CN106612283B - A method and device for identifying the source of a downloaded file - Google Patents

Abstract

The invention discloses a method and a device for identifying the source of a downloaded file, which relate to the technical field of network security. The main technical scheme of the invention is as follows: monitoring the flow of the accessed network file, and extracting partial data stream of the network file to obtain verification data; associating the link address of the network file with the verification data; monitoring a data stream of a written file in a local storage, and matching verification data contained in the data stream; and marking the link address associated with the verification data in the written file according to the verification data successfully matched. The method and the device are mainly used for identifying the source of the downloaded file.

Description

A method and device for identifying the source of a downloaded file

technical field

The present invention relates to the technical field of network security, and in particular, to a method and device for identifying the source of a downloaded file.

Background technique

With the rapid development of computer technology, information network has become an important guarantee for social development. Through the Internet, people can get the information they need. However, when browsing information or network files on the network, these files are generally temporarily cached in the local memory, and when the user determines that they need to be downloaded, the file information required by the user is saved locally from the memory. In this process, since the memory does not mark the cached content, and a large number of data information of users accessing different URLs are often cached in the memory, when saving the data information in the memory to the local , it is difficult for the user to judge the file source of the saved data information. This will form a huge security risk for equipment and systems that lack security protection.

SUMMARY OF THE INVENTION

In view of this, the present invention provides a method and device for identifying the source of a downloaded file, by sampling the accessed network file and marking the information source, and matching the file written in the local storage to determine the information source of the file.

According to one aspect of the present invention, a method for identifying the source of a downloaded file is proposed, the method comprising:

monitoring the flow of the accessed network file, extracting part of the data flow of the network file, and obtaining verification data;

associating the link address of the network file with the verification data;

Monitoring the data stream written to the file in the local storage, matching the verification data contained in the data stream;

According to the successfully matched verification data, the link address associated with the verification data is marked in the write file.

Preferably, the extracting part of the data stream of the network file to obtain the verification data includes:

Randomly extracting a fixed-size data stream in the network file to generate verification data;

Or, extracting multiple data streams in the network file to generate verification data including multiple data stream files.

Preferably, the extracting part of the data stream of the network file to obtain the verification data includes:

When the accessed network file is an encrypted file, the decryption function of the encrypted file is called;

Part of the data stream in the plaintext data stream output by the decryption function is extracted to obtain the verification data.

Preferably, the associating the link address of the network file with the verification data includes:

Obtain the link address of the network file;

The link address and the verification data are associated with an associative array KEY-VALUE key-value pair, where the KEY stores the link address, and the VALUE stores the verification data.

Preferably, the method further includes:

Reporting the associative array to the cloud server, so that the cloud server judges whether the network file is safe according to the link address in the associative array;

Whether the network file can be saved in the local storage is determined according to the information fed back by the cloud server.

Preferably, the method further includes:

Determine whether the link address is a secure link according to the link address marked in the write file;

If not, an alarm message is prompted for the written file, and an isolation or deletion operation is performed.

According to another aspect of the present invention, a device for identifying the source of a downloaded file is provided, the device comprising:

an extraction unit, configured to monitor the flow of the accessed network file, extract part of the data flow of the network file, and obtain verification data;

an association unit, configured to associate the link address of the network file with the verification data extracted by the extraction unit;

a matching unit for monitoring the data stream written to the file in the local storage, and matching the verification data contained in the data stream;

A marking unit, configured to mark the link address associated with the verification data in the writing file according to the verification data successfully matched by the matching unit.

Preferably, the extraction unit includes:

The first extraction module is used for randomly extracting a fixed-size data stream in the network file to generate verification data;

The second extraction module is configured to extract multiple data streams in the network file, and generate verification data containing multiple data stream files.

Preferably, the extraction unit further includes:

a calling module for calling the decryption function of the encrypted file when the accessed network file is an encrypted file;

The third extracting module is configured to extract a part of the data stream in the plaintext data stream output after decrypting the encrypted file by the decryption function called by the calling module to obtain the verification data.

Preferably, the association unit includes:

an acquisition module for acquiring the link address of the network file;

The association module is used for associating the link address and the verification data by using an associative array KEY-VALUE key-value pair, where the KEY stores the link address, and the VALUE stores the verification data.

Preferably, the device further includes:

a sending unit, configured to report the associative array obtained by the associative unit to the cloud server, so that the cloud server judges whether the network file is safe according to the link address in the associative array;

A determining unit, configured to determine whether the network file can be saved in the local storage according to the information fed back by the cloud server.

Preferably, the device further includes:

a judging unit for judging whether the link address is a secure link according to the link address marked by the labeling unit in the write file;

A processing unit, when the judging unit judges that the link address is not a secure link, prompts an alarm message to the written file, and executes an isolation or deletion operation.

The method and device for identifying the source of a downloaded file adopted in the present invention are mainly used to mark the source of the downloaded file, so as to judge the security of the file according to the source of the file. In the identification process, part of the data in the file cache is extracted as verification data, and the link address for accessing the file is recorded at the same time, and is associated with the corresponding verification data, and then the file in the cache is saved to the local storage. , monitor the data stream written to the file, match the verification data contained in the data stream, mark the link address associated with the verification data in the write file, and complete the marking of the source of the downloaded file. By marking the source of the file, if the content of the file cannot be identified, whether the file is a secure file can be identified by judging the source of the file, thereby improving the ability of the system to identify the file.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

1 shows a flowchart of a method for identifying the source of a downloaded file provided by an embodiment of the present invention;

2 shows a flowchart of another method for identifying the source of a downloaded file provided by an embodiment of the present invention;

3 shows a block diagram of a composition of an apparatus for identifying the source of a downloaded file provided by an embodiment of the present invention;

FIG. 4 shows a block diagram of another apparatus for identifying the source of a downloaded file provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present invention will be more thoroughly understood, and will fully convey the scope of the present invention to those skilled in the art.

The embodiment of the present invention provides a method for identifying the source of a downloaded file. The method is mainly used to mark the source of the downloaded file, and the source information is confirmed and marked by dividing the file downloading process into two stages. The two stages are the file caching stage and the saving stage. The caching stage is the process of caching the file when the user browses the network file. In this process, the file is associated with its network address and saved. , that is, the process of saving the file in the cache to the local storage, and marking the network address corresponding to the file in the file. Since most of the network files viewed by users do not need to be saved, a large number of network files that users have browsed are generally stored in the device cache. When the file is moved to the local, the corresponding file movement operation is performed, and the source information of the file can no longer be traced. However, for an unknown file, its security can largely be judged by its source. Therefore, the method for identifying the source of the downloaded file provided by the embodiment of the present invention proposes a solution to this problem. The specific steps are shown in FIG. 1 , including:

101. Monitor the flow of the accessed network file, extract part of the data flow of the network file, and obtain verification data.

This step is a process of caching the network file in the memory or the cache area of the local device when the user views the network file through the Internet. The types of network files are not limited to files in formats such as text, pictures, and videos. In this process, the local device obtains network data through the network interface, and the current network requests and responses are all sent and transmitted through network data streams, which are digitally encoded signals of information used in transmission. sequence. By monitoring these data streams, that is, monitoring the traffic of accessing network files, the data content of the network files saved in the cache can be acquired in real time. Due to the sequence nature of the data stream, different network files have different data sequences. Therefore, by extracting part of the data stream of the network file written into the cache, there is a unique correspondence with the network file. , and the extracted part of the data stream can be used for subsequent data verification by writing the files in the cache to the local storage.

Therefore, in this step, when the user browses each network file, when the stream data of the network file is downloaded into the cache, a part of the data stream is extracted from the data stream as the verification data of the network file. The manner of extracting a part of the data stream is not limited in the embodiment of the present invention to be a manner of extracting by random sampling or a manner of extracting a fixed position. The extracted partial data stream is associated with the network file and saved locally for invocation of subsequent matching steps.

102. Associate the link address of the network file with the verification data.

According to the part of the data stream extracted in step 101, that is, the verification data, when saving, in addition to establishing an association relationship between the verification data and the network file, it is also necessary to establish an association relationship with the source of the network file, that is, to obtain the network file. link address. For this reason, while extracting the verification data, it is also necessary to record the link address of the currently received data stream, and save the link address together locally. Specifically, these associated data can be stored in the form of a data table. The data table records the file name of each cached network file, the extracted verification data and the corresponding link address. By querying the file name or verification data or link address in the data table, the other two contents associated with the query content can be matched.

103. Monitor the data stream written to the file in the local storage, and match the verification data contained in the data stream.

Wherein, the write file stored in the local storage monitored in this step refers to saving the network file in the cache to the network file in the local storage. Since these network files may not be the currently browsed network content, in order to determine the source of these network content, it is necessary to monitor the written content in real time when writing these network files to the local storage, and determine the content. contains the verification data saved in the above steps.

Since each network file in the cache is cached, the verification data is extracted, and there is a unique correspondence between these verification data and the network file. Therefore, when matching the network file written to the local storage, it must be A verification data will be matched, and when the corresponding verification data is matched, step 104 is executed. For the case where the verification data is not matched, there may be two reasons: one is that the network file is stored in the cache before the extraction verification data operation is performed, resulting in the cached network file without corresponding verification data . The other is that the network file is rewritten during the process of writing from the cache to the local storage or before the writing operation, so that the corresponding verification data cannot be matched.

For the above two cases, since the network file written cannot obtain its corresponding link address, it is impossible to judge the security of the file. At this time, the user may be informed through a prompt page that the stored current network file is at risk, and the user is required to determine whether to continue the writing operation or terminate the operation.

104. According to the successfully matched verification data, mark the link address associated with the verification data in the write file.

When the monitored write file contains corresponding verification data, the system will use the verification data to find its corresponding link address, and mark the link address in the write file. The specific labeling method in the embodiment of the present invention is to add the link address to the attribute of the file in the form of a label, or to add the link address to the file name of the written file.

The above-mentioned method for identifying the source of a downloaded file provided by the embodiment of the present invention is mainly used to mark the source of the downloaded file, so as to judge the security of the file according to the source of the file. In the identification process, part of the data in the file cache is extracted as verification data, and the link address for accessing the file is recorded at the same time, and is associated with the corresponding verification data, and then the file in the cache is saved to the local storage. , monitor the data stream written to the file, match the verification data contained in the data stream, mark the link address associated with the verification data in the write file, and complete the marking of the source of the downloaded file. By marking the source of the file, if the content of the file cannot be identified, whether the file is a secure file can be identified by judging the source of the file, thereby improving the ability of the system to identify the file.

Further, in order to explain in more detail the specific implementation of the above-mentioned method for identifying the source of downloaded files in practical applications, especially in the cache stage of network files, the specific details of extracting verification data from the data stream of the cached network file and saving the verification data. The method will be described in detail in the following embodiments, as shown in Figure 2, including:

201. Extract a part of the data stream of the cached network file to obtain verification data.

The method of extracting part of the data stream of the network file in this step may be to randomly extract a fixed-size data stream from the network file in this embodiment of the present invention, wherein, in order to ensure that the fixed-size data stream has a unique correspondence with the network file relationship, the size of this data stream should have enough data content to generate validation data. In addition, multiple data streams can also be extracted from the network file, and the multiple data streams can be combined into one verification data. In this way, when matching the verification data, it is determined only when all the data streams are successfully matched. The write file and the network file corresponding to the verification data are the same file.

Further, when the network file accessed by the user is an encrypted file, at this time, when the encrypted file is cached, the system will call the corresponding decryption function according to the encrypted format of the encrypted file to decrypt the encrypted file, and obtain the encrypted file after decryption. Extract part of the data stream from the plaintext data to obtain the corresponding verification data.

202. Associate the link address of the network file with the verification data.

This step is to establish an association relationship between the link address of the network file and the verification data on the basis of obtaining the verification data. In the embodiment of the present invention, the association relationship is expressed in the form of an associative array. Specifically, the associated data is expressed in the form of a KEY-VALUE key-value pair, where the KEY stores the link address and the VALUE stores the verification data. By judging whether the written file contains the same VALUE value, if the same, it proves that the written file is a network file from which the verification data is extracted, that is, the source of the written file is the link address stored in the KEY value. .

The above two steps are the processing operations performed by the user to cache the network file in the memory of the local device or in the designated cache area during the process of browsing the network file, mainly including the extraction of the verification data and the establishment of the association relationship. The corresponding processing result is to create a verification data for all network files in the cache, and associate the verification data with the link address corresponding to the network file, thereby obtaining a list of association relationships, in which the above-mentioned items are stored respectively. associative array. On this basis, the embodiment of the present invention can also report the list to the cloud server, and the cloud server parses the associated data in the list, identifies the link address recorded in the list, and determines whether the link address is a malicious website Or a secure website, through the identification and judgment of the cloud server, the corresponding information will be fed back to the local. Accordingly, the local device can delete the network files identified as malicious URLs in the cache, or set these network files as data files that are prohibited from being written to the local storage.

203. Monitor the data stream written to the file in the local storage, and match the verification data contained in the data stream.

204. According to the successfully matched verification data, mark the link address associated with the verification data in the write file.

The above two steps are the same as the above-mentioned steps 103 and 104, and they are all specific operations performed in the storage stage of the network file, that is, the real-time monitoring of the written data stream is performed, and the corresponding verification data is matched. The verification data is the verification data extracted in step 201 , and its source is marked in the written file according to the corresponding verification data, that is, the link address associated in step 202 is marked.

Through the above steps, the process of identifying the source of the written file is completed. In this process, it should be noted that the process of writing the file is the process of saving from the local cache to the local storage, for example, from the memory The process of writing files to the hard disk. In this process, a data file is selected from multiple files in the cache of the user, and source information is marked on the data file by the method provided by the embodiment of the present invention. The main purpose of this is that the user does not need to judge the security of the data file without executing the data file locally, so as to avoid harm and loss to the local device or system caused by the execution of the data file. Refer to step 205 for how to identify the security of the network file marked with the source information.

205. Determine whether the written file can be saved in the local storage according to the link address marked in the written file.

After determining the source identifier written in the file, that is, the link address, the local device can identify and judge the link address through the defense software in the local system to determine whether the link address is a malicious website. When the local defense software cannot determine whether it is safe, it can further send these link addresses to the cloud server through the network, and use the cloud server to determine whether the link address is a malicious website or a safe website.

Further, when it is determined that the link address written to the file is a non-secure website, the system will output alarm information to the user, and the alarm information will display different levels of processing opinions to the user according to the nature of the link address. The alarm information will advise the user to delete the write file, and for the link address whose security cannot be determined, the output alarm information is to remind the user that the write file is at risk, and it is recommended to isolate the write file. In addition, the alarm information output to the user is also used to obtain the user's operation instruction. For example, in the alarm information, the user can also choose to save the written file or delete the operation instruction of the written file.

It can be seen from the method for identifying the source of the downloaded file proposed in the above embodiment that when an unknown file in the cache is saved to the local storage, marking the link address of the file can not only help the user to understand the relevant information of the file, but also The security of the file can be judged by the link address, thereby improving the security of the local application of the network file.

The specific implementation of the method for identifying the source of a downloaded file in practical applications is described in detail above. As a specific device for implementing the above method, an embodiment of the present invention also provides a device for identifying the source of a downloaded file. As shown in FIG. 3 , the device include:

The extraction unit 31 is used to monitor the flow of the accessed network file, extract part of the data flow of the network file, and obtain verification data;

an association unit 32, configured to associate the link address of the network file with the verification data extracted by the extraction unit 31;

A matching unit 33, for monitoring the data stream of the written file in the local storage, and matching the verification data extracted by the extraction unit 31 contained in the data stream;

The marking unit 34 is configured to mark the link address associated with the verification data in the writing file according to the verification data successfully matched by the matching unit 33 .

Further, as shown in FIG. 4 , the extraction unit 31 includes:

The first extraction module 311 is used to randomly extract a fixed-size data stream in the network file to generate verification data;

The second extraction module 312 is configured to extract multiple data streams in the network file, and generate verification data including multiple data stream files.

Further, as shown in FIG. 4 , the extraction unit 31 further includes:

The calling module 313 is used to call the decryption function of the encrypted file when the accessed network file is an encrypted file;

The third extracting module 314 is configured to extract part of the data stream in the plaintext data stream output after decrypting the encrypted file by the decryption function called by the calling module 313 to obtain the verification data.

Further, as shown in FIG. 4 , the association unit 32 includes:

Obtaining module 321, for obtaining the link address of the network file;

The association module 322 is configured to associate the link address obtained by the obtaining module 321 with the verification data by using an associative array KEY-VALUE key-value pair, where the KEY stores the link address, and the VALUE stores the verification data.

Further, as shown in Figure 4, the device further includes:

The sending unit 35 is used to report the associative array obtained by the associative unit 32 to the cloud server, so that the cloud server judges whether the network file is safe according to the link address in the associative array;

The determining unit 36 is configured to determine whether the network file can be saved in the local storage according to the information fed back by the cloud server.

Further, as shown in Figure 4, the device further includes:

Judging unit 37, for judging whether the link address is a secure link according to the link address marked by the labeling unit 34 in the write file;

The processing unit 38, when the judging unit 37 judges that the link address is not a secure link, prompts an alarm message to the written file, and executes an isolation or deletion operation.

To sum up, the method and device for identifying the source of a downloaded file provided by the embodiments of the present invention are mainly used to mark the source of the downloaded file, so as to judge the security of the file according to the source of the file. In the identification process, by extracting part of the data in the file cache process as verification data, recording the link address of accessing the file, and associating it with the corresponding verification data, and then saving the file in the cache to the local storage , monitor the data stream written to the file, match the verification data contained in the data stream, mark the link address associated with the verification data in the write file, and complete the marking of the source of the downloaded file. By marking the source of the file, it can help the user to provide relevant information on the content of the file when the content of the file cannot be identified, so that the user can judge whether the file is the file to be downloaded. The determination of the source of the file identifies whether the file is a secure file, thereby improving the system's ability to identify the file.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

It can be understood that, the relevant features in the above cloud server and device may refer to each other. In addition, "first", "second", etc. in the above-mentioned embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing cloud server embodiment, which will not be repeated here.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It should be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known cloud servers, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. However, this disclosure of a cloud server should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any cloud server so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive Or all processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the components of the inventive title (eg, a device for determining a connection level within a website) according to embodiments of the present invention some or all of the functions. The present invention can also be implemented as an apparatus or apparatus program (eg, computer programs and computer program products) for executing part or all of the cloud server described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

Claims (12)

1. A method for identifying a source of a downloaded file, the method comprising:

monitoring the flow of the accessed network file, and extracting partial data stream of the network file to obtain verification data;

associating the link address of the network file with the verification data;

monitoring a data stream of a written file in a local storage, and matching verification data contained in the data stream;

and marking the link address associated with the verification data in the written file according to the verification data successfully matched.

2. The method of claim 1, wherein extracting the partial data stream of the network file to obtain the verification data comprises:

randomly extracting a section of data stream with a fixed size in the network file to generate verification data;

or extracting a plurality of data streams in the network file to generate verification data containing a plurality of data stream files.

3. The method of claim 1 or 2, wherein extracting the partial data stream of the network file to obtain the verification data comprises:

when the accessed network file is an encrypted file, calling a decryption function of the encrypted file;

and extracting part of data stream in the plaintext data stream output by the decryption function to obtain the verification data.

4. The method of claim 1, wherein associating the link address of the network file with the authentication data comprises:

acquiring a link address of the network file;

and associating the link address with the verification data by using an associated array KEY-VALUE KEY VALUE pair, wherein the KEY stores the link address, and the VALUE stores the verification data.

5. The method of claim 4, further comprising:

reporting the association array to a cloud server so that the cloud server can judge whether the network file is safe or not according to the link address in the association array;

and determining whether the network file can be stored in a local storage according to the information fed back by the cloud server.

6. The method of claim 1, further comprising:

judging whether the link address is a safe link or not according to the link address marked in the written file;

if not, prompting alarm information to the written file, and executing isolation or deletion operation.

7. An apparatus for identifying a source of a downloaded file, the apparatus comprising:

the extraction unit is used for monitoring the flow of the accessed network file, extracting partial data stream of the network file and obtaining verification data;

the association unit is used for associating the link address of the network file with the verification data extracted by the extraction unit;

the matching unit is used for monitoring the data stream of the written file in the local storage and matching the verification data contained in the data stream;

and the marking unit is used for marking the link address associated with the verification data in the written file according to the verification data successfully matched by the matching unit.

8. The apparatus of claim 7, wherein the extraction unit comprises:

the first extraction module is used for randomly extracting a section of data stream with a fixed size in the network file to generate verification data;

and the second extraction module is used for extracting a plurality of data streams in the network file and generating verification data containing a plurality of data stream files.

9. The apparatus according to claim 7 or 8, wherein the extraction unit further comprises:

the calling module is used for calling a decryption function of the encrypted file when the accessed network file is the encrypted file;

and the third extraction module is used for extracting part of data streams in the plaintext data streams output after the encrypted files are decrypted by the decryption function called by the calling module to obtain the verification data.

10. The apparatus of claim 7, wherein the associating unit comprises:

the acquisition module is used for acquiring the link address of the network file;

and the association module is used for associating the link address with the verification data by using an association array KEY-VALUE KEY VALUE pair, wherein the KEY stores the link address, and the VALUE stores the verification data.

11. The apparatus of claim 10, further comprising:

the sending unit is used for reporting the association array obtained by the association unit to a cloud server so that the cloud server can judge whether the network file is safe or not according to the link address in the association array;

and the determining unit is used for determining whether the network file can be saved in a local storage according to the information fed back by the cloud server.

12. The apparatus of claim 7, further comprising:

the judging unit is used for judging whether the link address is a safe link or not according to the link address marked by the marking unit in the written file;

and the processing unit prompts alarm information for the written file and executes isolation or deletion operation when the judging unit judges that the link address is not the safe link.

Images