A system call monitoring method, device, electronic device, and storage medium

Abstract

This invention provides a system call monitoring method, apparatus, electronic device, and storage medium. The method includes: in response to detecting that the circular kernel context log (CKCL) is in the process of logging, obtaining a predetermined array of structure pointers in the kernel, wherein the predetermined array of structure pointers is the execution object when a kernel event occurs, and the kernel event includes system calls; replacing the addresses of predetermined members of the structures pointed to by the predetermined pointers in the structure pointer array with preset hook functions, so that the preset hook functions are executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook functions; and filtering out system calls from the kernel events hijacked by the preset hook functions. This invention, by mounting the preset hook functions to the system kernel, eliminates the possibility of preset hook functions being bypassed by malware on the Windows x64 platform, and does not affect the stability of the operating system, thus improving the operating system's defense capabilities.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a system call monitoring method, apparatus, electronic device, and storage medium. Background Technology

[0002] Existing endpoint security products typically use various data analysis techniques to detect suspicious system behavior, provide correlation information, and thus block malicious activities. Windows provides some interfaces for obtaining relevant events, but these interfaces are far from sufficient to meet the needs of current attack methods. Due to the impact of Kernel Patch Protection (PG), existing security vendors on Windows x64 systems monitor running processes, detect suspicious activity, collect information, and perform behavior-based analysis by hooking into dynamic link libraries in user dynamic memory.

[0003] Because the "hook" code exists in the process's user space, the user space memory can be directly modified, and therefore can be bypassed by malicious code. This will cause the hook to be erased and become ineffective, making it impossible to detect system call behavior initiated by malicious programs. Summary of the Invention

[0004] This invention provides a system call monitoring method, device, electronic device, and storage medium to solve the problem that existing preset hook functions can be bypassed by malicious code. By mounting the preset hook functions to the system kernel, the possibility of preset hook functions being bypassed by malicious software on the Windows x64 platform is eliminated, greatly improving the operating system's defense capabilities.

[0005] This invention provides a system call monitoring method, comprising:

[0006] In response to detecting that the circular kernel context log (CKCL) is in the process of logging, a predefined array of structure pointers in the kernel is obtained, wherein the predefined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log (CKCL) is used to log kernel events, including system calls;

[0007] The address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array is replaced by a preset hook function so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function;

[0008] System calls are filtered out from kernel events hijacked by the preset hook function.

[0009] According to the system call monitoring method provided by the present invention, when the kernel event is a system call, the method further includes:

[0010] The PerflnfoLogSysCallEntry function replaces the system service function in the current stack with the system service function of the current system call, and logs the current system call. The PerflnfoLogSysCallEntry function is the calling function of the KiSystemCall64 function.

[0011] According to the system call monitoring method provided by the present invention, the step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function includes:

[0012] When the operating system version is not higher than the predetermined version, the address of the GetCpuClock member of the structure pointed to by the predetermined pointer in the structure pointer array is modified to the predetermined hook function, where GetCpuClock is the name of the predetermined member in the structure.

[0013] According to the system call monitoring method provided by the present invention, the step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function includes:

[0014] When the operating system version is higher than the predetermined version, the index value GetCpuClock in the structure pointer array is set to a preset value, where the index value GetCpuClock is the index value of the function pointed to by the structure pointer array;

[0015] Based on the preset value set for the index value GetCpuClock, the address of a predetermined member in the structure inside the function corresponding to the preset value is modified to the preset hook function.

[0016] According to the system call monitoring method provided by the present invention, before replacing the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array using a preset hook function, the method further includes:

[0017] By hijacking predetermined members of the structure pointed to by predetermined pointers in the structure pointer array using a preset hook function, the address of the predetermined member of the structure pointed to by the predetermined pointers in the structure pointer array can be replaced using the preset hook function.

[0018] According to the system call monitoring method provided by the present invention, the method further includes:

[0019] Detect whether the circular kernel context log (CKCL) is enabled;

[0020] If the circular kernel context log (CKCL) is not enabled, then enable the circular kernel context log (CKCL).

[0021] The present invention also provides a system call monitoring device, comprising:

[0022] The structure acquisition module is used to acquire a predetermined array of structure pointers in the kernel in response to the detection that the circular kernel context log (CKCL) is in the process of logging. The predetermined array of structure pointers is the execution object when a kernel event occurs. The circular kernel context log (CKCL) is used to log kernel events, including system calls.

[0023] The preset hook function replacement module is used to replace the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function, so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function; the system call filtering module is used to filter out system calls from the kernel events hijacked by the preset hook function.

[0024] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the system call monitoring method as described above.

[0025] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system call monitoring method as described above.

[0026] The system call monitoring method, apparatus, electronic device, and storage medium provided by this invention, in response to the detection that the circular kernel context log (CKCL) is in the process of logging, obtains a predetermined array of structure pointers in the kernel, wherein the predetermined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log (CKCL) is used to log kernel events, including system calls; replaces the addresses of predetermined members of the structures pointed to by the predetermined pointers in the structure pointer array with preset hook functions, so that the preset hook functions are executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook functions; and filters out system calls from the kernel events hijacked by the preset hook functions. This invention, by mounting the preset hook functions to the system kernel, eliminates the possibility of preset hook functions being bypassed by malware on the Windows x64 platform, and does not affect the stability of the operating system, greatly improving the operating system's defense capabilities. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0028] Figure 1 This is a flowchart illustrating the system call monitoring method provided by the present invention;

[0029] Figure 2 This is a schematic diagram of the system call monitoring device provided by the present invention;

[0030] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0032] The following is combined Figures 1-3 The present invention describes a system call monitoring method, apparatus, electronic device, and storage medium.

[0033] Figure 1 The flowchart of the system call monitoring method provided by the present invention is as follows: Figure 1 As shown in one specific embodiment, the system call monitoring method provided by the present invention includes the following steps:

[0034] Step S110: In response to detecting that the circular kernel context log CKCL is in the process of logging, obtain a predetermined array of structure pointers in the kernel, wherein the predetermined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log CKCL is used to log kernel events, including system calls;

[0035] Step S120: Replace the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array with a preset hook function, so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function;

[0036] Step S130: Filter out system calls from the kernel events hijacked by the preset hook function.

[0037] In this embodiment, the Circular Kernel Context Logger (CKCL) is a type of Windows log that can be used to track kernel events such as process / thread creation or exit, image loading, interrupts, and system calls. Preset hook functions can modify the execution flow of a calling function and are typically used to patch a program. The kernel refers to Microsoft's Windows system kernel. PG (kernel patch protection) is an anti-patching technology developed by Microsoft for the Windows kernel, designed to protect code and critical data structures within the Windows kernel from unknown modifications. A kernel hook is an action executed by a preset hook function. A system call is a way for a computer program to request services from the kernel of the operating system executing it. It provides a basic interface between processes and the operating system, including hardware-related services (such as accessing hard drives or accessing a device's camera), the creation and execution of new processes, and communication with integrated kernel services (such as process scheduling).

[0038] In this embodiment, in response to detecting that the circular kernel context log CKCL is in the process of logging, the predefined array of structure pointers WmipLoggerContext in the kernel is obtained; the address of the predefined member of the structure pointed to by the predefined pointer in the array of structure pointers WmipLoggerContext is replaced by a predefined hook function; so that the predefined hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the predefined hook function and filtering out system calls from the kernel event hijacked by the predefined hook function.

[0039] The system call monitoring method provided in this embodiment eliminates the possibility of malicious software bypassing the preset hook functions on the Windows x64 platform by mounting preset hook functions to the system kernel, without affecting the stability of the operating system and improving the operating system's defense capabilities.

[0040] It should be noted that in any embodiment of this application, the circular kernel context log (CKCL) must be enabled before kernel events can be recorded. Therefore, if the circular kernel context log (CKCL) is detected to be enabled, the process will proceed to the step of detecting whether the circular kernel context log (CKCL) is in the process of logging. If the circular kernel context log (CKCL) is detected to be disabled, the circular kernel context log (CKCL) must be enabled first before proceeding to the step of detecting whether the circular kernel context log (CKCL) is in the process of logging.

[0041] In one specific embodiment, according to the system call monitoring method provided by the present invention, the method further includes:

[0042] Detect whether the circular kernel context log (CKCL) is enabled;

[0043] If the circular kernel context log (CKCL) is not enabled, then enable the circular kernel context log (CKCL).

[0044] In this embodiment, it is detected whether the circular kernel context log (CKCL) is enabled; if the circular kernel context log (CKCL) is not enabled, the circular kernel context log (CKCL) is enabled so that kernel events can be logged through the circular kernel context log (CKCL).

[0045] The system call monitoring method provided in this embodiment detects whether the circular kernel context log (CKCL) is enabled, thereby ensuring that kernel events are recorded when the CKCL is enabled. This allows the system to hijack kernel events through a preset hook function, eliminating the possibility of malicious software bypassing the preset hook function on the Windows x64 platform and improving the operating system's defense capabilities.

[0046] In one specific embodiment, according to the system call monitoring method provided by the present invention, when the kernel event is a system call, the method further includes:

[0047] The PerflnfoLogSysCallEntry function replaces the system service function in the current stack with the system service function of the current system call, and logs the current system call. The PerflnfoLogSysCallEntry function is the calling function of the KiSystemCall64 function.

[0048] In this embodiment, the KiSystemCall64 function is an unexported function in the Windows kernel, and normally all execution flows after a system call will be transferred to this function.

[0049] In this embodiment, when a current system call occurs, before the KiSystemCall64 function calls the system service function, it logs the current system call. Before logging, the pointer to the system service function of the current system call is placed on the current stack. The PerflnfoLogSysCallEntry function replaces the system service function in the current stack with the system service function of the current system call and logs the current system call. The PerflnfoLogSysCallEntry function is the calling function of the KiSystemCall64 function. After logging is completed, it is removed from the current stack, and then the execution of the system service function of the current system call continues.

[0050] The system call monitoring method provided in this embodiment further refines the specific operation path of log recording by placing the pointer of the system service function of the current system call into the current stack for log recording. This effectively supports the implementation process of mounting the preset hook function to the system kernel, thereby effectively supporting the improvement of the operating system's defense capabilities.

[0051] In one specific embodiment, according to the system call monitoring method provided by the present invention, the step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function includes:

[0052] When the operating system version is not higher than the predetermined version, the address of the GetCpuClock member of the structure pointed to by the predetermined pointer in the structure pointer array is modified to the predetermined hook function, where GetCpuClock is the name of the predetermined member in the structure.

[0053] In this embodiment, when the Microsoft operating system version is no higher than Windows 18956, the address of the second item in the structure pointer array WmipLoggerContext, GetCpuClock, is modified to a preset hook function.

[0054] The system call monitoring method provided in this embodiment modifies the address of the second item in the structure pointer array, GetCpuClock, to a preset hook function when the operating system version is no higher than a predetermined version. This further refines the specific operation path of the preset hook function mounting the system kernel, eliminates the possibility of the preset hook function being bypassed by malware on the Windows x64 platform, and improves the operating system's defense capabilities.

[0055] In one specific embodiment, according to the system call monitoring method provided by the present invention, the step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function includes:

[0056] When the operating system version is higher than the predetermined version, the index value GetCpuClock in the structure pointer array is set to a preset value, where the index value GetCpuClock is the index value of the function pointed to by the structure pointer array;

[0057] Based on the preset value set for the index value GetCpuClock, the address of the member in the structure inside the function corresponding to the preset value is modified to the preset hook function.

[0058] In this embodiment, on versions of Windows higher than 18956, Microsoft defines GetCpuClock as a sequence number, i.e., an index value. Different sequence numbers are used to process calls to the corresponding time-retrieval interface, making it impossible to replace the function pointed to by GetCpuClock with the preset hook function used to hijack the current system call. Therefore, when the Microsoft operating system version is higher than Windows 18956, the index value GetCpuClock in the structure array pointer WmipLoggerContext is set with a sequence number, modified to a preset value (e.g., 3). This, in turn, modifies the address of the function HalpPerformanceCounter+0x70 corresponding to this sequence number to the preset hook function.

[0059] The system call monitoring method provided in this embodiment sets the index value GetCpuClock in the structure pointer array when the operating system version is higher than a predetermined version; according to the preset value set for the index value GetCpuClock, the address of the member in the structure inside the function corresponding to the preset value is modified to the preset hook function, which further refines the specific operation path of the preset hook function to mount the system kernel, eliminates the possibility of the preset hook function being bypassed by malicious software on the Windows x64 platform, and improves the defense of the operating system.

[0060] In one specific embodiment, according to the system call monitoring method provided by the present invention, before replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array using a preset hook function, the method further includes:

[0061] By hijacking predetermined members of the structure pointed to by predetermined pointers in the structure pointer array using a preset hook function, the address of the predetermined member of the structure pointed to by the predetermined pointers in the structure pointer array can be replaced using the preset hook function.

[0062] In this embodiment, a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array WmipLoggerContext is hijacked by a preset hook function, so as to replace the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array WmipLoggerContext with the preset hook function.

[0063] The system call monitoring method provided in this embodiment further refines the specific operation path of the preset hook function mounting the system kernel by explaining the pre-step of replacing the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array with the preset hook function. This eliminates the possibility of the preset hook function being bypassed by malicious software on the Windows x64 platform and improves the defense of the operating system.

[0064] The following describes a system call monitoring device provided by the present invention. The system call monitoring device described below can be referred to in correspondence with the system call monitoring method described above.

[0065] Figure 2 A structural diagram of the system call monitoring device provided by the present invention is shown below. Figure 2 As shown, in one specific embodiment, the system call monitoring device provided by the present invention includes:

[0066] The structure acquisition module 210 is used to acquire a predetermined array of structure pointers in the kernel in response to detecting that the circular kernel context log CKCL is in the process of logging. The predetermined array of structure pointers is the execution object when a kernel event occurs. The circular kernel context log CKCL is used to log kernel events, including system calls.

[0067] The preset hook function replacement module 220 is used to replace the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function, so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function;

[0068] The system call filtering module 230 is used to filter out system calls from kernel events hijacked by the preset hook function.

[0069] The system call monitoring device provided in this embodiment, by setting up a structure acquisition module, a preset hook function replacement module, and a system call filtering module, mounts the preset hook function to the system kernel, eliminating the possibility of the preset hook function being bypassed by malicious software on the Windows x64 platform, without affecting the stability of the operating system, and improving the operating system's defense capabilities.

[0070] In one specific embodiment, the system call monitoring device according to the present invention further includes:

[0071] The stack storage module is used to replace the system service function in the current stack with the system service function of the current system call by the PerflnfoLogSysCallEntry function, and to log the current system call. The PerflnfoLogSysCallEntry function is the calling function of the KiSystemCall64 function.

[0072] The system call monitoring device provided in this embodiment, by setting up a stack storage module, replaces the system service function in the current stack with the system service function of the current system call for logging, further refines the specific operation path of logging, effectively supports the implementation process of mounting the system kernel with the preset hook function, and thus effectively supports the improvement of the operating system's defense capabilities.

[0073] In one specific embodiment, according to the system call monitoring device provided by the present invention, the preset hook function replacement module 220 includes:

[0074] The first replacement submodule is used to modify the address of the GetCpuClock member of the structure pointed to by the predetermined pointer in the structure pointer array to the preset hook function when the operating system version is not higher than the predetermined version. The GetCpuClock is the name of the predetermined member in the structure.

[0075] The system call monitoring device provided in this embodiment, by setting a first replacement submodule, modifies the GetCpuClock address of the second item in the structure pointer array to a preset hook function when the operating system version is not higher than a predetermined version. This further refines the specific operation path of the preset hook function mounting the system kernel, eliminates the possibility of the preset hook function being bypassed by malicious software on the Windows x64 platform, and improves the operating system's defense capabilities.

[0076] In one specific embodiment, according to the system call monitoring device provided by the present invention, the preset hook function replacement module 220 includes:

[0077] The second replacement submodule is used to set the index value GetCpuClock in the structure pointer array to a preset value when the operating system version is higher than a predetermined version. The index value GetCpuClock is the index value of the function pointed to by the structure pointer array. According to the preset value set for the index value GetCpuClock, the address of the member in the structure inside the function corresponding to the preset value is modified to the preset hook function.

[0078] The system call monitoring device provided in this embodiment sets a second replacement submodule to set the index value GetCpuClock in the structure pointer array when the operating system version is higher than a predetermined version. According to the preset value set for the index value GetCpuClock, the address of the member in the structure inside the function corresponding to the preset value is modified to the preset hook function. This further refines the specific operation path of the preset hook function to mount the system kernel, eliminates the possibility of the preset hook function being bypassed by malware on the Windows x64 platform, and improves the defense of the operating system.

[0079] In one specific embodiment, the system call monitoring device according to the present invention further includes:

[0080] The pre-module is used to hijack a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array through a preset hook function, so as to replace the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array with the preset hook function.

[0081] The system call monitoring device provided in this embodiment further explains the pre-step steps of replacing the address of the predetermined member of the structure pointed to by the predetermined pointer in the structure pointer array with the preset hook function by setting a pre-module. It refines the specific operation path of the preset hook function mounting the system kernel, eliminates the possibility of the preset hook function being bypassed by malicious software on the Windows x64 platform, and improves the defense of the operating system.

[0082] In one specific embodiment, the system call monitoring device according to the present invention further includes:

[0083] The detection module is used to detect whether the circular kernel context log (CKCL) is enabled; if the circular kernel context log (CKCL) is not enabled, then the circular kernel context log (CKCL) is enabled.

[0084] The system call monitoring device provided in this embodiment, by setting a detection module, explains the enabling action of the circular kernel context log (CKCL), further refines the specific operation path of the preset hook function mounting the system kernel, eliminates the possibility of the preset hook function being bypassed by malware on the Windows x64 platform, and improves the operating system's defense capabilities.

[0085] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute a system call monitoring method, which includes:

[0086] In response to detecting that the circular kernel context log (CKCL) is in the process of logging, a predefined array of structure pointers in the kernel is obtained, wherein the predefined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log (CKCL) is used to log kernel events, including system calls;

[0087] The address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array is replaced by a preset hook function so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function;

[0088] System calls are filtered out from kernel events hijacked by the preset hook function.

[0089] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the system call monitoring methods provided by the methods described above, the method comprising:

[0091] In response to detecting that the circular kernel context log (CKCL) is in the process of logging, a predefined array of structure pointers in the kernel is obtained, wherein the predefined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log (CKCL) is used to log kernel events, including system calls;

[0092] The address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array is replaced by a preset hook function so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function;

[0093] System calls are filtered out from kernel events hijacked by the preset hook function.

[0094] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0095] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A system call monitoring method, characterized by, include: In response to detecting that the circular kernel context log (CKCL) is in the process of logging, a predefined array of structure pointers in the kernel is obtained, wherein the predefined array of structure pointers is the execution object when a kernel event occurs, and the circular kernel context log (CKCL) is used to log kernel events, including system calls; The address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array is replaced by a preset hook function so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function; System calls are filtered out from kernel events hijacked by the preset hook function.

2. The system call monitoring method of claim 1, wherein, When the kernel event is a system call, the method further includes: The PerflnfoLogSysCallEntry function replaces the system service function in the current stack with the system service function of the current system call, and logs the current system call. The PerflnfoLogSysCallEntry function is the calling function of the KiSystemCall64 function.

3. The system call monitoring method of claim 1, wherein, The step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array using a preset hook function includes: When the operating system version is not higher than the predetermined version, the address of the GetCpuClock member of the structure pointed to by the predetermined pointer in the structure pointer array is modified to the predetermined hook function, where GetCpuClock is the name of the predetermined member in the structure.

4. The system call monitoring method of claim 1, wherein, The step of replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array using a preset hook function includes: When the operating system version is higher than the predetermined version, the index value GetCpuClock in the structure pointer array is set to a preset value, where the index value GetCpuClock is the index value of the function pointed to by the structure pointer array; Based on the preset value set for the index value GetCpuClock, the address of a predetermined member in the structure inside the function corresponding to the preset value is modified to the preset hook function.

5. The system call monitoring method of claim 1, wherein, Before replacing the address of a predetermined member of the structure pointed to by a predetermined pointer in the array of structure pointers using a preset hook function, the method further includes: By hijacking predetermined members of the structure pointed to by predetermined pointers in the structure pointer array using a preset hook function, the address of the predetermined member of the structure pointed to by the predetermined pointers in the structure pointer array can be replaced using the preset hook function.

6. The system call monitoring method of claim 1, wherein, The method further includes: Detect whether the circular kernel context log (CKCL) is enabled; If the circular kernel context log (CKCL) is not enabled, then enable the circular kernel context log (CKCL).

7. A system call monitoring apparatus characterized by comprising: include: The structure acquisition module is used to acquire a predetermined array of structure pointers in the kernel in response to the detection that the circular kernel context log (CKCL) is in the process of logging. The predetermined array of structure pointers is the execution object when a kernel event occurs. The circular kernel context log (CKCL) is used to log kernel events, including system calls. A preset hook function replacement module is used to replace the address of a predetermined member of the structure pointed to by a predetermined pointer in the structure pointer array with a preset hook function, so that the preset hook function is executed when a kernel event occurs, thereby hijacking the kernel event through the preset hook function; The system call filtering module is used to filter out system calls from kernel events hijacked by the preset hook function.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the system call monitoring method as described in any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by the processor, it implements the system call monitoring method as described in any one of claims 1 to 6.

Images