A method, device, electronic device and storage medium for identifying malicious processes

Abstract

The present application discloses a method, device, electronic device and storage medium for identifying malicious processes. The method includes: when an application layer interface is detected to be called by a process, domain name information corresponding to the application layer interface is obtained; when a system call is detected to be called by a process, connection information of a socket corresponding to the system call is obtained, and malicious identification of the process is performed based on the domain name information and connection information. Since the embodiment of the present application can directly perform malicious identification of the process based on the above-mentioned domain name information and connection information, it is not necessary to perform malicious identification of the process based on the analysis of the obtained data packet of the process, so that the monitoring efficiency of the process can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, electronic device and storage medium for identifying malicious processes. Background Art

[0002] With the rapid development of Internet technology, large-scale clusters in cloud computing have brought powerful computing power, but also increased the difficulty of cluster monitoring. Among them, a key task is to monitor the network communication of a process in the system, and perform a series of tasks such as program debugging, network security monitoring, early warning, tracing and processing. In the prior art, the way to monitor the process is to obtain the data packets of all processes offline, and obtain the relevant information of a process by analyzing the data packets to realize the monitoring of the process.

[0003] However, the above existing method of monitoring a process can only obtain the data packet of the process in an offline environment, and can only obtain relevant information of the process by analyzing the data packet. This means that when a process needs to be identified, it must be done in a specific offline environment, and there is a long time from obtaining the data packet to processing the data packet to obtain the necessary data, which can lead to the problem of high identification delay, thus resulting in low efficiency of process monitoring. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for identifying a malicious process, which can improve the efficiency of monitoring the process.

[0005] On the one hand, an embodiment of the present application provides a method for identifying a malicious process, the method comprising:

[0006] When it is detected that the application layer interface is called by the process, the domain name information corresponding to the application layer interface is obtained;

[0007] When it is detected that a system call is called by the process, the connection information of the socket corresponding to the system call is obtained;

[0008] Identify malicious processes based on domain name information and connection information.

[0009] On the other hand, a malicious process identification device is provided, the device comprising:

[0010] The first acquisition module is used to acquire the domain name information corresponding to the application layer interface when monitoring that the application layer interface is called by the process;

[0011] A second acquisition module is used to acquire connection information of a socket corresponding to the system call when it is detected that the system call is called by the process;

[0012] The identification module is used to identify malicious processes based on domain name information and connection information.

[0013] On the other hand, an electronic device is provided, which includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the malicious process identification method as described above.

[0014] On the other hand, a computer-readable storage medium is provided, in which at least one instruction, at least one program, a code set or an instruction set is stored. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the method for identifying malicious processes as described above.

[0015] The malicious process identification method, device, and storage medium provided by the embodiments of the present application have the following technical effects:

[0016] When it is detected that the application layer interface is called by the process, the domain name information corresponding to the application layer interface is obtained. When it is detected that the system call is called by the process, the connection information of the socket corresponding to the system call is obtained, and the process is maliciously identified based on the domain name information and the connection information. Since the embodiment of the present application can directly identify the process maliciously based on the above-mentioned domain name information and connection information, it is not necessary to identify the process maliciously based on the analysis of the obtained data packet of the process, so that the monitoring efficiency of the process can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application;

[0019] Figure 2 It is a protocol reference model provided by an embodiment of the present application;

[0020] Figure 3 It is a flowchart of a method for identifying a malicious process provided by an embodiment of the present application;

[0021] Figure 4 It is a flowchart of a method for identifying a malicious process provided by an embodiment of the present application;

[0022] Figure 5 It is a flowchart of a method for identifying a malicious process provided by an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the structure of a malicious process identification device provided in an embodiment of the present application;

[0024] Figure 7 It is a hardware structure block diagram of a server of a malicious process identification method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] See also Figure 1 and Figure 2 , Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application, Figure 2 is a protocol reference model provided by the embodiment of the present application. Figure 1 The device 101 is equipped with a Lunix system. The Lunix system in the device 101 includes a three-layer structure: a user space 102, a kernel space 103, and hardware 104. Optionally, the device can be a desktop computer, a laptop, a mobile phone, a smart device, etc. equipped with a Lunix system.

[0028] Among them, Figure 2As shown, the user space in the embodiment of the present application corresponds to the application layer in the 5-layer reference model, and the application layer in the 5-layer reference model corresponds to the application layer, presentation layer and session layer in the OSI model. The application layer in the OSI model directly interfaces with the application program and provides common network application services. Based on the above, in the embodiment of the present application, the interface between the application program and the user space is considered to be located in the user space and can be called an application layer interface.

[0029] In the embodiment of the present application, the application layer, i.e., the user space, can rely on certain specific protocols to complete corresponding functions. The Domain Name System (DNS), i.e., the domain name resolution protocol, is a protocol corresponding to the user space, which is used to resolve the host name provided by the user into an Internet Protocol (IP) address.

[0030] When users access a web page through an application, they usually enter meaningful English character identifiers, such as a domain name. www.xxxxxxxx.com However, the device does not use the above characters to find the server corresponding to the domain name, but uses the IP address to find the corresponding server, in preparation for establishing a communication connection with the server later. The following is an explanation of the working process of the DNS protocol based on the DNS protocol: the device sends the domain name entered by the user to a server that resolves the domain name. The server that resolves the domain name may include multiple servers that resolve different domain names, for example, there are servers that resolve .com, servers that resolve .org, and servers that resolve .net. The IP address of the above domain name is obtained by resolving the .com server, and the IP address is fed back to the device that sent the domain name, so that the device can establish a communication connection with the server based on the IP address.

[0031] In an embodiment of the present application, the process may be a running application. When the process needs to obtain an IP address, control must be transferred to the user space through the application layer interface, so that the user space completes the IP address query based on the DNS protocol.

[0032] like Figure 2 As shown in the figure, the system call is the interface between the application and the operating system. Most operating systems use system calls to transfer control between the application and the operating system. In other words, the system call is the interface for transferring the control of the process and the control of the operating system. When a process calls a system call, the control is transferred from the process to the system call, and the system call transfers the control to the operating system. The operating system then transfers the control to a function in the kernel space to perform the requested operation. Therefore, the system call can be considered as the interface between the application and the kernel space, and is located in the kernel space.

[0033] In the present application embodiment, Figure 2As shown, the kernel space in the embodiment of the present application corresponds to the transport layer, network layer and data link layer in the 5-layer reference model. When a process needs to establish network communication, whether it is based on the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP), it needs to go through the kernel space, so a system call needs to be called.

[0034] In the embodiments of the present application, Lunix is ​​a free and open source UNIX-like operating system. Figure 1 As shown, the application layer interface and system calls can be located in the Linux system.

[0035] The following describes a specific embodiment of a method for identifying a malicious process of the present application. Figure 3 It is a flowchart of a method for identifying malicious processes provided in an embodiment of the present application. This specification provides method operation steps such as the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or server product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. Specifically, Figure 3 As shown, the method may include:

[0036] S301: When it is detected that the application layer interface is called by a process, domain name information corresponding to the application layer interface is obtained.

[0037] In the embodiment of the present application, when a process obtains an IP address, it needs to complete the query of the IP address through the DNS protocol of the user space. Specifically, the process calls the application layer interface, and transmits the domain name and control right to the user space through the application layer interface, so that the user space can complete the query of the IP address based on the domain name, where the domain name is the domain name information in the above S301.

[0038] In an embodiment of the present application, before S301, that is, before the application layer interface is detected to be called by the process, in an optional implementation, a first detection function can be inserted into the function corresponding to the application layer interface. In this way, when obtaining the domain name information corresponding to the application layer interface, the domain name information corresponding to the application layer interface can be obtained through the inserted first detection function. Optionally, the detection function can be dynamically inserted into most functions in the user space so that the relevant information of the detected function can be obtained through the detection function.

[0039] In an optional implementation of the first detection function to obtain domain name information, the function corresponding to the application layer interface in which the first detection function is to be inserted is determined, the first detection function is inserted into the function corresponding to the application layer interface, and the device starts a certain application according to the startup instruction converted from the user's operation behavior. The user can enter the domain name information of a web page in the process (the running application) (by manual input or by clicking the icon or link corresponding to the web page). When the device calls the application layer interface through the function corresponding to the application layer interface to transfer the domain name information and control rights to the user space, the operation of the function corresponding to the application layer interface is first suspended, and the first detection function is run to obtain the above-mentioned domain name information through the first detection function. Subsequently, the function corresponding to the application layer interface is run to transfer the domain name information and control rights to the user space, so that the user space can complete the query of the IP address of the server corresponding to the web page based on the domain name information.

[0040] In the embodiment of the present application, the above-mentioned first detection function may be a hook function based on the Uprobe technology.

[0041] S303: When it is detected that a system call is called by the process, connection information of a socket corresponding to the system call is obtained.

[0042] In the embodiment of the present application, the connection information includes the connection mode, the network protocol address and the port number.

[0043] In an embodiment of the present application, when a process needs to establish a communication connection, a system call is called, and the device transfers control from the process to the system call. The system call transfers control to the kernel space, and the kernel space establishes a socket so that the system resources required for the process's communication are allocated to the process.

[0044] In an embodiment of the present application, before S303, that is, before the system call is detected to be called by the process, in an optional implementation, a second detection function can be inserted into the function corresponding to the system call. In this way, when obtaining the connection information of the socket corresponding to the system call, the connection information of the socket corresponding to the system call can be obtained through the inserted second detection function. Optionally, the detection function can be dynamically inserted into most functions in the kernel space so that the relevant information of the detected function can be obtained through the detection function.

[0045] In an optional implementation method of obtaining the connection information of the socket by the second detection function, the function corresponding to the system call in which the second detection function is to be inserted can be determined, and the second detection function is inserted into the function corresponding to the system call. Based on the above process obtaining the IP address of a web page, it is further explained how the process calls the system call, and obtains the connection information of the socket corresponding to the system call through the second detection function. The device transmits the IP address and control right obtained in the above text to the kernel space through the system call by the process, and the kernel space establishes a socket, determines the IP address, port number and connection mode, and fills the above IP address, port number and connection mode into the above socket. When the device runs the function corresponding to the system call to establish a communication connection between the device and the server corresponding to the web page through the socket, the operation of the function corresponding to the system call is suspended, and the second detection function is run to obtain the above IP address, port number and connection mode through the second detection function. Subsequently, the device runs the function corresponding to the system call to establish a communication connection between the device and the server corresponding to the above web page through the socket. In this way, the server and the device can transmit data packets based on the established communication connection.

[0046] In the implementation example of the present application, the connection mode may include a connection based on the TCP protocol and a connection based on the UDP protocol. Optionally, the port number may be a target port number. Optionally, the second detection function may be a hook function based on the Kprobe technology.

[0047] S305: Identify malicious processes based on the domain name information and connection information.

[0048] In an embodiment of the present application, the domain name information and / or connection information may be matched with preset malicious process information. When any of the domain name information or the connection information matches the preset malicious process information, the process is determined to be a malicious process.

[0049] In an optional implementation, there is a malicious process information library, which contains preset malicious process information. If the preset malicious process information is the domain name information corresponding to each determined malicious process, after the domain name information is obtained through the first detection function, the preset malicious process information in the malicious process information library can be used to match the obtained domain name information process. If the preset malicious process information contains the obtained domain name information, the match is successful and the process is determined to be a malicious process.

[0050] In another optional implementation, there is a malicious process information library, which contains preset malicious process information. If the preset malicious process information is the IP address in the connection information corresponding to each determined malicious process, after the connection information is obtained through the second detection function, the preset malicious process information in the malicious process information library can be used to match the IP address process in the obtained connection information. If the preset malicious process information contains the IP address in the obtained connection information, the match is successful and the process is determined to be a malicious process.

[0051] In another optional implementation, there is a malicious process information library, which contains preset malicious process information. If the preset malicious process information is the port number in the connection information corresponding to each determined malicious process, after the connection information is obtained through the second detection function, the preset malicious process information in the malicious process information library can be used to match the process with the port number in the obtained connection information. If the preset malicious process information contains the port number in the obtained connection information, the match is successful and the process is determined to be a malicious process.

[0052] In another optional implementation, there is a malicious process information library, which contains preset malicious process information. If the preset malicious process information is the domain name information and the IP address in the connection information corresponding to each determined malicious process, after the domain name information is obtained through the first detection function and the connection information is obtained through the second detection function, the process can be matched based on the preset malicious process information in the malicious process information library and the obtained domain name information and the IP address in the connection information. If the preset malicious process information contains the obtained domain name information and the IP address in the connection information, the match is successful and the process is determined to be a malicious process.

[0053] In the embodiment of the present application, when the process is determined to be a malicious process, the running path and running time of the process can also be obtained, and the device that has run the malicious process can be determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process can be determined according to the running time of the process. In this way, the device that has run the malicious process can be maintained, or the software or hardware in certain devices can be maintained based on the time when the malicious process was run.

[0054] Optionally, the embodiment of the present application can obtain the process tag while obtaining the process running path and the process running time. The process tag is used to identify the identity information of the process, which can be a unique identifier of the process, that is, a unique identifier of the application. The running time of the process can refer to the time when the process is started, which can be the time when the device where the process is located and the server establish a communication connection.

[0055] In an optional implementation, the process mark, process running time and process running path mentioned above can be obtained and recorded at the same time when the first detection function and the second detection function obtain the domain name information and the connection information. After determining that the process is a malicious process, the recorded process running path and process running time will be obtained, and the device that has run the malicious process will be determined based on the process running path, and the time when the device that has run the malicious process runs the malicious process will be determined based on the process running time.

[0056] In another optional embodiment, after the process is maliciously identified based on the domain name information and the connection information, the tag of the process can be determined, and the running path and running time of the process can be obtained according to the tag of the process. Subsequently, the device that has run the malicious process can be determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process can be determined according to the running time of the process.

[0057] The following introduces a malicious process identification method for real-time identification of a malicious process. Figure 4 is a flowchart of a method for identifying a malicious process provided by an embodiment of the present application, and specifically Figure 4 As shown, the method may include:

[0058] S401: Insert a first detection function into a function corresponding to an application layer interface.

[0059] S403: Insert a second detection function into the function corresponding to the system call.

[0060] S405: When it is detected that the application layer interface is called by the process, the domain name information corresponding to the application layer interface is obtained through the inserted first detection function.

[0061] S407: When it is monitored that a system call is called by the process, connection information of the socket corresponding to the system call may be obtained through the inserted second detection function.

[0062] S409: Match the domain name information and / or connection information with the preset malicious process information. When any of the domain name information or the connection information matches the preset malicious process information, go to step S411; otherwise, delete the obtained domain name information and connection information.

[0063] In the embodiment of the present application, whether the process is a malicious process can be determined by judging whether the domain name information is the preset domain name information as in S409. Whether the process is a malicious process can also be determined by judging whether the IP address is the preset IP address. Whether the process is a malicious process can also be determined by judging whether the port number is the preset port number.

[0064] S411: Determine that the process is a malicious process, and determine a tag for the process.

[0065] S413: Obtain the process running path and the process running time according to the tag of the process.

[0066] S415: Determine the device that has run the malicious process according to the process running path.

[0067] S417: Determine the time when the device that ran the malicious process ran the malicious process according to the running time of the process.

[0068] The malicious process identification method described in S401 to S417 can identify the malicious process in real time, and promptly determine the device that has run the malicious process and the time when the device ran the malicious process.

[0069] The following introduces a specific embodiment of an optional method for identifying malicious processes. Figure 5 is a flowchart of a method for identifying a malicious process provided by an embodiment of the present application, and specifically Figure 5 As shown, the method may include:

[0070] S501: Insert a first detection function into a function corresponding to an application layer interface.

[0071] S503: Insert a second detection function into the function corresponding to the system call.

[0072] S505: When it is detected that the application layer interface is called by the process, the domain name information corresponding to the application layer interface is obtained through the inserted first detection function.

[0073] S507: When it is monitored that a system call is called by the process, the connection information of the socket corresponding to the system call can be obtained through the inserted second detection function.

[0074] S509: Obtain the tag of the process, the running path of the process, and the running time of the process.

[0075] S511: Match the domain name information and / or connection information and / or process tag with the preset malicious process information. When any of the domain name information, connection information or process tag matches the preset malicious process information, go to step S513, otherwise delete the domain name information, connection information, process tag, process running path and process running time.

[0076] S513: Determine that the process is a malicious process.

[0077] S515: Determine the device that has run the malicious process according to the process running path.

[0078] S517: Determine the time when the device that ran the malicious process ran the malicious process according to the running time of the process.

[0079] In the embodiment of the present application, malicious processes can be collectively identified for all processes based on domain name information and / or connection information and / or process tags and preset malicious process information for all process-related information acquired in a certain time period. Alternatively, one device can be used to acquire process information, and another device can identify malicious processes for the processes based on the acquired information. Therefore, after acquiring domain name information, connection information, process tags, process running path, and process running time, the domain name information, connection information, process tags, process running path, and process running time can be stored in the memory cache area of ​​the device.

[0080] In an optional implementation scheme, a mapping table is stored in the memory cache area, and the mapping table is used to represent the mapping relationship between the domain name information and the storage area of ​​all the information of the process corresponding to the domain name information in the memory cache area. Among them, all the information includes the above-mentioned domain name information, connection information, process tag, process running path and process running time. The domain name information is matched with the preset malicious process information. When the domain name information matches the preset malicious process information, the process is determined to be a malicious process, and the storage area of ​​all the information of the process in the memory cache area can be determined through the domain name information, and the running path of the process and the running time of the process are extracted from the storage area, so that the device that has run the malicious process can be determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process can be determined according to the running time of the process.

[0081] In another optional implementation scheme, a mapping table is stored in the memory cache area, which is used to represent the mapping relationship between the IP address and the storage area of ​​all information of the process corresponding to the IP address in the memory cache area. Among them, all information includes the above-mentioned domain name information, connection information, process tag, process running path and process running time. The IP address is matched with the preset malicious process information. When the IP address matches the preset malicious process information, the process is determined to be a malicious process, and the storage area of ​​all information of the process in the memory cache area can be determined through the IP address, and the running path of the process and the running time of the process are extracted from the storage area, so that the device that has run the malicious process is determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process is determined according to the running time of the process.

[0082] In another optional implementation scheme, a mapping table is stored in the memory cache area, which is used to represent the mapping relationship between the port number and the storage area of ​​all the information of the process corresponding to the port number in the memory cache area. Among them, all the information includes the above-mentioned domain name information, connection information, process tag, process running path and process running time. The port number is matched with the preset malicious process information. When the port number matches the preset malicious process information, the process is determined to be a malicious process, and the storage area of ​​all the information of the process in the memory cache area can be determined by the port number, and the running path of the process and the running time of the process are extracted from the storage area, so that the device that has run the malicious process can be determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process can be determined according to the running time of the process.

[0083] In another optional implementation scheme, a mapping table is stored in the memory cache area, which is used to represent the mapping relationship between the process tag and the storage area of ​​all the process information corresponding to the process tag in the memory cache area. Among them, all information includes the above-mentioned domain name information, connection information, process tag, process running path and process running time. The process tag is matched with the preset malicious process information. When the process tag matches the preset malicious process information, the process is determined to be a malicious process, and the storage area of ​​all the process information in the memory cache area can be determined by the process tag, and the running path of the process and the running time of the process are extracted from the storage area, so that the device that has run the malicious process can be determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process can be determined according to the running time of the process.

[0084] In another optional implementation scheme, a mapping table is stored in the memory cache area, and the mapping table is used to represent the mapping relationship between the IP address and port number and the storage area of ​​all information of the process corresponding to the IP address and port number in the memory cache area. Among them, all information includes the above-mentioned domain name information, connection information, process tag, process running path and process running time. The IP address and port number are matched with the preset malicious process information. When the IP address and port number match the preset malicious process information, the process is determined to be a malicious process, and the storage area of ​​all information of the process in the memory cache area can be determined by the IP address and port number, and the running path of the process and the running time of the process are extracted from the storage area, so that the device that has run the malicious process is determined according to the running path of the process, and the time when the device that has run the malicious process runs the malicious process is determined according to the running time of the process.

[0085] In an embodiment of the present application, the IP address of the server providing the process service can also be determined based on the IP address; the port number of the server providing the process service can be determined based on the port number; when the device connects to the server, it can be determined based on the connection method whether the connection is based on the TCP protocol or the UDP protocol; and the unique identifier of the process can be determined based on the process tag.

[0086] In the embodiment of the present application, since many processes can be run in the device, and each process is monitored to call the application layer interface, the domain name information corresponding to the application layer interface can be obtained through the first detection function. When each process is monitored to call a system call, the connection information of the socket corresponding to the call can be obtained through the second detection function. Similarly, the tag, running path and running time of each process can also be obtained. Optionally, all information obtained by each process based on each call to the application layer interface and system call can be classified into an information file and stored in the memory cache area. This storage method allows a large number of information files to be stored in the memory cache area. And a process can also be started at different times. Therefore, more and more information files are stored in the memory cache area, resulting in more and more mapping table content. In an optional implementation, all information files can be classified based on the same information and stored in different areas of the memory cache area.

[0087] Optionally, the file information of all processes can be classified according to the domain name information, and the information file corresponding to process A is stored in the first area of ​​the memory cache area, the information file corresponding to process B is stored in the second area of ​​the memory cache area, the information file corresponding to process C is stored in the third area of ​​the memory cache area, the information file corresponding to process D is stored in the fourth area of ​​the memory cache area... and so on. The classification can be done before malicious identification of the process is performed.

[0088] Optionally, the file information of all processes can be classified according to the IP address, and the information file corresponding to process A is stored in the first area of ​​the memory cache area, the information file corresponding to process B is stored in the second area of ​​the memory cache area, the information file corresponding to process C is stored in the third area of ​​the memory cache area, the information file corresponding to process D is stored in the fourth area of ​​the memory cache area... and so on. The classification can be done before malicious identification of the process is performed.

[0089] Optionally, the file information of all processes may be classified according to the port number or the tag of the process.

[0090] In the embodiment of the present application, a specific description will be given on how to insert a first detection function into a function corresponding to an application program interface and how to insert a second detection function into a function corresponding to a system call based on a device loaded with a Lunix system.

[0091] In an optional implementation, the second detection function may be a hook function based on Kprobe technology. Kprobe is a debugging interface related to the kernel space. Optionally, the device may use ftrace to manage Kprobe. Ftrace is a debugging tool provided by the Linux kernel space. Kprobe may be controlled by ftrace. By using the debugging information provided by the kernel space, a specific system call and parameters may be specified, and the second detection function may be inserted through a series of commands. During system operation, ftrace may be enabled by dynamically mounting the tracefs ( / sys / kernel / tracing) file system of ftrace. Optionally, the Linux kernel space may also mount a debugging system file debugfs. Before inserting the second detection function, debugfs may be initialized to prepare for inserting the second detection function into the function corresponding to the system call. Optionally, the specific system call may be a sys_connect system call.

[0092] Correspondingly, Uprobe is a debugging interface related to the user space. Before inserting the first detection function, debugfs can be initialized to prepare for inserting the first detection function into the function corresponding to the application program interface. Optionally, the application program interface can be a gethostbyname, getaddrinfo application layer interface.

[0093] In an embodiment of the present application, before obtaining domain name information through the first detection function and obtaining connection information through the second detection function, Uprobe can also be run to initialize the first detection function, and Kprobe can be run to initialize the second detection function, so that the first detection function only monitors application layer interfaces related to the network, and the second detection function only monitors system calls related to the network.

[0094] Optionally, the process mark, the process path and the process time can be obtained by any one of the first detection function and the second detection function. For example, the process mark and running time can be obtained by the first detection function, and the process path information can be obtained by the second detection function.

[0095] The present application also provides a malicious process identification device. Figure 6 is a schematic diagram of the structure of a malicious process identification device provided in an embodiment of the present application, such as Figure 6 As shown, the device comprises:

[0096] The first acquisition module 601 is used to acquire the domain name information corresponding to the application layer interface when monitoring that the application layer interface is called by the process;

[0097] The second acquisition module 602 is used to acquire connection information of the socket corresponding to the system call when monitoring that the system call is called by the process;

[0098] The identification module 603 is used to identify malicious processes based on domain name information and connection information.

[0099] In an optional embodiment, the device further comprises:

[0100] The first acquisition module 601 is used to insert a first detection function into a function corresponding to the application layer interface;

[0101] The domain name information corresponding to the application layer interface is obtained through the first detection function.

[0102] In an optional embodiment, the device further comprises:

[0103] The second acquisition module 602 is used to insert a second detection function into the function corresponding to the system call;

[0104] The connection information of the socket corresponding to the system call is obtained through the second detection function.

[0105] In an optional embodiment, the device further comprises:

[0106] The identification module 603 is used to match the domain name information and / or connection information with the preset malicious process information;

[0107] When any one of the domain name information or the connection information matches the preset malicious process information, the process is determined to be a malicious process.

[0108] In an optional embodiment, the device further comprises:

[0109] The first acquisition module 601 acquires the running path of the process and the running time of the process;

[0110] The identification module 603 is used to determine the device that has run the malicious process according to the running path of the process;

[0111] The time when the device that ran the malicious process ran the malicious process is determined according to the running time of the process.

[0112] The device and method embodiments in the embodiments of this application are based on the same application concept.

[0113] The method embodiments provided in the embodiments of the present application can be executed in a computer terminal, a server or a similar computing device. Taking running on a server as an example, Figure 7 1 is a hardware structure block diagram of a server of a method for identifying a malicious process provided by an embodiment of the present application. Figure 7As shown, the server 700 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 710 (the processor 710 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 730 for storing data, and one or more storage media 720 (such as one or more mass storage devices) for storing application programs 723 or data 722. Among them, the memory 730 and the storage medium 720 can be short-term storage or permanent storage. The program stored in the storage medium 720 may include one or more modules, each of which may include a series of instruction operations on the server. Furthermore, the central processing unit 710 can be configured to communicate with the storage medium 720 and execute a series of instruction operations in the storage medium 720 on the server 700. The server 700 may also include one or more power supplies 760, one or more wired or wireless network interfaces 750, one or more input and output interfaces 740, and / or one or more operating systems 721, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0114] The input / output interface 740 may be used to receive or send data via a network. The specific example of the network may include a wireless network provided by a communication provider of the server 700. In one example, the input / output interface 740 includes a network adapter (Network Interface Controller, NIC), which may be connected to other network devices via a base station so as to communicate with the Internet. In one example, the input / output interface 740 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0115] It can be understood by those skilled in the art that Figure 7 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 7 More or fewer components as shown, or with Figure 7 Different configurations are shown.

[0116] An embodiment of the present application also provides a storage medium, which can be set in a server to store at least one instruction, at least one program, a code set or an instruction set related to a method for identifying a malicious process in a method embodiment. The at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the above-mentioned method for identifying a malicious process.

[0117] Optionally, in this embodiment, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0118] It can be seen from the embodiments of the malicious process identification method, device or storage medium provided by the present application that in the present application, when it is detected that the application layer interface is called by the process, the domain name information corresponding to the application layer interface is obtained, and when it is detected that the system call is called by the process, the connection information of the socket corresponding to the system call is obtained, and the process is maliciously identified based on the domain name information and connection information. Since the embodiments of the present application can directly identify the process maliciously based on the above-mentioned domain name information and connection information, it is not necessary to obtain the data packet of the process and then analyze it to identify the process maliciously, so that the monitoring efficiency of the process can be improved.

[0119] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0120] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0121] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0122] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for identifying a malicious process, characterized in that: The method comprises: When it is monitored that the process is running in the real application environment and the application layer interface is called by the process, domain name information corresponding to the application layer interface is obtained; the process calls the application layer interface to transmit the domain name information and control right to the user space through the application layer interface, so that the user space completes the query of the IP address based on the domain name information; When it is monitored that a system call is called by the process during the running of the process in the real application environment, connection information of the socket corresponding to the system call is obtained; when the process calls the system call to establish a communication connection for the process, the control right is transferred from the process to the kernel space through the system call, so that the kernel space establishes the socket to allocate system resources required for communication of the process to the process; During the running of the process, malicious identification of the process is performed based on the domain name information and the connection information; The identifying maliciousness of the process based on the domain name information and the connection information includes: Obtain the running path of the process and the running time of the process; match the domain name information and / or the connection information with preset malicious process information, and when any one of the domain name information and the connection information matches the preset malicious process information, determine that the process is a malicious process; determine the device that has run the malicious process based on the running path of the process; determine the time when the device that has run the malicious process runs the malicious process based on the running time of the process.

2. The method according to claim 1, characterized in that The method further comprises: Inserting a first detection function into a function corresponding to the application layer interface; The obtaining of the domain name information corresponding to the application layer interface includes: The domain name information corresponding to the application layer interface is obtained through the first detection function.

3. The method according to claim 1, characterized in that The method further comprises: Inserting a second detection function into the function corresponding to the system call; The obtaining the connection information of the socket corresponding to the system call includes: The connection information of the socket corresponding to the system call is obtained through the second detection function.

4. The method according to claim 1, characterized in that: The connection information includes connection mode, network protocol address and port number.

5. The method according to claim 1, characterized in that The identifying maliciousness of the process based on the domain name information and the connection information includes: Matching the domain name information and / or the connection information with preset malicious process information; When any one of the domain name information or the connection information matches the preset malicious process information, the process is determined to be a malicious process.

6. The method according to claim 1, characterized in that The application layer interface and system call are located in the Linux system.

7. A malicious process identification device, characterized in that: The device comprises: A first acquisition module is used to acquire domain name information corresponding to the application layer interface when it is monitored that the application layer interface is called by the process during the operation of the process in the real application environment; the process calls the application layer interface to transmit the domain name information and control right to the user space through the application layer interface, so that the user space completes the query of the IP address based on the domain name information; The second acquisition module is used for acquiring connection information of a socket corresponding to the system call when it is monitored that a system call is called by the process during the operation of the process in the real application environment; when the process calls the system call to establish a communication connection with the process, the control right is transferred from the process to the kernel space through the system call, so that the kernel space establishes the socket to allocate system resources required for communication of the process to the process; an identification module, used for identifying maliciousness of the process based on the domain name information and the connection information during the running of the process; The identification module is used to obtain the running path of the process and the running time of the process; match the domain name information and / or the connection information with the preset malicious process information, and when any one of the domain name information and the connection information matches the preset malicious process information, determine that the process is a malicious process; determine the device that has run the malicious process based on the running path of the process; and determine the time when the device that has run the malicious process runs the malicious process based on the running time of the process.

8. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the malicious process identification method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the malicious process identification method as described in any one of claims 1-6.

Images