Desktop environment-oriented interactive management and control method for Linux sandbox lightweight process auditing

Abstract

The invention relates to the technical field of computer security, in particular to a desktop environment-oriented interactive management and control method for Linux sandbox lightweight process auditing. Comprising the following steps: constructing a dynamic hierarchical sandbox environment based on a namespace and a control group of a Linux kernel, and carrying out bidirectional binding on a specified directory of a host machine and a virtual directory in a sandbox through a preset environment variable mapping rule to realize isolation and dynamic adaptation of a process running environment; loading an intelligent file filter driver with context sensing capability, and performing multi-dimensional monitoring on file operation behaviors of processes in the sandbox in combination with a dynamic probe technology of a kernel mode; constructing a real-time auditing model based on the behavior feature vector, performing security level evaluation on the process operation behavior through the model, and triggering a corresponding management and control strategy according to an evaluation result; according to the method and the device, accurate auditing and dynamic management and control of process behaviors can be realized, so that the safety and the flexibility of the sandbox are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer security, in particular to an interactive management and control method for lightweight process auditing of Linux sandbox in a desktop environment. BACKGROUND

[0002] In a Linux system in a desktop environment, sandbox technology is a core means of isolating and limiting the running environment of an application program, and its security and flexibility directly affect the overall protection capability of the system. The existing sandbox technology has significant limitations in process auditing and management and control. On the one hand, traditional auditing mechanisms mostly rely on single-dimensional behavior monitoring, lack deep correlation analysis of process operation context, and are difficult to accurately identify abnormal behaviors with strong concealment, and often cause performance loss due to excessive occupation of system resources. On the other hand, the management and control means are mostly static rule configurations, which cannot dynamically adjust strategies according to real-time behaviors of processes, and users cannot achieve fine and interactive management of processes in the sandbox. This problem of "one-sidedness of auditing dimension" and "rigidity of control strategy" makes the sandbox lag in response when facing new unknown threats, and cannot fully capture the potential risks of processes or flexibly adapt to diversified application scenarios, which seriously restricts the practical value of Linux sandbox in a desktop environment.

[0003] Based on the above problems, there is an urgent need for a technical solution that can break through the above limitations and achieve accurate auditing and dynamic management and control of process behaviors to improve the security and flexibility of the sandbox. SUMMARY

[0004] The purpose of the present application is to solve the problems in the prior art, and an interactive management and control method for lightweight process auditing of Linux sandbox in a desktop environment is proposed, which comprises: A dynamic hierarchical sandbox environment is constructed based on the namespace and control group of the Linux kernel, and a preset environment variable mapping rule is used to bidirectionally bind the specified directory of the host and the virtual directory in the sandbox, so as to realize the isolation and dynamic adaptation of the process running environment; An intelligent file filtering driver with context awareness capability is loaded, and a dynamic probe technology in the kernel state is combined to monitor the file operation behavior of the process in the sandbox in multiple dimensions; A real-time auditing model based on behavior feature vectors is constructed, the process operation behavior is evaluated by the model, and the corresponding management and control strategy is triggered according to the evaluation result; An plug-in management framework supporting hot plugging is integrated, a management and control plug-in with specific functions is loaded through the framework, and personalized management and control of the process in the sandbox is realized; a hybrid communication protocol architecture is adopted to establish a secure communication channel between the inside and outside of the sandbox, and the bidirectional safe transmission of management and control instructions and auditing data is ensured; Develop a management tool with an adaptive interface that can dynamically adjust the display content according to the running state of the process in the sandbox, and support users to control the process in real time through visual operation.

[0005] Preferably, the construction process of the dynamic hierarchical sandbox environment comprises: Create a basic isolation layer through the namespace mechanism of the Linux kernel, and independently divide the process ID, network stack, file system mounting point, user permission and host name in the sandbox; Based on the preset directory mapping rule table, the application directory, configuration file directory, temporary file directory and user data directory of the host are respectively mapped to the corresponding virtual directory in the sandbox, and the hash check mechanism is used to ensure the integrity of the directory content during the mapping process; Use the control group technology to build a multi-level resource restriction layer, the first level restriction layer limits the total CPU occupancy, total memory usage, total disk I / O bandwidth and total network traffic of all processes in the sandbox, and the second level restriction layer sets resource restriction thresholds for different process types in the sandbox, realizing fine allocation of resources.

[0006] Further preferably, the loading and running process of the intelligent file filtering driver comprises: in the system startup stage, load the compiled intelligent file filtering driver ko file into the kernel space through the kernel module loading tool, and perform integrity check and signature verification on the driver module; After the driver is loaded, automatically register the file system hook function, which can intercept the opening, reading, writing, closing, deleting and renaming operations of the process in the sandbox to the file; When intercepting the file operation request, the driver module automatically obtains the PID, UID, GID, operation timestamp, file path, operation type and operation data size of the process initiating the operation, and encapsulates these information into a standardized event structure, and sends it to the user state audit module for processing; The adaptive adjustment mechanism built in the driver module can dynamically adjust the triggering frequency of the hook function according to the load of the system, and when the CPU usage of the system exceeds the preset threshold, automatically reduce the sampling frequency of the hook function to reduce the impact on the system performance.

[0007] Further preferably, the real-time audit model construction and running process based on the behavior feature vector comprises: Extract the file operation behavior features of the process from the historical audit log, and construct a feature vector space containing operation frequency, operation type distribution, sensitive file access times, cross directory operation times, abnormal time period operation times and operation data volume change rate dimensions; The machine learning algorithm is used to train the feature vector to generate an initial security level evaluation model, which can divide the operation behavior of the process into four levels of security, low risk, medium risk and high risk; During the model running process, the operation behavior data of the process in the sandbox is collected in real time to generate a real-time feature vector, and the vector is input into the evaluation model for security level evaluation; A dynamic threshold adjustment mechanism is set, and when a new threat type or operation mode appears in the sandbox, the model can automatically adjust the evaluation threshold according to the feedback of the administrator to improve the recognition ability of new threats.

[0008] Further preferably, in the process of evaluating the security level of the process operation behavior, the following formula is used to calculate the risk index of the process operation behavior: ; Among them, represents the risk index of the process operation behavior; represents the number of behavior feature dimensions participating in evaluation; represents the weight value of the th feature dimension, which is determined according to the importance of the feature to the security evaluation, and the value range is , and the sum of the weight values of all feature dimensions is 1; represents the actual observation value of the th feature dimension; represents the normalization function of the th feature dimension, which is used to convert the actual observation value into a normalized value between and , and the specific calculation formula is , wherein represents the minimum possible value of the feature dimension, represents the maximum possible value of the feature dimension; represents the abnormal deviation degree of the th feature dimension, that is, the deviation degree of the actual observation value from the normal value range of the feature dimension, and the value range is ; represents the amplification function of the abnormal deviation degree, which is used to enhance the influence weight of abnormal behavior, and the specific calculation formula is .

[0009] Further preferably, the plug-in management framework supports dynamic loading and unloading of the control plug-in, and the following formula is used to calculate the compatibility score of the plug-in during the loading process: ; Among them, represents the compatibility score of the plug-in, and the value range is , and the higher the score is, the better the compatibility is; 、 、 respectively represent the weight coefficients of the function matching degree, the resource occupation rate and the error rate, and ; represents the actual number of functions supported by the plug-in, represents the total number of functions required by the sandbox environment; represents the average resource occupation of the plug-in in the standard test environment, represents the maximum resource limit allocated to the plug-in by the sandbox environment; represents the number of errors occurred by the plug-in in the test process, represents the total number of tests of the plug-in.

[0010] Further preferably, in the mixed communication protocol architecture, the security evaluation of data transmission calculates the security coefficient of the transmission link by using the following formula: ; wherein, represents the security coefficient of the transmission link, and the value range is , and the higher the security coefficient is, the safer the transmission link is; 、 、 respectively represent the weight coefficients of the identity authentication strength, the data encryption strength and the transmission integrity, and ; represents the complexity score of the identity authentication mechanism, 、 are parameters of the logistic function, which are used to adjust the growth rate and the midpoint position of the function; represents the security strength score of the data encryption algorithm, 、 are parameters of the logistic function; represents the number of data errors or tampering detected in the transmission process, represents the total number of data frames transmitted.

[0011] Further preferably, the plug-in management framework supports the loading of control plug-ins, including: a behavior analysis plug-in capable of performing time series analysis on the operation behavior of the process in the sandbox, identifying abnormal behavior patterns with periodicity, burstiness or concealment, and generating a detailed behavior analysis report; a resource dynamic adjustment plug-in capable of automatically adjusting the CPU scheduling priority, memory allocation limit and disk I / O queue length of the process according to the real-time resource usage of the process in the sandbox and the preset resource adjustment strategy, to realize dynamic optimization configuration of resources; a communication encryption plug-in that uses the national SM4 algorithm to encrypt data transmitted between the inside and outside of the sandbox, and uses the national SM3 algorithm for data hash verification, to ensure the confidentiality and integrity of the data; a process behavior simulation plug-in capable of simulating the operation behavior characteristics of normal processes, generating false file operation records and network communication data, to confuse potential attack programs and improve the anti-detection ability of the sandbox environment; a security policy learning plug-in based on reinforcement learning algorithm, which learns and optimizes security control policies by constantly interacting with the process behavior in the sandbox, and gradually improves the identification and response ability to unknown threats.

[0012] Further preferably, the construction process of the mixed communication protocol architecture includes: deploying a protocol conversion gateway inside the sandbox, which supports mutual conversion of Unix domain sockets, TCP / IP protocols, WebSocket protocols and gRPC protocols; using differentiated communication protocols for different types of data transmission needs, using gRPC protocol for process control instruction transmission to ensure the efficiency and reliability of instruction transmission; using WebSocket protocol for real-time audit data transmission to realize real-time data pushing and bidirectional interaction; using TCP / IP protocol for transmission of a large amount of historical log data, to ensure data transmission integrity through fragmentation transmission and breakpoint resume mechanism; in the protocol conversion process, the gateway performs format verification and length check on all transmission data, filters out data packets that do not conform to the specification, and prevents malicious data injection attacks; using a dynamic port allocation mechanism, randomly selecting an unoccupied port as the communication port each time the sandbox is started, and periodically changing the port during sandbox operation to reduce the risk of port scanning and attack.

[0013] Further preferably, the implementation process of the management tool of the adaptive interface comprises: automatically detecting the terminal device type and screen resolution of the user when the tool is started, and loading the corresponding interface layout template according to the detection result; adopting the modular design idea, dividing the functions of the tool into process monitoring module, resource statistics module, audit log module, security alarm module and control operation module, each module corresponding to an independent interface component; dynamically adjusting the display priority of the interface component according to the running state of the process in the sandbox, and when detecting high-risk operation behavior, automatically displaying the component of the security alarm module on top and issuing visual and audible prompts; supporting user-defined interface layout, the user can adjust the position and size of each component through drag-and-drop operation, and save the custom layout as a template for subsequent use; integrating intelligent search function, the user can input process name, PID, file path or operation type and other keywords to quickly query related process information and audit records; providing detailed operation log recording function, all control operations performed by the user through the management tool will be recorded in the log file, and the log content includes operation time, operation type, operation object, operation parameter and operation result, so as to facilitate subsequent audit and traceability.

[0014] Technical effects: The application solves the problems of one-sided audit dimension and rigid control strategy in the background technology by constructing a dynamic hierarchical sandbox environment, integrating an intelligent file filtering driver and a dynamic probe technology, establishing a real-time audit model based on a behavior feature vector, introducing a hot plug-in management framework, adopting a hybrid communication protocol architecture, and developing an adaptive interface management tool. The creativity lies in realizing process environment dynamic adaptation, multi-dimensional behavior monitoring, real-time risk assessment, personalized control and secure communication, improving the sandbox security and flexibility, and accurately identifying abnormal behavior and dynamically adjusting the strategy. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The flow chart of the interactive control method of the Linux sandbox lightweight process audit of the present application for a desktop environment. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application, and are not used to limit the present application.

[0017] The Linux process management of the traditional desktop environment faces the following technical problems: the process running environment is difficult to flexibly isolate and adapt, leading to resource conflicts and interference between different processes; the monitoring means for process file operation behavior is single, and cannot comprehensively and accurately identify abnormal behavior; there is a lack of efficient real-time audit model, making it difficult to quickly assess process security and take timely control measures; the individual control ability is insufficient, making it difficult to meet the needs of diversified business scenarios; the security of communication inside and outside the sandbox is questionable, and is vulnerable to data leakage and malicious attack risks; the management tool interface is not intelligent enough to dynamically provide effective information and convenient operations according to the process state.

[0018] Based on this, please refer to Figure 1 The embodiment provides an interactive control method for a Linux sandbox lightweight process audit of a desktop environment, comprising the following steps: A dynamic hierarchical sandbox environment is constructed based on the namespace and control group of the Linux kernel, and a specified directory of a host machine and a virtual directory in the sandbox are bidirectionally bound through preset environment variable mapping rules, so as to realize isolation and dynamic adaptation of a process running environment; An intelligent file filtering driver with context awareness capability is loaded, and a dynamic probe technology in the kernel state is combined to perform multidimensional monitoring on file operation behavior of a process in the sandbox; A real-time audit model based on a behavior feature vector is constructed, the process operation behavior is evaluated in terms of security level through the model, and corresponding control strategies are triggered according to the evaluation result; A plug-in management framework supporting hot plugging is integrated, a control plug-in with specific functions is loaded through the framework, and individual control of a process in the sandbox is realized; A hybrid communication protocol architecture is adopted to establish a secure communication channel between the inside and outside of the sandbox, ensuring the bidirectional secure transmission of control instructions and audit data; A management tool with an adaptive interface is developed, which can dynamically adjust the display content according to the running state of the process in the sandbox, and supports real-time control of the process by visual operation of the user.

[0019] The scheme realizes the isolation and resource limitation of the process running environment by constructing a dynamic hierarchical sandbox environment, using namespace and control group technology, combining with environment variable mapping rules, so that the process running environment can be dynamically adapted according to the actual demand, effectively solving the problems of resource conflict and environment adaptation between processes; the intelligent file filtering driver cooperates with the dynamic probe technology to monitor the process file operation behavior in multiple dimensions, and comprehensively captures abnormal signs; the real-time audit model based on behavior feature vector can quickly and accurately evaluate the process security level, providing a strong basis for management and control; the plug-in management framework supporting hot plug makes it convenient to load different functional plug-ins, meeting the diversified management and control needs; the mixed communication protocol architecture ensures the safety of communication inside and outside the sandbox, reduces the risk of data leakage and attack; the adaptive interface management tool intelligently presents information and provides operations according to the process state, improving user management efficiency.

[0020] The traditional dynamic hierarchical sandbox environment construction has the following technical problems: the isolation granularity is not fine enough, and it is difficult to realize differentiated and fine allocation of resources for different process types; the directory mapping lacks a complete integrity checking mechanism, which may lead to data inconsistency and loss risk; the resource limitation strategy is static and single, and it is difficult to adapt to the dynamic changes of resource demand during process running.

[0021] Therefore, the construction process of the dynamic hierarchical sandbox environment includes: creating a basic isolation layer through the namespace mechanism of the Linux kernel, independently dividing the process ID, network stack, file system mounting point, user permission and host name in the sandbox; based on the preset directory mapping rule table, mapping the application directory, configuration file directory, temporary file directory and user data directory of the host to the corresponding virtual directory in the sandbox, and using the hash checking mechanism to ensure the integrity of the directory content during the mapping process; using the control group technology to build a multi-level resource limitation layer, the first level limitation layer limits the total CPU occupancy, total memory usage, total disk I / O bandwidth and total network traffic of all processes in the sandbox, and the second level limitation layer sets resource limitation thresholds for different process types in the sandbox, realizing fine allocation of resources.

[0022] When the basic isolation layer is created, the Linux kernel namespace mechanism is used to independently divide key elements such as process ID and network stack, achieving deep isolation between processes; based on the mapping method of the preset directory mapping rule table, the hash checking mechanism is used to ensure the consistency and integrity of the directory data between the host and the sandbox; the multi-level resource limitation layer constructed by the control group technology can not only control the upper limit of resource usage of all processes in the sandbox as a whole, but also set exclusive resource thresholds for different process types in the second level limitation layer, accurately meeting the resource needs of various processes, effectively solving the problems of isolation granularity, directory mapping integrity and resource limitation flexibility in traditional sandbox environment construction, and greatly improving the stability and resource utilization efficiency of the sandbox environment.

[0023] The conventional intelligent file filtering driver has the following technical problems: unable to obtain comprehensive process operation context information, resulting in insufficient basis for judging operation behavior; the hook function triggering mechanism lacks flexibility, making it difficult to balance monitoring accuracy and system performance; the safety and stability of the driver loading and running process are poor, and it is easy to be disturbed by malicious attacks.

[0024] Therefore, the loading and running process of the intelligent file filtering driver includes: in the system startup stage, the compiled intelligent file filtering driver ko file is loaded into the kernel space through the kernel module loading tool, and the integrity check and signature verification of the driver module are performed; after the driver is loaded, the file system hook function is automatically registered, which can intercept the opening, reading, writing, closing, deleting and renaming operations of processes in the sandbox on files; when the file operation request is intercepted, the driver module automatically obtains the PID, UID, GID, operation timestamp, file path, operation type and operation data size of the process initiating the operation, and encapsulates these information into a standardized event structure, and sends it to the user state audit module for processing; the adaptive adjustment mechanism built-in the driver module can dynamically adjust the triggering frequency of the hook function according to the load of the system, and when the CPU usage of the system exceeds the preset threshold, the sampling frequency of the hook function is automatically reduced to reduce the impact on the system performance.

[0025] In the driver loading link, the ko file is loaded through the kernel module loading tool, and the integrity check and signature verification are performed to ensure the safe and reliable loading of the driver; the automatically registered file system hook function can comprehensively intercept various file operations, and the driver module can obtain rich operation context information and encapsulate it into a standard structure for the audit module to analyze, providing sufficient basis for accurately judging process behavior; the built-in adaptive adjustment mechanism dynamically regulates the triggering frequency of the hook function according to the system load, ensuring the monitoring accuracy while effectively reducing the impact on the system performance, solving the problems of the traditional intelligent file filtering driver in information acquisition, triggering mechanism flexibility and safety and stability, and improving the monitoring ability of process file operation behavior.

[0026] The traditional real-time audit model construction has the following technical problems: the dimension of the behavior feature vector is single, which cannot fully reflect the complexity of process operation behavior; the machine learning algorithm has poor adaptability, which is difficult to cope with the changing process behavior pattern; the evaluation threshold is fixed, and the recognition ability of new threats is insufficient.

[0027] Based on this, the process of constructing and running the real-time audit model based on the behavior feature vector includes: extracting file operation behavior features of the process from historical audit logs, constructing a feature vector space including dimensions of operation frequency, operation type distribution, sensitive file access times, cross-directory operation times, abnormal time period operation times, and operation data volume change rate; using a machine learning algorithm to train the feature vector to generate an initial security level evaluation model.

[0028] The model can divide the operation behavior of the process into four levels of security, low risk, medium risk, and high risk; during the model running process, real-time operation behavior data of the process in the sandbox is collected to generate a real-time feature vector, and the vector is input into the evaluation model for security level evaluation; a dynamic threshold adjustment mechanism is set, and when a new threat type or operation mode appears in the sandbox, the model can automatically adjust the evaluation threshold according to the administrator's feedback to improve the identification ability of new threats.

[0029] The scheme comprehensively covers process operation frequency, sensitive file access, and other behavior features by constructing a multi-dimensional behavior feature vector space, fully reflecting the complexity of process operation behavior; the model is trained by using a machine learning algorithm, which can learn different behavior patterns according to a large amount of historical data to generate an effective security level evaluation model; real-time data is collected during the running process to generate a real-time feature vector for evaluation, ensuring the timeliness of the evaluation; the dynamic threshold adjustment mechanism automatically adjusts the evaluation threshold according to new threat types and administrator feedback to enhance the identification ability of the model to new threats, solving the problems of traditional real-time audit models in feature vector dimension, algorithm adaptability, and threshold flexibility, and significantly improving the accuracy and adaptability of the audit model.

[0030] The traditional security level evaluation of process operation behavior has technical problems: the evaluation method lacks comprehensive consideration of behavior features, and only relies on single or a few features for judgment, resulting in inaccurate evaluation results; the importance difference of features and the influence weight of abnormal behavior are not fully considered, and high-risk behaviors cannot be effectively identified.

[0031] Based on this, the following formula is used to calculate the risk index of the process operation behavior during the process of evaluating the security level of the process operation behavior: ; Wherein, represents the risk index of the process operation behavior; represents the number of behavior feature dimensions participating in the evaluation; represents the weight value of the th feature dimension, the weight value is determined according to the importance of the feature to the security evaluation, and the value range is , and the sum of the weight values of all feature dimensions is 1; represents the weight value of the Actual observed values ​​for each feature dimension; Indicates the first A normalization function for each feature dimension is used to transform the actual observations into... arrive The normalized value between them is calculated using the following formula: ; in This represents the minimum possible value of this feature dimension. This represents the maximum possible value of this feature dimension; Indicates the first The abnormal deviation of each feature dimension, that is, the degree of deviation between the actual observed value and the normal range of values ​​for that feature dimension, with a range of values ​​of [value range missing]. ; The amplification function, representing the degree of abnormal deviation, is used to enhance the influence weight of abnormal behavior. The specific calculation formula is as follows: .

[0032] This represents the risk index of process operation behavior, which comprehensively reflects the degree of security risk of process operation. The higher the value, the greater the risk.

[0033] The number of behavioral characteristics dimensions involved in the evaluation covers multiple dimensions such as operation frequency and access frequency of sensitive files, ensuring that process behavior is evaluated from multiple perspectives.

[0034] : No. The weight values ​​for each feature dimension are set according to the importance of the feature to the security assessment. For example, the weight of sensitive file access operations is higher than that of ordinary file reading, and the sum of all weights is 1 to ensure the scientific nature of the assessment.

[0035] : No. Actual observations of a feature dimension, such as the number of times a process accesses a sensitive file within one hour.

[0036] : Normalization function, formula is ,in and These are the minimum and maximum possible values ​​of the feature dimension, respectively. By normalizing, feature values ​​of different magnitudes are transformed to the range of 0-1, thus enabling the comparability of multi-dimensional data.

[0037] : No. The abnormal deviation of a feature dimension, that is, the deviation between the actual observed value and the normal range. For example, when a process accesses sensitive files at a frequency far exceeding the normal range, this value is large.

[0038] : the amplification function of abnormal deviation degree, the formula is , the influence of abnormal behavior is amplified by quadratic function form, so that the contribution of high deviation degree behavior to risk index is more significant.

[0039] : the logarithmic conversion of the amplified abnormal deviation degree, avoiding the excessive dominance of single abnormal feature on risk index, while retaining the influence trend of abnormal behavior.

[0040] The formula realizes the accurate quantification of process operation risk through the combination of multi-dimensional feature weighting, data normalization, abnormal amplification and logarithmic adjustment, considering the importance difference of different features and effectively identifying abnormal behavior, solving the risk misjudgment problem caused by single dimension or simple weighting in traditional evaluation.

[0041] The scheme considers multiple behavior feature dimensions by the above formula, a feature dimension participates in evaluation together, reflecting the process operation behavior comprehensively; set weight value for each feature dimension, allocate weight according to feature importance, highlight the influence of key features on evaluation results; use normalization function to normalize the actual observation value, so that different dimension feature data have comparability; introduce abnormal deviation degree and amplification function , enhance the influence of abnormal behavior on risk index , which can effectively identify high-risk behavior deviating from the normal range, solve the problems of traditional evaluation method in feature consideration, weight setting and abnormal behavior processing, greatly improve the accuracy and reliability of process operation behavior safety level evaluation.

[0042] The following technical problems exist in traditional plug-in management: the compatibility evaluation of plug-in and sandbox environment lacks quantitative standard, and relies on manual experience judgment, resulting in low function matching degree, resource occupation exceeding expectation or frequent running errors; the compatibility evaluation dimension is single, only focusing on part of surface features, which cannot comprehensively reflect the adaptation of plug-in and sandbox, affecting the stability of plug-in after loading and the overall performance of sandbox.

[0043] Therefore, the plug-in management framework supports the dynamic loading and unloading of controlled plug-in, and uses the following formula to calculate the compatibility score of plug-in during the loading process of plug-in: ; Among them, represents the compatibility score of plug-in, the value range is , the higher the score, the better the compatibility; , , respectively represent the weight coefficients of the function matching degree, the resource occupation rate and the error rate, and the sum of the three is 1. ; represents the number of functions actually supported by the plug-in, represents the total number of functions required by the sandbox environment; represents the average resource occupation of the plug-in in the standard test environment, represents the maximum resource limit allocated to the plug-in by the sandbox environment; represents the number of errors occurred in the test process of the plug-in, represents the total number of tests of the plug-in.

[0044] : Compatibility score of the plug-in, the value range is 0-1, the higher the score, the better the adaptability of the plug-in to the sandbox environment, and the more suitable for loading and running.

[0045] , , : Respectively the weight coefficients of the function matching degree, the resource occupation rate and the error rate, and the sum of the three is 1, which can be adjusted according to the sandbox demand, for example, the weight is higher in the resource limited scene.

[0046] : The number of functions actually supported by the plug-in, such as a plug-in supporting process monitoring and resource limitation 2 functions. : The total number of functions required by the sandbox environment, such as process monitoring, resource limitation, log audit, etc. 5 functions, reflects the coverage degree of plug-in functions to sandbox demand.

[0047] : The average resource occupation of the plug-in in the standard test environment, including the consumption of CPU, memory and other resources.

[0048] : The maximum resource limit allocated to the plug-in by the sandbox environment, whether the resource occupation of the plug-in is within a reasonable range. : The number of errors occurred in the test process of the plug-in, such as runtime crash, function failure and other errors.

[0049] : The total number of tests of the plug-in, reflects the stability of the plug-in, the lower the error rate, the closer the value to 1. The formula quantifies the compatibility of the plug-in from the three core dimensions of function matching, resource control and running stability, adjusts the weight to adapt to different scenes, solves the subjective problem of traditional experience-dependent compatibility judgment, and ensures that the loaded plug-in is highly compatible with the sandbox.

[0050] ​The scheme realizes objective and accurate evaluation of plug-in compatibility by constructing a three-dimensional evaluation model including function matching degree, resource occupation rate and error rate, and quantifying it into compatibility score by formula The weight coefficient is introduced 、 、 The importance of each dimension can be adjusted according to the actual needs of the sandbox, and different scenarios can be flexibly adapted. Through the calculation method of 、 、 , the plug-in adaptability is measured from three core aspects of function coverage, resource control and running stability, solving the problem of relying on experience and single dimension in traditional evaluation. Before loading the plug-in, the score is screened to ensure that the loaded plug-in is functionally matched, resource occupation is reasonable and running is stable, reducing sandbox failures caused by compatibility problems, and improving the scientificity of plug-in management and the overall running efficiency of the sandbox.

[0051] The traditional sandbox communication security evaluation has the following technical problems: the security coefficient of the transmission link lacks a systematic quantitative method, and is mainly judged by a single index, which cannot comprehensively reflect the multi-dimensional security state of identity authentication, data encryption and transmission integrity; the security evaluation model is fixed, and it is difficult to adapt to the security needs of different communication scenarios, which leads to incomplete identification of potential risks and affects the security of data transmission inside and outside the sandbox.

[0052] Therefore, in the hybrid communication protocol architecture, the security evaluation of data transmission calculates the security coefficient of the transmission link by the following formula: Wherein, represents the security coefficient of the transmission link, and the value range is The higher the security coefficient, the safer the transmission link; 、 、 respectively represent the weight coefficients of identity authentication strength, data encryption strength and transmission integrity, and ; represents the complexity score of the identity authentication mechanism, 、 are the parameters of the logistic function, which are used to adjust the growth rate and midpoint position of the function; represents the security strength score of the data encryption algorithm, 、 are the parameters of the logistic function; represents the number of data errors or tampering detected in the transmission process, represents the total number of data frames transmitted.

[0053] : Security coefficient of transmission link, value 0-1, the higher the value, the safer the link, which can effectively protect the confidentiality and integrity of data transmission.

[0054] , , : Respectively, the weight coefficients of identity authentication strength, data encryption strength and transmission integrity, the sum is 1, which can be adjusted according to the communication scene, such as transmitting sensitive instructions The weight is higher.

[0055] : The complexity score of identity authentication mechanism, which comprehensively considers the authentication methods such as password, key, biometric identification, authentication times, etc. The higher the complexity, the higher the score.

[0056] , : The parameter of logistic function, Adjust the growth rate of the function, The larger the curve is steeper; The midpoint position determines when the function reaches 0.5, Convert the authentication strength value to 0-1 through the function, Reflects the nonlinear growth characteristics.

[0057] : The security strength score of data encryption algorithm, based on algorithm type such as SM4, AES, key length, etc. The higher the strength, the higher the score.

[0058] , : The parameter of logistic function, same as , Convert the encryption strength value to 0-1.

[0059] : The number of data errors or tampering detected during transmission, identified through checksum mechanism, etc.

[0060] : The total number of data frames transmitted, Reflects the transmission integrity, the fewer the errors, the closer the value is to 1. This formula processes the nonlinear characteristics of authentication and encryption strength through a nonlinear function, combines with the transmission integrity evaluation, and comprehensively quantifies the link security, solving the one-sidedness problem of traditional single index evaluation, and providing a scientific quantitative basis for safe communication inside and outside the sandbox.

[0061] ​The scheme builds a security coefficient calculation model through multi-dimensional indicators, includes identity authentication strength, data encryption strength and transmission integrity into the evaluation system, and uses a logistic function to process the security indicators of non-linear relationship, realizes the comprehensive quantification of the transmission link security state; the weight coefficient 、 、 can be dynamically adjusted according to the communication scene, and adapts to different security requirements; through directly reflects the transmission integrity, ensures that the data is not tampered with or damaged in the transmission process.

[0062] Solve the limitations of single indicator and fixed model in traditional evaluation, can more accurately identify the security risk of transmission link, provide scientific security judgment basis for data transmission inside and outside the sandbox, enhance the reliability and anti-attack ability of communication process, and protect the safe interaction of control instructions and audit data.

[0063] The traditional sandbox control plug-in has the following technical problems: the plug-in function is single, only part of the basic control demand can be met, and the complex and changeable security scene cannot be coped with; the plug-in lacks targeted design, and the support for key links such as process behavior analysis, resource dynamic adjustment and communication encryption is insufficient, resulting in weak sandbox control ability, which is difficult to resist diversified threats; the synergy between plug-ins is poor, and each functional module runs independently, which cannot form a complete security protection system.

[0064] Based on this, the plug-in management framework supports the loaded control plug-in, including: behavior analysis plug-in, which can perform time sequence analysis on the operation behavior of the process in the sandbox, identify abnormal behavior patterns with periodicity, suddenness or concealment, and generate detailed behavior analysis report; resource dynamic adjustment plug-in, which can automatically adjust the CPU scheduling priority, memory allocation limit and disk I / O queue length of the process in the sandbox according to the real-time resource usage of the process and the preset resource adjustment strategy, and realize dynamic optimization configuration of resources; communication encryption plug-in, which uses the national encryption SM4 algorithm to encrypt the data transmitted between the sandbox and the outside, and uses the national encryption SM3 algorithm for hash check, to ensure the confidentiality and integrity of the data; process behavior simulation plug-in, which can simulate the operation behavior characteristics of normal processes, generate false file operation records and network communication data, and is used to confuse potential attack programs and improve the anti-probing ability of the sandbox environment; security policy learning plug-in, which is based on reinforcement learning algorithm, interacts with the process behavior in the sandbox continuously, learns and optimizes the security control policy autonomously, and gradually improves the identification and response ability to unknown threats.

[0065] The scheme solves the problem of single function and insufficient targeting of traditional plug-ins by designing various function-specific and targeted plug-ins covering key links such as process behavior analysis, resource allocation, communication security, anti-probing and policy optimization; the behavior analysis plug-in identifies abnormal patterns through time sequence analysis to provide a basis for security decision-making; the resource dynamic adjustment plug-in realizes on-demand allocation of resources to improve system efficiency; the communication encryption plug-in uses national cryptographic algorithms to ensure data security; the process behavior simulation plug-in enhances anti-probing capability; and the security policy learning plug-in continuously optimizes the policy through reinforcement learning to improve the response capability to unknown threats.

[0066] The various plug-ins work cooperatively to form a multi-level and all-round security management and control system, significantly enhancing the security protection capability and adaptability of the sandbox and meeting the management and control requirements in complex scenarios.

[0067] The traditional sandbox communication protocol architecture has the following technical problems: the communication protocol is single and cannot adapt to the transmission requirements of different types of data, resulting in low transmission efficiency, poor real-time performance or inability to guarantee integrity; the protocol conversion process lacks a security verification mechanism and is vulnerable to malicious data injection attacks, threatening the security of the sandbox; and the communication port is fixed, which is easy to be scanned and attacked, increasing the security risk.

[0068] Therefore, the construction process of the hybrid communication protocol architecture includes: deploying a protocol conversion gateway inside the sandbox, which supports mutual conversion of Unix domain sockets, TCP / IP protocols, WebSocket protocols and gRPC protocols; using differentiated communication protocols for different types of data transmission requirements, using gRPC protocol for transmission of process management and control instructions to ensure the efficiency and reliability of instruction transmission; using WebSocket protocol for real-time audit data transmission to realize real-time data pushing and bidirectional interaction; using TCP / IP protocol for transmission of a large amount of historical log data to ensure data transmission integrity through fragmentation transmission and breakpoint resume mechanism; in the protocol conversion process, the gateway performs format verification and length check on all transmission data to filter out data packets that do not meet the specifications and prevent malicious data injection attacks; and using a dynamic port allocation mechanism, a port that is not occupied is randomly selected as the communication port each time the sandbox is started, and the port is changed regularly during sandbox operation to reduce the risk of port scanning and attack.

[0069] The scheme realizes flexible conversion between different protocols by deploying a gateway supporting multi-protocol conversion, and solves the problem of poor adaptability of traditional single protocol by adopting differentiated protocols for different types of data such as process control instructions, real-time audit data, historical log data, etc., thereby improving the efficiency, real-time performance and integrity of data transmission; format checking and length checking in the protocol conversion process effectively filter malicious data and enhance communication security; the dynamic port allocation mechanism greatly reduces the probability of port scanning and attack by randomly selecting and periodically changing ports.

[0070] The overall architecture takes into account the efficiency, security and flexibility of communication, ensuring smooth and secure data interaction between the sandbox and the outside, and providing reliable communication support for real-time control and audit. The traditional sandbox management tool has the following technical problems: the interface layout is fixed and cannot adapt to different terminal devices and screen resolutions, affecting user operation experience; the display priority of the function modules is fixed and cannot highlight critical information in emergency situations, which may delay safety response; lack of individual customization capability, cannot meet the differentiated operation habits of users, and reduces management efficiency.

[0071] Therefore, the implementation process of the adaptive interface management tool includes: automatically detecting the terminal device type and screen resolution of the user when the tool starts, and loading the corresponding interface layout template according to the detection result; adopting a modular design idea, dividing the functions of the tool into process monitoring module, resource statistics module, audit log module, security alarm module and control operation module, each module corresponding to an independent interface component; dynamically adjusting the display priority of the interface component according to the running state of the process in the sandbox, and when detecting high-risk operation behavior, automatically displaying the component of the security alarm module on top and issuing visual and audible prompts; supporting user-defined interface layout, users can adjust the position and size of each component through drag-and-drop operation, and save the customized layout as a template for subsequent use; integrating intelligent search function, users can input process name, PID, file path or operation type, etc. Key words to quickly query related process information and audit records; provide detailed operation log recording function, all control operations performed by users through the management tool will be recorded in the log file, and the log content includes operation time, operation type, operation object, operation parameter and operation result, for subsequent audit and traceability.

[0072] The scheme solves the interface adaptability problem by automatically detecting the terminal device and resolution and loading the corresponding layout template, improves the operation experience on different devices; the modular design makes the function components independent and controllable, combined with the dynamic priority adjustment mechanism, highlights the safety alarm information when high-risk operation occurs, ensures that the user responds in time; support user-defined interface layout and save templates, meet the personalized operation habits, improve management efficiency; the intelligent search function facilitates quick information query, reduces operation time consumption; detailed operation log records provide basis for subsequent audit and traceability, enhance the standardization and traceability of management.

[0073] The whole realizes the intelligentization, individualization and high efficiency of the management tool, solves the problems of the traditional tool in interface adaptation, information priority, individualization and traceability, improves the control efficiency and experience of the user on the sandbox process.

[0074] The above is only the preferred embodiment of the present application, not other forms of the present application, any skilled in the art may use the above disclosed technical content to change or modify as equivalent embodiments applied to other fields, but any simple modification, equivalent change and modification made on the basis of the technical essence of the present application to the above embodiments without departing from the technical scheme content of the present application still belongs to the protection scope of the present application technical scheme.

Claims

1. An interactive management method for Linux sandbox lightweight process auditing in a desktop environment, characterized in that, The application comprises: A dynamic hierarchical sandbox environment is constructed based on the namespace and control group of the Linux kernel, and a specified directory of a host machine is bidirectionally bound to a virtual directory in the sandbox through preset environment variable mapping rules, so as to realize the isolation and dynamic adaptation of a process running environment; An intelligent file filtering driver with context awareness capability is loaded, and the file operation behavior of a process in the sandbox is monitored in multiple dimensions by combining the dynamic probe technology in the kernel mode; A real-time audit model based on a behavior feature vector is constructed, the process operation behavior is evaluated in terms of a security level through the model, and a corresponding control strategy is triggered according to the evaluation result; A plug-in management framework supporting hot plugging is integrated, a control plug-in with specific functions is loaded through the framework, and the individualized control of the process in the sandbox is realized; a mixed communication protocol architecture is adopted to establish a secure communication channel between the inside and outside of the sandbox, so as to ensure the bidirectional safe transmission of control instructions and audit data; An adaptive interface management tool is developed, the tool can dynamically adjust the display content according to the running state of the process in the sandbox, and supports the real-time control of the process through visual operation.

2. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The construction process of the dynamic hierarchical sandbox environment comprises: An isolated base layer is created through the namespace mechanism of the Linux kernel, and the process ID, network stack, file system mounting point, user permission and host name in the sandbox are independently divided; According to a preset directory mapping rule table, the application program directory, the configuration file directory, the temporary file directory and the user data directory of the host machine are respectively mapped to the corresponding virtual directories in the sandbox, and a hash check mechanism is adopted in the mapping process to ensure the integrity of the directory content; A multi-level resource restriction layer is constructed by using the control group technology, the first level restriction layer restricts the total CPU occupancy, the total memory usage, the total disk I / O bandwidth and the total network traffic of all processes in the sandbox, and the second level restriction layer sets resource restriction thresholds for different process types in the sandbox, so as to realize the fine allocation of resources.

3. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The loading and running process of the intelligent file filtering driver comprises: in the system startup stage, the compiled intelligent file filtering driver ko file is loaded into the kernel space through the kernel module loading tool, and the integrity check and signature verification of the driver module are performed; After the driver is loaded, the file system hook function is automatically registered, which can intercept the opening, reading, writing, closing, deleting and renaming operations of the process on the file in the sandbox; When the file operation request is intercepted, the driver module automatically obtains the PID, UID, GID, operation timestamp, file path, operation type and operation data size of the process initiating the operation, and encapsulates the information into a standardized event structure, and sends it to the user state audit module for processing; The adaptive adjustment mechanism built in the driver module can dynamically adjust the triggering frequency of the hook function according to the load of the system, and when the CPU usage of the system exceeds the preset threshold, the sampling frequency of the hook function is automatically reduced to reduce the impact on the system performance.

4. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The construction and running process of the real-time audit model based on the behavior feature vector comprises: The file operation behavior features of the process are extracted from the historical audit logs, and a feature vector space is constructed, which includes operation frequency, operation type distribution, sensitive file access times, cross-directory operation times, abnormal time period operation times, and operation data volume change rate dimensions; An initial security level evaluation model is generated by training the feature vector using a machine learning algorithm, which can divide the operation behavior of the process into four levels: safe, low risk, medium risk, and high risk; During the operation of the model, real-time operation behavior data of the process in the sandbox is collected to generate a real-time feature vector, which is input into the evaluation model for security level evaluation; A dynamic threshold adjustment mechanism is set, and when new threat types or operation modes appear in the sandbox, the model can automatically adjust the evaluation threshold according to the administrator's feedback to improve the recognition ability of new threats.

5. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, In the process of evaluating the security level of the process operation behavior, the risk index of the process operation behavior is calculated using the following formula: ； in, A risk index representing the process's operational behavior; Indicates the number of behavioral characteristic dimensions involved in the evaluation; Indicates the first The weights for each feature dimension are determined based on the importance of the feature to the security assessment, and their values ​​range from [value range missing]. And the sum of the weights of all feature dimensions is 1; Indicates the first Actual observed values ​​for each feature dimension; denotes the normalized function of the th feature dimension, which is used to convert the actual observation value into a normalized value between 0 and 1, and the specific calculation formula is wherein min denotes the minimum possible value of the feature dimension, and max denotes the maximum possible value of the feature dimension.​​​​ Indicates the first The abnormal deviation of each feature dimension, that is, the degree of deviation between the actual observed value and the normal range of values ​​for that feature dimension, with a range of values ​​of [value range missing]. ; The amplification function, representing the degree of abnormal deviation, is used to enhance the influence weight of abnormal behavior. The specific calculation formula is as follows: .

6. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The plug-in management framework supports the dynamic loading and unloading of controlled plug-ins, and the compatibility score of the plug-in is calculated using the following formula during the loading process: ； wherein, represents the compatibility score of the plug-in, and the value range is , and the higher the score is, the better the compatibility is; , , respectively represent the weight coefficients of the function matching degree, the resource occupation rate and the error rate, and ; represents the actual number of functions supported by the plug-in, represents the total number of functions required by the sandbox environment; represents the average resource occupation of the plug-in in the standard test environment, represents the maximum resource limit allocated to the plug-in by the sandbox environment; represents the number of errors of the plug-in in the test process, represents the total number of tests of the plug-in.

7. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, In the mixed communication protocol architecture, the security of data transmission is evaluated by calculating the security coefficient of the transmission link using the following formula: ； wherein, represents the security coefficient of the transmission link, and the value range is The higher the security coefficient, the safer the transmission link is. , , respectively represent the weight coefficients of the identity authentication strength, the data encryption strength and the transmission integrity, and ; represents the complexity score of the identity authentication mechanism, , are parameters of the logistic function, used to adjust the growth rate and midpoint position of the function; represents the security strength score of the data encryption algorithm, , are parameters of the logistic function; represents the number of data errors or tampering detected in the transmission process, represents the total number of data frames transmitted.

8. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The plug-in management framework supports the loading of controlled plug-ins, including: behavior analysis plug-in, which can perform time series analysis on the operation behavior of the process in the sandbox, identify abnormal behavior patterns with periodicity, burstiness or concealment, and generate detailed behavior analysis reports; resource dynamic adjustment plug-in, which can automatically adjust the CPU scheduling priority, memory allocation limit, and disk I / O queue length of the process in the sandbox according to the real-time resource usage and pre-set resource adjustment strategy, to realize dynamic optimization configuration of resources; communication encryption plug-in, which uses the SM4 algorithm to encrypt the data transmitted between the sandbox and the outside, and uses the SM3 algorithm to perform hash verification on the data, to ensure the confidentiality and integrity of the data; process behavior simulation plug-in, which can simulate the operation behavior features of normal processes, generate false file operation records and network communication data, and use them to confuse potential attack programs, to improve the anti-detection ability of the sandbox environment; security policy learning plug-in, which is based on reinforcement learning algorithm, and through continuous interaction with the process behavior in the sandbox, it can learn and optimize the security control strategy independently, and gradually improve the identification and response ability to unknown threats.

9. The interactive governance method of desktop environment oriented Linux sandboxed lightweight process auditing according to claim 1, characterized in that, The construction process of the mixed communication protocol architecture includes: deploying a protocol conversion gateway inside the sandbox, which supports mutual conversion of Unix domain sockets, TCP / IP protocols, WebSocket protocols and gRPC protocols; differentiating communication protocols for different types of data transmission needs, using gRPC protocol for process control instruction transmission to ensure efficiency and reliability of instruction transmission; using WebSocket protocol for real-time audit data transmission to realize real-time data pushing and bidirectional interaction; using TCP / IP protocol for transmission of a large number of historical log data, and using the fragmentation transmission and breakpoint resume mechanism to ensure the integrity of data transmission; in the protocol conversion process, the gateway performs format checking and length checking on all transmission data, filters out data packets that do not meet the specifications, and prevents malicious data injection attacks; using a dynamic port allocation mechanism, randomly selecting an unoccupied port as a communication port each time the sandbox is started, and periodically changing the port during sandbox operation to reduce the risk of port scanning and attack.

10. The interactive control method of the Linux sandbox lightweight process audit of the desktop environment according to claim 1, characterized in that, The implementation process of the adaptive interface management tool includes: automatically detecting the terminal device type and screen resolution of the user when the tool is started, and loading the corresponding interface layout template according to the detection result; using a modular design idea to divide the functions of the tool into process monitoring module, resource statistics module, audit log module, security alarm module and control operation module, each module corresponding to an independent interface component; dynamically adjusting the display priority of the interface component according to the running state of the process in the sandbox, and automatically displaying the component of the security alarm module on top when high-risk operation behavior is detected, and issuing visual and audible prompts; supporting user-defined interface layout, users can adjust the position and size of each component through drag-and-drop operation, and save the custom layout as a template for subsequent use; integrating intelligent search function, users can input process name, PID, file path or operation type and other keywords to quickly query related process information and audit records; providing detailed operation log recording function, all control operations performed by users through the management tool will be recorded in the log file, and the log content includes operation time, operation type, operation object, operation parameter and operation result, so as to facilitate subsequent audit and traceability.

Images