WO2025092706A1 - Virus detection and removal drilling method and apparatus, device, and storage medium - Google Patents

Abstract

A virus detection and removal drilling method and apparatus, a device, and a storage medium. The method comprises: when receiving a workflow starting instruction, acquiring backup data from a disaster recovery system (S101); carrying out data recovery on the backup data, and determining target recovery data (S102); and carrying out a virus detection and removal drill on the target recovery data in a preconstructed data sandbox having a unidirectional isolation function (S103).

Description

Virus detection and killing drill method, device, equipment and storage medium

This application claims priority to the Chinese patent application filed with the China Patent Office on October 31, 2023, with application number 202311436379.6, the entire contents of which are incorporated by reference into this application.

Technical Field

The present application relates to the field of data security technology, and for example, to a virus detection and killing drill method, device, equipment and storage medium.

Background Art

In recent years, computer viruses, especially ransomware, have had a significant impact on the availability and data security of business systems and have become increasingly rampant.

In response to the above threats, the main method at the data level is to use backup or disaster recovery systems to regularly back up necessary data to the disaster recovery system. Once the data in the production environment is infected with a virus, the data in the disaster recovery system can be used to quickly restore it and minimize the loss. However, this method cannot solve all anti-ransomware problems. If the production data has been infected before the backup or the file is in the virus infection incubation period during the backup, the backup can no longer prevent the virus from infecting the data.

The general solution is to use the disaster recovery system to regularly restore backup data, and then use antivirus software to detect viruses on the restored data to ensure data security. This method is called a virus detection drill. However, if the antivirus environment is not isolated from the production environment during the antivirus process, each virus detection may affect the production environment, causing greater and incalculable losses.

Summary of the invention

The present application provides a virus detection and killing drill method, device, equipment and storage medium, which solves the problem of the antivirus environment and the production environment not being isolated, avoids the impact of the virus detection and killing process on the production environment, realizes virus detection and killing while ensuring the security of production data in the production environment, and reduces economic losses in production.

In a first aspect, an embodiment of the present application provides a virus detection and killing drill method, comprising:

After receiving the workflow start instruction, the backup data is obtained from the disaster recovery system;

Performing data recovery on the backup data and determining target recovery data;

A virus detection and killing drill is performed on the target recovery data in a pre-built data sandbox with a one-way isolation function.

In a second aspect, an embodiment of the present application provides a virus detection and killing drill device, including:

A backup data recovery module is configured to obtain backup data from a disaster recovery system after receiving a workflow start instruction;

A recovery data determination module, configured to perform data recovery on the backup data and determine target recovery data;

The virus detection and killing drill module is configured to perform a virus detection and killing drill on the target recovery data in a pre-built data sandbox with a one-way isolation function.

In a third aspect, an embodiment of the present application provides an electronic device, including:

at least one processor; and

a memory communicatively connected to at least one processor; wherein,

The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the virus detection and killing drill method provided in the above-mentioned first aspect embodiment.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the virus detection and killing drill method provided in the embodiment of the first aspect above when executed.

BRIEF DESCRIPTION OF THE DRAWINGS

The following is an introduction to the drawings required for use in the description of the embodiments. The drawings described below are drawings of some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

FIG1 is a flow chart of a virus detection and killing drill method provided in Example 1 of the present application;

FIG2 is a schematic diagram of the structure of a data sandbox involved in a virus detection and killing drill method provided in Example 1 of the present application;

3 is a flow chart of a data sandbox construction involved in a virus detection and killing drill method provided in Example 1 of the present application;

FIG4 is a flow chart of a virus detection and killing drill method provided in Example 2 of the present application;

FIG5 is a schematic diagram of a virus detection and killing drill provided in Example 2 of the present application;

FIG6 is a schematic diagram of an open integrated antivirus engine involved in a virus detection and killing drill method provided in Example 2 of the present application;

FIG7 is a schematic diagram of the structure of a virus detection and killing drill device provided in Example 3 of the present application;

FIG8 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present application.

DETAILED DESCRIPTION

In order to make the technical personnel in this field understand the scheme of this application, the embodiments of this application will be described below in conjunction with the drawings in the embodiments of this application, and the described embodiments are some embodiments related to this application. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of this application.

The terms "first", "second" and "target" etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units listed, but may include other steps or units that are not listed or inherent to these processes, methods, products or devices.

Embodiment 1

Figure 1 is a flow chart of a virus detection and killing drill method provided in Example 1 of the present application. This embodiment can be applied to the situation of performing virus detection and killing drills in a data sandbox with a one-way isolation function. The method can be executed by a virus detection and killing drill device, and the virus detection and killing drill device can be implemented in the form of hardware and/or software.

The present application proposes a method for performing virus detection and killing drills in a data sandbox, which is isolated from the production environment. By performing virus detection and killing in the data sandbox, the security of the virus detection and killing drills is ensured. In addition, the virus detection and killing drill method proposed in the present application is open and supports the integration of multiple antivirus engines, which can effectively respond to different virus detection and killing needs.

As shown in FIG1 , the method includes:

S101, after receiving a workflow start instruction, obtaining backup data from a disaster recovery system.

In this embodiment, the workflow start instruction can be understood as an instruction for starting the overall operation process. The disaster recovery system can be understood as a backup system for preventing disaster situations, which is used to back up production data in the production environment. The production environment is the customer's business environment. The backup data can be understood as the data generated by backing up the production data of the production environment in the disaster recovery system.

Exemplarily, when a workflow start instruction is received, it can be determined that the current virus detection and killing drill can be started and executed. Therefore, it is necessary to first obtain backup data from the disaster recovery system so as to perform a virus detection and killing drill based on the backup data later.

S102: Restore the backup data and determine target recovery data.

In this embodiment, the target recovery data can be understood as the recovery data used for virus detection and killing drills. The data content of the target recovery data is the same as the production data.

Exemplarily, the backup data is restored to a resource directory in a pre-built data sandbox according to a preset data recovery algorithm, wherein the preset data recovery algorithm can be determined according to actual needs. The data sandbox includes at least one recovery resource, and there are multiple resource directories on the recovery resource. The recovery data formed after the backup data is restored is stored in the resource directory in the data sandbox.

S103: Perform virus detection and elimination drill on target recovery data in a pre-built data sandbox with a one-way isolation function.

In this embodiment, the data sandbox is a line of defense for network security. All programs running in the sandbox are simulated exercises, not real applications. The working process of the sandbox is to run the program in an isolated space, and the program running in the sandbox is readable but not writable, so as to prevent the program from causing permanent modification or damage to other programs and data on the computer. Exemplarily, the understanding of the data sandbox can be: the computer is a piece of paper, the running and modification of the program is like writing on the paper, and the sandbox is equivalent to a piece of glass placed on the paper. The running and modification of the program can only be written on that piece of glass, and the paper is still clean.

In some embodiments, the data sandbox in this embodiment can provide a network environment isolated from the production network.

Exemplarily, a data sandbox with a one-way isolation function is pre-built. Except for designated data, the data sandbox cannot interact with the production environment. Therefore, to ensure the security of the production environment, in the data sandbox with a one-way isolation function, a virus detection drill is performed on the target recovery data restored to the resource directory in the data sandbox according to a pre-selected virus detection engine.

A virus detection and killing drill method provided in an embodiment of the present application obtains backup data from a disaster recovery system after receiving a workflow start instruction; performs data recovery on the backup data and determines the target recovery data; and performs virus detection and killing drills on the target recovery data in a pre-built data sandbox with a one-way isolation function. The backup data is restored to a network-isolated recovery resource for virus detection and killing, thereby avoiding the impact on the production environment, and virus detection and killing of data under the specified path of the recovery resource is achieved, thereby ensuring the security of the recovery data. The problem of the antivirus environment and the production environment not being isolated is solved, and the impact of the virus detection and killing process on the production environment is avoided. While achieving virus detection and killing, the security of production data in the production environment is guaranteed, thereby reducing economic losses in production.

In some embodiments, based on the above embodiments, the method further includes:

Generate a virus detection and killing drill report and feed it back to the server.

In this embodiment, the virus detection and killing drill report can be understood as a report formed according to the results of the virus detection and killing drill. The server can be understood as a server. The server, the client, and the electronic device as the execution subject of the embodiment of the present application are all remotely wirelessly connected, and data interaction between any two parties can be achieved. The client can also interact with the user.

Exemplarily, after performing a virus detection drill on the target recovery data in the data sandbox, a corresponding virus detection drill report is generated based on the results of the virus detection drill, and the virus detection drill report is uploaded to the server. The server can send the virus detection drill report to the client for user query and display according to the client's calling requirements.

Figure 2 is a schematic diagram of the structure of a data sandbox involved in a virus detection and killing drill method provided in Example 1 of the present application. The data sandbox includes at least a proxy device and a virtual switch vSwitch2 without an uplink. A virtual network card vNic1 connected to the outside and multiple virtual network cards vNic2, vNic3, vNic4... connected to the inside are created on the proxy device. Multiple isolated network port groups are created on the virtual switch vSwitch2. Multiple internally connected virtual network cards and multiple isolated network port groups are connected one by one to build a network. Based on the above embodiments, in some embodiments, the steps of building a data sandbox are further added, including:

a1) Create a virtual switch without an uplink on the target virtualization platform, and create a preset number of isolated network ports on the virtual switch.

In this embodiment, the target virtualization platform is a virtualization platform determined based on the selection of the client user. A virtual switch without an uplink can be understood as a switch with a unidirectional isolation function. The virtual switch is the basis for the data sandbox to have isolation capabilities. Since there is no uplink, the virtual switch is isolated from the external network. At this time, any virtual machine connected to the virtual switch network is isolated from the external network. The isolated network port can be understood as a network port used for networking. The isolated network is a mapping of the production network of the external environment. Each production network can be mapped to an isolated network. Through mapping, multiple isolated networks inside the data sandbox together form a network similar to the production network. The difference is that the network is inside the data sandbox, isolated from the outside world, and will not affect the external environment.

The virtualization platform selected by the client and the user through interaction is determined as the target virtualization platform, and a data sandbox is constructed on the target virtualization platform based on the program. Exemplarily, a virtual switch without an uplink is created on the target virtualization platform, and a preset number of isolated network ports are created on the created virtual switch without an uplink, wherein the preset number of isolated network ports is a mapping of the production network ports in the data sandbox, and therefore, the preset number may be the same as the number of production network ports in the production network, and may be less than the number of production network ports under certain conditions.

b1) Creating a virtual machine with a preset operating system and enabled routing and forwarding functions on the target virtualization platform, and determining the virtual machine as a proxy device.

In this embodiment, the preset operating system can be understood as a Linux system. The proxy device can be understood as a device for data transfer. The proxy device is a Linux virtual machine with routing and forwarding functions enabled. It has multiple virtual network cards, one of which is connected to the external network, and the others are connected to the isolated network inside the data sandbox. The proxy device is not only the only bridge for communication between the outside world and the inside of the data sandbox, but also acts as a router connecting multiple isolated networks inside the data sandbox.

For example, a virtual machine of the Linux operating system is created on the target virtualization platform, and the routing The forwarding function determines the virtual machine as a proxy device for transferring between virtual machines within the data sandbox and between the data sandbox and the target virtualization platform.

c1) Establishing a connection between the proxy device and the isolated network port, and a connection between the proxy device and the target virtualization platform.

In this embodiment, a virtual network card is created on the proxy device, the virtual network card is connected to a production network of the target virtualization platform, and an Internet Protocol (IP) address is configured to establish a connection between the virtual network card and the production network, thereby realizing the connection between the proxy device and the target virtualization platform. In some embodiments, multiple virtual network cards are created on the proxy device, the number of which is the same as the number of isolated network ports, the virtual network cards created on the proxy device with the same number of isolated network ports are configured with addresses corresponding to the isolated network ports, and connections between the multiple virtual network cards and the isolated network are established to realize the connection between the proxy device and the isolated network ports.

In some embodiments, establishing a connection between the proxy device and the isolated network port includes:

c11) Creating a preset number of virtual network cards on the proxy device, and connecting each virtual network card to its corresponding isolated network port.

In this embodiment, a preset number of virtual network cards are created on the proxy device, the number of virtual network cards is consistent with the number of isolated network ports, and the virtual network cards are connected to the isolated network ports in a one-to-one correspondence.

c12) Determine the gateway address of the production network mapped to each isolated network as the address of the virtual network card corresponding to the isolated network.

In this embodiment, the production network mapped by the isolated network is determined, and the gateway address corresponding to the production network is determined, and the gateway address of the production network is determined as the IP address of the virtual network card connected to the isolated network.

c13) Receive the network configuration information of the client and configure the subnet mask and camouflage network segment of the virtual network card according to the network configuration information.

In this embodiment, the network configuration information can be understood as the network address information input by the user when the client interacts with the user.

Exemplarily, receiving the network configuration information of the client, the network configuration information of the client including the subnet mask and camouflage network segment configuration information of the virtual network card, and configuring the subnet mask and camouflage network segment of the virtual network card according to the network configuration information transmitted by the client.

d1) Receive the firewall configuration information of the client and configure the corresponding firewall rules for the proxy device according to the firewall configuration information.

In this embodiment, the firewall configuration information can be understood as the configuration information of the network filter (iptables).

Exemplarily, the firewall configuration information is information configured by the user during the process of interaction between the client and the user. Therefore, the firewall configuration information transmitted by the client is received, and the corresponding iptables configuration (firewall rule configuration) is performed on the proxy device according to the firewall configuration information.

FIG3 is a flowchart of the data sandbox construction involved in a virus detection and killing drill method provided in Example 1 of the present application. The data sandbox constructed based on this has three functions: one-way external connectivity, internal intercommunication, and support for active requests from the inside of the data sandbox to the outside according to the specified IP and port. Among them, the external one-way connectivity function allows active access to the inside of the data sandbox from the outside of the data sandbox, and allows the internal response to go out, and does not allow the data sandbox to actively access the outside of the data sandbox. Since the proxy device is the only bridge for communication between the inside of the data sandbox and the outside world, the one-way isolation is mainly achieved by configuring the corresponding iptables rules on the proxy device; the internal intercommunication function, multiple networks inside the data sandbox support mutual connectivity, and the internal intercommunication is mainly achieved by marking the traffic inside the isolated network on the proxy device, and setting the corresponding routing strategy; support for the active request function of opening the data sandbox from the inside to the outside according to the specified IP and port is a special case of the external one-way connectivity function. According to actual needs, it can allow the request to access the specified IP address and port from the inside of the data sandbox to pass, and this function is also achieved by configuring the corresponding iptables rules on the proxy device.

As shown in Figure 3, the configuration process of the data sandbox is as follows:

S10. Select a virtualization platform: Select a virtualization platform (for deploying a data sandbox).

S11. Create a virtual switch without an uplink: create a virtual switch without an uplink on the virtualization platform.

S12. Create a proxy device and enable routing forwarding: create a virtual machine of a Linux operating system on the virtualization platform and enable routing forwarding function.

S13. Add a virtual network card on the proxy device, connect it to a production network external to the virtualization platform, and configure an IP address: Add a virtual network card on the proxy device, connect the virtual network card to a production network external to the virtualization platform, and configure an IP address.

S14. Create N port groups on the previously created virtual switch, where N is the number of production networks that need to be mapped: create multiple isolated network port groups on the virtual switch according to the number of production networks that need to be mapped, and the number of isolated network port groups is the same as the number of production networks that need to be mapped.

S15. Add N virtual network cards on the proxy device, connect them to the port groups created in the previous step respectively, and configure the IP, subnet mask, and camouflage network segment: Create multiple virtual network cards on the proxy device, connect the virtual network cards to the isolated networks one by one, and set the IP address, subnet mask, and camouflage network segment of the virtual network cards created on the proxy device. The IP address needs to be set to the gateway address of the production network mapped to the isolated network corresponding to the virtual network card.

S16. Configure iptables rules and arptables rules on the proxy device: Configure the corresponding The corresponding iptables rules and arptables rules. The basic idea of arptables rules is the same as iptables, but arptables processes packets related to Address Resolution Protocol (arp).

S17, determine whether the isolated network is interconnected: if the isolated network is interconnected, execute step S18; if the isolated network is not interconnected, execute step S19.

S18. Mark the internal traffic on the proxy device and set the routing policy: If the internal interconnection of the isolated network is enabled, continue to configure on the proxy device, mark the messages that meet the internal characteristics of the isolated network, and specify the corresponding routing policy.

S19. Determine whether the specified IP and port are open: If the specified IP and port are open, execute step S20; if the specified IP and port are not open, end the data sandbox construction process and complete the construction of the data sandbox.

S20. Configure iptables rules on the proxy device: If the traffic of an IP address and port is specified to be released to the outside, continue to configure the corresponding iptables rules on the proxy device. After the configuration is completed, the data sandbox construction process ends and the construction of the data sandbox is completed.

Embodiment 2

Figure 4 is a flow chart of a virus detection and killing drill method provided in Example 2 of the present application. This embodiment is an optimization of any of the above embodiments and can be applied to situations where virus detection and killing drills are performed in a data sandbox with a one-way isolation function. The method can be executed by a virus detection and killing drill device, which can be implemented in the form of hardware and/or software.

As shown in FIG. 4 , the method includes:

S201. After receiving a workflow start instruction, obtain backup data from a disaster recovery system.

S202: Restore the backup data to the recovery resources in the data sandbox to form initial recovery data and verify it.

In this embodiment, the initial recovery data may be understood as the backup data directly restored to the recovery resource without verification.

For example, traditional data recovery is abandoned and data recovery is performed by mounting recovery. Mounting recovery refers to mounting backup data to recovery resources through protocols such as Network File System (NFS), Internet Small Computer System Interface (iSCSI), Fibre Channel Storage Area Network (FC SAN), Simple Storage Service (S3), Distributed File System (Hadoop Distributed File System, HDFS), and Container Storage Interface (CSI). Initial recovery data is formed on the recovery resource to achieve rapid recovery of services. This method does not require occupying The storage of recovery resources not only improves data recovery efficiency but also saves costs. After the backup data is restored to the recovery resources in the data sandbox to form the initial recovery data, the initial recovery data is verified by a preset verification method to determine whether the data content of the initial recovery data is consistent with the production data backed up by the backup data. If so, it is determined that the initial recovery data verification has passed; if not, it is determined that the initial recovery data verification has failed.

S203: Determine the verified initial recovery data as the target recovery data.

In this embodiment, the target recovery data can be understood as recovery data that is consistent with the production data and can be used for virus detection and killing drills.

Exemplarily, the initial recovery data passes verification, indicating that the data content is consistent with the production data and can be used for virus detection and killing drills. Therefore, the verified initial recovery data is determined as the target recovery data for virus detection and killing drills.

S204: Send virus detection engine options to the client, and receive target virus detection engine feedback from the client.

In this embodiment, the virus detection engine option can be understood as a virus detection engine that can be selected by the client user, including a software development kit (SDK), a license, and anti-virus software of a virus database, etc. The target virus detection engine can be understood as a virus detection engine selected by the client user.

Exemplarily, several virus detection engines are sent to the client as options, and the client user selects one or more virus detection engines from the virus detection engine options, and the client transmits the selection information back to the electronic device that is the subject of the application execution. The virus detection engine selected by the user is determined as the target virus detection engine.

S205. In a pre-built data sandbox with a one-way isolation function, a virus detection drill is performed on the target recovery data according to the target virus detection engine, wherein the data sandbox includes at least one recovery resource, each recovery resource includes at least one resource directory, and the target recovery data is in the resource directory.

In this embodiment, the data sandbox with a one-way isolation function includes at least one recovery resource, each recovery resource includes at least one resource directory, and the target recovery data is on the resource directory. Multiple virus detection engine instances (target virus detection engines) are simultaneously pulled up on the recovery resource to perform parallel detection on the target path on the resource. In order to better control the resource usage of the recovery resource, the configurable concurrency of the recovery resource and the concurrency configured for a single virus detection task are managed as a resource pool. A parallel detection upper limit can be configured according to the actual situation of the recovery resource, and an expected concurrency can be configured for each virus detection task. When the actual task process is executed, it is necessary to control the number of concurrencies that can actually be used for each detection task based on the upper limit of the concurrency of the recovery resource and the concurrency used by the actual detection task. This method not only makes full use of the recovery resources, but also ensures the efficiency of virus detection. Among them, the resource pool is a configuration mechanism for recovery resources, which is used to manage the number of concurrent virus detection engines for recovery resources and the number of concurrency of a single virus detection task. The number of concurrent virus detection engines that can be used for virus detection tasks.

Figure 5 is a schematic diagram of a virus killing drill provided in Example 2 of the present application. As shown in Figure 5, a virus killing drill is performed on the target recovery data on the recovery resource in the data sandbox. In the figure, the production environment is the client business environment; the distributed storage is the backup medium, which is used to store the backup data; the virus killing configuration refers to the configuration of the killing path of the target recovery data for virus killing, which can be connected with other different types of configurations according to a certain topological relationship to form a specific task process, through which a series of functions such as data recovery, virus killing, recovery data verification, recovery resource cleaning and email notification can be realized in sequence; the antivirus engine refers to the antivirus software including the virus killing SDK, license and virus library; the recovery resource refers to the destination end used for data recovery, which can be the production environment or other environments that are interconnected with the production environment, and virus killing is also performed on this resource.

Exemplarily, as shown in Figure 5, virus detection and killing drills are conducted in isolation and security from the production network, including: S21, creating a data sandbox, and deploying recovery resources and antivirus engine clients in the data sandbox, the data sandbox specifies the registration port of the antivirus engine client open to the outside world to the virus detection and killing drill server; S22, configuring the task process, wherein the virtualization platform on which the data sandbox is deployed is selected as the recovery resource in the recovery resource configuration of the disaster recovery configuration; S23, virus detection and killing configuration, selecting one or more paths on the recovery resource as the path to be virus detected and killed, and selecting the antivirus engine client in the data sandbox as the antivirus client, and then configuring virus detection and killing; S24, configuration of other nodes in the task process; S25, initiating the task process.

Figure 5 includes a built-in virus detection engine and a third-party virus detection engine, which can support different types of antivirus engines and realize open calls to multiple virus detection engines. Figure 6 is a schematic diagram of an open integrated antivirus engine involved in a virus detection drill method provided in Example 2 of the present application. As shown in Figure 6, the open integrated antivirus engine includes a virus detection scheduling layer, a virus detection adaptation layer, and a virus detection engine. Among them, the virus detection scheduling layer mainly provides a set of public virus detection interface definitions, which are implemented by each virus detection engine adapter. When initiating virus detection, the specified virus detection engine public interface is directly called to implement it, regardless of the function of the virus detection engine. The virus detection adaptation layer mainly stores adapters. The adapter is a unified encapsulation for different types of antivirus engines. Different virus detection engines only need to implement a set of interfaces defined by the upper scheduling layer, and the scheduling and use of the virus detection engine are realized in the implementation of these interfaces. The virus detection engine includes the virus detection SDK, license and virus library files. The SDK contains a series of interfaces required for virus detection. The license file is a file that authorizes the call of the interface. The virus library is a file used to record virus characteristics.

In some embodiments, performing virus detection drill on target recovery data according to the target virus detection engine includes:

a2) Calling the adapter corresponding to the target virus detection engine through the preset virus detection interface.

In this embodiment, the preset virus detection and killing interface can be understood as a public interface provided by the virus detection and killing scheduling layer. The common virus detection interface definition can correspond to various types of virus detection adapters.

Exemplarily, the virus detection scheduling layer calls a preset virus detection interface to connect with the virus detection adaptation layer, and calls the virus detection adapter corresponding to the target virus detection engine in the virus detection adaptation layer through the preset virus detection interface.

b2) Calling the target virus detection engine according to the adapter corresponding to the target virus detection engine to perform virus detection drill on the target recovery data.

In this embodiment, after the virus detection scheduling layer calls the adapter of the virus detection adaptation layer, the corresponding target virus detection engine is called according to each adapter, and the target virus detection engine performs parallel virus detection drills on the target recovery data.

The present embodiment provides a method for virus detection and killing drill, which obtains backup data from the disaster recovery system after receiving a workflow start instruction; restores the backup data to the recovery resources in the data sandbox to form initial recovery data and verify it; determines the initial recovery data that has passed the verification as the target recovery data; sends the virus detection and killing engine option to the client, and receives the target virus detection and killing engine fed back by the client; in a pre-built data sandbox with a one-way isolation function, performs virus detection and killing drills on the target recovery data according to the target virus detection and killing engine, wherein the data sandbox includes at least one recovery resource, each recovery resource includes at least one resource directory, and the target recovery data is on the resource directory. Different antivirus engines are openly integrated through the adaptation layer and the virus detection and killing scheduling layer, which solves the differences between multiple types of virus detection and killing engines and provides a technical foundation for the future integration of other virus detection and killing engines. Users can freely configure virus detection and killing, making the virus detection and killing function more complete, and quickly provide detection and killing objects and resource pools through mounting and recovery to achieve full utilization of recovery resources. The two mechanisms achieve efficient and parallel detection and killing. It solves the problem of the antivirus environment and the production environment not being isolated, avoids the impact of the virus detection process on the production environment, and ensures the security of production data in the production environment while achieving virus detection, thereby reducing economic losses in production.

Exemplarily, in order to explain the contents of the embodiments of the present application, an example is given here. The present application includes building a data sandbox with a one-way isolation function, and performing virus detection and killing drills on the recovered data on the recovery resources of the data sandbox.

Exemplarily, as shown in FIG. 2 and FIG. 5 , the method includes:

1. Select a virtualization platform A to deploy a data sandbox;

2. Create a virtual switch vSwitch2 without an uplink on A;

3. Create a virtual machine appliance proxy for the Linux operating system on A and enable the routing and forwarding function;

4. Add a virtual network card vNic1 to the appliance proxy, connect vNic1 to A's external production network, and configure the IP address;

5. Create an isolated network port group Isolated VM Network1 on vSwitch2. Add a virtual network card vNic2 to the appliance proxy and connect vNic2 to Isolated VM Network1. Assume that the virtual machine to be restored is vm1 (IP address is 192.168.125.100), which is connected to the production network VM Network1. The gateway address of VM Network1 is 192.168.125.254. Then configure the IP address of vNic2 to 192.168.125.254 and the subnet mask to the subnet mask of VM Network1. Set the masquerade network of Isolated VM Network1 to 192.168.225.0/24.

6. Assuming that the IP address of the virus detection and killing drill server is 192.168.10.100, and the port registered by the antivirus engine client to the server is 9614, configure the data sandbox to specify the open IP address as 192.168.10.100 and the port as 9614;

7. Set the corresponding iptables rules on the appliance proxy;

8. Deploy a virtual machine with an antivirus engine client installed on Isolated VM Network1, assuming it is client 1 (client1);

9. Create a task flow, where in the recovery resource section of the disaster recovery configuration, select virtualization platform A, select vm1 as the virtual machine to be recovered in the application configuration section, select A as the recovery destination, name the recovered virtual machine vm2, and select Isolated VM Network1 as the network connection;

10. In the verification configuration, select the virtual machine verification method as ping, and the target IP address is 192.168.225.100 (the masquerade IP of vm1);

11. In the virus detection configuration, select client1 as the antivirus engine client (since port 9614 of 192.168.10.100 is open, the virus detection drill server can find client1), select the /home path of the restored virtual machine vm2 as the antivirus path, and select virus detection and antivirus;

12. Select script cleanup in the cleanup configuration and specify the virtual machine to be cleaned as vm2;

13. After configuration, execute the task flow.

In this embodiment, according to the previously configured task flow, during the task execution process, vm1 will be restored to the virtualization platform A where the data sandbox is located. The name of the restored virtual machine is vm2, and the network is connected to Isolated VM Network1. In the verification stage, ping 192.168.225.100 is used from outside the data sandbox to verify whether the recovery of vm2 is normal. After verification, the /home path of vm2 is checked for viruses. Since the antivirus engine client and vm2 are both connected to Isolated VM Network1, and Isolated VM Network1 is in the data sandbox and isolated from the outside world, the security of the virus detection process can be ensured, and finally a report on this virus detection drill is generated.

Embodiment 3

FIG7 is a schematic diagram of the structure of a virus detection and killing drill device provided in Example 3 of the present application. As shown in FIG7 , the device includes:

The backup data recovery module 31 is configured to obtain backup data from the disaster recovery system after receiving a workflow start instruction;

A recovery data determination module 32 is configured to perform data recovery on the backup data and determine target recovery data;

The virus detection and killing drill module 33 is configured to perform a virus detection and killing drill on the target recovery data in a pre-built data sandbox with a one-way isolation function.

The virus detection and killing drill device adopted in this application solves the problem that the antivirus environment and the production environment are not isolated, avoids the impact of the virus detection and killing process on the production environment, realizes virus detection and killing while ensuring the security of production data in the production environment, and reduces economic losses in production.

Optionally, the recovery data determination module 32 is configured to:

Restoring the backup data to the recovery resources in the data sandbox to form initial recovery data and verifying it;

The initial restored data that has passed the verification is determined as the target restored data.

Optionally, the virus detection and killing drill module 33 includes:

A target engine determination unit, configured to send a virus detection engine option to a client, and receive a target virus detection engine feedback from the client;

The virus detection and killing drill unit is configured to perform virus detection and killing drills on the target recovery data according to the target virus detection and killing engine in a pre-built data sandbox with a one-way isolation function, wherein the data sandbox includes at least one recovery resource, each recovery resource includes at least one resource directory, and the target recovery data is on the resource directory.

Optional, virus detection drill unit is set to:

Calling the adapter corresponding to the target virus detection engine through a preset virus detection interface;

The target virus detection engine is called according to the adapter corresponding to the target virus detection engine to perform virus detection drill on the target recovery data.

Optionally, the device further comprises:

The drill report generation module is configured to generate a virus detection and killing drill report and feed the virus detection and killing drill report back to the server.

Optionally, the device further includes a data sandbox creation module, including:

an isolated network creation unit, configured to create a virtual switch without an uplink on a target virtualization platform, and to create a preset number of isolated network ports on the virtual switch;

The proxy device determining unit is configured to create a virtual machine with a preset operating system on the target virtualization platform. A virtual machine with a routing and forwarding function enabled is configured, and the virtual machine is determined as a proxy device;

an agent connection establishing unit, configured to establish a connection between the agent device and the preset number of isolated network ports, and a connection between the agent device and the target virtualization platform;

The rule configuration unit is configured to receive the firewall configuration information of the client and perform corresponding firewall rule configuration on the proxy device according to the firewall configuration information.

Optionally, the proxy connection establishment unit is set to:

Creating a preset number of virtual network cards on the proxy device, and connecting the preset number of virtual network cards to the preset number of isolated network ports in a one-to-one correspondence;

Determine the gateway address of the production network mapped by each isolated network as the address of the virtual network card corresponding to the isolated network;

Receive network configuration information from the client and configure the subnet mask and camouflage network segment of the virtual network card according to the network configuration information.

The virus detection and killing drill device provided in the embodiment of the present application can execute the virus detection and killing drill method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method.

Embodiment 4

FIG8 shows a schematic diagram of an electronic device 40 that can be used to implement an embodiment of the present application. The electronic device can represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are by way of example.

As shown in FIG8 , the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41 in communication, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the ROM 42 or the computer program loaded from the storage unit 48 to the RAM 43. Various programs and data required for the operation of the electronic device 40 can also be stored in the RAM 43. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input/output (I/O) interface 45 is also connected to the bus 44.

Multiple components in the electronic device 40 are connected to the I/O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information/data with other devices through a computer network such as the Internet and/or various telecommunication networks.

The processor 41 may be a variety of general and/or special processing components with processing and computing capabilities. Some examples of the processor 41 may include a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The processor 41 performs the various methods and processes described above, such as a virus detection and killing drill method.

In some embodiments, the virus detection and killing drill method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program can be loaded and/or installed on the electronic device 40 via the ROM 42 and/or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the virus detection and killing drill method described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to perform the virus detection and killing drill method in any other appropriate manner (for example, by means of firmware).

Various implementations of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), system on chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various implementations may include: being implemented in one or more computer programs that are executable and/or interpreted on a programmable system that includes at least one programmable processor that may be a special purpose or general purpose programmable processor that may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions/operations specified in the flow charts and/or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer readable storage medium may include an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. Examples of machine readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (Electronic Programable Read Only Memory, EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc-Read Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a cathode ray tube (CRT), a liquid crystal display (LCD), or a monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN), blockchain network, and the Internet.

A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

Claims (10)

A virus detection and killing drill method, comprising: After receiving the workflow start instruction, the backup data is obtained from the disaster recovery system; Performing data recovery on the backup data and determining target recovery data; A virus detection and killing drill is performed on the target recovery data in a pre-built data sandbox with a one-way isolation function. The method according to claim 1, wherein the performing data recovery on the backup data and determining target recovery data comprises: Restoring the backup data to the recovery resources in the data sandbox to form initial recovery data and verifying it; The initial restored data that has passed the verification is determined as the target restored data. The method according to claim 1, wherein the performing virus detection and killing drill on the target recovery data in a pre-built data sandbox with a one-way isolation function comprises: Sending virus detection engine options to the client, and receiving target virus detection engine feedback from the client; In a pre-built data sandbox with a one-way isolation function, a virus detection drill is performed on the target recovery data according to the target virus detection engine, wherein the data sandbox includes at least one recovery resource, each recovery resource includes at least one resource directory, and the target recovery data is on the resource directory. The method according to claim 3, wherein the performing virus detection and killing drill on the target recovery data according to the target virus detection and killing engine comprises: Calling the adapter corresponding to the target virus detection engine through a preset virus detection interface; The target virus detection engine is called according to the adapter corresponding to the target virus detection engine to perform virus detection drill on the target recovery data. The method according to claim 1, further comprising: Generate a virus detection and killing drill report, and feed the virus detection and killing drill report back to the server. The method according to claim 1, wherein the construction of the data sandbox comprises: Creating a virtual switch without an uplink on the target virtualization platform, and creating a preset number of isolated network ports on the virtual switch; Creating a virtual machine with a preset operating system and enabled routing and forwarding functions on the target virtualization platform, and determining the virtual machine as a proxy device; Establishing a connection between the proxy device and the preset number of isolated network ports, and the proxy The connection between the device and the target virtualization platform; Receive the firewall configuration information of the client and perform corresponding firewall rule configuration on the proxy device according to the firewall configuration information. The method according to claim 6, wherein establishing the connection between the proxy device and the preset number of isolated network ports comprises: Creating a preset number of virtual network cards on the proxy device, and connecting the preset number of virtual network cards to the preset number of isolated network ports in a one-to-one correspondence; Determine the gateway address of the production network mapped by each isolated network as the address of the virtual network card corresponding to the isolated network; Receive network configuration information from the client and configure the subnet mask and camouflage network segment of the virtual network card according to the network configuration information. A virus detection and killing drill device, comprising: A backup data recovery module is configured to obtain backup data from a disaster recovery system after receiving a workflow start instruction; A recovery data determination module, configured to perform data recovery on the backup data and determine target recovery data; The virus detection and killing drill module is configured to perform a virus detection and killing drill on the target recovery data in a pre-built data sandbox with a one-way isolation function. An electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a virus detection and killing drill method according to any one of claims 1 to 7. A computer-readable storage medium stores computer instructions, wherein the computer instructions are used to enable a processor to implement a virus detection and killing drill method according to any one of claims 1 to 7 when executed.