Malicious software interception method and device based on kernel module

Abstract

The embodiment of the invention provides a malicious software interception method and device based on a kernel module, and the method comprises the steps: determining that a kernel module loading notification is detected, carrying out the legality detection of kernel module information, and obtaining a legality detection result; wherein the legitimacy detection at least comprises detecting whetheran anti-initialization function exists; and if it is determined that the legality detection result is illegal, determining that malicious software loads the kernel module, and intercepting the malicious software. The device executes the method. According to the method and the device provided by the embodiment of the invention, malicious software can be intercepted in time, so that after-event detection and repair carried out after the kernel module is loaded by the malicious software are avoided.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a kernel module-based malicious software interception method and device. Background technique [0002] Linux is a set of Unix-like operating systems that are free to use and spread freely. It is a POSIX and UNIX-based multi-user, multi-tasking, multi-threading and multi-CPU operating system. It can run major UNIX utility software, application programs and network protocols. It supports 32-bit and 64-bit hardware. Linux inherits Unix's network-centric design idea and is a multi-user network operating system with stable performance. [0003] Along with the extensive application of Linux system, more and more malicious softwares attack the kernel module of Linux system, thereby brought great harm to the system security of Linux system, prior art adopts following means to handle: [0004] 1. Scan the local file system to detect the characteristic files of malware, so as t...

AI Technical Summary

Problems solved by technology

[0005] However, there are certain defects in the above-mentioned several technical solutions, that is, after the malware is loaded into the kernel module, it is confirmed whether there is a malware attack by means of detection; , it also needs to be processed by manual operation and maintenance, so as to eliminate the adverse effects of malware attacks

Images