A method and device for monitoring a newly created process, a computer device and a storage medium

Abstract

The application discloses a kind of method, device, computer equipment and computer readable storage medium for monitoring new process, it is related to computer technical field, wherein method includes: receiving the command of creating new process;When detecting the command, according to the call address in system call table, execute kernel function;The context information of the new process is obtained using the kernel function, and the context information is transmitted to user state program in real time, and the new process is monitored.The application can obtain context information by using kernel function and transmit context information to user state program in real time, so that process monitoring can be realized when triggering process, i.e., malicious processes can be detected before system call, and malicious processes bypassed by rootkit defense can be discovered in time, avoiding missing malicious processes.In addition, the application avoids full scanning of processes each time, thereby occupying less computing resources and bandwidth resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method and device for monitoring newly created process, computer equipment and computer readable storage medium. BACKGROUND

[0002] The commonly used method for detecting linux process is to detect linux process by command statement, for example, using ps aux or ls / proc / <pid>The command statement detects a Linux process, or detects a Linux process by reading all files under / proc through a program openproc. However, the existing detection method is easy to be bypassed by a rootkit. For example, an intruder covers or tampers with the system call of the ps or ls command through the rootkit hook technology, so that the process to be seen is hidden, and the malicious process cannot be detected.

[0003] Meanwhile, the existing detection method is a periodic sampling technology. The process information is periodically sampled, the sampling is not real-time enough, and problems that occur several minutes ago may not be found by the intrusion detection system until several minutes later, so that the best killing opportunity is missed. Meanwhile, the periodic sampling reports all current process information to the server every time, which generates a large amount of repeated data and consumes a large amount of computer and bandwidth resources. The periodic sampling may miss a lot of short-life processes. If the missed newly created process is a malicious process, the intrusion detection system will not detect it. SUMMARY

[0004] The purpose of the present application is to provide a method and device for monitoring newly created processes, a computer device and a computer readable storage medium. The present application can monitor processes when the processes are triggered by obtaining context information through a kernel function and transmitting the context information to a user state program in real time. That is, the present application can detect malicious processes before system calls, can timely prevent malicious processes from bypassing rootkits, can avoid missing malicious processes, and can avoid full scanning of processes every time, thereby occupying less computing resources and bandwidth resources.

[0005] According to one aspect of the present application, a method for monitoring newly created processes is provided, comprising:

[0006] receiving a command for creating a newly created process;

[0007] detecting the command, and executing a kernel function according to a call address in a system call table;

[0008] obtaining context information of the newly created process by using the kernel function, and transmitting the context information to a user state program in real time to monitor the newly created process.

[0009] Optionally, the obtaining of the context information of the newly created process by using the kernel function comprises:

[0010] obtaining the context information of the newly created process by using an interception method in the kernel function.

[0011] Optionally, before the execution of the kernel function according to the call address in the system call table, the method further comprises:

[0012] modifying an original address of the system call table to the call address, wherein the call address is an address of the kernel function.

[0013] Optionally, the modifying the original address of the system call table to the call address comprises:

[0014] modifying an original fork address of the system call table to the call address.

[0015] Optionally, after the transmitting the context information to the user mode program in real time, the method further comprises:

[0016] analyzing the collected context information by the user mode program and generating a log.

[0017] Optionally, the method for monitoring a newly created process further comprises:

[0018] sending the log to an intrusion detection system for detection to determine whether the newly created process is malicious.

[0019] Optionally, the determining whether the newly created process is malicious comprises:

[0020] comparing command line information with a rule of abnormal behavior of a malicious process to determine whether the command line information is consistent with the rule of abnormal behavior of the malicious process;

[0021] if the command line information is consistent with the rule of abnormal behavior of the malicious process, reporting that the newly created process is abnormal.

[0022] The application provides a device for monitoring a newly created process, comprising:

[0023] a receiving module configured to receive a command for creating a newly created process;

[0024] a detecting module configured to detect the command and execute a kernel function according to a call address in a system call table;

[0025] a monitoring module configured to acquire context information of the newly created process by using the kernel function and transmit the context information to a user mode program in real time, so as to monitor the newly created process.

[0026] The application provides a computer device, comprising:

[0027] a memory configured to store a computer program;

[0028] a processor configured to execute the computer program to implement the method for monitoring a newly created process.

[0029] The application provides a computer readable storage medium, which stores computer executable instructions, and when the computer executable instructions are loaded and executed by a processor, the steps of the method for monitoring a newly created process are implemented.

[0030] It can be seen that, by using the kernel function to obtain context information and transmitting the context information to the user mode program in real time, the process monitoring can be implemented when the process is triggered, that is, the malicious process can be detected before the system call, the malicious process bypassing the rootkit defense can be found in time, the malicious process is avoided to be missed, and the application avoids full scanning of the process each time, so that less computing resources and bandwidth resources are occupied. The application also provides a device for monitoring a newly created process, a computer device and a computer readable storage medium, which have the beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only part of the embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0032] Figure 1 A flow chart of a method for monitoring a newly created process provided by an embodiment of the present application;

[0033] Figure 2 A structural block diagram of a device for monitoring a newly created process provided by an embodiment of the present application;

[0034] Figure 3 A structural block diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0036] Currently, the commonly used methods for detecting linux processes include detecting linux processes by command statements, such as using ps aux or ls / proc / <pid>The command statement detects the Linux process, or detects the Linux process by reading all files under / proc through the program openproc. But the existing detection method is easy to be bypassed by rootkit, for example, the intruder covers or tampers the system call of the ps or ls command through the rootkit hook technology, so that the process to be seen is hidden, and the malicious process cannot be detected.

[0037] At present, the existing detection method is periodic sampling technology. The process information is periodically sampled, and the sampling is not real-time, which is easy to cause the problem that the malicious process created several minutes ago is not found by the intrusion detection system until several minutes later, so that the best killing opportunity is missed. At the same time, the periodic sampling reports all the current process information to the server every time, which will generate a large amount of repeated data and consume a large amount of computer and bandwidth resources. The periodic sampling will miss a lot of short life cycle processes. If the missed new process is a malicious process, the intrusion detection system will not detect it.

[0038] Therefore, the application provides a method for monitoring a new process. The application can monitor the process when the process is triggered by using the kernel function to obtain the context information and transmitting the context information to the user state program in real time. The malicious process can be detected before the system call, the malicious process bypassed by the rootkit defense can be found in time, the malicious process can be avoided to be missed, and the application avoids full scanning of the process every time, so that less computer resources and bandwidth resources are occupied.

[0039] The application will be described in detail below. Please refer to Figure 1 , Figure 1 The application provides a flowchart of a method for monitoring a new process. The method for monitoring a new process can include the following steps.

[0040] Step S101: receiving a command for creating a new process.

[0041] The form of the command is not limited in the application, which can be a small piece of data code, a specific high level or low level, or an identifier, etc. The required form can be determined according to the actual situation, for example, the application can receive a command for creating a new process by a user through a shell statement.

[0042] Step S102: detecting the command, and executing a kernel function according to the call address in the system call table.

[0043] The system call table in the embodiment of the application is a table composed of function pointers pointing to kernel functions implementing various system calls, which can be indexed based on system call numbers to locate function addresses, and complete system calls.

[0044] In the embodiment of the application, the original address in the system call table can be modified as a call address, and it should be noted that the call address is the address of a kernel function, that is, the position of the kernel function can be pointed to according to the call address, so as to execute the kernel function. In the embodiment of the application, the kernel function includes an interception method and the like for implementing interception and obtaining context information of a newly created process.

[0045] It should be noted that the original address modified in the embodiment of the application is not limited, and the original fork address can be modified as a call address, the original clone address can be modified as a call address, or the original vfork address can be modified as a call address. In the embodiment of the application, fork, clone and vfork are system calls required when a new process is created.

[0046] In the embodiment of the application, since a system call needs to be called when a new process is created, compared with the related art which detects a command and then creates a process, and then periodically samples and detects the process, the embodiment of the application modifies the call address in the system call table, so as to intercept and detect the information of the newly created process before the newly created process is created, which can timely discover malicious processes and can timely discover malicious processes bypassing the rookit defense, and avoids missing malicious processes.

[0047] Step S103: obtaining context information of a newly created process by using a kernel function, and transmitting the context information to a user state program in real time to realize monitoring of the newly created process.

[0048] In the embodiment of the application, the context information includes a parent process id, a process id, a newly created process id, a current user, a current user group, a current session control session, a path of program execution such as / home / test, a program execution command line such as cat / etc / passwd, and all clone, fork and vfork system call logs. It should be noted that the system call numbers corresponding to clone, fork and vfork in the linux system are 56, 57 and 58 respectively.

[0049] In the embodiment of the application, the context information of the newly created process can be obtained by using an interception method in the kernel function, and the method of interception in the embodiment of the application is not limited, and the interception can be performed by a hook_fork interception method or an open source tool such as audit.

[0050] In the embodiment of the present application, the context information of the newly created process is acquired, and a system native function is called to create the process. The system native function includes clone, fork, vfork, etc. For example, the address of the fork in the system call table is modified to the address of the hook_fork to acquire the context information, and the system call table is returned from the hook_fork address to continue to call the native fork function to execute the process creation.

[0051] In the embodiment of the present application, the way of transmitting the context information to the user mode program in real time is not limited, and the context information can be transmitted to the user mode program in real time through Netlink. It should be noted that Netlink is a socket family used to realize the communication between the user process and the kernel process, and is a special inter-process communication and the most commonly used interface for the network application program to communicate with the kernel.

[0052] In the embodiment of the present application, after being transmitted to the user mode program, the user mode program can analyze the collected context information and generate a log, and the log is sent to the system after being generated. In the embodiment of the present application, the system is not limited, and the generated log can be sent to an intrusion detection system for detection, or the generated log can be sent to other systems.

[0053] It should be noted that in the embodiment of the present application, the log can be sent to the intrusion detection system for detection to determine whether it is a malicious process. In the embodiment of the present application, the detection method is not limited, and the command line information can be compared with the abnormal behavior rule of the malicious process to determine whether they are consistent. If they are consistent, the newly created process is reported to be abnormal. Other detection methods can also be used. It should be noted that in the embodiment of the present application, various process abnormal behavior rules can be customized in the cloud of the intrusion detection system, and saved in a database. In the embodiment of the present application, the abnormal behavior rule is not limited, and can be a regular expression rule or other rules. In the embodiment of the present application, the setting of the abnormal behavior rule is not limited, and the abnormal behavior rule can be set according to the demand in advance, or the abnormal behavior rule can be set according to the specific use scenario. Further, the abnormal behavior rule can be continuously updated and improved.

[0054] In the embodiment of the present application, the context information of the newly created process is acquired by using the kernel function, and the context information is transmitted to the user mode program in real time. In this way, full scanning of the process is avoided each time, less computing resources and bandwidth resources are occupied, and the process can be monitored when it is triggered. That is, the malicious process can be detected before the system call, and the malicious process bypassed by the rootkit defense can be discovered in time, so that the malicious process is not missed.

[0055] Based on the above embodiment, the embodiment of the present application provides a method for monitoring a newly created process. By using a kernel function to obtain context information and transmitting the context information to a user state program in real time, the process monitoring can be realized when the process is triggered, that is, the malicious process can be detected before the system call, and since the embodiment of the present application detects the malicious process before the system call, the system call table modified by the rookit cannot bypass the system, the malicious process bypassed by the rootkit defense can be found in time, the malicious process is avoided to be missed, and the full process scanning each time is avoided by the present application, so that less computing resources and bandwidth resources are occupied.

[0056] The above process is described below by a specific example. In the example, the system call table is the system call table in Linux, and the process is specifically as follows:

[0057] 1. A user executes a command for creating a new process through a shell.

[0058] 2. After the command is detected, a kernel function is executed according to the modified fork address in the system call table.

[0059] 3. The context information of the newly created process is obtained by using the kernel function, and is transmitted to the user state program through Netlink.

[0060] 4. The user state program analyzes the collected context information to generate a log, and transmits the log to a cloud intrusion detection system in real time for analysis.

[0061] 5. The intrusion detection system customizes various process abnormal behavior rules in the cloud, and saves the rules in a database. The abnormal behavior rules can be regular expression rules.

[0062] 6. The cloud receives the newly created process, matches the command line information of the newly created process with the prepared regular rules, and then judges whether the process is malicious. If the matching is successful, the process abnormal behavior is reported.

[0063] In the embodiment of the present application, the context information is obtained by using a kernel function and transmitted to a user state program in real time, so that the process monitoring can be realized when the process is triggered, that is, the malicious process can be detected before the system call. Since the embodiment of the present application detects the malicious process before the system call, the system call table modified by the rookit cannot bypass the system, the malicious process bypassed by the rootkit defense can be found in time, the malicious process is avoided to be missed, and the full process scanning each time is avoided by the present application, so that less computing resources and bandwidth resources are occupied.

[0064] The following introduces a device for monitoring a newly created process and a computer device provided by an embodiment of the present application, and the device for monitoring a newly created process described below can be correspondingly referred to the method for monitoring a newly created process described above.

[0065] Please refer to Figure 2 , Figure 2 The device for monitoring a newly created process provided by an embodiment of the present application has a structure diagram as shown in the figure, and the device can include:

[0066] A receiving module 201 is configured to receive a command for creating a newly created process.

[0067] A detecting module 202 is configured to detect the command, and execute a kernel function according to a calling address in a system calling table.

[0068] A monitoring module 203 is configured to acquire context information of the newly created process by using the kernel function, and transmit the context information to a user state program in real time, so as to monitor the newly created process.

[0069] In an embodiment of the present application, the context information of the newly created process can be acquired by using an intercepting method in the kernel function, and the method for intercepting is not limited in the embodiment of the present application, which can be intercepting by a hook_fork method or an open source tool such as audit.

[0070] Based on the above embodiment, the detecting module 202 can further include:

[0071] A setting module is configured to modify an original address of the system calling table to the calling address, wherein the calling address is an address of the kernel function.

[0072] In the embodiment of the present application, the original address is not limited, which can be modified from a fork address to the calling address, or from a clone address to the calling address, or from a vfork address to the calling address, wherein the fork, the clone and the vfork are system calls required when a newly created process is created.

[0073] Based on any of the above embodiments, the monitoring module 203 can further include:

[0074] A generating module is configured to analyze the acquired context information by using the user state program and generate a log.

[0075] Based on any of the above embodiments, the generating module can further include:

[0076] A judging module is configured to send the log to an intrusion detection system for detection to determine whether the process is malicious.

[0077] According to any of the above embodiments, the judging module can include:

[0078] A judging unit is configured to compare the command line information with the abnormal behavior rule of the malicious process to determine whether they are consistent.

[0079] In the embodiment of the present application, the context information is obtained by using the kernel function and is transmitted to the user mode program in real time, so that the process monitoring can be realized when the process is triggered, that is, the malicious process can be detected before the system call, the malicious process bypassing the rootkit defense can be found in time, the malicious process can be avoided to be missed, and the full scan of the process each time can be avoided, so that less computing resources and bandwidth resources are occupied.

[0080] Please refer to Figure 3 , Figure 3 The computer device provided by the embodiment of the present application includes:

[0081] A memory 10 is configured to store a computer program.

[0082] A processor 20 is configured to execute the computer program to realize the method for monitoring the newly created process.

[0083] As shown in Figure 3 , the structure diagram of the computer device can include a memory 10, a processor 20, a communication interface 31, an input / output interface 32, and a communication bus 33.

[0084] In the embodiment of the present application, the memory 10 is configured to store one or more programs, and the program can include program code including computer operation instructions.

[0085] The program stored in the memory 10 can include the following functions:

[0086] Receiving a command for creating a newly created process;

[0087] Using the kernel function to obtain the context information of the newly created process and transmitting the context information to the user mode program in real time to realize monitoring of the newly created process.

[0088] In a possible implementation, the memory 10 can include a program storage area and a data storage area, where the program storage area can store an operating system and application programs required by at least one function, etc.; and the data storage area can store data created during use.

[0089] In addition, the memory 10 can include a read-only memory and a random access memory, and provide instructions and data for the processor. A part of the memory can also include an NVRAM. The memory stores an operating system and operation instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, where the operation instructions can include various operation instructions for implementing various operations. The operating system can include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0090] The processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, and the processor 20 can be a microprocessor or any conventional processor, etc. The processor 20 can invoke a program stored in the memory 10.

[0091] The communication interface 31 can be an interface for connecting with other devices or systems.

[0092] The input / output interface 32 can be an interface for obtaining external input data or outputting data to the outside.

[0093] Of course, it should be noted that, Figure 3 The structures shown do not constitute a limitation on the computer device in the embodiments of the present application, and the computer device can include more or fewer components than those shown, or combine certain components in actual applications. Figure 3 The structures shown do not constitute a limitation on the computer device in the embodiments of the present application, and the computer device can include more or fewer components than those shown, or combine certain components in actual applications.

[0094] In the embodiments of the present application, the context information is obtained by using a kernel function and transmitted to a user-mode program in real time, so that process monitoring can be implemented when a process is triggered, that is, a malicious process can be detected before a system call, and since the embodiments of the present application detect a malicious process before a system call, the system call table is modified by a rookit, and the system call table cannot bypass the system, a malicious process bypassed by a rookit can be found in time, a malicious process is avoided to be missed, and full-scan of a process each time is avoided, so that less computing resources and bandwidth resources are occupied.

[0095] The embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium stores computer executable instructions, when the computer executable instructions are loaded and executed by a processor, receiving a command of creating a new process is realized; detecting the command, executing a kernel function according to a call address in a system call table; obtaining context information of the new process by using the kernel function, and transmitting the context information to a user state program in real time, and realizing monitoring the new process. In the embodiment of the present application, the context information is obtained by using the kernel function, and the context information is transmitted to the user state program in real time, so that full scanning of the process is avoided each time, less computing resources and bandwidth resources are occupied, and monitoring of the process can be realized when the process is triggered, that is, a malicious process can be detected before a system call, a malicious process bypassing a rootkit defense can be found in time, and a malicious process can be avoided to be missed.

[0096] The embodiments in the description are described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0097] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present text can be realized by electronic hardware, computer software or combination of both, and in order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0098] The steps of the method or algorithm described in combination with the embodiments disclosed in the present text can be directly implemented by hardware, software module executed by a processor, or combination of both. The software module can be placed in a random access memory (RAM), a memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0099] The above describes in detail the method, device, computer equipment and storage medium for monitoring a newly created process provided by the present application. The principles and implementation manners of the present application are described by applying specific examples in this paper, and the above description of the examples is only used to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, some improvements and modifications can be made to the present application without departing from the principles of the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.< / pid> < / pid>

Claims

1. A method of intercepting a newly created process, characterized by, The method comprises the following steps: receiving a command for creating a new process; detecting the command, and executing a kernel function according to a call address in a system call table; obtaining context information of the new process by using the kernel function, and transmitting the context information to a user mode program in real time to realize monitoring of the new process; wherein the modification of the original address of the system call table to the call address comprises: modifying the original fork address of the system call table to the call address.

2. The method of claim 1, wherein, The obtaining of the context information of the new process by using the kernel function comprises: obtaining the context information of the new process by using an interception method in the kernel function.

3. The method of claim 1, wherein the new process is a process that is created by a user. Before the execution of the kernel function according to the call address in the system call table, the method further comprises the following step: modifying the original address of the system call table to the call address, wherein the call address is the address of the kernel function.

4. The method of claim 1, wherein the new process is a process that is created by a user. After the transmitting of the context information to the user mode program in real time, the method further comprises the following step: analyzing the collected context information by using the user mode program and generating a log.

5. The method of claim 4, wherein the new process is a process that is created by a user. The method further comprises the following steps: sending the log to an intrusion detection system for detection to determine whether the new process is malicious.

6. The method of claim 5, wherein the new process is a process that is created by a user. The determination of whether the new process is malicious comprises: comparing command line information with a rule of abnormal behavior of a malicious process to determine whether they are consistent; if they are consistent, reporting that the new process is abnormal.

7. An apparatus for monitoring a newly created process, the apparatus comprising: The method comprises the following steps: a receiving module for receiving a command for creating a new process; a detecting module for detecting the command, and executing a kernel function according to a call address in a system call table; a monitoring module for obtaining context information of the new process by using the kernel function, and transmitting the context information to a user mode program in real time to realize monitoring of the new process; wherein the modification of the original address of the system call table to the call address comprises: modifying the original fork address of the system call table to the call address.

8. A computer device, comprising: The method comprises the following steps: a memory for storing a computer program; a processor for executing the computer program to realize the method for monitoring a new process according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by a processor, the steps of the method for monitoring a new process according to any one of claims 1 to 6 are realized.

Images