users of Alibaba Cloud, there will be a problem on the server side. After receiving a large number of files with vulnerabilities, even after filtering, the number of files is still large. Therefore, the AliYunDun server can parse the above suspicious files into a syntax tree structure.

In the embodiment of the present application, the file repairing device firstly performs syntax analysis on the suspicious file to determine the syntax characteristics of each field in the suspicious file, where the syntax analysis refers to scanning the code into a container, On the basis of lexical analysis, fields are combined into various grammatical phrases. After determining the grammatical features of each field, the file repairing apparatus may form at least one field group with fields with the same grammatical feature, and further, the file repairing apparatus may parse the at least one field group into a grammar according to the parent-child relationship between the fields tree structure.

Step S206, according to the grammatical feature of each field group, obtain the token sequence feature corresponding to each grammatical feature.

In the above step S206 of the present application, the token sequence feature may be pre-configured by security operators, and the file repairing device uses the token sequence feature corresponding to each grammatical feature to search for vulnerabilities.

Step S208, according to the token sequence feature, determine the vulnerability in at least one field group.

In the above-mentioned step S208 of the present application, after acquiring the token sequence feature corresponding to each grammatical feature, the file repairing apparatus may locate the vulnerability in at least one field group according to the token sequence feature.

Here is a popular example to illustrate, if there are 100 people, the purpose is to determine the person whose eyeball color is blue, that is, the token sequence feature is "eyeball-blue", then according to the idea of the file restoration method provided by the embodiment of the present application , we first group the various parts of the 100 people, for example, divide the eyes of 100 people into a group, nose into a group, mouth into a group, etc., then, according to the token sequence features When searching for loopholes, it is only necessary to search in the group of eyes, and there is no need to search for other parts, so as to improve the efficiency of loophole search.

Optionally, determining a vulnerability in at least one field group according to the token sequence feature includes: searching for a field identical to the token sequence feature in the at least one field group, and determining the field identical to the token sequence feature as a vulnerability.

In the embodiment of the present application, the security operator only needs to configure the above token sequence feature once, and the file repair device can automatically locate the vulnerability, which increases the time cost of security operation.

Step S210, replacing the vulnerability with a preset repair code sequence to obtain at least one field group after repair.

In the above step S210 of the present application, the preset repair code sequence may also be pre-configured by the security operator. After determining the vulnerability in at least one field group according to the token sequence feature, the file repairing device can obtain the preset repair code sequence, and then replace the vulnerability with the preset repair code sequence to realize repair of suspicious files.

The file repairing device of the embodiment of the present application adopts the 1:1 precise point repairing technology, that is, all suspicious files are directly modified based on the original file of the requesting device, which can avoid the code logic caused by the vulnerability repair to the greatest extent. The inconsistency causes the normal business logic of the user to be affected or even unavailable. At the same time, the security operator only needs to configure a repair code sequence, and when the file repair device determines a vulnerability, replace the vulnerability with a preset repair code sequence to obtain at least one field group after repair.

Step S212, reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file.

In the above-mentioned step S212 of the present application, in the above-mentioned file repairing process, the file repairing device divides the suspicious file having the first format into at least one field group according to the grammatical characteristics of each field, so after obtaining the repaired at least one field group , the file repairing apparatus can reorganize the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file according to its reverse process.

Optionally, reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file includes: reorganizing the repaired at least one field according to the parent-child relationship of each field in the repaired at least one field group. The group is reorganized into repair files in the first format corresponding to suspicious files.

Taking the file repairing device as the AliYunDun server as an example, the AliYunDun server can parse the above suspicious file into a syntax tree structure, locate the vulnerability according to the token sequence feature (token sequence feature), and then insert a preset repair code sequence into the syntax tree. After that, rebuild the suspicious file, complete the vulnerability repair of the suspicious file, and obtain the above repaired file.

In the file repairing method provided by the embodiment of the present application, since the number of suspicious files may be thousands, the whole process of using the above-mentioned file repairing method can be automated through program code, and the entire vulnerability repairing can be realized. From discovery, to auditing, to automating the whole process of repair, in theory, all user devices on Alibaba Cloud's entire network can be repaired for a certain vulnerability within 20 minutes.

The file restoration method of the embodiment of the present application has at least the following technical effects:

1. Fix the vulnerabilities precisely for each user's specific business;

2. The whole process of vulnerability repair is automated. Security operators only need to focus on vulnerability research and perform one configuration. After that, the entire network repair action is fully automated;

3. Realize that all machines in the entire Alibaba Cloud network can repair a certain vulnerability within 20 minutes;

4. Use the syntax tree method to locate and repair vulnerabilities, which can avoid false positives caused by regular and string searches, with high accuracy and low false positive rate;

5. Does not affect the normal operation of the program to be repaired on the requesting device.

As can be seen from the above, in the solution provided by the first embodiment of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to the corresponding token sequence features and repair code sequences of each grammatical feature. Repair, to achieve the purpose of 1:1 automatic repair of the vulnerability, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the vulnerability repair caused by the use of the same set of Patch codes in the existing technology. Technical issues with poor accuracy.

In an optional solution provided by the above embodiment of the present application, as shown in FIG. 3 , in the case where the number of suspicious files is at least two, after obtaining the suspicious files in the first format uploaded by the requesting device in the above step S202, In the above-mentioned step S204, according to the grammatical features of each field in the suspicious file, before the fields with the same grammatical features are formed into at least one field group, the file repairing method may further include:

Step S302: Extract the meta information of each suspicious file, wherein the meta information includes the file path corresponding to the suspicious file and the message digest algorithm MD5, and the file path refers to the path of the suspicious file on the user equipment where the requesting device is located.

In the above step S302 of the present application, the number of suspicious files acquired by the file repairing device may be thousands, and there may be some duplicate files. Therefore, when the number of suspicious files is at least two, the file repairing device may Suspicious files can be deduplicated.

Then, when the number of suspicious files is at least two, the file repairing apparatus can extract the meta information of each suspicious file, and save the meta information in the distributed fingerprint database. The meta information may include a file path and MD5 (Message Digest Algorithm) corresponding to the suspicious file, and the file path refers to the path of the suspicious file on the user equipment where the requesting apparatus is located.

Step S304, performing deduplication processing on each suspicious file according to the file path and MD5.

In the above step S304 of the present application, the deduplication process refers to removing duplicate suspicious files. After extracting the file path and MD5 of each suspicious file, the file repairing device can judge whether there are duplicate files in each suspicious file according to the file path and MD5, and then perform deduplication processing on each suspicious file.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 4 , in the above-mentioned step S304, according to the file path and MD5, performing deduplication processing on each suspicious file may include:

Step S402 , determining repeated suspicious files in each suspicious file, wherein the repeated suspicious files refer to files with the same file path and the same MD5.

In the above step S402 of the present application, with respect to how to perform deduplication processing on each suspicious file according to the file path and MD5, the method provided by the embodiment of the present application is that the file restoration device determines whether the file paths of each suspicious file are the same, and each suspicious file Whether the MD5 is the same, if the file path is the same and the MD5 is the same, it is determined to be a duplicate suspicious file.

For example, after extracting the file path and MD5 of each suspicious file, the file repairing device determines that the file paths of suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are the same and the MD5 is the same, then the file repairing device determines the suspicious file. 1. Suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files.

Step S404: Retain the first file among the repeated suspicious files, and delete the repeated suspicious files except the first file, where the first file is any one of the repeated suspicious files.

In the above step S404 of the present application, after determining the duplicate suspicious files in each suspicious file, the file repairing device needs to keep only one of the suspicious files, and delete the other duplicate suspicious files to realize deduplication processing.

For example, after determining that suspicious file 1, suspicious file 7, suspicious file 24, and suspicious file 30 are duplicate suspicious files, the file repairing device can keep any one of suspicious file 1, suspicious file 7, suspicious file 24, and suspicious file 30. One file, for example, keep suspicious file 1, and then delete the duplicate suspicious files except suspicious file 1, that is, delete suspicious file 7, suspicious file 24 and suspicious file 30, so as to realize deduplication processing of suspicious files.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 5 , in the above step S212, after the repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file, the file is repaired. Methods can also include:

Step S502: Receive a first request sent by the requesting device, where the first request is used to download the updated vulnerability repair program.

In the above step S502 of the present application, the requesting device may periodically download the latest vulnerability repair program according to the configuration, and further, the file repairing device may receive a first request sent by the requesting device for downloading the updated vulnerability repair program.

Take the requesting device as AliYunDun and the file repairing device as the AliYunDun server as an example. Based on the C/S network architecture, AliYunDun maintains a long-term connection with the AliYunDun server through encrypted channels. According to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. .

Step S504: Send the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes a repair file, so that the requesting device repairs the suspicious file according to the repair file.

In the above step S504 of the present application, after completing the repair of the suspicious file, the file repairing device will obtain a copy of the latest vulnerability repair program. For example, the format of the vulnerability repair program may be: {"filename":"/webapps/manager /WEB-INF/web.xml","md5":"bc5ef661b746b0c55462353583a7eb34","action":"delete"};{"filename":"/webapps/manager/WEB-INF/web.xml","md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. The latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5. After downloading the updated vulnerability repair program, the requesting device can Repair files, repair suspicious files, such as turning suspicious files into the above repaired files.

In an optional solution provided by the above-mentioned embodiment of the present application, as shown in FIG. 6 , in the above step S502, a first request sent by the requesting device is received, and the first request is used to download the updated vulnerability repair program. Can also include:

Step S602: Receive a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program.

In the above step S602 of the present application, since the requesting device downloads the vulnerability repair program periodically according to the configuration, the requesting device can first determine whether the updated vulnerability repair program is the latest.

Taking the requesting device as AliYunDun and the file repairing device as the AliYunDun server as an example, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server, and the criterion for judging whether it is the latest is to check the AliVulfix vulnerability saved in the AliYunDun server. Whether the MD5 of the repair program is the same as the MD5 of the AliVulfix vulnerability repair program downloaded on the machine before, if it is different, it means that the AliYunDun server has been modified and changed, then download the latest AliVulfix vulnerability repair program again, and replace the local AliVulfix vulnerability repair program .

Step S604, sending the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device determines whether the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device according to the MD5 of the updated vulnerability repair program, If the same, the requesting device initiates the first request.

Optionally, the requesting device, according to the MD5 of the updated vulnerability repair program, judging whether the updated vulnerability repair program is the same as the stored vulnerability repair program of the requesting device may include: requesting the device to obtain the MD5 of the stored vulnerability repair program; requesting The device determines whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; if the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program, the updated vulnerability repair program is determined. It is the same as the bugfix already stored by the requesting device; if the MD5 of the updated bugfix is not the same as the MD5 of the stored bugfix, it is determined that the updated bugfix is different from the bugfix already stored by the requesting device. same.

Under the above operating environment, the present application also provides a file repairing method. The file repairing method may include the following implementation steps:

Step S10, sending the suspicious file having the first format to the file repairing device, wherein the file repairing device forms at least one field group according to the grammatical features of each field in the suspicious file, and according to each field group grammatical features, obtain the token sequence feature corresponding to each grammatical feature, determine the vulnerability in at least one field group according to the token sequence feature, replace the vulnerability with a preset repair code sequence, and obtain the repaired at least one field group, The repaired at least one field group is reorganized into a repaired file having the first format corresponding to the suspicious file.

In the above step S10 of the present application, the requesting device may refer to an application program (such as a client) installed on the user equipment, and the requesting device may periodically start scanning the user equipment according to the configuration of the server, and when a suspicious file is found, Upload the suspicious file to the file restoration device through a pre-configured channel. The requesting device can also be a computer terminal or a similar computing device, which regularly starts to scan its own disk file. Sent to the file restoration device.

Step S12, obtaining a repaired file in the first format corresponding to the suspicious file from the file repairing device.

Optionally, step S12 obtaining a repaired file in the first format corresponding to the suspicious file from the file repairing device includes:

Step S20, sending a first request to the file repairing apparatus, where the first request is used to download the updated vulnerability repair program.

In the above step S20 of the present application, the requesting device may periodically download the latest vulnerability repair program according to the configuration, and further, the file repairing device may receive a first request sent by the requesting device for downloading the updated vulnerability repair program.

Take the requesting device as AliYunDun and the file repairing device as the AliYunDun server as an example. Based on the C/S network architecture, AliYunDun maintains a long-term connection with the AliYunDun server through encrypted channels. According to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server. .

Step S22, receiving an updated vulnerability repair program returned by the file repairing device, wherein the updated vulnerability repair program includes a repair file.

In the above step S22 of the present application, after completing the repair of the suspicious file, the file repair device will obtain a copy of the latest vulnerability repair program. For example, the format of the vulnerability repair program may be: {"filename":"/webapps/manager /WEB-INF/web.xml","md5":"bc5ef661b746b0c55462353583a7eb34","action":"delete"};{"filename":"/webapps/manager/WEB-INF/web.xml","md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. The latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5. After downloading the updated vulnerability repair program, the requesting device can Repair files, repair suspicious files, such as turning suspicious files into the above repaired files.

Optionally, in step S20, before sending the first request to the file repairing device, the file repairing method further includes:

Step S30, sending a second request to the file repairing apparatus, where the second request is used to obtain the identification information of the updated vulnerability repair program.

In the above step S30 of the present application, since the requesting device downloads the vulnerability repair program periodically according to the configuration, the requesting device can first determine whether the updated vulnerability repair program is the latest.

Taking the requesting device as AliYunDun and the file repairing device as the AliYunDun server as an example, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server, and the criterion for judging whether it is the latest is to check the AliVulfix vulnerability saved in the AliYunDun server. Whether the MD5 of the repair program is the same as the MD5 of the AliVulfix vulnerability repair program downloaded on the machine before, if it is different, it means that the AliYunDun server has been modified and changed, then download the latest AliVulfix vulnerability repair program again, and replace the local AliVulfix vulnerability repair program .

Step S32, receiving the MD5 of the updated vulnerability repair program returned by the file repairing device.

Step S34, according to the MD5 of the updated vulnerability repair program, determine whether the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device, and if they are the same, the requesting device initiates a first request.

Optionally, the requesting device, according to the MD5 of the updated vulnerability repair program, judging whether the updated vulnerability repair program is the same as the stored vulnerability repair program of the requesting device may include: requesting the device to obtain the MD5 of the stored vulnerability repair program; requesting The device determines whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; if the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program, the updated vulnerability repair program is determined. It is the same as the bugfix already stored by the requesting device; if the MD5 of the updated bugfix is not the same as the MD5 of the stored bugfix, it is determined that the updated bugfix is different from the bugfix already stored by the requesting device. same.

In an optional solution, taking AliYunDun as an example, in conjunction with FIG. 7 , the above-mentioned file restoration method of the present application is described:

Step A, AliYunDun is based on the C/S network architecture, and an independent AliYunDun program is deployed on each user device, and maintains a long connection with the AliYunDun server through an encrypted channel.

In the above step A of this application, AliYunDun is equivalent to the above-mentioned requesting device, and the AliYunDun server is equivalent to the above-mentioned file repairing device. The requesting device can periodically start scanning the user equipment according to the configuration of the server side. channel to upload the suspicious file.

Step B, according to the configuration of the AliYunDun server, AliYunDun regularly downloads the latest AliVulfix vulnerability repair program from the AliYunDun server.

In the above step B of this application, the criterion for judging whether it is the latest is to check whether the MD5 of the AliVulfix vulnerability repair program saved in the AliYunDun server is the same as the MD5 of the AliVulfix vulnerability repair program that has been downloaded to the local machine before. If it is different, it means that the AliYunDun server If changes are made, download the latest AliVulfix vulnerability repair program again to replace the local AliVulfix vulnerability repair program.

Since the requesting device periodically downloads the vulnerability repair program according to the configuration, the requesting device can first determine whether the updated vulnerability repair program is the latest, and the requesting device determines whether the updated vulnerability repair program is the same as the updated vulnerability repair program according to the MD5 of the updated vulnerability repair program. Requesting whether the vulnerability repair programs stored by the device are the same may include: requesting the device to obtain the MD5 of the stored vulnerability repair program; requesting the device to determine whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; The MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program, then it is determined that the updated vulnerability repair program is the same as the stored vulnerability repair program of the requesting device; if the MD5 of the updated vulnerability repair program is the same as the stored vulnerability repair program If the MD5 of the vulnerability repair program is not the same, it is determined that the updated vulnerability repair program is not the same as the vulnerability repair program stored in the requesting device.

When it is determined that the updated vulnerability repair program is not the same as the vulnerability repair program stored by the requesting device, the file repairing device may receive a first request sent by the requesting device for downloading the updated vulnerability repairing program, and send a request to the requesting device. The updated vulnerability repair program, wherein the updated vulnerability repair program includes a repair file, so that the device is requested to repair the suspicious file according to the repair file.

Step C, according to the configuration of the AliYunDun server, the AliVulfix vulnerability repair program on the user device will be started and executed regularly.

In the above step C of this application, AliYunDun can periodically start scanning the user equipment according to the configuration on the server side, and when a suspicious file is found, upload the suspicious file through a pre-configured channel.

Step D, AliVulfix performs a full-disk traversal scan on all disk directories on the user's machine.

In the above step D of this application, according to the configuration information issued by the AliYunDun server, the file in the specified directory is received. For example, if there is a configuration item: /plus/mytag_js.php, AliVulfix will scan and report the suspicious file through the encryption of AliYunDun.

Step E: After receiving the suspicious file reported by AliYunDun, the AliYunDun server extracts the meta information of the suspicious file.

In the above step E of the present application, the number of suspicious files acquired by the file repair device may be thousands, and there may be some duplicate files. Therefore, when the number of suspicious files is at least two, the file repair device may Suspicious files can be deduplicated. Then, when the number of suspicious files is at least two, the file repairing apparatus can extract the meta information of each suspicious file, and save the meta information in the distributed fingerprint database. The meta information may include the file path and MD5 corresponding to the suspicious file, and the file path refers to the path of the suspicious file on the user equipment where the requesting device is located.

Deduplication refers to removing duplicate suspicious files. After extracting the file path and MD5 of each suspicious file, the file repairing device can judge whether there are duplicate files in each suspicious file according to the file path and MD5, and then perform deduplication processing on each suspicious file. Regarding how to perform deduplication processing on each suspicious file according to the file path and MD5, the method provided by the embodiment of the present application is that the file repair device judges whether the file path of each suspicious file is the same, and whether the MD5 of each suspicious file is the same, if the file If the path is the same and the MD5 is the same, it is determined to be a duplicate suspicious file.

For example, after extracting the file path and MD5 of each suspicious file, the file repairing device determines that the file paths of suspicious file 1, suspicious file 7, suspicious file 24 and suspicious file 30 are the same and the MD5 is the same, then the file repairing device determines the suspicious file. 1. Suspicious file 7, suspicious file 24 and suspicious file 30 are duplicate suspicious files.

Optionally, after determining the duplicate suspicious files among the various suspicious files, the file repairing apparatus needs to keep only one of the suspicious files, and delete the other duplicate suspicious files to realize deduplication processing.

For example, after determining that suspicious file 1, suspicious file 7, suspicious file 24, and suspicious file 30 are duplicate suspicious files, the file repairing device can keep any one of suspicious file 1, suspicious file 7, suspicious file 24, and suspicious file 30. One file, for example, keep suspicious file 1, and then delete the duplicate suspicious files except suspicious file 1, that is, delete suspicious file 7, suspicious file 24 and suspicious file 30, so as to realize deduplication processing of suspicious files.

Optionally, after the AliYunDun server extracts the meta-information of suspicious files, the meta-information can be saved in a distributed fingerprint database.

Step F, parse the suspicious file into a token syntax tree structure.

In the above step F of this application, because most of the users on Alibaba Cloud are e-commerce and website users, users often make customized modifications to their own website code files. The server adopts a one-to-one targeted repair strategy. However, one-to-one repair will cause a problem. After adopting a 1:1 repair, with hundreds of thousands of users of Alibaba Cloud, the server will receive a large number of The number of vulnerable files is still large even after filtering. Therefore, the AliYunDun server can parse the above suspicious files into a syntax tree structure.

In the embodiment of the present application, the file repairing device firstly performs syntax analysis on the suspicious file to determine the syntax characteristics of each field in the suspicious file, where the syntax analysis refers to scanning the code into a container, On the basis of lexical analysis, fields are combined into various grammatical phrases. After determining the grammatical features of each field, the file repairing apparatus may form at least one field group with fields with the same grammatical feature, and further, the file repairing apparatus may parse the at least one field group into a grammar according to the parent-child relationship between the fields tree structure.

In step G, the security operator only needs to configure the token sequence feature once to locate the vulnerability in the file.

In the above step G of this application, the token sequence feature is equivalent to the above token sequence feature, the token sequence feature may be pre-configured by security operators, and the file repair device uses the token sequence feature corresponding to each grammatical feature to realize the vulnerability 's search.

After acquiring the token sequence feature corresponding to each grammatical feature, the file repairing device can locate the vulnerability in at least one field group according to the token sequence feature.

Here is a popular example to illustrate, if there are 100 people, the purpose is to determine the person whose eyeball color is blue, that is, the token sequence feature is "eyeball-blue", then according to the idea of the file restoration method provided by the embodiment of the present application , we first group the various parts of the 100 people, for example, divide the eyes of 100 people into a group, nose into a group, mouth into a group, etc., then, according to the token sequence features When searching for loopholes, it is only necessary to search in the group of eyes, and there is no need to search for other parts, so as to improve the efficiency of loophole search.

Optionally, determining a vulnerability in at least one field group according to the token sequence feature includes: searching for a field identical to the token sequence feature in the at least one field group, and determining the field identical to the token sequence feature as a vulnerability.

In the embodiment of the present application, the security operator only needs to configure the above token sequence feature once, and the file repair device can automatically locate the vulnerability, which increases the time cost of security operation.

In step H, the security operator only needs to configure a patch token sequence, which is used to insert the patch token sequence after locating the vulnerability.

In the above step H of the present application, the patch token sequence is equivalent to the above-mentioned preset repair code sequence. Preset repair code sequences can also be preconfigured by security operations personnel. After determining the vulnerability in at least one field group according to the token sequence feature, the file repairing device can obtain the preset repair code sequence, and then replace the vulnerability with the preset repair code sequence to realize repair of suspicious files.

The file repairing device of the embodiment of the present application adopts the 1:1 precise point repairing technology, that is, all suspicious files are directly modified based on the original file of the requesting device, which can avoid the code logic caused by the vulnerability repair to the greatest extent. The inconsistency causes the normal business logic of the user to be affected or even unavailable. At the same time, the security operator only needs to configure a repair code sequence, and when the file repair device determines a vulnerability, replace the vulnerability with a preset repair code sequence to obtain at least one field group after repair.

In step I, after the patch token sequence is inserted into the token syntax tree, the suspicious file is then reconstructed to complete the vulnerability repair of this file.

In the above-mentioned step 1 of the present application, after the AliYunDun server can parse the above-mentioned suspicious file into a syntax tree structure, locate the vulnerability according to the token sequence feature (token sequence feature), and then insert the preset repair code sequence in the syntax tree, then Rebuild the suspicious file, complete the vulnerability repair of the suspicious file, and obtain the above repaired file.

In the above-mentioned file repairing process, the file repairing apparatus divides the suspicious file in the first format into at least one field group according to the grammatical characteristics of each field, so after obtaining the repaired at least one field group, the file repairing apparatus can In the reverse process, the repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file.

Optionally, reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file includes: reorganizing the repaired at least one field according to the parent-child relationship of each field in the repaired at least one field group. The group is reorganized into repair files in the first format corresponding to suspicious files.

Step J, after completing the audit of suspicious files, you will get the latest vulnerability fix on the AliYunDun server.

In the above step J of this application, after the file repairing device completes repairing the suspicious file, it will obtain a copy of the latest vulnerability repair program. For example, the format of the vulnerability repair program can be: {"filename":"/webapps/manager /WEB-INF/web.xml","md5":"bc5ef661b746b0c55462353583a7eb34","action":"delete"};{"filename":"/webapps/manager/WEB-INF/web.xml","md5" : "bc5ef661b746b0c55462353583a7eb55", "action": "replace"}. The latest vulnerability repair program is accurately located under the file path of the above-mentioned suspicious file, corresponding to the suspicious file of MD5. After downloading the updated vulnerability repair program, the requesting device can Repair files, repair suspicious files, such as turning suspicious files into the above repaired files.

In step K, every time AliVulfix starts and runs regularly, it will pull the latest vulnerability rule base file from the AliYunDun server, and perform repair operations (including deletion and replacement operations) on the corresponding matching files on the local machine during a full-scale scan.

Step L, complete the vulnerability repair of the script of the Alibaba Cloud user website.

In the above step L of this application, the AliYunDun server receives the real CMS vulnerability file (that is, the suspicious file) on the user device from AliYunDun, and performs one-to-one targeted repairs, which maximizes the business compatibility after repair and before repair. , it will not happen that the website business is unavailable due to vulnerability repair; the AliYunDun server adopts automatic auditing and automatic file repair based on the Token syntax tree, which greatly improves the processing speed; AliYunDun locates suspicious files based on file paths and MD5, to avoid Misoperation occurs, which will affect the user's website.

The file restoration method of the embodiment of the present application has at least the following technical effects:

1. Fix the vulnerabilities precisely for each user's specific business;

2. The whole process of vulnerability repair is automated. Security operators only need to focus on vulnerability research and perform one configuration. After that, the entire network repair action is fully automated;

3. Realize that all machines in the entire Alibaba Cloud network can repair a certain vulnerability within 20 minutes;

4. Using the syntax tree method to locate and repair vulnerabilities can avoid false positives caused by regular and string searches, with high accuracy and low false positive rates.

As can be seen from the above, in the solution provided by the first embodiment of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to the corresponding token sequence features and repair code sequences of each grammatical feature. Repair, to achieve the purpose of 1:1 automatic repair of the vulnerability, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the vulnerability repair caused by the use of the same set of Patch codes in the existing technology. Technical issues with poor accuracy.

From this, it can be seen that there is a problem in the prior art that the accuracy of vulnerability repair caused by the implementation of the same set of Patch codes is poor. Finding and repairing vulnerabilities corresponding to token sequence features and repair code sequences achieves the purpose of 1:1 automatic repair of vulnerabilities, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security.

It should be noted that, for the sake of simple description, the foregoing method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Because in accordance with the present application, certain steps may be performed in other orders or concurrently. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

From the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence or in a part that contributes to the prior art, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, CD-ROM), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in the various embodiments of this application.

Example 2

According to an embodiment of the present application, an apparatus embodiment for implementing the foregoing method embodiment is also provided. As shown in FIG. 8 , the apparatus includes:

FIG. 8 is a schematic structural diagram of a file restoration apparatus according to an embodiment of the present application.

As shown in FIG. 8 , the file repairing apparatus may include an acquiring unit 802 , a processing unit 804 , a first determining unit 806 , a second determining unit 808 , a repairing unit 810 and a reorganizing unit 812 .

Wherein, the obtaining unit 802 is used to obtain a suspicious file with the first format uploaded by the requesting device; the processing unit 804 is used to form at least one field group according to the grammatical features of each field in the suspicious file, with fields with the same grammatical features ; The first determining unit 806 is used to obtain the corresponding token sequence feature of each grammatical feature according to the grammatical feature of each field group; the second determining unit 808 is used to determine the at least one token sequence feature according to the token sequence feature The vulnerability in the field group; the repair unit 810 is used to replace the vulnerability with a pre-configured repair code sequence to obtain the repaired at least one field group; the reorganization unit 812 is used to repair the at least one field group. The field group is reorganized into a repair file in the first format corresponding to the suspect file.

As can be seen from the above, in the solution provided by the first embodiment of the present application, after at least one field group is obtained by splitting suspicious files according to grammatical features, loopholes are searched and repaired according to the corresponding token sequence features and repair code sequences of each grammatical feature. Repair, to achieve the purpose of 1:1 automatic repair of the vulnerability, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security, and then solving the vulnerability repair caused by the use of the same set of Patch codes in the existing technology. Technical issues with poor accuracy.

It should be noted here that the acquisition unit 802, the processing unit 804, the first determination unit 806, the second determination unit 808, the repair unit 810, and the recombination unit 812 correspond to steps S202 to S212 in the first embodiment, and six Examples and application scenarios implemented by modules and corresponding steps are the same, but are not limited to the content disclosed in the first embodiment above. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, as shown in FIG. 9 , the file restoration apparatus may further include: an extraction unit 902 and a deduplication unit 904 .

The extraction unit 902 is configured to extract the meta information of each suspicious file, wherein the meta information includes the file path corresponding to the suspicious file and the message digest algorithm MD5, and the file path refers to the suspicious file in the requesting device. The path on the user equipment where it is located; the deduplication unit 904 is configured to perform deduplication processing on each suspicious file according to the file path and the MD5.

It should be noted here that the above-mentioned extracting unit 902 and deduplication unit 904 correspond to steps S302 to S304 in the first embodiment, and the modules and the corresponding steps have the same examples and application scenarios, but are not limited to the above-mentioned embodiments. a published content. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, as shown in FIG. 10 , the deduplication unit 904 may include: a determination module 1002 and a processing module 1004 .

Wherein, the determination module 1002 is used to determine the repeated suspicious files among the various suspicious files, wherein the repeated suspicious files refer to the files with the same file path and the same MD5; the processing module 1004 is used to retain For the first file in the repeated suspicious files, the repeated suspicious files other than the first file are deleted, wherein the first file is any one of the repeated suspicious files.

It should be noted here that the above-mentioned determination module 1002 and processing module 1004 correspond to steps S402 to S404 in the first embodiment, and the modules and the corresponding steps have the same examples and application scenarios, but are not limited to the above-mentioned first embodiment. disclosed content. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, the first determining unit 806 is configured to perform the following steps to determine the loopholes in the at least one field group according to the token sequence feature: searching the at least one field group for the same as the token sequence A field with the same characteristics, and the field with the same characteristics as the token sequence is determined as the vulnerability.

Optionally, the reorganization unit 812 is configured to perform the following steps to reorganize the repaired at least one field group into a repaired file in the first format corresponding to the suspicious file: according to the repaired The parent-child relationship of each field in the at least one field group is reorganized, and the repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file.

Optionally, as shown in FIG. 11 , the file repairing apparatus may further include: a first receiving unit 1102 and a first sending unit 1104 .

The first receiving unit 1102 is configured to receive a first request sent by the requesting device, where the first request is used to download the updated vulnerability repair program; the first sending unit 1104 is configured to send the requesting device to the requesting device. The updated vulnerability repair program, wherein the updated vulnerability repair program includes the repair file, so that the requesting device repairs the suspicious file according to the repair file.

It should be noted here that the above-mentioned first receiving unit 1102 and first sending unit 1104 correspond to steps S502 to S504 in Embodiment 1, and the modules and corresponding steps have the same examples and application scenarios, but are not limited to The content disclosed in the first embodiment above. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, as shown in FIG. 12 , the file restoration apparatus may further include: a second receiving unit 1202 and a second sending unit 1204 .

The second receiving unit 1202 is configured to receive a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program; the second sending unit 1204 is configured to Send the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges the updated vulnerability repair program and the requesting device according to the MD5 of the updated vulnerability repair program Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request.

It should be noted here that the above-mentioned second receiving unit 1202 and second sending unit 1204 correspond to steps S602 to S604 in Embodiment 1, and the modules and corresponding steps have the same examples and application scenarios, but are not limited to The content disclosed in the first embodiment above. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, the requesting device judging, according to the MD5 of the updated vulnerability repair program, whether the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device may include: the requesting device obtaining The MD5 of the stored vulnerability repair program; the requesting device determines whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; The MD5 is the same as the MD5 of the stored vulnerability repair program, then it is determined that the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device; if the MD5 of the updated vulnerability repair program is the same as the stored vulnerability repair program. If the MD5 of the stored vulnerability repair program is different, it is determined that the updated vulnerability repair program is different from the vulnerability repair program stored by the requesting device.

According to an embodiment of the present application, an apparatus embodiment for implementing the foregoing method embodiment is also provided. As shown in FIG. 13 , the apparatus includes:

FIG. 13 is a schematic structural diagram of a requesting apparatus according to an embodiment of the present application.

As shown in FIG. 13 , the requesting apparatus may include a third sending unit 1302 and a control unit 1304 .

The third sending unit 1302 is configured to send the suspicious file with the first format to the file repairing device, wherein the file repairing device, according to the grammatical features of each field in the suspicious file, sends the fields with the same grammatical features Form at least one field group, obtain the token sequence feature corresponding to each grammatical feature according to the grammatical feature of each field group, determine the loophole in the at least one field group according to the token sequence feature, and replace the loophole obtaining the repaired at least one field group for a preset repair code sequence, and reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file; the control unit 1304, for acquiring, from the file repairing apparatus, a repaired file in the first format corresponding to the suspicious file.

It should be noted here that the above-mentioned third sending unit 1302 and control unit 1304 correspond to steps S10 to S12 in the first embodiment, and the examples and application scenarios implemented by this module and the corresponding steps are the same, but are not limited to the above-mentioned implementation. Example 1 disclosed content. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment, and may be implemented by software or hardware.

Optionally, the control unit 1304 is configured to perform the following steps to obtain a repaired file in the first format corresponding to the suspicious file from the file repairing device: sending a first request to the file repairing device, the The first request is for downloading the updated vulnerability repair program; and receiving the updated vulnerability repair program returned by the file repairing device, wherein the updated vulnerability repair program includes the repair file.

Optionally, the control unit 1304 is further configured to send a second request to the file repair device, where the second request is used to obtain the identification information of the updated vulnerability repair program; receive the file repair device The returned MD5 of the updated vulnerability repair program; according to the MD5 of the updated vulnerability repair program, determine whether the updated vulnerability repair program is the same as the vulnerability repair program stored in the requesting device, and if the same , the requesting device initiates the first request.

From this, it can be seen that there is a problem in the prior art that the accuracy of vulnerability repair caused by the implementation of the same set of Patch codes is poor. Finding and repairing vulnerabilities corresponding to token sequence features and repair code sequences achieves the purpose of 1:1 automatic repair of vulnerabilities, thereby achieving the technical effect of improving the accuracy of vulnerability repair and system security.

Example 3

Embodiments of the present application also provide a storage medium. Optionally, in this embodiment, the above-mentioned storage medium may be used to store the program code executed by the file repairing method provided in the above-mentioned first embodiment.

Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: obtaining a suspicious file with the first format uploaded by the requesting device; according to the grammatical features of each field in the suspicious file, The fields with the same grammatical feature are formed into at least one field group; according to the grammatical feature of each field group, the token sequence feature corresponding to each grammatical feature is obtained; according to the token sequence feature, the loopholes in the at least one field group are determined ; Replace the vulnerability with a preset repair code sequence, and obtain the repaired at least one field group; reorganize the repaired at least one field group into a file corresponding to the suspicious file with the first format repair file.

Optionally, the storage medium is further configured to store program codes for performing the following steps: extracting meta-information of each suspicious file, wherein the meta-information includes a file path corresponding to the suspicious file and a message digest algorithm MD5, the file The path refers to the path of the suspicious file on the user equipment where the requesting device is located; according to the file path and the MD5, deduplication processing is performed on each suspicious file.

Optionally, the storage medium is further configured to store program codes for performing the following steps: determining repeated suspicious files in each of the suspicious files, wherein the repeated suspicious files refer to the same file paths and the MD5 the same file; keep the first file in the repeated suspicious files, delete the repeated suspicious files except the first file, wherein the first file is in the repeated suspicious files any one of .

Optionally, the storage medium is further configured to store program codes for performing the steps of: searching for a field identical to the token sequence feature in the at least one field group, and comparing the field with the token sequence feature The same fields are identified as the said vulnerability.

Optionally, the storage medium is further configured to store program codes for performing the following steps: according to the parent-child relationship of each field in the repaired at least one field group, the repaired at least one field The group is reorganized into a repair file in the first format corresponding to the suspect file.

Optionally, the storage medium is further configured to store program codes for performing the following steps: receiving a first request sent by the requesting device, where the first request is used to download an updated vulnerability repair program; The device sends the updated vulnerability repair program, wherein the updated vulnerability repair program includes the repair file, so that the requesting device repairs the suspicious file according to the repair file.

Optionally, the storage medium is further configured to store program codes for performing the following steps: receiving a second request sent from the requesting device, where the second request is used to obtain the identifier of the updated vulnerability repair program information; send the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges the updated vulnerability repair program and the Whether the vulnerability repair programs stored by the requesting device are the same, if they are the same, the requesting device initiates the first request.

Optionally, the storage medium is further configured to store program codes for executing the following steps: the requesting device obtains the MD5 of the stored vulnerability repair program; the requesting device judges the updated vulnerability repair program. Whether the MD5 is the same as the MD5 of the stored vulnerability repair program; if the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program, it is determined that the updated vulnerability repair program is the same as the The vulnerability repair program stored by the requesting device is the same; if the MD5 of the updated vulnerability repair program is different from the MD5 of the stored vulnerability repair program, it is determined that the updated vulnerability repair program is the same as the The bugfixes already stored by the requesting device are not the same.

The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus for processing order information may be implemented in other ways. The apparatus embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components may be combined or Integration into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes .

The above are only the preferred embodiments of the present application. It should be pointed out that for those skilled in the art, without departing from the principles of the present application, several improvements and modifications can also be made. It should be regarded as the protection scope of this application.

Claims (21)

1. a file repair method, is characterized in that, comprises: Obtaining suspicious files in the first format uploaded by the requesting device; According to the grammatical feature of each field in the suspicious file, the fields with the same grammatical feature are formed into at least one field group; According to the grammatical feature of each field group, obtain the token sequence feature corresponding to each grammatical feature; determining a vulnerability in the at least one field group according to the token sequence feature; replacing the vulnerability with a preset repair code sequence to obtain the repaired at least one field group; The repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file. 2 . The method according to claim 1 , wherein, when the number of the suspicious files is at least two, after obtaining the suspicious files in the first format uploaded by the requesting device, the The grammatical features of each field in the suspicious file, before the fields with the same grammatical features are formed into at least one field group, the method further includes: Extracting the meta information of each suspicious file, wherein the meta information includes the file path corresponding to the suspicious file and the message digest algorithm MD5, and the file path refers to the path of the suspicious file on the user equipment where the requesting device is located; Perform deduplication processing on each suspicious file according to the file path and the MD5. 3. The method according to claim 2, wherein the performing deduplication processing on each suspicious file according to the file path and the MD5 comprises: Determine the repeated suspicious files in each of the suspicious files, wherein the repeated suspicious files refer to the files with the same file path and the same MD5; The first file in the repeated suspicious files is retained, and the repeated suspicious files other than the first file are deleted, wherein the first file is any one of the repeated suspicious files. 4. The method according to claim 1, wherein the determining the vulnerability in the at least one field group according to the token sequence feature comprises: The at least one field group is searched for a field identical to the token sequence feature, and the field identical to the token sequence feature is determined as the vulnerability. 5. The method according to claim 1, wherein the reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file comprises: According to the parent-child relationship of each field in the repaired at least one field group, the repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file. 6 . The method according to claim 1 , wherein after reorganizing the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file, the Methods also include: receiving a first request sent by the requesting device, where the first request is used to download an updated vulnerability repair program; Sending the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes the repair file, so that the requesting device repairs the suspicious file according to the repair file. 7. The method according to claim 6, wherein before the receiving the first request sent by the requesting device, the method further comprises: receiving a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program; Send the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device judges the updated vulnerability repair program and the requesting device according to the MD5 of the updated vulnerability repair program Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request. 8 . The method according to claim 7 , wherein the requesting device judges the updated vulnerability repair program and the vulnerability repair stored by the requesting device according to the MD5 of the updated vulnerability repair program. 9 . Are the procedures the same including: the requesting device obtains the MD5 of the stored vulnerability repair program; The requesting device determines whether the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program; If the MD5 of the updated vulnerability repair program is the same as the MD5 of the stored vulnerability repair program, it is determined that the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device; If the MD5 of the updated vulnerability repair program is different from the MD5 of the stored vulnerability repair program, it is determined that the updated vulnerability repair program is not the same as the vulnerability repair program stored by the requesting device. 9. A file repair method, characterized in that, comprising: Sending the suspicious file with the first format to the file repairing device, wherein the file repairing device forms at least one field group according to the grammatical features of each field in the suspicious file, according to the grammatical features of each field. The grammatical features of the group are obtained, the token sequence features corresponding to each grammatical feature are obtained, the loopholes in the at least one field group are determined according to the token sequence features, and the loopholes are replaced with a preset repair code sequence to obtain a repair. After the at least one field group, reorganize the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file; A repaired file in the first format corresponding to the suspicious file is obtained from the file repairing device. 10 . The method according to claim 9 , wherein the obtaining, from the file repairing device, the repaired file in the first format corresponding to the suspicious file comprises: 10 . sending a first request to the file repairing device, where the first request is used to download the updated vulnerability repair program; The updated vulnerability repair program returned by the file repair device is received, wherein the updated vulnerability repair program includes the repair file. 11. The method according to claim 10, wherein before sending the first request to the file repairing device, the method further comprises: sending a second request to the file repairing device, where the second request is used to obtain the identification information of the updated vulnerability repair program; receiving the MD5 of the updated vulnerability repair program returned by the file repairing device; According to the MD5 of the updated vulnerability repair program, it is judged whether the updated vulnerability repair program is the same as the vulnerability repair program stored by the requesting device, and if they are the same, the requesting device initiates the first request. 12. A file repairing device, characterized in that, comprising: an obtaining unit, used for obtaining the suspicious file with the first format uploaded by the requesting device; a processing unit, configured to form at least one field group according to the grammatical features of each field in the suspicious file; The first determining unit is used to obtain the token sequence feature corresponding to each grammatical feature according to the grammatical feature of each field group; a second determining unit, configured to determine a vulnerability in the at least one field group according to the token sequence feature; A repair unit, configured to replace the vulnerability with a pre-configured repair code sequence to obtain the repaired at least one field group; A reorganization unit, configured to reorganize the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file. 13. The apparatus of claim 12, further comprising: The extraction unit is used to extract the meta information of each suspicious file, wherein the meta information includes the file path corresponding to the suspicious file and the message digest algorithm MD5, and the file path refers to the user where the suspicious file is located in the requesting device. the path on the device; A deduplication unit, configured to perform deduplication processing on each suspicious file according to the file path and the MD5. 14. The device according to claim 13, wherein the deduplication unit comprises: A determination module, configured to determine repeated suspicious files in each of the suspicious files, wherein the repeated suspicious files refer to files with the same file path and the same MD5; A processing module, configured to retain the first file in the repeated suspicious files, and delete the repeated suspicious files other than the first file, wherein the first file is one of the repeated suspicious files any one of . 15. The apparatus according to claim 12, wherein the first determining unit is configured to perform the following steps to determine the vulnerability in the at least one field group according to the token sequence feature: The at least one field group is searched for a field identical to the token sequence feature, and the field identical to the token sequence feature is determined as the vulnerability. 16. The apparatus according to claim 12, wherein the reorganization unit is configured to perform the following steps to reorganize the repaired at least one field group into a file with the first format corresponding to the suspicious file Repair files: According to the parent-child relationship of each field in the repaired at least one field group, the repaired at least one field group is reorganized into a repaired file in the first format corresponding to the suspicious file. 17. The apparatus of claim 12, further comprising: a first receiving unit, configured to receive a first request sent by the requesting device, where the first request is used to download an updated vulnerability repair program; The first sending unit is configured to send the updated vulnerability repair program to the requesting device, wherein the updated vulnerability repair program includes the repair file, so that the requesting device can pair the repair file according to the repair file. The suspicious files are repaired. 18. The apparatus of claim 17, further comprising: a second receiving unit, configured to receive a second request sent from the requesting device, where the second request is used to obtain the identification information of the updated vulnerability repair program; The second sending unit is configured to send the MD5 of the updated vulnerability repair program to the requesting device, wherein the requesting device determines the updated vulnerability according to the MD5 of the updated vulnerability repair program Whether the repair program is the same as the vulnerability repair program stored by the requesting device, if they are the same, the requesting device initiates the first request. 19. A requesting device, comprising: The third sending unit is configured to send the suspicious file having the first format to the file repairing device, wherein the file repairing device forms at least one field with the same grammatical feature according to the grammatical feature of each field in the suspicious file field group, according to the grammatical feature of each field group, obtain the token sequence feature corresponding to each grammatical feature, determine the loophole in the at least one field group according to the token sequence feature, and replace the loophole with a preset the repair code sequence, obtain the repaired at least one field group, and reorganize the repaired at least one field group into a repaired file with the first format corresponding to the suspicious file; a control unit, configured to obtain a repaired file in the first format corresponding to the suspicious file from the file repairing device. 20. The device according to claim 19, wherein the control unit is configured to perform the following steps to obtain a repaired file in the first format corresponding to the suspicious file from a file repairing device: sending a first request to the file repairing device, where the first request is used to download the updated vulnerability repair program; The updated vulnerability repair program returned by the file repair device is received, wherein the updated vulnerability repair program includes the repair file. 21. The device according to claim 20, wherein the control unit is further configured to send a second request to the file repair device, where the second request is used to obtain the updated vulnerability repair program Receive the MD5 of the updated vulnerability repair program returned by the file repair device; according to the MD5 of the updated vulnerability repair program, determine that the updated vulnerability repair program and the requesting device have been Whether the stored vulnerability repair programs are the same, if they are the same, the requesting device initiates the first request.