WO2017080076A1 - 监控系统分区文件的方法及装置 - Google Patents

监控系统分区文件的方法及装置 Download PDF

Info

Publication number
WO2017080076A1
WO2017080076A1 PCT/CN2015/099251 CN2015099251W WO2017080076A1 WO 2017080076 A1 WO2017080076 A1 WO 2017080076A1 CN 2015099251 W CN2015099251 W CN 2015099251W WO 2017080076 A1 WO2017080076 A1 WO 2017080076A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
input event
system partition
module
deleted
Prior art date
Application number
PCT/CN2015/099251
Other languages
English (en)
French (fr)
Inventor
李明浩
王乐
朱瑞贤
Original Assignee
小米科技有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 小米科技有限责任公司 filed Critical 小米科技有限责任公司
Priority to JP2017549578A priority Critical patent/JP6420916B2/ja
Priority to MX2016003678A priority patent/MX367589B/es
Priority to RU2016109933A priority patent/RU2639898C2/ru
Publication of WO2017080076A1 publication Critical patent/WO2017080076A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/17—Details of further file system functions
    • G06F16/1734—Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1415—Saving, restoring, recovering or retrying at system level
    • G06F11/1433—Saving, restoring, recovering or retrying at system level during software upgrading
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1458—Management of the backup or restore process
    • G06F11/1464—Management of the backup or restore process for networked environments
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3051—Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
    • G06F11/3433—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment for load management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/11—File system administration, e.g. details of archiving or snapshots
    • G06F16/122—File system administration, e.g. details of archiving or snapshots using management policies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
    • G06F16/162—Delete operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1458—Management of the backup or restore process
    • G06F11/1469—Backup restoration techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3013—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
    • G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466—Performance evaluation by tracing or monitoring
    • G06F11/3476—Data logging
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/84—Using snapshots, i.e. a logical point-in-time copy of the data

Definitions

  • the present disclosure relates to a method and apparatus for monitoring system partition files.
  • an intelligent mobile terminal such as an Android system
  • system upgrade requirements For mobile terminals, operating system version upgrades for mobile terminals are typically accomplished using OTA (Over-the-Air) technology.
  • OTA Over-the-Air
  • an upgrade failure error often occurs. This error usually occurs because the files in the system partition of the operating system of these mobile terminals have been accidentally modified or tampered with by third-party software, resulting in incomplete system files, missing or adding new files, etc., so the normal system cannot be performed. upgrade.
  • the present disclosure provides a method and apparatus for monitoring a system partition file.
  • a method of monitoring a system partition file comprising: initiating a monitoring service; creating a listening thread in the monitoring service to monitor whether there is a pair An input event of the target system partition, the input event being an operation on a file in the target system partition; and when the listener thread detects that there is an input event in the target system partition, the input event is recorded into the log file.
  • the monitoring service is started when the system of the mobile terminal is powered on.
  • the input event may include at least one of: creating a file, modifying a file, deleting a file, moving a file.
  • the method may further include: classifying the monitored input events, and performing corresponding security processing on each type of input event.
  • the corresponding security processing for each type of input event may include at least one of: when the intercepted input event is creating a file, deleting the created file; when the monitored input event When modifying the file or moving the file, determining whether the input event meets the preset report condition, if the preset report condition is met, sending a report message; when the input event is detected as modifying the file or deleting the file, before modifying The file or the deleted file is backed up; when the input event is detected as deleting the file, if an access request for the deleted file is received, a file recovery request is sent, and the file recovery request is used to request to send the deleted file. .
  • the method may further include: configuring rights protection on the log file to limit the process of deleting or modifying the log file by a process that is not allowed by the permission.
  • the configuring the privilege protection on the log file may include: configuring SELinux (Security Enhanced Linux) privilege protection on the log file.
  • an apparatus for monitoring a system partition file comprising: a startup module for initiating a monitoring service; and a monitoring module for monitoring A listener thread is created in the service to monitor whether there is an input event to the target system partition, the input event is an operation on a file in the target system partition; and a recording module is configured to monitor the target system partition in the listener thread The input event is logged to a log file when an event is entered.
  • the startup module may start the monitoring service when the system of the mobile terminal is powered on.
  • the input event may include at least one of: creating a file, modifying a file, deleting a file, moving a file.
  • the device may further include: a classification and security processing module, configured to monitor the Input events are categorized and corresponding security processing is performed for each type of input event.
  • a classification and security processing module configured to monitor the Input events are categorized and corresponding security processing is performed for each type of input event.
  • the classification and security processing module may include at least one of deleting a sub-module for deleting the created file when the intercepted input event is creating a file, and reporting a sub-module for When the detected input event is a modified file or a moving file, it is determined whether the input event meets the preset reporting condition, and if the preset reporting condition is met, a report message is sent; the backup sub-module is used to monitor the When the input event is to modify the file or delete the file, the file before the modification or the deleted file is backed up; the file recovery request sub-module is used to receive the access request for the deleted file when the input event is detected as the deleted file. And sending a file recovery request for requesting to send the deleted file.
  • the device may further include: a rights protection module, configured to configure rights protection on the log file, to limit the process of deleting or modifying the log file by a process that is not allowed by the permission.
  • a rights protection module configured to configure rights protection on the log file, to limit the process of deleting or modifying the log file by a process that is not allowed by the permission.
  • the rights protection may be SELinux (Security Enhanced Linux) rights protection.
  • apparatus for monitoring a system partition file comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to: initiate a monitoring service; Creating a listener thread in the monitoring service to monitor whether there is an input event to the target system partition, the input event being an operation on a file in the target system partition; when the listener thread is listening to an input event in the target system partition , the input event is logged to a log file.
  • a non-transitory computer readable storage medium wherein when instructions in the storage medium are executed by a processor of a mobile terminal, enabling the mobile terminal to perform a monitoring system partition file
  • the method includes: starting a monitoring service; creating a listening thread in the monitoring service to monitor whether there is an input event to the target system partition, the input event is an operation on a file in the target system partition; The input event is logged to a log file when an input event is detected in the target system partition.
  • the file in the target system partition is generated by creating a listening thread to monitor the target system partition file. Any input events are logged so that other software can be tampering with the files in the target system partition.
  • the OTA system version is upgraded in the future, it is possible to know which missing, modified, and the like of the files in the target system partition according to the log file, and the repair can be performed in a targeted manner to avoid the problem of the upgrade failure.
  • FIG. 1 is a flow chart showing a method of monitoring a system partition file according to an exemplary embodiment.
  • FIG. 2 is a flow chart showing a method of monitoring a system partition file, according to an exemplary embodiment.
  • FIG. 3 is a flow chart showing a method of monitoring a system partition file according to an exemplary embodiment.
  • FIG. 4 is a block diagram of an apparatus for monitoring a system partition file, according to an exemplary embodiment.
  • FIG. 5 is a block diagram of an apparatus for monitoring a system partition file, according to an exemplary embodiment.
  • FIG. 6 is a block diagram of a classification and security processing module, according to an exemplary embodiment.
  • FIG. 7 is a block diagram of an apparatus for monitoring a system partition file, according to an exemplary embodiment.
  • FIG. 8 is a block diagram of an apparatus for monitoring a system partition file, according to an exemplary embodiment.
  • FIG. 1 is a flowchart of a method for monitoring a system partition file according to an exemplary embodiment.
  • the method is used in a mobile terminal, and includes the following steps: in step S11, starting a monitoring service.
  • step S12 a listening thread is created in the monitoring service to monitor whether there is an input event to the target system partition; in step S13, when there is an input event in the target thread partition in the listening thread, Input events are logged to the log file.
  • step S11 starting a monitoring service.
  • step S12 a listening thread is created in the monitoring service to monitor whether there is an input event to the target system partition
  • step S13 when there is an input event in the target thread partition in the listening thread, Input events are logged to the log file.
  • step S11 the monitoring service is started.
  • the monitoring service is started, so that all changes of the target system partition file can be completely recorded.
  • a listening thread is created in the monitoring service.
  • the FileObserver class can be used to create a listener thread.
  • the FileObserver class is a listener for listening to file access, creation, modification, deletion, movement, etc. It can listen to a single file or folder. If you listen to a folder, all files and cascades in the folder. The directory will be monitored.
  • the created listening thread is used to listen to the target system partition, for example, the folder corresponding to the system partition in the Android system.
  • the input event is an operation on a file in a target system partition, wherein the input event may include, but is not limited to, at least one of: creating a file (CREAT), modifying a file (MODIFY), deleting a file ( DELETE), moving files (MOVE).
  • step S13 when there is an input event in the target system partition in the listening thread, the input event is recorded in a log file, for example, the A file is modified by the XX program into..., B The file is deleted by the XX program and so on. That is, if another program makes the above input event to the file in the target system partition, the listener can listen to and record the above input event. In this way, all changes to the files in the target system partition can be recorded, When the OTA system version is upgraded in the future, it is possible to know which files in the target system partition are missing or modified according to the log file, so that the repair can be performed.
  • FIG. 2 is a flowchart of a method for monitoring a system partition file according to an exemplary embodiment, where steps S11, S12, and S13 are the same as those in FIG. 1.
  • the method of the present disclosure further includes: classifying the monitored input events in step S14, and performing corresponding security processing for each type of input event.
  • the security processing can perform different security processing for different kinds of input events, depending on the risks that may be generated by these input events.
  • Some possible security processes are listed below, but those skilled in the art will appreciate that the manner of security processing is not limited in this respect.
  • the input event does not prevent such operations except for recording it, but it may also have the following security processing:
  • the monitored input event is a modified file or a moving file
  • the preset report condition may be, for example, that the input event is derived from a target program (for example, some malicious tampering program), and the user may be prompted to send a report message or send the report message to the server by the server.
  • a determination is made as to whether the input event needs to be stopped or resumed.
  • the file before the modification or the deleted file is backed up. This is to preserve the original files, in case the files are maliciously deleted or modified, resulting in file defects, system upgrades, and the original files can be found directly in the mobile terminal for system upgrade.
  • the original file may not be retained to avoid excessively retaining a large amount of useless data.
  • the input event is detected as deleting the file
  • a file recovery request is sent, and the file recovery request is used to request to send the deleted file.
  • the file has been deleted, but if the file is needed for system upgrade, an access request for the deleted file will be generated.
  • the mobile terminal can send a file recovery request to the server, and the server can send the deleted file to the mobile terminal again.
  • the system upgrade can be performed smoothly.
  • steps S11, S12, and S13 in the figure are the same as those in FIG. 1.
  • the present disclosure also provides a mechanism, that is, the method further includes: in step S15, configuring the privilege protection on the log file to Restrict the process that is not allowed permission to delete or modify the log file. In this way, even if some processes have root privileges (super administrator privileges), the log files cannot be deleted or modified. For Linux systems, you can use Security Enhanced Linux (SELinux) permissions protection.
  • the process allowed by the permission can be defined by the system.
  • the monitoring thread is the process allowed by the permission.
  • FIG. 4 is a block diagram of a device for monitoring a system partition file, according to an exemplary embodiment.
  • the apparatus includes a startup module 11, a listening module 12, and a recording module 13.
  • the startup module 11 is configured to start a monitoring service. According to an embodiment, the startup module 11 can initiate the monitoring service when the system of the mobile terminal is powered on.
  • the listening module 12 is configured to create a listening thread in the monitoring service to monitor whether there is an input event to the target system partition, and the input event is an operation on a file in the target system partition.
  • the recording module 13 is configured to record the input event into a log file when an interception thread has an input event in the target system partition.
  • the input event may include at least one of creating a file, modifying a file, deleting a file, and moving a file.
  • FIG. 5 is a block diagram of a device for monitoring a system partition file, according to an exemplary embodiment.
  • the apparatus may further include: a classification and security processing module 14 for classifying the monitored input events and performing corresponding security operations for various input events.
  • a classification and security processing module 14 for classifying the monitored input events and performing corresponding security operations for various input events.
  • Reason for classifying the monitored input events and performing corresponding security operations for various input events.
  • the classification and security processing module 14 can include at least one of the following:
  • the deleting sub-module 141 is configured to delete the created file when the intercepted input event is creating a file
  • the report sub-module 142 is configured to: when the monitored input event is a modified file or a moving file, determine whether the input event meets a preset report condition, and if the preset report condition is met, send a report message;
  • the backup sub-module 143 is configured to back up the modified file or the deleted file when the intercepted input event is a modified file or a deleted file;
  • the file recovery request sub-module 144 is configured to: when receiving the input event as deleting the file, if receiving an access request for the deleted file, sending a file recovery request, where the file recovery request is used to request to send the deleted file .
  • the apparatus may further include: a rights protection module 15 configured to configure rights protection on the log file to limit processes that are not allowed by the permission to the log file. Delete or modify.
  • the rights protection can be protected by Security Enhanced Linux (SELinux) permissions.
  • FIG. 8 is a block diagram of an apparatus 100 for monitoring a system partition file, according to an exemplary embodiment.
  • device 100 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a gaming console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.
  • apparatus 100 can include one or more of the following components: processing component 102, memory 104, power component 106, multimedia component 108, audio component 110, input/output (I/O) interface 112, sensor component 114, And a communication component 116.
  • Processing component 102 typically controls the overall operation of device 100, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations.
  • Processing component 102 can include one or more processors 120 to execute instructions to perform all or part of the steps of the above described methods.
  • processing component 102 can include one or more modules to facilitate interaction between component 102 and other components.
  • processing component 102 can include a multimedia module to facilitate interaction between multimedia component 108 and processing component 102.
  • the memory 104 is configured to store various types of data to support operation at the device 100. Examples of such data include instructions for any application or method operating on device 100, contact data, phone book data, messages, pictures, videos, and the like.
  • the memory 104 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Disk Disk or Optical Disk.
  • Power component 106 provides power to various components of device 100.
  • Power component 106 can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for device 100.
  • the multimedia component 108 includes a screen between the device 100 and the user that provides an output interface.
  • the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor may sense not only the boundary of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.
  • the multimedia component 108 includes a front camera and/or a rear camera. When the device 100 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera can receive external multimedia data. Each front and rear camera can be a fixed optical lens system or have focal length and optical zoom capabilities.
  • the audio component 110 is configured to output and/or input an audio signal.
  • the audio component 110 includes a microphone (MIC) that is configured to receive an external audio signal when the device 100 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode.
  • the received audio signal may be further stored in memory 104 or transmitted via communication component 116.
  • audio component 110 also includes a speaker for outputting an audio signal.
  • the I/O interface 112 provides an interface between the processing component 102 and the peripheral interface module, which may be a keyboard, a click wheel, a button, or the like. These buttons may include, but are not limited to, a home button, a volume button, a start button, and a lock button.
  • Sensor assembly 114 includes one or more sensors for providing device 100 with various aspects of status assessment.
  • sensor assembly 114 can detect an open/closed state of device 100, relative positioning of components, such as the display and keypad of device 100, and sensor component 114 can also detect changes in position of device 100 or a component of device 100. The presence or absence of user contact with device 100, device 100 orientation or acceleration/deceleration, and temperature change of device 100.
  • Sensor assembly 114 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • Sensor assembly 114 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor assembly 114 can also include an acceleration sensor, a gyro sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
  • Communication component 116 is configured to facilitate wired or wireless communication between device 100 and other devices.
  • the device 100 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof.
  • communication component 116 receives broadcast signals or broadcast associated information from an external broadcast management system via a broadcast channel.
  • the communication component 116 also includes a near field communication (NFC) module to facilitate short range communication.
  • NFC near field communication
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • device 100 may be implemented by one or more application specific integrated circuits (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronics Component implementation for performing the above method.
  • ASIC application specific integrated circuits
  • DSP digital signal processor
  • DSPD digital signal processing device
  • PLD programmable logic device
  • FPGA field programmable gate array
  • controller microcontroller, microprocessor or other electronics Component implementation for performing the above method.
  • non-transitory computer readable storage medium comprising instructions, such as a memory 104 comprising instructions executable by processor 120 of apparatus 100 to perform the above method.
  • the non-transitory computer readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Quality & Reliability (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Multimedia (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Human Computer Interaction (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Debugging And Monitoring (AREA)
  • Stored Programmes (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

本公开是关于一种监控系统分区文件的方法和装置。所述方法用于移动终端中，所述方法包括：启动监控服务；在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。本公开通过创建一个监听线程对目标系统分区文件进行监听，从而对目标系统分区中文件所发生的任何输入事件予以记录，这样就能够得知其他软件对目标系统分区中的文件进行了怎样的篡改。

Description

监控系统分区文件的方法及装置
本申请基于申请号为201510780666.8、申请日为2015年11月13日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及一种监控系统分区文件的方法及装置。
背景技术
智能移动终端的操作系统，例如安卓(Android)系统，会不断有系统升级的需求。目前，对移动终端的操作系统版本升级通常利用OTA(Over-the-Air，空中下载)技术完成。但是在进行OTA版本升级时，时常会发生升级失败的错误。一般发生这种错误是因为这些移动终端的操作系统的系统分区中的文件曾被意外修改或被第三方软件篡改，导致系统文件不完整、丢失或增加新文件等等，所以无法进行正常的系统升级。
发明内容
为克服相关技术中存在的问题，本公开提供一种监控系统分区文件的方法及装置。
根据本公开实施例的第一方面，提供一种监控系统分区文件的方法，所述方法用于移动终端中，所述方法包括：启动监控服务；在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
可选地，当移动终端的系统开机时，启动所述监控服务。
可选地，所述输入事件可以包括以下中的至少一者：创建文件、修改文件、删除文件、移动文件。
可选地，所述方法还可以包括：对监听到的输入事件进行分类，并针对各类输入事件进行对应的安全处理。
可选地，所述针对各类输入事件进行对应的安全处理，可以包括以下中的至少一者：当监听到的输入事件为创建文件时，对创建的文件进行删除；当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息；当监听到输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份；当监听到输入事件为删除文件时，若接收到对删除的文件的访问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。
可选地，所述方法还可以包括：对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。
可选地，所述对所述日志文件配置权限保护，可以包括：对所述日志文件配置SELinux(安全增强Linux)权限保护。
根据本公开实施例的第二方面，提供一种监控系统分区文件的装置，所述装置用于移动终端中，所述装置包括：启动模块，用于启动监控服务；监听模块，用于在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；记录模块，用于当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
可选地，所述启动模块可以在移动终端的系统开机时启动所述监控服务。
可选地，所述输入事件可以包括以下中的至少一者：创建文件、修改文件、删除文件、移动文件。
可选地，所述装置还可以包括：分类及安全处理模块，用于对监听到的 输入事件进行分类，并针对各类输入事件进行对应的安全处理。
可选地，所述分类及安全处理模块可以包括以下中的至少一者：删除子模块，用于当监听到的输入事件为创建文件时，对创建的文件进行删除；报告子模块，用于当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息；备份子模块，用于当监听到的输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份；文件恢复请求子模块，用于当监听到输入事件为删除文件时，若接收到对删除的文件的访问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。
可选地，所述装置还可以包括：权限保护模块，用于对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。
可选地，所述权限保护可以为SELinux(安全增强Linux)权限保护。
根据本公开实施例的第三方面，提供一种监控系统分区文件的装置，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为：启动监控服务；在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
根据本公开实施例的第四方面，提供一种非临时性计算机可读存储介质，当所述存储介质中的指令由移动终端的处理器执行时，使得移动终端能够执行一种监控系统分区文件的方法，所述方法包括：启动监控服务；在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
本公开的实施例提供的技术方案可以包括以下有益效果：通过创建一个监听线程对目标系统分区文件进行监听，从而对目标系统分区中文件所发生 的任何输入事件予以记录，这样就能够得知其他软件对目标系统分区中的文件进行了怎样的篡改。基于本公开，在日后进行OTA系统版本升级时，可以根据日志文件就能够知晓目标系统分区中的文件存在哪些缺失、修改等等，可以有针对性地进行修复，以避免升级失败的问题。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。
图1是根据一示例性实施例示出的一种监控系统分区文件的方法的流程图。
图2是根据一示例性实施例示出的一种监控系统分区文件的方法的流程图。
图3是根据一示例性实施例示出的一种监控系统分区文件的方法的流程图。
图4是根据一示例性实施例示出的一种监控系统分区文件的装置的框图。
图5是根据一示例性实施例示出的一种监控系统分区文件的装置的框图。
图6是根据一示例性实施例示出的分类及安全处理模块的框图。
图7是根据一示例性实施例示出的一种监控系统分区文件的装置的框图。
图8是根据一示例性实施例示出的一种监控系统分区文件的装置的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所 有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
图1是根据一示例性实施例示出的一种监控系统分区文件的方法的流程图，如图1所示，所述方法用于移动终端中，包括以下步骤：在步骤S11中，启动监控服务；在步骤S12中，在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件；在步骤S13中，当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。下面具体说明以上各步骤。
在步骤S11中，启动监控服务。可选地，当移动终端的系统开机时，启动所述监控服务，这样能够完整地记录目标系统分区文件的所有变动。
在步骤S12中，在监控服务中创建监听线程。例如，对于基于Linux的安卓系统来说，可利用FileObserver类创建监听线程。FileObserver类是一个用于监听文件访问、创建、修改、删除、移动等操作的监听器，能够监听一个单独的文件或者文件夹，如果监听一个文件夹的话，则文件夹下所有文件和级联子目录都会被监听。在本公开中，所创建的监听线程用于监听目标系统分区，例如安卓系统中即为system分区所对应的文件夹。
然后，利用所创建的监听线程监听是否有对目标系统分区的输入事件。例如，对于安卓系统来说，可以利用Linux中的inotify机制来进行监听。
在这里，所述输入事件为对目标系统分区中的文件的操作，其中所述输入事件可以包括但不限于以下中的至少一者：创建文件(CREAT)、修改文件(MODIFY)、删除文件(DELETE)、移动文件(MOVE)。
在步骤S13中，当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中，例如，A文件被XX程序修改成......、B文件被XX程序删除等等。也就是说，如果有其他程序对目标系统分区中的文件进行了上述输入事件，则监听程序都可以监听到并对上述输入事件进行记录。这样，可以对目标系统分区中文件所发生的所有改变留有记录，在 日后进行OTA系统版本升级时，可以根据日志文件知晓目标系统分区中的文件有哪些缺失、修改等，从而可以进行修复。
另外，对于所监听到的输入事件，可选地，本公开对其进行分类处理。图2为根据一示例性实施例示出的一种监控系统分区文件的方法的流程图，图中步骤S11、S12、S13均与图1中相同。除此之外，本公开的方法还包括：在步骤S14中，对监听到的输入事件进行分类，并针对各类输入事件进行对应的安全处理。
其中，所述安全处理对于不同种类的输入事件可以进行不同的安全处理，取决于这些输入事件所可能产生的风险。下面列出了一些可能的安全处理，但是本领域技术人员可以理解，安全处理的方式并不限于此。
对于创建文件(CREAT)这类输入事件，除了对其进行记录之外，还可以对创建的文件进行删除。
对于修改文件(MODIFY)、删除文件(DELETE)、移动文件(MOVE)这几类输入事件，则除了对其进行记录之外，并不阻止这样的操作，但是还可能有如下安全处理：
当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息。所述预置报告条件例如可以为所述输入事件来源于目标程序(例如某些恶意篡改程序)，这时可以对用户进行提示，即发出报告消息，也可以将报告消息发送到服务器，由服务器进行判断是否需要制止或恢复所述输入事件。
当监听到输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份。这是为了保留原始文件，以备如果这些文件被恶意删除或修改而导致文件缺损、无法系统升级，保留了原始文件就可以直接在移动终端内部找寻到这些原始文件用于系统升级。
另外一种情形中，也可以不保留原始文件，以避免过多地保留大量无用数据。这样，当监听到输入事件为删除文件时，若接收到对删除的文件的访 问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。文件已经被删除，但如果系统升级时需要用到该文件，则会产生对删除的文件的访问请求，这时移动终端可以发送文件恢复请求到服务器，服务器可以再次发送所删除的文件给移动终端以进行文件恢复，从而能够顺利地进行系统升级。
如图3所示，为根据一示例性实施例示出的一种监控系统分区文件的方法的流程图，图中步骤S11、S12、S13均与图1中相同。除此之外，为了防止对记录输入事件的日志文件进行篡改或删除，本公开还提供了一种机制，即所述方法还包括：在步骤S15中，对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。这样，即便有些进程取得了root权限(超级管理员权限)，也是无法对日志文件进行删除或修改。对于Linux系统，可以使用安全增强Linux(SELinux)权限保护。
其中权限允许的进程可以由系统定义，例如监控线程即为权限允许的进程。
图4是根据一示例性实施例示出的一种监控系统分区文件的装置框图。参照图4，该装置包括启动模块11、监听模块12和记录模块13。
其中，启动模块11用于启动监控服务。根据一种实施方式，所述启动模块11可以在移动终端的系统开机时启动所述监控服务。
监听模块12，用于在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作。
记录模块13，用于当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。其中所述输入事件可以包括以下中的至少一者：创建文件、修改文件、删除文件、移动文件。
图5是根据一示例性实施例示出的一种监控系统分区文件的装置框图。除图4中示出的结构之外，所述装置还可以包括：分类及安全处理模块14，用于对监听到的输入事件进行分类，并针对各类输入事件进行对应的安全处 理。
根据一种实施方式，如图6所示，为根据一示例性实施例示出的分类及安全处理模块14的框图。所述分类及安全处理模块14可以包括以下中的至少一者：
删除子模块141，用于当监听到的输入事件为创建文件时，对创建的文件进行删除；
报告子模块142，用于当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息；
备份子模块143，用于当监听到的输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份；
文件恢复请求子模块144，用于当监听到输入事件为删除文件时，若接收到对删除的文件的访问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。
此外，根据一种实施方式，如图7所示，所述装置还可以包括：权限保护模块15，用于对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。所述权限保护可以为安全增强Linux(SELinux)权限保护。
关于上述实施例中的装置，其中各个单元或模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图8是根据一示例性实施例示出的一种监控系统分区文件的装置100的框图。例如，装置100可以是移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
参照图5，装置100可以包括以下一个或多个组件：处理组件102，存储器104，电力组件106，多媒体组件108，音频组件110，输入/输出(I/O)的接口112，传感器组件114，以及通信组件116。
处理组件102通常控制装置100的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理组件102可以包括一个或多个处理器120来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件102可以包括一个或多个模块，便于处理组件102和其他组件之间的交互。例如，处理组件102可以包括多媒体模块，以方便多媒体组件108和处理组件102之间的交互。
存储器104被配置为存储各种类型的数据以支持在装置100的操作。这些数据的示例包括用于在装置100上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器104可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电力组件106为装置100的各种组件提供电力。电力组件106可以包括电源管理系统，一个或多个电源，及其他与为装置100生成、管理和分配电力相关联的组件。
多媒体组件108包括在所述装置100和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。所述触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与所述触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件108包括一个前置摄像头和/或后置摄像头。当装置100处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件110被配置为输出和/或输入音频信号。例如，音频组件110包括一个麦克风(MIC)，当装置100处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器104或经由通信组件116发送。在一些实施例中，音频组件110还包括一个扬声器，用于输出音频信号。
I/O接口112为处理组件102和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件114包括一个或多个传感器，用于为装置100提供各个方面的状态评估。例如，传感器组件114可以检测到装置100的打开/关闭状态，组件的相对定位，例如所述组件为装置100的显示器和小键盘，传感器组件114还可以检测装置100或装置100一个组件的位置改变，用户与装置100接触的存在或不存在，装置100方位或加速/减速和装置100的温度变化。传感器组件114可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件114还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件114还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件116被配置为便于装置100和其他设备之间有线或无线方式的通信。装置100可以接入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件116经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，所述通信组件116还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，装置100可以被一个或多个应用专用集成电路 (ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器104，上述指令可由装置100的处理器120执行以完成上述方法。例如，所述非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本领域技术人员在考虑说明书及实践本公开后，将容易想到本公开的其它实施方案。本申请旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (15)

  1. 一种监控系统分区文件的方法，其特征在于，所述方法用于移动终端中，所述方法包括：
    启动监控服务；
    在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；
    当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
  2. 根据权利要求1所述的方法，其特征在于，当移动终端的系统开机时，启动所述监控服务。
  3. 根据权利要求1所述的方法，其特征在于，所述输入事件包括以下中的至少一者：创建文件、修改文件、删除文件、移动文件。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    对监听到的输入事件进行分类，并针对各类输入事件进行对应的安全处理。
  5. 根据权利要求4所述的方法，其特征在于，所述针对各类输入事件进行对应的安全处理，包括以下中的至少一者：
    当监听到的输入事件为创建文件时，对创建的文件进行删除；
    当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息；
    当监听到输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份；
    当监听到输入事件为删除文件时，若接收到对删除的文件的访问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。
  6. 根据权利要求1-5中任一项权利要求所述的方法，其特征在于，所述方法还包括：
    对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。
  7. 根据权利要求6所述的方法，其特征在于，所述对所述日志文件配置权限保护，包括：
    对所述日志文件配置SELinux安全增强Linux权限保护。
  8. 一种监控系统分区文件的装置，其特征在于，所述装置用于移动终端中，所述装置包括：
    启动模块，用于启动监控服务；
    监听模块，用于在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；
    记录模块，用于当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
  9. 根据权利要求8所述的装置，其特征在于，所述启动模块在移动终端的系统开机时启动所述监控服务。
  10. 根据权利要求8所述的装置，其特征在于，所述输入事件包括以下中的至少一者：创建文件、修改文件、删除文件、移动文件。
  11. 根据权利要求10所述的装置，其特征在于，所述装置还包括：
    分类及安全处理模块，用于对监听到的输入事件进行分类，并针对各类输入事件进行对应的安全处理。
  12. 根据权利要求11所述的装置，其特征在于，所述分类及安全处理模块包括以下中的至少一者：
    删除子模块，用于当监听到的输入事件为创建文件时，对创建的文件进行删除；
    报告子模块，用于当监听到的输入事件为修改文件或移动文件时，判断所述输入事件是否符合预置报告条件，若满足所述预置报告条件，则发送报告消息；
    备份子模块，用于当监听到的输入事件为修改文件或删除文件时，对修改前的文件或删除的文件进行备份；
    文件恢复请求子模块，用于当监听到输入事件为删除文件时，若接收到对删除的文件的访问请求，则发送文件恢复请求，所述文件恢复请求用于请求发送所述删除的文件。
  13. 根据权利要求8-12中任一项权利要求所述的装置，其特征在于，所述装置还包括：
    权限保护模块，用于对所述日志文件配置权限保护，以限制未得到权限允许的进程对所述日志文件进行删除或修改。
  14. 根据权利要求13所述的装置，其特征在于，所述权限保护为SELinux安全增强Linux权限保护。
  15. 一种监控系统分区文件的装置，其特征在于，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被配置为：
    启动监控服务；
    在监控服务中创建监听线程以监听是否有对目标系统分区的输入事件，所述输入事件为对目标系统分区中的文件的操作；
    当监听线程中监听到所述目标系统分区中有输入事件时，将所述输入事件记录到日志文件中。
PCT/CN2015/099251 2015-11-13 2015-12-28 监控系统分区文件的方法及装置 WO2017080076A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2017549578A JP6420916B2 (ja) 2015-11-13 2015-12-28 システムパーティションファイルを監視する方法及び装置
MX2016003678A MX367589B (es) 2015-11-13 2015-12-28 Método y dispositivo para monitorear un archivo en la partición del sistema.
RU2016109933A RU2639898C2 (ru) 2015-11-13 2015-12-28 Способ и устройство для мониторинга файла в системном разделе

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510780666.8A CN105389507B (zh) 2015-11-13 2015-11-13 监控系统分区文件的方法及装置
CN201510780666.8 2015-11-13

Publications (1)

Publication Number Publication Date
WO2017080076A1 true WO2017080076A1 (zh) 2017-05-18

Family

ID=55421783

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/099251 WO2017080076A1 (zh) 2015-11-13 2015-12-28 监控系统分区文件的方法及装置

Country Status (7)

Country Link
US (1) US20170139944A1 (zh)
EP (1) EP3168747B1 (zh)
JP (1) JP6420916B2 (zh)
CN (1) CN105389507B (zh)
MX (1) MX367589B (zh)
RU (1) RU2639898C2 (zh)
WO (1) WO2017080076A1 (zh)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105868278B (zh) * 2016-03-22 2019-07-05 青岛海信移动通信技术股份有限公司 一种融合通信中的表情包的管理方法和装置
CN107634968A (zh) * 2017-10-19 2018-01-26 杭州安恒信息技术有限公司 基于Rsync的篡改恢复方法及系统
CN109002547B (zh) * 2018-07-30 2023-09-01 努比亚技术有限公司 日志文件存储方法、移动终端及计算机可读存储介质
CN109408473A (zh) * 2018-10-30 2019-03-01 深圳市理奥网络技术有限公司 一种防止文件误删的方法、装置、设备以及存储介质
CN110457192A (zh) * 2019-07-24 2019-11-15 北京小米移动软件有限公司 一种文件监控方法及装置、终端、存储介质
CN112306668A (zh) * 2019-07-31 2021-02-02 腾讯科技（深圳）有限公司 对象回收事件监听方法、装置和计算机可读存储介质
CN112015593B (zh) * 2020-08-27 2022-06-07 北京浪潮数据技术有限公司 Kubernetes集群的容灾备份方法及相关组件
CN113778703A (zh) * 2021-01-21 2021-12-10 北京沃东天骏信息技术有限公司 一种事件监听方法、相关装置和事件监听系统
CN113176978B (zh) * 2021-04-30 2023-07-21 平安壹钱包电子商务有限公司 基于日志文件的监控方法、系统、设备及可读存储介质
CN113553090B (zh) * 2021-07-26 2023-07-25 网易（杭州）网络有限公司 客户端应用程序的更新控制方法及装置
CN114661669A (zh) * 2022-04-06 2022-06-24 中信百信银行股份有限公司 文件处理方法、装置、电子设备和存储介质
CN116094900A (zh) * 2023-01-31 2023-05-09 渔翁信息技术股份有限公司 一种存储设备监控方法、装置、设备及存储介质
CN117742783B (zh) * 2024-02-19 2024-06-07 成都九洲电子信息系统股份有限公司 用于软件系统的日志数据跨语言自动记录方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7472420B1 (en) * 2008-04-23 2008-12-30 Kaspersky Lab, Zao Method and system for detection of previously unknown malware components
EP2584484A1 (en) * 2011-10-17 2013-04-24 Kaspersky Lab Zao System and method for protecting a computer system from the activity of malicious objects
CN103530559A (zh) * 2013-09-27 2014-01-22 北京理工大学 一种Android系统的完整性保护系统
CN104217174A (zh) * 2014-09-05 2014-12-17 四川长虹电器股份有限公司 分布式文件安全存储系统及其存储方法

Family Cites Families (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH10283241A (ja) * 1997-04-08 1998-10-23 Meidensha Corp 監視システムのメンテナンス方式
US7506257B1 (en) * 1999-06-30 2009-03-17 Microsoft Corporation System and method for providing help contents for components of a computer system
JP4733323B2 (ja) * 2001-09-17 2011-07-27 株式会社アール・アイ データ一括保護システム
JP4766826B2 (ja) * 2003-06-19 2011-09-07 アルパイン株式会社 データの復元装置および方法
JP4064914B2 (ja) * 2003-12-02 2008-03-19 インターナショナル・ビジネス・マシーンズ・コーポレーション 情報処理装置、サーバ装置、情報処理装置のための方法、サーバ装置のための方法および装置実行可能なプログラム
JP2007280096A (ja) * 2006-04-07 2007-10-25 Hitachi Ltd ログ保全方法、プログラムおよびシステム
JP2009205673A (ja) * 2008-02-01 2009-09-10 Canon Electronics Inc 記憶装置、情報処理装置、端末装置およびコンピュータプログラム
US20100070776A1 (en) * 2008-09-17 2010-03-18 Shankar Raman Logging system events
JP5396314B2 (ja) * 2010-03-10 2014-01-22 株式会社日立製作所 不正操作検知システム及び不正操作検知方法
US20120167218A1 (en) * 2010-12-23 2012-06-28 Rajesh Poornachandran Signature-independent, system behavior-based malware detection
RU2468427C1 (ru) * 2011-07-21 2012-11-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ защиты компьютерной системы от активности вредоносных объектов
CN102968486B (zh) * 2012-11-26 2016-09-07 国电南瑞科技股份有限公司 一种基于变化日志的高可靠文件同步方法
US9298916B2 (en) * 2012-12-10 2016-03-29 Lookout, Inc. Method and apparatus for enhanced file system monitoring on mobile communications devices
CN103902893A (zh) * 2012-12-24 2014-07-02 珠海市君天电子科技有限公司 一种监控Android程序行为的方法及系统
US9967284B2 (en) * 2012-12-31 2018-05-08 British Telecommunications Public Limited Company Processing device and method of operation thereof
CN103198255B (zh) * 2013-04-03 2015-06-24 武汉大学 一种Android软件敏感行为监控与拦截方法及系统
CN103268448B (zh) * 2013-05-24 2016-04-20 北京网秦天下科技有限公司 动态检测移动应用的安全性的方法和系统
CN103679028A (zh) * 2013-12-06 2014-03-26 深圳酷派技术有限公司 软件行为监控方法和终端
CN104915220B (zh) * 2014-03-13 2019-08-16 中国移动通信集团安徽有限公司 一种客户端应用程序的升级方法和系统、客户端
RU148692U1 (ru) * 2014-07-22 2014-12-10 Федеральное государственное казенное военное образовательное учреждение высшего профессионального образования "ВОЕННАЯ АКАДЕМИЯ СВЯЗИ имени Маршала Советского Союза С.М. Буденного" Министерства обороны Российской Федерации Система мониторинга событий компьютерной безопасности
CN104504326A (zh) * 2014-12-05 2015-04-08 深圳天珑无线科技有限公司 一种检查系统文件完整性的方法
CN204740592U (zh) * 2015-07-21 2015-11-04 常州轻工职业技术学院 一种计算机数据监控系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7472420B1 (en) * 2008-04-23 2008-12-30 Kaspersky Lab, Zao Method and system for detection of previously unknown malware components
EP2584484A1 (en) * 2011-10-17 2013-04-24 Kaspersky Lab Zao System and method for protecting a computer system from the activity of malicious objects
CN103530559A (zh) * 2013-09-27 2014-01-22 北京理工大学 一种Android系统的完整性保护系统
CN104217174A (zh) * 2014-09-05 2014-12-17 四川长虹电器股份有限公司 分布式文件安全存储系统及其存储方法

Also Published As

Publication number Publication date
CN105389507A (zh) 2016-03-09
EP3168747B1 (en) 2018-06-06
JP6420916B2 (ja) 2018-11-07
CN105389507B (zh) 2018-12-25
EP3168747A1 (en) 2017-05-17
MX2016003678A (es) 2018-06-22
MX367589B (es) 2019-08-28
RU2639898C2 (ru) 2017-12-25
RU2016109933A (ru) 2017-10-04
US20170139944A1 (en) 2017-05-18
JP2018506809A (ja) 2018-03-08

Similar Documents

Publication Publication Date Title
WO2017080076A1 (zh) 监控系统分区文件的方法及装置
WO2016173245A1 (zh) 权限管理方法和装置
KR101723556B1 (ko) 스마트 장면 삭제방법, 장치, 프로그램 및 기록매체
WO2017113660A1 (zh) 应用程序管理方法及装置
WO2016206293A1 (zh) 运营商网络的接入方法和装置
WO2016090822A1 (zh) 对固件进行升级的方法及装置
WO2017128718A1 (zh) 获取终端信息的方法及装置
CN104376273A (zh) 一种数据访问控制方法和装置
EP2985979B1 (en) Method and terminal for backing up data
CN106598488A (zh) 分布式数据读取方法及装置
CN105100074A (zh) 数据操作处理方法、装置以及终端设备
WO2018072193A1 (zh) 控制应用自启动的方法及装置
WO2018049610A1 (zh) 权限控制方法及装置
WO2018049609A1 (zh) 权限控制方法及装置
CN112784262A (zh) 数据访问方法、装置、终端及存储介质
CN105677513A (zh) 恢复备份数据的方法及装置
RU2632396C2 (ru) Способ и устройство для управления подключаемым модулем маршрутизатора
CN107733674B (zh) 组件升级方法及终端
CN112163192A (zh) root权限获取方法、装置、介质和电子设备
WO2017201692A1 (zh) 应用加密方法及装置
US9674768B2 (en) Method and device for accessing wireless network
WO2018049611A1 (zh) 权限控制方法及装置
CN108647285B (zh) 分布式文件系统中重命名方法、装置及分布式文件系统
CN105824513A (zh) 消息处理方法及装置
WO2018058598A1 (zh) 异常信息提示方法及装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2017549578

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: MX/A/2016/003678

Country of ref document: MX

ENP Entry into the national phase

Ref document number: 2016109933

Country of ref document: RU

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15908206

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15908206

Country of ref document: EP

Kind code of ref document: A1