Intrusion kernel detection method and device, computing equipment and computer storage medium

Abstract

The invention discloses an intrusion kernel detection method and device, computing equipment and a computer storage medium, and the method comprises the steps: extracting the feature information of anintrusion kernel process for an ROOT attack behavior, and determining a detection condition corresponding to the feature information, wherein the detection conditions comprise suspicious attack detection conditions and determined attack detection conditions; setting multi-stage detection at different module layers of the equipment to detect the to-be-detected process, wherein each stage of detection corresponds to different detection conditions; and determining whether the to-be-detected process is a process invading the kernel or not according to a detection result of the multi-stage detection. Corresponding detection conditions are determined according to feature information extracted from a process invading a kernel, multi-level detection is set in different module layers of equipmentto detect to-be-detected processes in a targeted mode, attack behaviors of the processes can be effectively detected before the to-be-detected processes attack ROOT or in the attack process, and therefore process execution is prevented, and the process from invading kernel is avoided.

Description

technical field [0001] The present invention relates to the field of software, in particular to a method and device for detecting an intrusion kernel, computing equipment, and a computer storage medium. Background technique [0002] The goal of an attacker invading the kernel is to obtain the ROOT privilege of the device, so that the ROOT privilege can be used to control the entire device. Based on kernel security considerations, device manufacturers set ROOT-related detection in the device before the device leaves the factory to detect whether it is attacked. There are also various methods for detecting ROOT in the prior art. However, the detection of the ROOT in the device manufacturer and the prior art is based on the detection of the device and the compromised kernel. The attack behavior of kernel intrusion generally needs to be divided into multi-step attacks to complete. The detection method in the prior art is often when the attack is nearly completed, and the devi...

AI Technical Summary

Problems solved by technology

[0003] 1) The timing of the detection is too late, the attacker has already invaded the kernel and controlled the execution of the code, so it is easy to bypass the above detection methods

[00

Images