Method and system intercepting Linux core malicious process escalating privilege

Abstract

The invention provides a method and system intercepting a Linux core malicious process escalating privileges; the method comprises the following steps: firstly obtaining a Linux core process, tracing the started core process in real time, and obtaining data information of the core process; determining whether the data information contains sensitive information or not; if yes, obtaining Linux user information, and determining whether the sensitive information has user authorization or not; if no sensitive information is contained, continuously tracking the core process; if the sensitive information is determined to have user authorization, permitting the corresponding core process; if not, intercepting the corresponding process. The method and system can accurately and effectively inspect the privilege maliciously escalating process from the Linux core processes, thus preventing Linux core system leaks from being attached.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and a system for intercepting the privilege escalation of a Linux kernel malicious process. Background technique [0002] Due to the strict user authority restriction of the Linux system kernel, there are not many loopholes in the Linux system. In Linux vulnerability attacks, most malicious programs call the commit_creds function to elevate the root-level privileges of the process to achieve the purpose of releasing malicious behaviors, and many malicious programs do not extract system privileges for a long time or permanently, but in The right is elevated immediately after the program starts, and the right is lowered after the malicious behavior is released. Generally, this process takes very little time, and it is easy to bypass the detection of protection products. Most of the existing protection products only detect obvious rights escalation operations, ...

AI Technical Summary

Problems solved by technology

In Linux vulnerability attacks, most malicious programs call the commit_creds function to elevate the root-level privileges of the process to achieve the purpose of releasing malicious behaviors, and many malicious programs do not extract system privileges for a long time or permanently, but in The right is elevated immediately after the program starts, and the right is lowered after the malicious behavior is released. Generally, this process takes very little time, and it is easy to bypass the detection of protection products. Most of the existing protection products only detect obvious rights escalation operations, such as It is automatically set as a startup item, etc., and rarely enters the process state to detect process privilege escalation, which is not conducive to the maintenance of information security

Images