WO2024082375A1 - 一种基于区块链的网页防篡改监控方法、系统及存储介质 - Google Patents

一种基于区块链的网页防篡改监控方法、系统及存储介质 Download PDF

Info

Publication number
WO2024082375A1
WO2024082375A1 PCT/CN2022/134012 CN2022134012W WO2024082375A1 WO 2024082375 A1 WO2024082375 A1 WO 2024082375A1 CN 2022134012 W CN2022134012 W CN 2022134012W WO 2024082375 A1 WO2024082375 A1 WO 2024082375A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
protected
blockchain
module
inconsistent
Prior art date
Application number
PCT/CN2022/134012
Other languages
English (en)
French (fr)
Inventor
冯淞耀
粟邈如
贺冠博
黄安妮
蒙琦
宋骏豪
艾洲
孟椿智
Original Assignee
广西电网有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广西电网有限责任公司 filed Critical 广西电网有限责任公司
Publication of WO2024082375A1 publication Critical patent/WO2024082375A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the present invention relates to the field of computer security, and in particular to a blockchain-based web page tamper-proof monitoring method, system and storage medium.
  • the website system represents the facade of enterprises and institutions, and malicious tampering may damage the image of the unit.
  • the website system of a government department is tampered with and reactionary information or hidden links are implanted, it will cause a major security incident.
  • ordinary users who visit the tampered pages will obtain incorrect information or even the website will be implanted with malicious code, resulting in the leakage of sensitive information.
  • Web page polling technology refers to the use of a web page detection program to read the web page files to be protected in turn through polling, and compare the web page to be protected with the web page in the initialization state. If a difference is found between the two, it is determined that the web page has been tampered with, otherwise the web page has not been tampered with.
  • the core embedded technology uses the module of the Web server to detect each web page requested by the user when the data flows out. If a difference is found with the web page in the initialization state, it is determined that the web page has been tampered with and the user request is terminated immediately.
  • Event triggering technology uses the functions provided by the operating system to dynamically detect the functions called by the current program, such as file creation functions, file modification functions, etc.
  • the program detects that the set function or action is executed, a warning message pops up and the relevant operation is terminated.
  • the three types of web page anti-tampering methods mentioned above can better protect web page files, but there are also some shortcomings.
  • the initialization web page backed up during initialization may be tampered with, resulting in the inability to successfully detect the tampered files.
  • the core embedded technology needs to rely on the structure provided by the web server software, which has poor applicability and has a great impact on system performance.
  • the event trigger mechanism is easy to be bypassed. When an illegal attacker invades the system through a system vulnerability or a web software vulnerability, the mechanism may not be triggered, resulting in missed reports.
  • the current web anti-tampering methods mainly have problems such as high missed report rate and poor compatibility.
  • the present invention provides a blockchain-based web page anti-tampering monitoring method, system and storage medium, which are used to solve the problems of high false negative rate and poor compatibility.
  • a webpage anti-tampering monitoring method based on blockchain includes the following steps:
  • S3 Collect data information of the file to be protected according to system operation parameters
  • S6 Collect data information of the file to be protected according to the system operation parameters, and compare it with the data information of the file to be protected in the storage file formed in steps S4 and S5; if the comparison is inconsistent, enter S7; if the comparison is consistent, repeat this step;
  • step S7 When mismatched information is detected, the system administrator is notified and the process returns to step S3.
  • system operation parameters include the path to be protected, the inspection frequency, the monitoring file suffix, the system selection and the alarm mode.
  • the to-be-protected file data information includes an absolute path and a corresponding digital digest.
  • the data information of the file to be protected is collected according to the system operation parameters, and compared with the data information of the file to be protected in the storage file formed in steps S4 and S5, including the following steps:
  • step S4 Compare the total number of absolute paths in the local storage file and the blockchain platform storage file in step S4 with the number collected in the above steps; if the three are consistent, the number of files has not been tampered with; if they are inconsistent, it means that the file has been deleted or newly created, and proceed to step S7;
  • step S4 Compare the digital summary values of each absolute path in the local storage file and the blockchain platform storage file in step S4 with the ones collected in the above steps; if the three are consistent, the file content has not been tampered with; if they are inconsistent, it means that the file content has been tampered with, and proceed to step S7;
  • step S4 The local storage file of step S4 is compared with the storage file of the blockchain platform; if the two are consistent, the file has not been tampered with; if they are inconsistent, it indicates that an illegal intruder has tampered with the local storage file, and the process goes to step S7.
  • notifying the system administrator includes the following steps:
  • step S4 When the local storage file in step S4 is inconsistent with the storage file of the blockchain platform, the administrator is notified that the storage file content is abnormal.
  • a webpage anti-tampering monitoring system based on blockchain comprising:
  • a system initialization module which is used to start the monitoring program and complete the system working status verification work
  • a system configuration module which is used to configure system operation parameters
  • An information collection module which is used to collect data information of the file to be protected according to the system operation parameters
  • An information storage module which is used to store the data information of the file to be protected to form a storage file
  • a blockchain operation module which is used to upload the stored files to the blockchain platform
  • An information comparison module which is used to collect data information of the file to be protected according to the system operation parameters, and compare it with the data information of the file to be protected in the storage file formed in the information storage module and the blockchain operation module; if the comparison is inconsistent, enter the system notification module, if the comparison is consistent, repeat the operation of this module;
  • a system notification module is used to notify the system administrator when mismatched information is detected, and return to the information collection module for execution.
  • a log module is used to record system logs. For example, after the program comparison is completed, the comparison results can be stored in a log.
  • the log format is: a combination of time and event.
  • system operation parameters include the path to be protected, the inspection frequency, the monitoring file suffix, the system selection and the alarm mode; the file data information to be protected includes the absolute path and the corresponding digital summary.
  • the information comparison module includes:
  • a collection unit which is used to recursively collect the absolute paths of all files to be protected, count the number of all collected absolute paths and calculate the digital summary value of each absolute path;
  • the first comparison unit is used to compare the total number of absolute paths in the local storage file of the information storage module and the blockchain platform storage file with the number collected by the collection unit; if the three are consistent, the number of files has not been tampered with; if they are inconsistent, it means that the file has been deleted or newly created, and the system notification module is entered;
  • the second comparison unit is used to compare the digital summary value of each absolute path in the local storage file of the information storage module and the blockchain platform storage file with the digital summary value collected by the collection unit; if the three are consistent, the file content has not been tampered with; if they are inconsistent, it means that the file content has been tampered with, and the system notification module is entered;
  • the third comparison unit is used to compare the local storage file of the information storage module with the storage file of the blockchain platform; if the two are consistent, the file has not been tampered with; if they are inconsistent, it indicates that an illegal intruder has tampered with the local storage file, and enters the system notification module;
  • the system notification module includes:
  • the first notification unit is used to notify the administrator of an abnormal number of files in the protected folder when all absolute path numbers are inconsistent, and to notify the three parties of the number of files monitored;
  • the second notification unit is used to notify the administrator of abnormal file content in the protected folder when the digital summary values of the absolute paths are inconsistent, and to notify the three parties of the absolute paths and digital summaries of the files monitored, and indicate the inconsistent contents;
  • the third notification unit is used to notify the administrator that the storage file content is abnormal when the local storage file in step S4 is inconsistent with the storage file of the blockchain platform.
  • a blockchain-based webpage anti-tampering monitoring system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.
  • a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above are implemented.
  • the present invention provides a webpage anti-tampering monitoring method based on blockchain, comprising the following steps: S1: starting a monitoring program to complete the system working status verification work; S2: configuring the system operation parameters; S3: collecting data information of a file to be protected according to the system operation parameters; S4: storing the data information of the file to be protected to form a storage file; S5: uploading the storage file to a blockchain platform; S6: collecting data information of the file to be protected according to the system operation parameters, and comparing it with the data information of the file to be protected in the storage file formed in steps S4 and S5; if the comparison is inconsistent, entering S7, if the comparison is consistent, repeating this step; S7: when mismatching information is detected, notifying the system administrator, and returning to execute step S3.
  • the problem of difficulty in detecting web page tampering is alleviated through personalized configuration and polling mechanism for the system.
  • the previous methods have the problem of underreporting.
  • the method and system of the present invention effectively overcome the problem of underreporting by matching local files with blockchain files.
  • the solution of the present invention has the characteristics of fast comparison speed and less resource occupation.
  • FIG1 is a flow chart of a webpage anti-tampering monitoring method based on blockchain
  • Figure 2 is a schematic diagram of the structure of a web page anti-tampering monitoring system based on blockchain.
  • a flowchart of a method for monitoring webpage tamper-proofing based on blockchain includes the following steps:
  • S3 Collect data information of the file to be protected according to system operation parameters
  • S6 Collect data information of the file to be protected according to the system operation parameters, and compare it with the data information of the file to be protected in the storage file formed in steps S4 and S5; if the comparison is inconsistent, enter S7; if the comparison is consistent, repeat this step;
  • step S7 When mismatched information is detected, the system administrator is notified and the process returns to step S3.
  • system operation parameters include the path to be protected, the inspection frequency, the monitoring file suffix, the system selection and the alarm mode.
  • the to-be-protected file data information includes an absolute path and a corresponding digital digest.
  • the data information of the file to be protected is collected according to the system operation parameters, and compared with the data information of the file to be protected in the storage file formed in steps S4 and S5, including the following steps:
  • step S4 Compare the total number of absolute paths in the local storage file and the blockchain platform storage file in step S4 with the number collected in the above steps; if the three are consistent, the number of files has not been tampered with; if they are inconsistent, it means that the file has been deleted or newly created, and proceed to step S7;
  • step S4 Compare the digital summary values of each absolute path in the local storage file and the blockchain platform storage file in step S4 with the ones collected in the above steps; if the three are consistent, the file content has not been tampered with; if they are inconsistent, it means that the file content has been tampered with, and proceed to step S7;
  • step S4 The local storage file of step S4 is compared with the storage file of the blockchain platform; if the two are consistent, the file has not been tampered with; if they are inconsistent, it indicates that an illegal intruder has tampered with the local storage file, and the process goes to step S7.
  • notifying the system administrator includes the following steps:
  • step S4 When the local storage file in step S4 is inconsistent with the storage file of the blockchain platform, the administrator is notified that the storage file content is abnormal.
  • a blockchain-based webpage anti-tampering monitoring system includes:
  • a system initialization module which is used to start the monitoring program and complete the system working status verification work
  • a system configuration module which is used to configure system operation parameters
  • An information collection module which is used to collect data information of the file to be protected according to the system operation parameters
  • An information storage module which is used to store the data information of the file to be protected to form a storage file
  • a blockchain operation module which is used to upload the stored files to the blockchain platform
  • An information comparison module which is used to collect data information of the file to be protected according to the system operation parameters, and compare it with the data information of the file to be protected in the storage file formed in the information storage module and the blockchain operation module; if the comparison is inconsistent, enter the system notification module, if the comparison is consistent, repeat the operation of this module;
  • a system notification module is used to notify the system administrator when mismatched information is detected, and return to the information collection module for execution.
  • a log module is used to record system logs. For example, after the program comparison is completed, the comparison results can be stored in a log.
  • the log format is: a combination of time and event.
  • system operation parameters include the path to be protected, the inspection frequency, the monitoring file suffix, the system selection and the alarm mode; the file data information to be protected includes the absolute path and the corresponding digital summary.
  • the information comparison module includes:
  • a collection unit which is used to recursively collect the absolute paths of all files to be protected, count the number of all collected absolute paths and calculate the digital summary value of each absolute path;
  • the first comparison unit is used to compare the total number of absolute paths in the local storage file of the information storage module and the blockchain platform storage file with the number collected by the collection unit; if the three are consistent, the number of files has not been tampered with; if they are inconsistent, it means that the file has been deleted or newly created, and the system notification module is entered;
  • the second comparison unit is used to compare the digital summary value of each absolute path in the local storage file of the information storage module and the blockchain platform storage file with the digital summary value collected by the collection unit; if the three are consistent, the file content has not been tampered with; if they are inconsistent, it means that the file content has been tampered with, and the system notification module is entered;
  • the third comparison unit is used to compare the local storage file of the information storage module with the storage file of the blockchain platform; if the two are consistent, the file has not been tampered with; if they are inconsistent, it indicates that an illegal intruder has tampered with the local storage file, and enters the system notification module;
  • the system notification module includes:
  • the first notification unit is used to notify the administrator of an abnormal number of files in the protected folder when all absolute path numbers are inconsistent, and to notify the three parties of the number of files monitored;
  • the second notification unit is used to notify the administrator of abnormal file content in the protected folder when the digital summary values of the absolute paths are inconsistent, and to notify the three parties of the absolute paths and digital summaries of the files monitored, and indicate the inconsistent contents;
  • the third notification unit is used to notify the administrator that the storage file content is abnormal when the local storage file in step S4 is inconsistent with the storage file of the blockchain platform.
  • a webpage anti-tampering monitoring system based on blockchain includes the following modules:
  • System initialization module information collection module, information comparison module, information storage module, blockchain operation module, system configuration module, system notification module, and log module.
  • the system module diagram is shown in Figure 2.
  • Initialization module When the system is deployed and run for the first time, the initialization configuration of the system is completed through the system initialization module. This includes configuring the default directory check frequency, default web protection path, default alarm method, default working system, and default monitoring file suffix.
  • the default target check frequency is every 5 minutes
  • the default web protection path is the default www path of the Apache server
  • the default alarm method is the web background system reminder method
  • the default working system is the Linux platform
  • the default monitored file suffixes are jsp, asp, aspx, and php.
  • This module collects the absolute paths of the files to be protected and calculates the complete digital summary value of each path.
  • This module is used to compare the initialization file digital summary value with the latest collected file digital summary value. If the comparison is successful, it can return success; if the comparison fails, it returns failure.
  • Information storage module used for storage operations of digital summary information and file path information.
  • Blockchain operation module connects with the blockchain platform of China Southern Power Grid (full name: China Southern Power Grid) to complete the operations of uploading data to the blockchain platform and downloading data from the blockchain platform.
  • System configuration module used to configure system parameters, including the path to be protected, directory check frequency, alarm mode, working platform, and monitoring file suffix.
  • System notification module configure the notification method used when the system finds an abnormality.
  • the default method is the web backend system method.
  • Log module used to record system logs. For example, after the program comparison is completed, the comparison results can be stored in a log.
  • the log format is: a combination of time and event.
  • System general scheduling module coordinates the operation of each module of the system. For example: regularly calls the information collection module to collect path information and complete data comparison and alarm tasks.
  • FIG1 is a flow chart of a method for monitoring webpage tamper-proofing based on blockchain, which includes the following steps:
  • Step (1) Start the monitoring program and complete the system working status verification.
  • Step (1-1) First, start the monitoring program to collect the information of the file to be protected, calculate the digital summary, and perform blockchain operations and comparisons.
  • the preferred background program uses tomcat middleware and listens on port 8081.
  • the preferred default parameters are: the default target inspection frequency is every 5 minutes, the default web protection path is: "/var/www/html", the default alarm method is the web background system reminder method, the default working system is the Linux platform, and the default monitored file suffixes are jsp, asp, aspx and php.
  • Step (2) After step (1) is successfully completed, the system runs with default parameters.
  • the default parameters are only used for program deployment testing and are not very applicable.
  • the system operation parameters need to be configured according to the user environment.
  • Step (2-3) configures the inspection frequency, and the inspection frequency can be selected from the interval of a few minutes to the interval of a few hours.
  • the preferred inspection frequency is once every 5 minutes.
  • Step (2-4) Alarm mode configuration the alarm modes include system background alarm mode and email mode. Since the application scenarios of this invention are mostly intranet, the preferred alarm mode is web system notification mode.
  • Step (2-5) The optional working platforms of the system are Linux platform and Windows platform. This parameter is selected according to the monitoring program deployment system.
  • Step (2-6) monitors the file extension configuration.
  • This parameter determines which file extension the system monitors.
  • the web system written in Java is set to jsp, java, and class.
  • the web system written in PHP is set to php, php3, php4, php5, pht, phtml, and phps.
  • the web system written in Asp and Aspx is set to asp and aspx.
  • the monitoring system monitors htaccess, conf, and xml files.
  • Step (3) Based on the configurations completed in steps (1) and (2), the system has configured the optimal parameters. The system will collect the information of the files to be protected through the information collection module.
  • Step (3-1) Recursively collect the absolute paths of all files to be protected according to the file paths to be protected configured in step (2-2).
  • the algorithm for calculating the digital summary is the md5 algorithm.
  • Step (4) Store the absolute path information and corresponding digital summary information collected in step (3).
  • Step (4-1) Store all the absolute path quantities calculated in step (3-2).
  • the preferred storage method is file storage, and the storage file name rule is "name of the folder to be protected_file_amount.txt", and the stored content is: folder name, total number of files.
  • Step (4-2) Store the digital summary values of each absolute path calculated in step (3-2).
  • the preferred storage method is file storage
  • the storage file name rule is "name of the folder to be protected_file_list.txt”
  • the stored content is: the absolute path of the file and the digital summary of the file.
  • Step (5) Upload the two files "Folder name to be protected_file_amount.txt” and "Folder name to be protected_file_list.txt” generated in step (4) to the blockchain platform.
  • Step (5-1) Connect to the China Southern Power Grid blockchain platform, and the system verifies whether the connection is successful.
  • the file upload operation uses the Southern Power Grid blockchain platform SDK.
  • Step (6) After completing steps (1)-(5), the system enters the monitoring state.
  • the system general scheduling module runs step (3) according to the detection frequency configured in step (2-3) and the monitoring file suffix configured in step (2-6), collects the data information to be protected and compares it.
  • Step (6-1) recursively collect the absolute paths of all files to be protected, count the number of all collected absolute paths and calculate the digital summary value of each absolute path.
  • Step (6-5) If the local "file list.txt" read in step (6-2) and step (6-3) is inconsistent with the "file list.txt" stored in the blockchain platform, it indicates that the illegal intruder has tampered with the local "file list.txt". The system enters step (7-4).
  • Step (7) When mismatched information is detected in step (6), the system administrator needs to be notified through the system notification module according to various specific circumstances.
  • the preferred notification method is the system background reminder method.
  • Step (7-1) When the comparison in step (6-2) is inconsistent, the system informs the administrator of the abnormal number of files in the folder to be protected, and at the same time informs the local "folder name to be protected_file_amount.txt" file, the blockchain platform "folder name to be protected_file_amount.txt” file and the number of files monitored in step (6-1).
  • Step (7-2) When the comparison in step (6-3) is inconsistent, the system informs the administrator that the file content of the folder to be protected is abnormal, and at the same time informs the local "folder name to be protected_file_list.txt” file, the blockchain platform "folder name to be protected_file_list.txt” file, and the absolute path and digital summary of each file monitored in step (6-1), and indicates the inconsistent content.
  • Step (7-3) When the comparison in step (6-4) is inconsistent, the system informs the administrator that the content of the local "folder name to be protected_file_amount.txt" file is inconsistent with the content of the blockchain platform "folder name to be protected_file_amount.txt".
  • Step (7-4) When the comparison in step (6-5) is inconsistent, the system informs the administrator that the content of the local "Folder name to be protected_file_list.txt" file is inconsistent with the content of the blockchain platform "Folder name to be protected_file_list.txt".
  • Step (8) If the system information matches in step (6) are all consistent, the system general scheduling module will loop through step (6) according to the detection frequency configured in step (2-3) and the monitoring file suffix configured in step (2-6).
  • step (3) If the system information in step (6) does not match, then after executing step (7), execute step (3), step (4), step (5) and step (6) in sequence.
  • Step (8-1) If the system information in step (6) matches, it means that the system has not been tampered with, and there is no need to perform the system alarm in step (7).
  • the system cyclically runs step (6) according to the configuration parameters of steps (2-3) and step (2-6) to monitor the folder to be protected.
  • Step (8-2) If there is a mismatch in step (6), it indicates that the system has been tampered with, and the system administrator is notified according to step (7). After the system administrator completes the corresponding investigation and recovery work, the system needs to monitor the folder to be protected.
  • Steps (3), (4), (5) and (6) need to be performed according to the parameters of steps (2-3) and (2-6); wherein step (4) updates the locally stored "folder name to be protected_file_amount.txt" and "folder name to be protected_file_list.txt”; step (5) updates the "folder name to be protected_file_amount.txt” and "folder name to be protected_file_list.txt” stored on the Southern Power Grid blockchain platform; step (6), enter the folder monitoring state.
  • Log operation During the execution of step (1) to step (8), logs are recorded through the system log module.
  • the preferred log format is: a combination of time and event.
  • the preferred log protocol is "syslog”.
  • step (3) by performing personalized parameter configuration on the system, the detection efficiency can be effectively improved and the waste of system resources can be avoided.
  • step (4) by calculating the total number of files in the folder to be protected and the digital summary of each file in the folder to be protected, and recording them in "folder name to be protected_file_amount.txt" and "folder name to be protected_file_list.txt", database operations are avoided, and the access and detection efficiency is effectively improved.
  • the record file "name of the folder to be protected_file_amount.txt” and the record file "name of the folder to be protected_file_list.txt” are stored in the Southern Power Grid blockchain platform, so that the contents of the two files cannot be tampered with, the system detection capability is improved, and underreporting is effectively avoided.
  • step (6), step (7) and step (8) the system will regularly detect the contents of the folder to be protected and compare them with the contents of the initialization state according to the time interval configured by the user, and can promptly prompt the administrator if an abnormality is found.
  • the system abnormality can be effectively and timely discovered.
  • a blockchain-based webpage anti-tampering monitoring system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.
  • a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above are implemented.
  • the present invention provides a webpage anti-tampering monitoring method based on blockchain, comprising the following steps: S1: starting a monitoring program to complete system working status verification; S2: configuring system operation parameters; S3: collecting data information of a file to be protected according to the system operation parameters; S4: storing the data information of the file to be protected to form a storage file; S5: uploading the storage file to a blockchain platform; S6: collecting data information of the file to be protected according to the system operation parameters, and comparing it with the data information of the file to be protected in the storage file formed in steps S4 and S5; if the comparison is inconsistent, entering S7, if the comparison is consistent, repeating this step; S7: when mismatching information is detected, notifying the system administrator, and returning to execute step S3.
  • the problem of difficulty in detecting web page tampering is alleviated through personalized configuration and polling mechanism for the system.
  • the previous methods have the problem of underreporting.
  • the method and system of the present invention effectively overcome the problem of underreporting by matching local files with blockchain files.
  • Blockchain has the characteristic that data cannot be tampered with. This characteristic can be used to effectively protect record files and ensure that important record files cannot be tampered with.
  • the solution of the present invention has the characteristics of fast comparison speed and less resource occupation.
  • first feature "on” the second feature may be that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium.
  • Multiple means at least two, such as two, three, etc., unless otherwise clearly and specifically limited.
  • the terms “installed”, “connected”, “connected”, “fixed” and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection, an electrical connection, or communication with each other; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined.
  • installed installed, “connected”, “connected”, “fixed” and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection, an electrical connection, or communication with each other; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined.
  • the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioethics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供一种基于区块链的网页防篡改监控方法，包括以下步骤：S1：启动监测程序，完成系统工作状态校验工作；S2：进行系统运行参数配置；S3：根据系统运行参数采集待保护文件的数据信息；S4：将待保护文件的数据信息进行存储形成存储文件；S5：将存储文件文件上传区块链平台；S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；S7：检测到不匹配信息时，通知系统管理员，并返回执行步骤S3。通过本地文件与区块链文件双匹配，解决漏报率高、兼容性差的问题。

Description

一种基于区块链的网页防篡改监控方法、系统及存储介质 技术领域
本发明涉及计算机安全领域，尤其涉及一种基于区块链的网页防篡改监控方法、系统及存储介质。
背景技术
随着信息化的发展，各企事业单位部署了大量的基于WEB的系统，且总量逐年增加。一方面，网站系统代表的是企事业单位的门面，被恶意篡改可能有损单位形象。特别的，若政府部门的网站系统被篡改后植入反动信息或者暗链，将造成较大安全事故。另一方面，普通用户访问被篡改的页面将获取到不正确的信息甚至网站被植入恶意代码而导致敏感信息泄露。
当前存在一些网页防篡改方式包括：1、网页轮询技术；2、核心内嵌技术；3、事件触发技术；网页轮询技术是指采用网页检测程序，通过轮询的方式依次读取待保护的网页文件，将待保护的网页与初始化状态的网页进行比较，如果发现二者存在差异，则判定为网页被篡改，否则网页未被篡改。核心内嵌技术是利用Web服务器的模块，对用户请求的每一个网页在数据流出时进行检测，如果发现与初始化状态网页存在差异则判定为网页被篡改，立即终止用户请求。事件触发技术是利用操作系统提供的函数，动态的检测当前程序调用的函数，例如文件创建函数、文件修改函数等。当程序检测到所设置的函数或动作被执行时，弹出预警信息并终止相关操作。
上面提高的三类网页防篡改方式能够较好的保护网页文件，但也存在一些不足，例如初始化时备份的初始化网页可能遭到篡改而导致的无法顺利检测出被篡改的文件。核心内嵌技术需要依托于web服务器软件提供的结构，适用性比较差且该方式对系统性能影响大。事件触发机制容易被绕过，当非法攻击者 通过系统漏洞或web软件漏洞入侵系统时，该机制可能不会被触发，导致漏报。综合以上分析，当前的web防篡改方式主要存在漏报率高、兼容性差等问题。
发明内容
为解决上述问题，本发明提供一种基于区块链的网页防篡改监控方法、系统及存储介质，用于解决漏报率高、兼容性差的问题。
为实现上述目的，本发明采取的技术方案如下：
一种基于区块链的网页防篡改监控方法，包括以下步骤：
S1：启动监测程序，完成系统工作状态校验工作；
S2：进行系统运行参数配置；
S3：根据系统运行参数采集待保护文件的数据信息；
S4：将待保护文件的数据信息进行存储形成存储文件；
S5：将存储文件文件上传区块链平台；
S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；
S7：检测到不匹配信息时，通知系统管理员，并返回执行步骤S3。
进一步的，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式。
进一步的，所述待保护文件数据信息包括绝对路径与对应的数字摘要。
进一步的，所述根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对，包括以下步骤：
递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计 算各个绝对路径的数字摘要值；
将步骤S4本地存储文件中、区块链平台存储文件中的全部绝对路径数量与上述步骤采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入步骤S7；
将步骤S4本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与上述步骤采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入步骤S7；
将步骤S4的本地存储文件与区块链平台的存储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入步骤S7。
进一步的，所述检测到不匹配信息时，通知系统管理员，包括以下步骤：
当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
一种基于区块链的网页防篡改监控系统，包括：
一系统初始化模块，其用于启动监测程序，完成系统工作状态校验工作；
一系统配置模块，其用于进行系统运行参数配置；
一信息采集模块，其用于根据系统运行参数采集待保护文件的数据信息；
一信息存储模块，其用于将待保护文件的数据信息进行存储形成存储文件；
一区块链操作模块，其用于将存储文件文件上传区块链平台；
一信息比对模块，其用于根据系统运行参数采集待保护文件的数据信息，并将其与信息存储模块、区块链操作模块中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入系统通知模块，如果比对一致则重复执行本模块操作；
一系统通知模块，其用于检测到不匹配信息时，通知系统管理员，并返回信息采集模块执行。
一日志模块，其用于记录系统日志。例如程序比对完成后，可以将比对结果进行日志存储。日志格式为：时间与事件组合。
进一步的，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式；所述待保护文件数据信息包括绝对路径与对应的数字摘要。
进一步的，所述信息比对模块包括：
采集单元，其用于递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值；
第一比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的全部绝对路径数量与采集单元采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入系统通知模块；
第二比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与采集单元采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入系统通知模块；
第三比对单元，其用于将信息存储模块的本地存储文件与区块链平台的存储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入系统通知模块；
所述系统通知模块包括：
第一通知单元，其用于当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
第二通知单元，其用于当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
第三通知单元，其用于当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
一种基于区块链的网页防篡改监控系统，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上所述方法的步骤。
一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器运行时实现如上所述方法的步骤。
本发明提供一种基于区块链的网页防篡改监控方法，包括以下步骤：S1：启动监测程序，完成系统工作状态校验工作；S2：进行系统运行参数配置；S3：根据系统运行参数采集待保护文件的数据信息；S4：将待保护文件的数据信息进行存储形成存储文件；S5：将存储文件文件上传区块链平台；S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；S7：检测到不匹配信息时，通知系统管理员，并返回执行 步骤S3。
本方案有益效果如下：
1、通过针对系统的个性化配置与轮询机制，缓解网页篡改难发现问题；以往的方法存在漏报问题；本发明方法与系统通过本地文件与区块链文件双匹配，有效克服漏报问题。
2、运用区块链技术，将重要记录文件上传区块链平台；区块链具有数据无法篡改的特性，利用该特性可以有效保护记录文件，起到重要记录文件无法篡改的作用。
3、及时准确的监测系统待保护文件是否发生篡改，能够及时发现，及时响应；对各个操作都进行详细的日志记录，发生异常情况时能有效进行溯源。
4、通过比对待保护文件数量与对应的数字摘要来确定是否存在篡改，相对现有技术的网页轮询方式对服务器性能消耗较大，本发明方案具有比对速度快与资源占用少的特点。
附图说明
图1为一种基于区块链的网页防篡改监控方法流程图；
图2一种基于区块链的网页防篡改监控系统结构示意图。
具体实施方式
下面结合附图对本公开实施例进行详细描述。
以下通过特定的具体实例说明本公开的实施方式，本领域技术人员可由本说明书所揭露的内容轻易地了解本公开的其他优点与功效。显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。本公开还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本公开的精神下进行各种修饰或改变。需说明的是， 在不冲突的情况下，以下实施例及实施例中的特征可以相互组合。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
实施例一
如图1所示一种基于区块链的网页防篡改监控方法流程图，包括以下步骤：
S1：启动监测程序，完成系统工作状态校验工作；
S2：进行系统运行参数配置；
S3：根据系统运行参数采集待保护文件的数据信息；
S4：将待保护文件的数据信息进行存储形成存储文件；
S5：将存储文件文件上传区块链平台；
S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；
S7：检测到不匹配信息时，通知系统管理员，并返回执行步骤S3。
进一步的，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式。
进一步的，所述待保护文件数据信息包括绝对路径与对应的数字摘要。
进一步的，所述根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对，包括以下步骤：
递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值；
将步骤S4本地存储文件中、区块链平台存储文件中的全部绝对路径数量与 上述步骤采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入步骤S7；
将步骤S4本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与上述步骤采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入步骤S7；
将步骤S4的本地存储文件与区块链平台的存储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入步骤S7。
进一步的，所述检测到不匹配信息时，通知系统管理员，包括以下步骤：
当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
实施例二
如图2所示一种基于区块链的网页防篡改监控系统，包括：
一系统初始化模块，其用于启动监测程序，完成系统工作状态校验工作；
一系统配置模块，其用于进行系统运行参数配置；
一信息采集模块，其用于根据系统运行参数采集待保护文件的数据信息；
一信息存储模块，其用于将待保护文件的数据信息进行存储形成存储文件；
一区块链操作模块，其用于将存储文件文件上传区块链平台；
一信息比对模块，其用于根据系统运行参数采集待保护文件的数据信息，并将其与信息存储模块、区块链操作模块中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入系统通知模块，如果比对一致则重复执行本模块操作；
一系统通知模块，其用于检测到不匹配信息时，通知系统管理员，并返回信息采集模块执行。
一日志模块，其用于记录系统日志。例如程序比对完成后，可以将比对结果进行日志存储。日志格式为：时间与事件组合。
进一步的，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式；所述待保护文件数据信息包括绝对路径与对应的数字摘要。
进一步的，所述信息比对模块包括：
采集单元，其用于递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值；
第一比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的全部绝对路径数量与采集单元采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入系统通知模块；
第二比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与采集单元采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入系统通知模块；
第三比对单元，其用于将信息存储模块的本地存储文件与区块链平台的存 储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入系统通知模块；
所述系统通知模块包括：
第一通知单元，其用于当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
第二通知单元，其用于当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
第三通知单元，其用于当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
实施例三
如图2为一种基于区块链的网页防篡改监控系统，包括以下模块：
系统初始化模块、信息采集模块、信息比对模块、信息存储模块、区块链操作模块、系统配置模块、系统通知模块、日志模块。系统模块图如图2所示。
各个系统模块的功能：
初始化模块：在系统首次部署运行时，通过系统初始化模块完成系统的初始化配置。包括配置默认目录检查频率、默认web保护路径、默认告警方式、默认工作系统与默认监测文件后缀名。其中默认目标检查频率是每5分钟检查依次，默认的web保护路径为Apache服务器默认www路径，默认告警方式是web后台系统提醒方式，默认工作系统为Linux平台，默认监测的文件后缀名为jsp、asp、aspx与php。
信息采集模块：通过该模块采集待保护的文件绝对路径，并计算各个路径完整的数字摘要值。
信息比对模块：该模块用来比对初始化文件数字摘要值与最新采集的文件数字摘要值。当比对成功时，可以返回成功；比对失败则返回失败。
信息存储模块：用于数字摘要信息与文件路径信息的存储操作。
区块链操作模块：与南网(全称：南方电网)区块链平台对接，完成上传数据到区块链平台与从区块链平台下载数据的操作。
系统配置模块：用于配置系统参数，包括待保护的路径、目录检查频率、告警方式、工作平台、监测文件后缀名。
系统通知模块：配置系统发现异常时采取的通知方式。默认方式是web后台系统方式。
日志模块：用于记录系统日志。例如程序比对完成后，可以将比对结果进行日志存储。日志格式为：时间与事件组合。
系统总调度模块：协调系统各模块运行。例如：定期调用信息采集模块采集路径信息并完成数据比对与告警任务。
实施例四
如图1所示为一种基于区块链的网页防篡改监控方法流程示意图，包括以下步骤：
步骤(1)：启动监测程序，完成系统工作状态校验工作。
步骤(1-1)：首先启动监测程序，用于采集待保护文件信息、计算数字摘要、区块链操作与比对等操作。优选的后台程序使用tomcat中间件并监听在8081端口。
步骤(1-2)：监测程序成功启动后，系统读取默认参数并完成初始化。优选的默认参数为：默认目标检查频率是每5分钟检查依次，默认的web保护路径为:“/var/www/html”，默认告警方式是web后台系统提醒方式，默认工作系 统为Linux平台，默认监测的文件后缀名为jsp、asp、aspx与php。
步骤(2)：步骤(1)成功完成后，系统使用默认参数运行。默认参数仅供程序部署测试用，适用性不高，需要根据用户环境个性化配置系统运行参数。
步骤(2-1)：监测程序成功启动后，进行系统运行参数配置。进入系统配置模块。
步骤(2-2)：首先进行待保护路径配置。输入需要保护的文件夹绝对路径，系统将递归的保护该目录下全部文件。
步骤(2-3)配置检查频率，检查频率可选间隔多少分钟检查一次与间隔多少小时检查一次。优选的检查频率为每5分钟检查一次。
步骤(2-4)告警方式配置，告警方式有系统后台告警方式与邮件方式。由于该发明应用的场景大多为内网，优选的告警方式为web系统通知方式。
步骤(2-5)系统可选的工作平台为Linux平台与Windows平台。该参数根据监测程序部署系统选择。
步骤(2-6)监测文件后缀名配置，该参数决定系统监测何种后缀名的文件。优选的，Java系统编写的web系统设置为jsp、java、class，PHP语言编写的web系统设置了php、php3、php4、php5，pht,phtml,phps，Asp与Aspx语言编写的web系统则设置为asp、aspx。优选的，不论那种类型语言的web系统，监测系统均监测htaccess、conf、xml文件。
步骤(3)：基于步骤(1)与步骤(2)完成的配置，系统已配置好了最优参数。系统将通过信息采集模块，采集待保护文件信息。
步骤(3-1)：依照步骤(2-2)配置的待保护文件路径递归采集全部待保护文件的绝对路径。
步骤(3-2)：统计步骤(3-1)采集的全部绝对路径数量并计算各个绝对路 径的数字摘要值。优选的，计算数字摘要算法是md5算法。
步骤(4)：将步骤(3)采集的绝对路径信息与对应的数字摘要信息进行存储。
步骤(4-1)：将步骤(3-2)计算得到的全部绝对路径数量进行存储。优选的存储方式是文件存储，存储文件名规则为“待保护文件夹名称_file_amount.txt”，存储的内容是：文件夹名称、文件总数量。
步骤(4-2)：将步骤(3-2)计算得到的各个绝对路径的数字摘要值进行存储。优选的存储方式是文件存储，存储文件名规则为“待保护文件夹名称_file_list.txt”，存储的内容是：文件的绝对路径、文件的数字摘要。
步骤(5)：将步骤(4)产生的“待保护文件夹名称_file_amount.txt”与“待保护文件夹名称_file_list.txt”两份文件上传区块链平台。
步骤(5-1)：连接南网区块链平台，系统验证是否连接成功。
步骤(5-2)：完成步骤(5-1)后，将步骤(4)产生的文件上传到南网区块链平台。优选的，文件上传操作使用南网区块链平台SDK。
步骤(6)：完成步骤(1)-(5)之后，系统进入监测状态。系统总调度模块根据步骤(2-3)配置的检测频率与步骤(2-6)配置的监测文件后缀，运行步骤(3)，采集待保护数据信息并进行比对。
步骤(6-1)：递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值。
步骤(6-2)：读取步骤(4-1)存储的“待保护文件夹名称_file_amount.txt”。读取步骤(5-2)上传到南网区块链平台的“待保护文件夹名称_file_amount.txt”。将本地存储的“待保护文件夹名称_file_amount.txt”与区块链平台存储的“待保护文件夹名称_file_amount.txt”存储的值以及步骤 (6-1)采集的全部绝对路径数量进行比对。如果三者比对一致，则文件数量没有被篡改。如果不一致，则说明存在文件被删除或文件新创建的情况。系统进一步进行筛选匹配操作并进入步骤(7-1)。
步骤(6-3)：读取步骤(4-2)存储的“待保护文件夹名称_file_list.txt”。读取步骤(5-2)上传到南网区块链平台的“待保护文件夹名称_file_list.txt”。将本地存储的“待保护文件夹名称_file_list.txt”与区块链平台存储的“待保护文件夹名称_file_list.txt”存储的值以及步骤(6-1)采集的全部绝对路径数与对应数字摘要一一进行比对。如果三者比对一致，则文件内容没有被篡改。如果不一致，则说明存在文件内容被篡改的情况。系统进一步进行筛选匹配操作并进入步骤(7-2)。
步骤(6-4)：如果步骤(6-2)与步骤(6-3)读取的本地“待保护文件夹名称_file_amount.txt”与区块链平台存储的“待保护文件夹名称_file_amount.txt”内容不一致则表明非法入侵者篡改了本地“待保护文件夹名称_file_amount.txt”。系统进入步骤(7-3)。
步骤(6-5)：如果步骤(6-2)与步骤(6-3)读取的本地“待保护文件夹名称_file_list.txt”与区块链平台存储的“待保护文件夹名称_file_list.txt”内容不一致则表明非法入侵者篡改了本地“待保护文件夹名称_file_list.txt”。系统进入步骤(7-4)。
步骤(7)：当步骤(6)中检测到不匹配信息时，根据各类具体情况。需要通过系统通知模块通知系统管理员。优选的通知方式是系统后台提醒的方式。
步骤(7-1)：当步骤(6-2)对比不一致时，系统告知管理员待保护文件夹文件数量异常，同时告知本地“待保护文件夹名称_file_amount.txt”文件、区块链平台“待保护文件夹名称_file_amount.txt”文件以及步骤(6-1)监测 到的文件数量。
步骤(7-2)：当步骤(6-3)对比不一致时，系统告知管理员待保护文件夹文件内容异常，同时告知本地“待保护文件夹名称_file_list.txt”文件、区块链平台“待保护文件夹名称_file_list.txt”文件以及步骤(6-1)监测到的各个文件绝对路径与数字摘要，并表明不一致的内容。
步骤(7-3)：当步骤(6-4)对比不一致时，系统告知管理员本地“待保护文件夹名称_file_amount.txt”文件内容与区块链平台“待保护文件夹名称_file_amount.txt”内容不一致。
步骤(7-4)：当步骤(6-5)对比不一致时，系统告知管理员本地“待保护文件夹名称_file_list.txt”文件内容与区块链平台“待保护文件夹名称_file_list.txt”内容不一致。
步骤(8)：如果步骤(6)系统信息匹配均一致，则系统总调度模块根据步骤(2-3)配置的检测频率与步骤(2-6)配置的监测文件后缀，循环运行步骤(6)。
如果步骤(6)系统信息匹配不一致，则在执行步骤(7)之后，依次执行步骤(3)、步骤(4)与步骤(5)与步骤(6)。
步骤(8-1)：如果步骤(6)系统信息匹配均一致，说明系统未发生篡改，无需进行步骤(7)的系统告警。系统根据步骤(2-3)与步骤(2-6)的配置参数循环运行步骤(6)，监测待保护文件夹。
步骤(8-2):如果步骤(6)存在匹配不一致的情况，说明系统出现的篡改，根据步骤(7)通知系统管理员。系统管理员完成相应的排查与恢复工作之后需要让系统监测待保护文件夹。需要根据步骤(2-3)与步骤(2-6)的参数进行步骤(3)、步骤(4)、步骤(5)与步骤(6)；其中步骤(4)更新本地存储的 “待保护文件夹名称_file_amount.txt”与“待保护文件夹名称_file_list.txt”；步骤(5)更新南网区块链平台存储的“待保护文件夹名称_file_amount.txt”与“待保护文件夹名称_file_list.txt”；步骤(6)，进入文件夹监控状态。
日志操作：在步骤(1)-步骤(8)执行期间均通过系统日志模块进行日志记录。优选的日志格式是：时间与事件组合。优选的日志协议是“syslog”。
由于本发明采用了步骤(3)，通过对系统进行个性化的参数配置，能够有效提高检测效率，避免系统资源浪费。
由于本发明采用了步骤(4)，通过计算待保护文件夹中文件总数与待保护文件夹中各个文件的数字摘要，同时将其记录在“待保护文件夹名称_file_amount.txt”与“待保护文件夹名称_file_list.txt”中，避免了数据库操作，有效提高存取与检测效率。
由于本发明采用了步骤(5)，将记录文件“待保护文件夹名称_file_amount.txt”与记录文件“待保护文件夹名称_file_list.txt”存储在南网区块链平台。使得该两份文件内容无法被篡改，提高系统检测能力，有效避免漏报。
由于本发明采用了步骤(6)、步骤(7)与步骤(8)的操作，系统将根据用户配置的时间间隔，定期的检测待保护文件夹内容并与初始化状态内容进行比较，发现异常能够及时提示管理员。能有效的、及时的发现系统异常情况。
实施例五
一种基于区块链的网页防篡改监控系统，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上所述方法的步骤。
实施例六
一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器运行时实现如上所述方法的步骤。
本发明提供一种基于区块链的网页防篡改监控方法，包括以下步骤：S1：启动监测程序，完成系统工作状态校验工作；S2：进行系统运行参数配置；S3：根据系统运行参数采集待保护文件的数据信息；S4：将待保护文件的数据信息进行存储形成存储文件；S5：将存储文件文件上传区块链平台；S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；S7：检测到不匹配信息时，通知系统管理员，并返回执行步骤S3。
本方案有益效果如下：
1、通过针对系统的个性化配置与轮询机制，缓解网页篡改难发现问题；以往的方法存在漏报问题；本发明方法与系统通过本地文件与区块链文件双匹配，有效克服漏报问题。
2、运用区块链技术，将重要记录文件上传区块链平台；区块链具有数据无法篡改的特性，利用该特性可以有效保护记录文件，起到重要记录文件无法篡改的作用。
3、及时准确的监测系统待保护文件是否发生篡改，能够及时发现，及时响应；对各个操作都进行详细的日志记录，发生异常情况时能有效进行溯源。
4、通过比对待保护文件数量与对应的数字摘要来确定是否存在篡改，相对现有技术的网页轮询方式对服务器性能消耗较大，本发明方案具有比对速度快与资源占用少的特点。
在本发明的描述中，需要理解的是，术语“中间”、“长度”、“上”、“下”、“前”、“后”、“竖直”、“水平”、“内”、“外”、“径向”、“周向”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本发明和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本发明的限制。
在本发明中，除非另有明确的规定和限定，第一特征在第二特征“上”可以是第一和第二特征直接接触，或第一和第二特征通过中间媒介间接接触。“多个”的含义是至少两个，例如两个，三个等，除非另有明确具体的限定。
在本发明中，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”、“固定”等术语应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或成一体；可以是机械连接，也可以是电连接或彼此可通讯；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通或两个元件的相互作用关系，除非另有明确的限定。对于本领域的普通技术人员而言，可以根据具体情况理解上述术语在本发明中的具体含义。
以上仅为说明本发明的实施方式，并不用于限制本发明，对于本领域的技术人员来说，凡在本发明的精神和原则之内，不经过创造性劳动所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (10)

  1. 一种基于区块链的网页防篡改监控方法，其特征在于，包括以下步骤：
    S1：启动监测程序，完成系统工作状态校验工作；
    S2：进行系统运行参数配置；
    S3：根据系统运行参数采集待保护文件的数据信息；
    S4：将待保护文件的数据信息进行存储形成存储文件；
    S5：将存储文件文件上传区块链平台；
    S6：根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对；如果比对不一致则进入S7，如果比对一致则重复执行本步骤；
    S7：检测到不匹配信息时，通知系统管理员，并返回执行步骤S3。
  2. 根据权利要求1所述的基于区块链的网页防篡改监控方法，其特征在于，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式。
  3. 根据权利要求2所述的基于区块链的网页防篡改监控方法，其特征在于，所述待保护文件数据信息包括绝对路径与对应的数字摘要。
  4. 根据权利要求3所述的基于区块链的网页防篡改监控方法，其特征在于，所述根据系统运行参数采集待保护文件的数据信息，并将其与步骤S4、S5中形成的存储文件中的待保护文件数据信息进行比对，包括以下步骤：
    递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值；
    将步骤S4本地存储文件中、区块链平台存储文件中的全部绝对路径数量与上述步骤采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入步骤S7；
    将步骤S4本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与上述步骤采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入步骤S7；
    将步骤S4的本地存储文件与区块链平台的存储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入步骤S7。
  5. 根据权利要求4所述的基于区块链的网页防篡改监控方法，其特征在于，所述检测到不匹配信息时，通知系统管理员，包括以下步骤：
    当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
    当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
    当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
  6. 一种基于区块链的网页防篡改监控系统，其特征在于，包括：
    一系统初始化模块，其用于启动监测程序，完成系统工作状态校验工作；
    一系统配置模块，其用于进行系统运行参数配置；
    一信息采集模块，其用于根据系统运行参数采集待保护文件的数据信息；
    一信息存储模块，其用于将待保护文件的数据信息进行存储形成存储文件；
    一区块链操作模块，其用于将存储文件文件上传区块链平台；
    一信息比对模块，其用于根据系统运行参数采集待保护文件的数据信息，并将其与信息存储模块、区块链操作模块中形成的存储文件中的待保护文件数 据信息进行比对；如果比对不一致则进入系统通知模块，如果比对一致则重复执行本模块操作；
    一系统通知模块，其用于检测到不匹配信息时，通知系统管理员，并返回信息采集模块执行。
  7. 根据权利要求6所述的基于区块链的网页防篡改监控系统，其特征在于，所述系统运行参数包括待保护路径、检查频率、监测文件后缀名、系统选择和告警方式；所述待保护文件数据信息包括绝对路径与对应的数字摘要。
  8. 根据权利要求7所述的基于区块链的网页防篡改监控系统，其特征在于，所述信息比对模块包括：
    采集单元，其用于递归采集全部待保护文件的绝对路径，统计采集的全部绝对路径数量并计算各个绝对路径的数字摘要值；
    第一比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的全部绝对路径数量与采集单元采集的进行比对；如果三者比对一致则文件数量没有被篡改，如果不一致则说明存在文件被删除或文件新创建的情况，进入系统通知模块；
    第二比对单元，其用于将信息存储模块的本地存储文件中、区块链平台存储文件中的各个绝对路径的数字摘要值与采集单元采集的进行比对；如果三者比对一致则文件内容没有被篡改，如果不一致则说明存在文件内容被篡改的情况，进入系统通知模块；
    第三比对单元，其用于将信息存储模块的本地存储文件与区块链平台的存储文件进行比对；如果两者比对一致则文件没有被篡改，如果不一致则表明非法入侵者篡改了本地存储文件，进入系统通知模块；
    所述系统通知模块包括：
    第一通知单元，其用于当全部绝对路径数量比对不一致时通知管理员待保护文件夹文件数量异常，并通知三者监测到的文件数量；
    第二通知单元，其用于当各个绝对路径的数字摘要值比对不一致时通知管理员待保护文件夹文件内容异常，并通知三者监测到的各个文件绝对路径与数字摘要，并表明不一致的内容；
    第三通知单元，其用于当步骤S4的本地存储文件与区块链平台的存储文件比对不一致时，通知管理员存储文件内容异常。
  9. 一种基于区块链的网页防篡改监控系统，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至5任一项所述方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，其特征在于，所述计算机程序被处理器运行时实现如权利要求1至5任一项所述方法的步骤。
PCT/CN2022/134012 2022-10-21 2022-11-24 一种基于区块链的网页防篡改监控方法、系统及存储介质 WO2024082375A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211294072.2 2022-10-21
CN202211294072.2A CN115688192A (zh) 2022-10-21 2022-10-21 一种基于区块链的网页防篡改监控方法、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2024082375A1 true WO2024082375A1 (zh) 2024-04-25

Family

ID=85065555

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/134012 WO2024082375A1 (zh) 2022-10-21 2022-11-24 一种基于区块链的网页防篡改监控方法、系统及存储介质

Country Status (2)

Country Link
CN (1) CN115688192A (zh)
WO (1) WO2024082375A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109257340A (zh) * 2018-08-29 2019-01-22 北京中科锐链科技有限公司 一种基于区块链的网站防篡改系统及方法
CN111832083A (zh) * 2020-09-15 2020-10-27 江苏开博科技有限公司 基于区块链和国密数字指纹技术的系统资源防篡改方法
WO2022094635A1 (en) * 2020-10-30 2022-05-05 Nguyen Khuong Tuan Anti-tampering medium, anti-tampering authentication system and tamper detection method

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109257340A (zh) * 2018-08-29 2019-01-22 北京中科锐链科技有限公司 一种基于区块链的网站防篡改系统及方法
CN111832083A (zh) * 2020-09-15 2020-10-27 江苏开博科技有限公司 基于区块链和国密数字指纹技术的系统资源防篡改方法
WO2022094635A1 (en) * 2020-10-30 2022-05-05 Nguyen Khuong Tuan Anti-tampering medium, anti-tampering authentication system and tamper detection method

Also Published As

Publication number Publication date
CN115688192A (zh) 2023-02-03

Similar Documents

Publication Publication Date Title
Milajerdi et al. Holmes: real-time apt detection through correlation of suspicious information flows
Manral et al. A systematic survey on cloud forensics challenges, solutions, and future directions
US8555385B1 (en) Techniques for behavior based malware analysis
JP4807970B2 (ja) 自動開始拡張ポイントを介したスパイウェアおよび不要ソフトウェアの管理
US8955134B2 (en) Malicious code infection cause-and-effect analysis
US20050114658A1 (en) Remote web site security system
CN113660224B (zh) 基于网络漏洞扫描的态势感知防御方法、装置及系统
CN102812441A (zh) 自动化的恶意软件检测和修复
US20220050765A1 (en) Method for processing logs in a computer system for events identified as abnormal and revealing solutions, electronic device, and cloud server
Valdes et al. An architecture for an adaptive intrusion-tolerant server
CN114116322B (zh) 数据恢复方法、装置、设备及存储介质
CN112818307B (zh) 用户操作处理方法、系统、设备及计算机可读存储介质
CN110908910B (zh) 一种基于区块链的测试监控方法、装置及可读存储介质
KR100736540B1 (ko) 웹 서버 위/변조 감시장치 및 그 방법
CN112231130B (zh) 一种根据日志定位故障的方法、系统、设备及介质
WO2024082375A1 (zh) 一种基于区块链的网页防篡改监控方法、系统及存储介质
CN107124311B (zh) 一种数据服务系统
CN115543744A (zh) 一种日志收集方法、装置、设备及存储介质
CN110798356B (zh) 固件监控方法、装置、存储介质和计算机设备
CN110677483B (zh) 信息处理系统和可信安全管理系统
Cornelius et al. Recommended practice: Creating cyber forensics plans for control systems
JP4862619B2 (ja) ログ管理方式及びログ管理方法
US20230104516A1 (en) System and method for detecting system executable abnormalities
JP2020017821A (ja) 外部情報受配信装置、データ送信方法、及びプログラム
Fredrikson et al. A declarative framework for intrusion analysis