CN106203105B - File management method and device - Google Patents

Abstract

Whether, the invention discloses a kind of file management method and device, which includes: judgment module, is scanned for the memory space to mobile device, judge in the memory space comprising file to be treated；Configuration module, for creating file in the memory space, and the file to be treated is put into the file in the case where judgement is comprising file to be treated；Processing module, for being handled according to instruction the file stored in the file；Wherein, the judgment module is for judging whether the memory space includes apocrypha and/or malicious file；And in the case where judging that the memory space includes apocrypha and/or malicious file, by the memory space apocrypha and/or malicious file be determined as file to be treated.The file that can effectively restore or consult the storage of mobile device original using technical solution of the present invention avoids the problem that operation can not carry out.

Description

File management method and device

This application is a divisional application based on the parent case "Document Management Method and Device", the application number of the parent case "Document Management Method and Device" is CN201210393609.0, and the publication number is CN102915359A.

technical field

The present invention relates to the field of computers, in particular to a file management method and device.

Background technique

With the widespread use of computer technology in various fields of social life, malicious programs (Malwar, malicious software, refers to any software program that is intentionally created to perform unauthorized and usually harmful behaviors) also follow like its accessories. . Due to the infectivity, replication and destructiveness of these malicious programs, they have become a major problem that plagues computer usage.

Therefore, in today's growing network threats, updating virus signatures has become an essential task for enterprises and netizens every day. From once a week to once a day, until they are updated at any time, users expect to avoid malicious computer equipment by matching virus signatures. affected by the program. In traditional antivirus software, the virus database is placed on the client computer, and the files are analyzed on the client side. During the scanning process, the local virus database is repeatedly compared, which occupies a large amount of system resources. With the upgrade, the capacity of the virus database is getting larger and larger, and the time spent in analyzing the files is also getting longer and longer, which leads to excessive occupation of system resources of the client computer and reduced performance. Therefore, the anti-virus industry must find new technological breakthroughs.

The "Cloud Security" plan is the latest manifestation of information security in the network era. It integrates emerging technology concepts such as parallel processing, grid computing, and unknown virus behavior judgment, and applies the concept of "cloud computing" to the security field.

Cloud scanning and killing refers to putting the virus database on the server side, because the virus database on the server side is updated faster and more timely, and it can be quickly detected and killed after being connected to the Internet. After the U disk (mobile device) is scanned by the cloud killing technology, the usual practice is to store the dangerous (judged malicious files) or suspicious files obtained after the cloud killing scanning on the local computing device.

Since the dangerous or suspicious files obtained after the cloud scanning and killing of the U disk are stored on the local computing device, when the U disk is moved from the local computing device to another computing device, if the It is impossible to recover accidentally deleted dangerous or suspicious files on a single computing device.

For the problem in the related art that it is difficult to perform other subsequent processing on the file based on the mobile device due to the storage of the isolated file on the computing device side, no effective solution has been proposed so far.

SUMMARY OF THE INVENTION

In view of the above problems, the present invention is proposed to provide a file management method and apparatus that overcomes the above problems or at least partially solves the above problems.

According to one aspect of the present invention, a file management method is provided, the file management method comprising:

Scan the storage space of the mobile device to determine whether the storage space contains files that need to be processed;

If it contains files that need to be processed, create a folder in the storage space and put the files that need to be processed into the folder;

Process the files stored in the folder according to the instructions;

Among them, judging whether the storage space contains files that need to be processed includes:

Determine whether the storage space contains suspicious files and/or malicious files;

If the storage space contains suspicious files and/or malicious files, the suspicious files and/or malicious files in the storage space are determined as files that need to be processed.

Optionally, after placing the files to be processed into the folder, the file management method further includes:

Receive an instruction from the user, and determine the processing to be performed on the files in the folder according to the instruction.

Optionally, in the case where the instruction from the user is to restore the files in the folder, processing the files in the folder includes:

Restore the files in the folder to their original storage location.

Optionally, when the instruction from the user is to delete the files in the folder, processing the files in the folder includes:

Delete the files in the folder.

According to another aspect of the present invention, a file management device is provided, the file management device comprising:

The judgment module is used to scan the storage space of the mobile device to determine whether the storage space contains files that need to be processed;

The configuration module is used to create a folder in the storage space when it is judged that the file to be processed is included, and put the file to be processed into the folder;

The processing module is used to process the files stored in the folder according to the instructions;

Wherein, the judgment module is used to judge whether the storage space contains suspicious files and/or malicious files; and when judging that the storage space contains suspicious files and/or malicious files, the suspicious files and/or malicious files in the storage space are determined as necessary processed files.

Optionally, the file management device further includes:

The determining module is configured to receive an instruction from the user after placing the file to be processed into the folder, and determine the processing to be performed on the file in the folder according to the instruction.

Optionally, when the instruction from the user is to restore the files in the folder, the processing module is configured to restore the files in the folder to the original storage location.

Optionally, when the instruction from the user is to delete the files in the folder, the processing module is configured to delete the files in the folder.

According to the file management method and device of the present invention, by scanning the storage space of the mobile device, when it is judged that there are files that need to be processed in the storage space, a folder is created in the storage space of the mobile device, and the files that need to be processed are created. The files are put into this folder for processing, which solves the problem that the isolated files are stored on the computing device side, which makes it difficult to perform other subsequent processing on the files based on the mobile device, and achieves the storage space of the mobile device. The processed files, even if the mobile device is connected to other computers, can also effectively restore or consult the files originally stored in the mobile device, and have the beneficial effect of avoiding the problem that the operation cannot be performed.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

1 shows a flowchart of a file management method according to an embodiment of the present invention;

FIG. 2 is a schematic diagram showing the execution result of the file management method according to an embodiment of the present invention; and

FIG. 3 shows a block diagram of a file management apparatus according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

According to an embodiment of the present invention, a file management method is provided.

As shown in Figure 1, the file management method includes:

Step S101, scan the storage space of the mobile device, and determine whether the storage space contains files that need to be processed;

Step S103, if the file to be processed is contained, a folder is created in the storage space, and the file to be processed is placed in the folder;

Step S105, process the files stored in the folder according to the instruction.

Among them, judging whether the storage space contains files that need to be processed includes:

Determine whether the storage space contains suspicious files and/or malicious files;

If the storage space contains suspicious files and/or malicious files, the suspicious files and/or malicious files in the storage space are determined as files that need to be processed.

And, after putting the files to be processed into the folder, the file management method further includes:

Receive an instruction from the user, and determine the processing to be performed on the files in the folder according to the instruction.

In addition, in the case where the instruction from the user is to restore the files in the folder, the processing of the files in the folder includes:

Restore the files in the folder to their original storage location.

Moreover, when the instruction from the user is to delete the files in the folder, the processing of the files in the folder includes:

Delete the files in the folder.

For example, after connecting the mobile device to a computing device, the server scans the files on the user's U disk (mobile device) after networking, and finds the file level corresponding to the md5 of the file; among them, the server scans and queries the background file level, and the background saves The md5 of different files and the corresponding file level. The file level is mainly based on the static characteristics in the program file, such as the md5 verification code obtained by the Message-Digest Algorithm 5 (referred to as md5) operation, or the SHA1 code, or the Cyclic Redundancy Check (Cyclic Redundancy Check). , CRC for short) code, etc., which can uniquely identify the original program, or it can be a static feature string in the program file.

First of all, in the server, if the value of the file level code corresponding to the file is 10-20, it is white (that is, a safe file, or called a trusted file), and the value of the file level code corresponding to the file is 30, which is unknown (that is, a suspicious file). ), not in the whitelist (the whitelist can be a list of trusted files), nor in the blacklist (the blacklist can be a list of malicious files), the file level code value corresponding to the file is 50-70, which are all black (that is, malicious document). When the U disk is connected to the cloud database, the code value can be queried according to the md5 of the file.

The found dangerous (malicious) or suspicious files are then placed in quarantine (i.e. a folder created in the storage space of the mobile device). It should be noted that, in some embodiments, suspicious files may also not be placed in the quarantine area.

The level used in the background of the u disk scanning is mainly based on the level of the PE file of a certain file collected in the background. If the level of the non-PE file is >=30, it is a suspicious file; if the level of the PE file is >=50, it is dangerous (Malicious) file; if the level of the PE file = 70, it is a Trojan horse file.

As shown in Figure 2, it is the scanning result of the file in the mobile device. When a mobile device is plugged into a computing device, Cloud Antivirus scans and confirms that the file is abnormal, including whether the file is a suspicious file, a dangerous file or a Trojan horse file.

For example, in Figure 2, the file named auto.bat is a suspicious file, the file named setup-guiying.exe and the file named pucgc5951 hurricane.exe are Trojan horse files.

The user can choose not to process it temporarily, process it immediately, or process it immediately and scan the U disk comprehensively.

When the user selects the "Process Immediately" command, a "quarantine file" folder is created on the USB flash drive, and the files to be processed are placed in the "quarantine file" folder for processing.

If a dangerous or suspicious file placed in the quarantine area is falsely reported or mishandled, and the dangerous or suspicious file needs to be restored, restore the dangerous or suspicious file directly from the quarantine area to its original location.

According to an embodiment of the present invention, a file management apparatus is provided.

As shown in Figure 3, the file management device includes:

The judgment module 31 is used to scan the storage space of the mobile device, and determine whether the storage space contains files that need to be processed;

The configuration module 32 is used to create a folder in the storage space when it is judged that the file to be processed is included, and put the file to be processed into the folder;

The processing module 33 is configured to process the files stored in the folder according to the instruction.

Wherein, the judgment module 31 is used to judge whether the storage space contains suspicious files and/or malicious files; and when judging that the storage space contains suspicious files and/or malicious files, the suspicious files and/or malicious files in the storage space are determined as The file that needs to be processed.

And, the file management device further includes:

The determining module (not shown in the figure) is configured to receive an instruction from the user after placing the file to be processed into the folder, and determine the required processing for the file in the folder according to the instruction.

In addition, when the instruction from the user is to restore the files in the folder, the processing module 33 is configured to restore the files in the folder to the original storage location.

Moreover, when the instruction from the user is to delete the files in the folder, the processing module 33 is used to delete the files in the folder.

With the help of the technical solution of the present invention, a mobile device such as a U disk can be connected to any computing device, and the dangerous (malicious) or suspicious that was previously deleted by mistake on the mobile device can be recovered on the computing device. document.

To sum up, with the help of the above technical solutions of the present invention, by scanning the storage space of the mobile device, when it is determined that there are files that need to be processed in the storage space, a folder is created in the storage space of the mobile device, Put the files to be processed into this folder for processing, and can store the files to be processed in the storage space of the mobile device. Even if the mobile device is connected to other computers, it can effectively restore or view the files originally stored on the mobile device. , to avoid the problem that the operation cannot be performed.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be construed as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the file management method and apparatus according to the embodiments of the present invention. The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

Claims (8)

1. a kind of file management method, for being managed to the file on USB flash disk comprising:

Server carries out cloud killing scanning to the file in USB flash disk memory space, obtains the background grade of scanned document, together When in the server, the corresponding file hierarchies code of setting file, file hierarchies obtained and set file hierarchies code into Whether row comparison judges in the memory space comprising file to be treated；

If creating file in the memory space comprising file to be treated, and by the text to be treated Part is put into the file；

The file stored in the file is handled according to instruction；

Wherein, judge in the memory space whether to include that file to be treated includes:

Judge whether the memory space includes apocrypha and/or malicious file；

If the memory space include apocrypha and/or malicious file, by the memory space apocrypha and/ Or malicious file is determined as file to be treated.

2. file management method according to claim 1, which is characterized in that the file to be treated is being put into institute After stating in file, the file management method further comprises:

Instruction from the user is received, is determined according to the instruction to the file needed processing in the file.

3. file management method according to claim 2, which is characterized in that be designated as restoring the text from the user In the case where file in part folder, carrying out processing to the file in the file includes:

By the file access pattern in the file to former storage location.

4. file management method according to claim 2, which is characterized in that be designated as deleting the text from the user In the case where file in part folder, carrying out processing to the file in the file includes:

File in the file is deleted.

5. a kind of document management apparatus, for being managed to the file on USB flash disk comprising:

Judgment module, server carry out cloud killing scanning to the file in USB flash disk memory space, obtain the backstage text of scanned document Part grade, while in the server, the corresponding file hierarchies code of file, file hierarchies obtained and set file are set Whether grade code compares, judge in the memory space comprising file to be treated；

Configuration module, for creating file in the memory space in the case where judgement is comprising file to be treated, And the file to be treated is put into the file；

Processing module, for being handled according to instruction the file stored in the file；

Wherein, the judgment module is for judging whether the memory space includes apocrypha and/or malicious file；And judge In the case that the memory space includes apocrypha and/or malicious file, by the memory space apocrypha and/or Malicious file is determined as file to be treated.

6. document management apparatus according to claim 5, which is characterized in that further include:

Determining module, for receiving finger from the user after the file to be treated is put into the file Show, and is determined according to the instruction to the file needed processing in the file.

7. document management apparatus according to claim 6, which is characterized in that be designated as restoring the text from the user In the case where file in part folder, the processing module is used for the file access pattern in the file to former storage location.

8. document management apparatus according to claim 6, which is characterized in that be designated as deleting the text from the user In the case where file in part folder, the processing module is used to delete the file in the file.