A method for detecting server malicious file injection behavior

Abstract

A kind of detection method of server malicious file injection behavior, including by timing detection system network service port, find the executable file name corresponding to the process starting the port, the monitoring file name is added to program management list to form program management node, system is initially set to the program management node Rule learning state and learning time threshold, file access monitoring is carried out to the process;Establish host file access monitoring mechanism, collect the event message of the file created by the monitored process;The monitoring of a new application first enters learning phase, and the file access record is counted and learned;When learning time exceeds threshold, the behavior of monitoring is summarized, the access rule of process to file directory is extracted, enters monitoring mode, in turn judge the analysis state of the program management node;In monitoring mode, the file access record of the process monitored by system is classified and compared in combination with the access rule of the process, and abnormal file access event is identified.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for detecting malicious file injection behavior on servers. Background Technology

[0002] Current host security methods collect data by installing lightweight data collection tools or agents on each endpoint device. This data includes login records, process execution / creation logs, directory / file access logs, DNS request information, etc., and is then aggregated to a central service node. At the central service node, suspicious activity, unknown or variant threats are identified using intelligent detection algorithms, UEBA (User and Entity Behavior Analysis), and event correlation analysis. For advanced threats, attackers exploit zero-day vulnerabilities to infiltrate the system and inject modified malware that is difficult for antivirus software to detect and remove. Even when detection is attempted, the malware may have already been triggered and run, leaving the system still potentially infected. In reality, administrators often struggle to detect the injected files. Current protection models are reactive and cannot intercept advanced threats during the incident itself. Summary of the Invention

[0003] The purpose of this invention is to solve the problem of malicious file injection attacks based on zero-day vulnerabilities and to remove the attack files in real time when the attack occurs, and to provide a method for detecting malicious file injection behavior on servers.

[0004] The technical solution of this invention is: a method for detecting malicious file injection behavior on a server, comprising:

[0005] Step 1: By periodically checking the system's network service ports, if a newly opened network service port is found, the executable file name corresponding to the process that started the port is found. If the file name corresponding to the process is within the monitoring scope, the file name is added to the program management list to form a program management node. The system initially sets the rule learning status and learning time threshold for the program management node and monitors the file access of the process.

[0006] Step 2: Establish a host file access monitoring mechanism to collect event messages of monitored processes creating files;

[0007] Step 3: Monitoring a new application first enters the learning phase. The monitoring system statistically analyzes and learns the file access records of the application's process and saves the process access records to disk.

[0008] Step 4: When the learning time exceeds the threshold, the monitored behavior is summarized, the access rules of the process to the file directory are extracted, the monitoring mode is entered, and the analysis status of the program management node is judged in turn. If the program management node is in the learning state but the learning threshold has expired, the access records of the program management node and the access rules are extracted, and the rules are injected into the rule list of the program.

[0009] Step 5: In monitoring mode, the system classifies and compares the file access records of the monitored process with the access rules of the process to identify and process abnormal file access events.

[0010] Furthermore, in step 1, a timed processing flow is established to query the open network ports of the local service and find the file name of the service process on that port; if the file name belongs to the monitored object, then file access monitoring is performed on the process PID.

[0011] Furthermore, in step 2, file access monitoring uses the Linux system file access monitoring framework Fanotify to listen for event messages of process opening and creation, extract file paths and file names, collect directory access records of the process, parse out the process ID, file name, and path of the accessed file for each event, and form a message from the parsing results.

[0012] Furthermore, in step 3, the message is first written to the database. Based on the process PID, the analysis status of the program is obtained. If the file access monitoring of the process is in the learning state, the message is placed in the cache. If the program has completed rule learning, the access record is matched according to the rules to determine whether the access is suspicious. If the access rules are not met, the access behavior is recorded in the access record table of abnormal files. At the same time, the abnormal files of the monitored process are isolated and cleared.

[0013] Furthermore, in step 4, the access rules are a list of directories where files are created, learned by the monitored process.

[0014] Furthermore, in step 5, when handling abnormal files, for a message about a newly created file, it checks whether the file is in the directory list. If the file is not in the directory list, the monitoring program issues an alarm and deletes and backs up the file.

[0015] The beneficial effects of this invention are as follows: By establishing a file access monitoring framework, the file access behavior of network service programs is statistically analyzed. Access rules are formed through self-learning and pre-configuration, creating a security policy for program file creation behavior. During subsequent normal business operations, file creation behavior can be monitored, abnormal file writing behavior can be detected, and abnormal files can be deleted and cleaned up in real time. This solution, through file rule filtering, can effectively detect and clean up malicious files injected based on unknown vulnerabilities in real time, blocking advanced attack threats such as zero-day vulnerabilities. This method is simple and easy to use, suitable for server scenarios based on fixed server business models, and has good protection effects. Attached Figure Description

[0016] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0017] The detection method of the present invention, such as Figure 1 As shown, it includes:

[0018] Step 1: By periodically checking the system's network service ports, if a newly opened network service port is found, the executable file name corresponding to the process that started the port is found. If the file name corresponding to the process is within the monitoring scope, the file name is added to the program management list to form a program management node. The system initially sets the rule learning status and learning time threshold for the program management node and monitors the file access of the process.

[0019] Step 2: Establish a host file access monitoring mechanism to collect event messages of monitored processes creating files;

[0020] Step 3: Monitoring a new application first enters the learning phase. The monitoring system statistically analyzes and learns the file access records of the application's process and saves the process access records to disk.

[0021] Step 4: When the learning time exceeds the threshold, the monitored behavior is summarized, the access rules of the process to the file directory are extracted, the monitoring mode is entered, and the analysis status of the program management node is judged in turn. If the program management node is in the learning state but the learning threshold has expired, the access records of the program management node and the access rules are extracted, and the rules are injected into the rule list of the program.

[0022] Step 5: In monitoring mode, the system classifies and compares the file access records of the monitored process with the access rules of the process to identify and process abnormal file access events.

[0023] Furthermore, in step 1, a timed processing flow is established to query the open network ports of the local service and find the file name of the service process on that port; if the file name belongs to the monitored object, then file access monitoring is performed on the process PID.

[0024] Furthermore, in step 2, file access monitoring uses the Linux system file access monitoring framework Fanotify to listen for event messages of process opening and creation, extract file paths and file names, collect directory access records of the process, parse out the process ID, file name, and path of the accessed file for each event, and form a message from the parsing results.

[0025] Furthermore, in step 3, the message is first written to the database. Based on the process PID, the analysis status of the program is obtained. If the file access monitoring of the process is in the learning state, the message is placed in the cache. If the program has completed rule learning, the access record is matched according to the rules to determine whether the access is suspicious. If the access rules are not met, the access behavior is recorded in the access record table of abnormal files. At the same time, the abnormal files of the monitored process are isolated and cleared.

[0026] Furthermore, in step 4, the access rule is a list of directories in which files are created, learned by the monitored process.

[0027] Furthermore, in step 5, when handling abnormal files, for a message about a newly created file, the system checks whether the created file is in the directory list. If the created file is not in the directory list, the monitoring program issues an alarm and deletes and backs up the file.

[0028] Application examples (or simulation experiments)

[0029] Access monitoring was established on the host machine for Java programs running Tomcat and Nginx. After a period of self-learning, Tomcat and Nginx generated the following list of file access records. The access records include the process name, file access path, and file type. This forms the access record table:

[0030] The program analysis module statistically analyzes a program's access records, summarizing file access paths and file types to form a list of file access rules for that program. The rule list is a directory tree composed of directories along the access path. The access rules include the program process name, the accessed file path, the type of file created, and the operation behavior. File access compliance assessment: After a program's access rules are established, subsequent file creation records are analyzed by matching these rules to determine the legality of the file writing. In a typical file injection vulnerability, a hacker remotely injects .class or .jar files into the / opt / tomcat / bin directory. Based on system analysis, the program does not have rules for writing .class and .jar files, and the monitoring system can issue real-time alerts and perform cleanup.

[0031] The above are merely specific embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting malicious file injection behavior on a server, characterized in that, include: Step 1: By periodically checking the system's network service ports, if a newly opened network service port is found, the executable file name corresponding to the process that started the port is found. If the file name corresponding to the process is within the monitoring scope, the file name is added to the program management list to form a program management node. The system initially sets the rule learning status and learning time threshold for the program management node and monitors the file access of the process. Step 2: Establish a host file access monitoring mechanism to collect event messages of monitored processes creating files; Step 3: Monitoring a new application first enters the learning phase. The monitoring system statistically analyzes and learns the file access records of the application's process and saves the process access records to disk. Step 4: When the learning time exceeds the threshold, the monitored behavior is summarized, the access rules of the process to the file directory are extracted, the monitoring mode is entered, and the analysis status of the program management node is judged in turn. If the program management node is in the learning state but the learning threshold has expired, the access records of the program management node and the access rules are extracted, and the rules are injected into the rule list of the program. The access rules are the list of directories where the monitored process creates files. Step 5: In monitoring mode, the system classifies and compares the file access records of the monitored process with the access rules of the process to identify and process abnormal file access events.

2. The method for detecting malicious file injection behavior on a server according to claim 1, characterized in that, In step 1, a timed processing flow is established to query the open network ports of the local service and find the file name of the service process on that port; if the file name belongs to the monitored object, file access monitoring is performed on the process PID.

3. The method for detecting malicious file injection behavior on a server according to claim 1, characterized in that, In step 2, file access monitoring uses the Linux system file access monitoring framework Fanotify to listen for event messages of process opening and creation, extract file paths and file names, collect directory access records of the process, parse out the process ID, file name and path of the accessed file for each event, and form a message from the parsing results.

4. The method for detecting malicious file injection behavior on a server according to claim 1, characterized in that, In step 3, the message is first written to the database. Based on the process PID, the analysis status of the program is obtained. If the file access monitoring of the process is in the learning state, the message is put into the cache. If the program has completed rule learning, it will match the access record according to the rules to determine whether the access is suspicious. If the access rules are not met, the access behavior will be recorded in the access record table of abnormal files, and the abnormal files of the monitoring process will be isolated and deleted.

5. The method for detecting malicious file injection behavior on a server according to claim 1, characterized in that, In step 5, when handling abnormal files, for a message about a newly created file, check if the file is in the directory list. If the file is not in the directory list, the monitoring program will issue an alarm and delete and back up the file.

Images