A detection method for malicious Trojans in the Internet of Things

Abstract

The present invention discloses a method for detecting malicious Trojans in the Internet of Things, the method comprising the following steps: (1) whitelist process management; (2) performing integrity detection based on signatures and hash values ​​on the user process request obtained in step 1; (3) using virtualized kernel technology to detect hidden processes of malicious code; (4) using Syscall functions and interrupt mechanisms in Linux kernel modules to detect whether malicious code exists through the results of interrupt responses. The present invention implements a method for detecting malicious Trojans in Internet of Things devices through whitelist process management technology, integrity detection technology, and Linux kernel system call Hook functions and interrupt response mechanisms, thereby building a more efficient and complete security protection system for Internet of Things devices.

Description

Technical Field

[0001] The present invention relates to the technical field of information security protection of the Internet of Things, and in particular to a method for detecting malicious Trojans of the Internet of Things based on Hash and signature integrity detection and embedded Linux kernel system call principles. Background Art

[0002] In the era of big data, the Internet has developed beyond the network of personal computers and large servers, and it also connects millions of small embedded devices. This new trend is called the Internet of Things, or IoT for short, and the technology is widely used in various fields such as industry, commerce, agriculture, as well as smart transportation, smart home, smart logistics, smart security, and smart energy. Users can control embedded devices connected to the network at any time and anywhere through mobile devices such as mobile phones and computers, realizing the true interconnection of all things. However, while bringing great convenience to society, the Internet of Things also brings some risks related to information security. Since most IoT devices are built with cheap embedded devices, these devices can be easily compromised by exploiting weaknesses in their operating methods and vulnerabilities in the software components running on them. Malware designed for IoT devices is similar to malware designed for other types of computers: it compromises the integrity of the device by installing unwanted and potentially harmful software components on the device. These software components can then be used to cause other types of harm, such as allowing attackers to remotely access the device by installing backdoors, tampering with messages sent by the device to other devices, or making the data stored on the device unusable by deleting or encrypting it. The malicious Trojan threat of the Internet of Things needs to be taken seriously. After the Mirai and Hajime malicious codes were discovered in 2016, they attracted widespread attention from IoT security researchers. A large number of smart devices were hijacked, and using these smart devices to launch DoS attacks would cause great harm. The PinkBot botnet discovered at the end of 2019 specifically attacks optical modems, which can cause network disconnection and remote control in an area, and contaminate more devices in the subnet through the same gateway, which is highly contagious.

[0003] Malicious Trojan attacks on embedded IoT devices not only damage the security of the devices themselves, but also threaten the stability of the entire computer system. Therefore, it is urgent to analyze the operating architecture of the IoT operating system, mainly for the embedded Linux system, combined with its kernel system call, through static analysis, through anti-virus engine scanning to identify known malicious code families and variant names, reverse analysis of malicious code module composition, internal data structure, key control flow, etc., to understand the mechanism of malicious code, and extract feature codes for detection; dynamic analysis, by executing the target code in a controlled environment to obtain the behavior and operation results of the target code, comprehensive detection and then maintain the security and stability of the entire computer system. Summary of the invention

[0004] The purpose of the present invention is to address the deficiencies of the above-mentioned prior art and propose a method combining Linux kernel system call technology and integrity detection, which detects the integrity, consistency and reliability of the kernel code and kernel data structure of the acquired user process request and the untrusted operating system, and then uses the interrupt response value mechanism to detect abnormal code and data structure. In this way, malicious Trojan detection of embedded IoT devices is realized.

[0005] The technical solution adopted by the present invention to solve the technical problem is: a detection method for malicious Trojans in the Internet of Things, the method comprising the following steps:

[0006] Step 1: Whitelist process management: judge the data of the process call request obtained from the user and the system process list to determine whether the process corresponding to the process call request is in the preset whitelist database and whether the function requested by the process in the process call request is located in the sensitive function area;

[0007] Step 2: For the process obtained in step 1, use the calculated hash value of the memory image to verify the integrity of the system call table, kernel code segment, currently executing system program, and code segment running in an untrusted execution environment;

[0008] Step 3: Build a client application that runs a trusted application in the TEE and as a user space process in the REE, leveraging the host operating system for task automation and scheduling and virtualized kernel technology to detect suspicious hidden processes;

[0009] Step 4: Based on the detection environment built in step 3, use the system call hook to check whether the kernel memory state is consistent with the data structure traversed by the kernel, actively trigger the exception through the abnormal instruction, directly detect the address in the system call table and the symbol table for comparison, and use Syscall to fall into the kernel state and return the interrupt response to determine whether there is a malicious Trojan.

[0010] Furthermore, the whitelist process management in step 1 of the present invention enables various security access control models to be implemented in the form of Linux loadable kernel modules through the Linux security module (a lightweight universal access control framework). The trusted application selects a suitable security module to load into the Linux kernel to control the operation of the user process, thereby greatly improving the flexibility and ease of use of the Linux security access control mechanism, including:

[0011] Step 1-1: Whitelist process management: The process call request obtained from the user and the system process list data are judged to determine whether the process corresponding to the process call request is in the preset whitelist database and whether the function requested by the process in the process call request is located in the sensitive function area. At the same time, the whitelist will be compared according to the process feature value and timely feedback will be given for abnormal feature values;

[0012] Step 1-2: Whitelist mutex: Through the call of two types of Hook functions of the Linux security module: one type manages the security domain of kernel objects, and the other type arbitrates access to these kernel objects. Calls to security Hook functions are inserted at different key points in the kernel source code, and a general security system call is added to implement arbitration of processes. At the same time, the bit vector is moved to the appropriate security domain in the security module structure, and the system call interface is relocated. When the Linux kernel grants access rights, the Linux security module may deny them, and when the Linux kernel denies access, the Linux security module is directly skipped; and only a small amount of support is provided for the opposite "permit" access control decision.

[0013] Furthermore, in step 2 of the present invention, an intrusion feature database and a hash value table are established to perform integrity detection on the user process obtained in step 1, including:

[0014] Step 2-1: Use the calculated hash value of the memory image to verify the integrity of the system call table, kernel code segment, currently executing system programs, and code segments running in an untrusted execution environment;

[0015] Step 2-2: Retrieve the location of the system call table after the kernel is compiled. With the number of entries in the table and this information, create a hash and compare it with the hash calculated on the complete system call table.

[0016] Step 2-3: Establish an intrusion feature database, perform feature matching on functions in client application requests issued by users, compare the current activity set with existing features, and issue an alarm if a match is found, mainly targeting client user programs.

[0017] Furthermore, in step 3 of the present invention, the Pid namespace, IDR and structpid of the host operating system are used to automate and schedule tasks, and the effective path of the program is expanded to an absolute path, including:

[0018] Step 3-1: Build a client application that runs as a trusted application in the TEE and as a user space process in the REE;

[0019] Step 3-2: The main role of the client application is to periodically call the trusted program and pass certain data to the trusted program collected from REE;

[0020] Step 3-3: Malicious Trojans may attempt to evade integrity detection by stopping all malicious activities, restoring kernel objects to their clean state, and hiding in the file system using a persistence mechanism. To achieve this, the host operating system is mainly used to automate and schedule tasks, and the effective path of the program is expanded to an absolute path to check whether there are any suspicious hidden processes.

[0021] Furthermore, in step 4 of the present invention, based on the detection environment established in step 3, attack behavior detection is performed, and the Linux kernel module is used to use the Syscall function and the interrupt mechanism to detect whether there is abnormal code through the result of the interrupt echo, including:

[0022] Step 4-1: Check the data structure of existing task information and compare it with the task list. Assuming that deleting a task from the run queue will make it permanently unschedulable, the trusted application collects the pids of all tasks and compares them with the previously jointly created pid to determine whether the kernel is compromised.

[0023] Step 4-2: Use the client application to help the trusted application in the TEE obtain the pointer to the memory mapping structure of the corresponding task in the kernel memory, and convert the virtual address of the process to the physical address to check whether the code has changed;

[0024] Step 4-3: System call is a piece of code (function) provided by the Linux kernel, which implements some specific functions. Between the user space and the kernel space, there is an intermediate layer called Syscall, which is a bridge connecting the user state and the kernel state. This not only improves the security of the kernel, but also facilitates porting, and only needs to implement the same set of interfaces. In the Linux system, the user space generates a soft interrupt by issuing a Syscall to the kernel space, so that the program falls into the kernel state and performs the corresponding operations. Use the embedded Linux system call Hook function and interrupt response feedback to detect whether there is abnormal code.

[0025] Beneficial effects:

[0026] 1. The present invention is aimed at embedded Internet of Things devices. It uses the Linux kernel system call Hook to perform interrupt response to determine whether there is malicious code. The trusted execution space TEE can protect the integrity of some trusted malicious Trojan detection codes, making it impossible for potential malware running in REE to access these codes. It can provide a safe execution environment for the malicious Trojan detection code, which can access and check all system resources.

[0027] 2. The present invention uses whitelist process management, whitelist mutex locks, and hash and signature-based integrity detection methods to screen out a large number of simple malicious Trojans, while largely avoiding the destruction of kernel data structures. Then, through virtualized kernel technology, the kernel plays the role of a security personnel outside the virtual machine, monitoring sensitive behaviors and detecting hidden processes. 3.

[0028] 3. The present invention verifies the integrity of the system call table, kernel code segments (including functions that process system calls), currently executing system programs, and code segments of our system processes running in an untrusted execution environment, and focuses on checking the integrity and consistency of the kernel. Since malicious Trojans may try to evade detection by stopping all malicious activities, restoring kernel objects to their clean state, and hiding in the file system using a persistence mechanism, the system finally uses an interrupt response mechanism for detection feedback, and cooperates with the compiled file list for hash value calculation, so that malicious Trojans and their hidden processes and components can be detected persistently. Later security protection such as malicious code sample analysis, feature storage, and vulnerability mining are more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 The figure is a flow chart of the method of the present invention.

[0030] Figure 2 It is a structural block diagram of the integrity detection in the present invention.

[0031] Figure 3 It is a structural block diagram of the malicious Trojan detection and passive defense method in the present invention. DETAILED DESCRIPTION

[0032] The following will disclose the embodiments of the present invention with drawings. For the purpose of clear description, many practical details will be described together in the following description. However, it should be understood that these practical details should not be used to limit the present invention. That is to say, in some embodiments of the present invention, these practical details are not necessary.

[0033] like Figure 1 As shown, the present invention provides a method for detecting malicious Trojans in the Internet of Things, the method comprising the following steps:

[0034] Step 1: Through the Linux security module (i.e., a lightweight universal access control framework), various security access control models can be implemented in the form of Linux loadable kernel modules. Trusted applications select appropriate security modules to load into the Linux kernel to control the operation of user processes, thereby greatly improving the flexibility and ease of use of the Linux security access control mechanism. Specifically, it includes:

[0035] Step 1-1: Whitelist process management: judging the data of the process call request obtained from the user and the system process list, judging whether the process corresponding to the process call request is in the preset whitelist database and whether the function requested by the process in the process call request is located in the sensitive function area;

[0036] Step 1-2: Whitelist mutex: Through the call of two types of Hook functions of the Linux security module: one type manages the security domain of kernel objects, and the other type arbitrates access to these kernel objects. Calls to security Hook functions are inserted at different key points in the kernel source code, and a general security system call is added to implement arbitration of processes.

[0037] Step 2: For the process obtained in step 1, use the calculated hash value of the memory image to verify the integrity of the system call table, kernel code segment, currently executing system program, and code segment running in an untrusted execution environment, such as Figure 2 The integrity detection methods shown include:

[0038] Step 2-1: Use the calculated hash value of the memory image to verify the integrity of the system call table, kernel code segment, currently executing system programs, and code segments running in an untrusted execution environment;

[0039] Step 2-2: Retrieve the location of the system call table after the kernel is compiled. With the number of entries in the table and this information, create a hash and compare it with the hash calculated on the complete system call table.

[0040] Step 2-3: Establish an intrusion feature database, perform feature matching on functions in client application requests issued by users, compare the current activity set with existing features, and issue an alarm if a match is found, mainly targeting client user programs.

[0041] Step 3: The host operating system's Pid namespace, IDR, and structpid are used to automate and schedule tasks, and the effective path of the program is expanded to an absolute path. At the same time, the trusted execution space TEE is used to establish an isolated detection environment, such as Figure 3 The malicious Trojan detection and passive defense methods shown include:

[0042] Step 3-1: Build a client application that runs as a trusted application in the TEE and as a user space process in the REE;

[0043] Step 3-2: The main role of the client application is to periodically call the trusted program and pass certain data to the trusted program collected from REE;

[0044] Step 3-3: Malicious Trojans may attempt to evade integrity detection by stopping all malicious activities, restoring kernel objects to their clean state, and hiding in the file system using a persistence mechanism. To achieve this, the host operating system is mainly used to automate and schedule tasks, and the effective path of the program is expanded to an absolute path to check whether there are any suspicious hidden processes.

[0045] Step 4: Based on the detection environment established in step 3, perform attack behavior detection. Use the Linux kernel module to use the Syscall function and interrupt mechanism to detect whether there is abnormal code through the result of interrupt echo. Malicious Trojan detection and passive defense methods include:

[0046] Step 4-1: Check the data structure of existing task information and compare it with the task list. Assuming that deleting a task from the run queue will make it permanently unschedulable, the trusted application collects the pids of all tasks and compares them with the previously jointly created pid to determine whether the kernel is compromised.

[0047] Step 4-2: Use the client application to help the trusted application in the TEE obtain the pointer to the memory mapping structure of the corresponding task in the kernel memory, and convert the virtual address of the process to the physical address to check whether the code has changed;

[0048] Step 4-3: System call is a piece of code (function) provided by the Linux kernel, which implements some specific functions. Between the user space and the kernel space, there is an intermediate layer called Syscall, which is a bridge connecting the user state and the kernel state. This not only improves the security of the kernel, but also facilitates porting, and only needs to implement the same set of interfaces. In the Linux system, the user space generates a soft interrupt by issuing a Syscall to the kernel space, so that the program falls into the kernel state and performs the corresponding operations. Use the embedded Linux system call Hook function and interrupt response feedback to detect whether there is abnormal code.

[0049] The system of the present invention utilizes the embedded Linux kernel system to call the Hook function, combines static analysis with dynamic analysis, and uses TEE and REE to build a trusted execution environment to detect user processes and system processes. It determines whether there is a malicious Trojan by triggering an interrupt to form an interrupt response result, thereby building a safer and more reliable system security protection system.

[0050] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for detecting malicious Trojans in the Internet of Things, characterized by: The method comprises the following steps: Step 1: Whitelist process management, the process call request from the user and the data of the system process list are obtained to determine whether the process corresponding to the process call request is in the preset whitelist database and whether the function requested by the process in the process call request is located in the sensitive function area; Step 2: For the process obtained in step 1, use the calculated hash value of the memory image to verify the integrity of the system call table, kernel code segment, currently executing system program, and code segment running in an untrusted execution environment; Step 3: Establish a client application that runs a trusted application in a trusted execution environment (TEE) and runs as a user space process in a rich execution environment (REE), using the host operating system for task automation and scheduling and virtualized kernel technology to detect suspicious hidden processes; Step 4: Based on the detection environment built in step 3, use the system call hook to check whether the kernel memory state is consistent with the data structure traversed by the kernel, actively trigger the exception through the abnormal instruction, directly detect the address in the system call table and the symbol table for comparison, and use Syscall to fall into the kernel state and return the interrupt response to determine whether there is a malicious Trojan.

2. A method for detecting malicious Trojans in the Internet of Things according to claim 1, characterized in that: The step 1 comprises: Step 1-1: Whitelist process management, judging the data of the process call request obtained from the user and the system process list, judging whether the process corresponding to the process call request is in the preset whitelist database and whether the function requested by the process in the process call request is located in the sensitive function area; Step 1-2: Whitelist mutex, through the call of two types of Hook functions of the Linux security module: one type manages the security domain of kernel objects, and the other type arbitrates access to these kernel objects. Calls to security Hook functions are inserted at different key points in the kernel source code and a general security system call is added.

3. A method for detecting malicious Trojans in the Internet of Things according to claim 1, characterized in that: The step 2 comprises: Step 2-1: Store the user's process call request and system process list data collected in step 1 and calculate the hash value of the memory image; Step 2-2: Hash-based integrity check: After the kernel is compiled, the location of the system call table is retrieved. With the number of entries in the table and this information, a hash is created and compared with the hash calculated on the complete system call table. Step 2-3: Signature-based malicious code detection: Establish an intrusion feature database, perform feature matching on functions in client application requests issued by users, compare the current activity set with existing features, and issue an alarm if a match is found.

4. A method for detecting malicious Trojans in the Internet of Things according to claim 1, characterized in that: In step 3, a trusted isolation environment for detecting malicious Trojans is built based on TEE and REE in a virtualized environment, including: Step 3-1: Build a client application that runs as a trusted application in the TEE and as a user space process in the REE; Step 3-2: The main role of the client application is to periodically call the trusted program and pass certain data to the trusted program collected from REE; Step 3-3: Malicious Trojans may attempt to evade integrity detection by stopping all malicious activities, restoring kernel objects to their clean state, and hiding in the file system using a persistence mechanism. To achieve this, the host operating system is mainly used to automate and schedule tasks, and the effective path of the program is expanded to an absolute path to detect whether there are suspicious hidden processes.

5. A method for detecting malicious Trojans in the Internet of Things according to claim 1, characterized in that: The step 4 comprises: Step 4-1: Check the data structure of existing task information and compare it with the task list. Assuming that deleting a task from the run queue will make it permanently unschedulable, the trusted application collects the pids of all tasks and compares them with the previously jointly created pid to determine whether the kernel is compromised. Step 4-2: Use the client application to help the trusted application in the TEE obtain the pointer to the memory mapping structure of the corresponding task in the kernel memory, and convert the virtual address of the process to the physical address to check whether the code has changed; Step 4-3: Use the embedded Linux system to call the Hook function and interrupt response feedback to detect whether there is abnormal code; Step 4-4: Combine steps 3 and 4, focus on monitoring modules that are vulnerable to malicious Trojan attacks, study corresponding solutions from a system perspective, improve the system's ability to defend against various attack behaviors, and build a safe and reliable system security protection system.

Images