File protection method and device, electronic device, and computer-readable storage medium

Abstract

The present application proposes a file protection method and device, an electronic device and a computer-readable storage medium, the method comprising: in response to a file modification operation issued by the system, the target file targeted by the file modification operation is plugged in the kernel layer using the eBPF method, and the plugging is used to execute a predetermined file monitoring strategy; if the plugging is successful, the associated information of the target file is obtained; the associated information is monitored to see if it meets the predetermined file protection conditions; if the associated information of the file modification operation meets the predetermined file protection conditions, the eBPF auxiliary function is called to intercept the file modification operation. The technical solution of the present application utilizes the eBPF provided by the Linux system to plug in each file modification operation of the system to realize the monitoring and protection of the file modification operation at the kernel layer of the system, which can effectively intercept attacks from the kernel layer.

Description

[Technical field]

[0001] The present application relates to the field of information security technology, and in particular to a file protection method and device, an electronic device, and a computer-readable storage medium. [Background technology]

[0002] Traditional file protection methods often focus on protecting against attacks from the user layer, but lack corresponding protection measures for attacks on the kernel layer, such as attacks on files by rootkits or lkm kernel modules.

[0003] Therefore, how to effectively deal with attacks on files at the kernel layer has become a technical problem that needs to be solved urgently. [Summary of the invention]

[0004] The embodiments of the present application provide a file protection method and device, an electronic device and a computer-readable storage medium, which are intended to solve the technical problem in the related art that the existing protection means for protecting against attacks from the user layer cannot meet the demand for protecting against attacks from the kernel layer.

[0005] In the first aspect, an embodiment of the present application provides a file protection method, comprising: in response to a system issuing a file modification operation, using the eBPF method to insert a target file targeted by the file modification operation at the kernel layer, and the insertion is used to execute a predetermined file monitoring strategy; if the insertion is successful, obtaining the associated information of the target file; monitoring whether the associated information meets the predetermined file protection condition; if the associated information of the file modification operation meets the predetermined file protection condition, calling the eBPF auxiliary function to intercept the file modification operation.

[0006] In a possible design, the target file targeted by the file modification operation is inserted at the kernel layer in an eBPF manner, including: verifying whether the intermediate file compiled by the eBPF bytecode meets the predetermined activation rules in the system; if the intermediate file meets the predetermined activation rules, inserting the eBPF executable program at the kernel layer on the target file targeted by the file modification operation, wherein the eBPF executable program is used to reflect the predetermined file monitoring policy.

[0007] In one possible design, calling the eBPF auxiliary function to intercept the file modification operation includes: calling the eBPF auxiliary function to prevent the file modification operation from writing the file modification information in the buffer into the system memory.

[0008] In a possible design, it also includes: generating protection result feedback information after intercepting the file modification operation; and overwriting the modification result feedback information for the file modification operation in the system with the protection result feedback information.

[0009] In a possible design, it further includes: generating a first warning message if the stub insertion fails; and generating a second warning message if the modification result feedback information fails to be overwritten by the protection result feedback information.

[0010] In a possible design, obtaining the associated information of the target file includes: obtaining the file path and file type of the target file; monitoring whether the associated information meets a predetermined file protection condition includes: if the associated information does not match the predetermined associated information in the predetermined whitelist, and in the case where the file modification operation exceeds the predetermined modification permission range of the target file, determining that the associated information of the file modification operation meets the predetermined file protection condition.

[0011] In a possible design, it further includes: if the associated information matches the predetermined associated information in the predetermined whitelist, allowing the file modification operation to be executed; and if the associated information does not match the predetermined associated information in the predetermined whitelist, when the file modification operation is within the predetermined modification permission range of the target file, allowing the file modification operation to be executed.

[0012] In a second aspect, an embodiment of the present application provides a file protection device, including: a dynamic stub insertion unit, configured to respond to a file modification operation issued by the system, and perform stub insertion on the target file targeted by the file modification operation in the kernel layer in an eBPF manner, where the stub insertion is used to execute a predetermined file monitoring policy; an associated information acquisition unit, configured to obtain the associated information of the target file if the stub insertion is successful; a protection monitoring unit, configured to monitor whether the associated information meets a predetermined file protection condition; and a modification operation interception unit, configured to call an eBPF auxiliary function to intercept the file modification operation if the associated information of the file modification operation meets the predetermined file protection condition.

[0013] In a possible design, the dynamic stub insertion unit is configured to: verify whether an intermediate file compiled from the bytecode of eBPF meets a predetermined enabling rule within the system; if the intermediate file meets the predetermined enabling rule, perform stub insertion of an eBPF executable program on the target file targeted by the file modification operation in the kernel layer, where the eBPF executable program is used to reflect a predetermined file monitoring policy.

[0014] In a possible design, the modification operation interception unit is configured to: call an eBPF auxiliary function to prevent the file modification operation from writing file modification information in the buffer to the system memory.

[0015] In a possible design, the file protection device further includes: a feedback information generation unit, configured to generate protection result feedback information after intercepting the file modification operation; and a feedback information covering unit, configured to cover the modification result feedback information for the file modification operation in the system with the protection result feedback information.

[0016] In a possible design, the file protection device further includes: a first warning unit, configured to generate a first warning message if the staking fails; and a second warning unit, configured to generate a second warning message if covering the modification result feedback information with the protection result feedback information fails.

[0017] In a possible design, the association information acquisition unit is configured to: acquire the file path and file type of the target file; and the protection monitoring unit is configured to: determine that the association information of the file modification operation meets the predetermined file protection condition if the association information does not match the predetermined association information in the predetermined whitelist and the file modification operation exceeds the predetermined modification permission range of the target file.

[0018] In a possible design, the file protection device further includes: a first execution unit, configured to allow the file modification operation to be executed if the association information matches the predetermined association information in the predetermined whitelist; and a second execution unit, configured to allow the file modification operation to be executed if the association information does not match the predetermined association information in the predetermined whitelist and the file modification operation is within the predetermined modification permission range of the target file.

[0019] In a third aspect, an embodiment of the present application provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in the first aspect above.

[0020] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, storing computer-executable instructions, and the computer-executable instructions are used to execute the method flow described in the first aspect above.

[0021] For the technical problem that the existing protection means for protecting against attacks from the user layer in the related art cannot meet the requirement of protecting against attacks from the kernel layer, first, once the system issues a file modification operation on a file, it will trigger staking based on the eBPF method. In the present application, staking specifically refers to introducing a predetermined file monitoring policy for the target file targeted by the file modification operation. Here, the introduced predetermined file monitoring policy is an executable program.

[0022] In other words, every time a file modification operation is detected, an instrumentation operation can be triggered in real time, and the target file targeted by the file modification operation can be monitored through the instrumentation operation. In this way, all file modification operations at the kernel layer of the system can be dynamically monitored, which helps to deal with attacks on files at the kernel layer.

[0023] Next, if the insertion is successful, a predetermined file monitoring strategy is executed on the target file. In the predetermined file monitoring strategy, the associated information of the target file is first obtained. The associated information of the target file is used to reflect the characteristics of the target file itself, and this characteristic can be used to determine whether it is necessary to protect the target file from file modification operations.

[0024] Then, whether the associated information satisfies a predetermined file protection condition is monitored, and if the associated information of the file modification operation satisfies the predetermined file protection condition, an eBPF auxiliary function is called to intercept the file modification operation.

[0025] The predetermined file protection condition refers to the requirement that the associated information of the target file should meet when the target file needs to be protected for the file modification operation. If the associated information of the file modification operation meets the predetermined file protection condition, file protection can be implemented. Conversely, if the associated information of the file modification operation does not meet the predetermined file protection condition, there is no need to implement file protection for the target file. The method of implementing file protection is to call the eBPF auxiliary function to intercept the file modification operation. The eBPF auxiliary function refers to the function used to interact between the content of the eBPF plug-in and the kernel layer of the system. Here, the interaction between the content of the eBPF plug-in and the kernel layer of the system is reflected in intercepting the file modification operation of the kernel layer.

[0026] The above technical solution effectively utilizes the eBPF that comes with the Linux system, and inserts a stub for each file modification operation of the system to realize the monitoring and protection of the file modification operation at the kernel layer of the system, which can effectively intercept attacks from the kernel layer, among which, attacks on files from rootkits or lkm kernel modules can be effectively intercepted. At the same time, since eBPF comes with the Linux system, the method of intercepting kernel layer attacks in this application can not affect the normal operation of the system. Moreover, since eBPF is compatible with multiple versions of Linux systems, the method of intercepting kernel layer attacks in this application also has low cost and high compatibility. In summary, the technical solution of the present application can safely and effectively protect files from kernel layer attacks, improve the scope of file security protection, and effectively increase file security.

Brief Description of the Drawings

[0027] To more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings required for the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0028] Figure 1 Shows a flowchart of a file protection method according to an embodiment of the present application;

[0029] Figure 2 Shows a block diagram of a file protection device according to an embodiment of the present application;

[0030] Figure 3 Shows a block diagram of an electronic device according to an embodiment of the present application.

Specific Embodiments

[0031] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0032] Figure 1 Shows a flowchart of a file protection method according to an embodiment of the present application.

[0033] As Figure 1 shown, the file protection method according to an embodiment of the present application includes:

[0034] Step 102, in response to a file modification operation issued by the system, use the eBPF method to perform instrumentation on the target file targeted by the file modification operation, and the instrumentation is used to execute a predetermined file monitoring policy.

[0035] Once the system issues a file modification operation on a file, it will trigger instrumentation based on the eBPF method. The file modification operations described here include, but are not limited to, operations such as copying, changing, and deleting any file that the system can access.

[0036] Among them, eBPF (Extended Berkeley Packet Filter) is a kernel technology in the Linux system (starting from Linux 4.x), which allows programs to run without changing the kernel source code or adding additional modules. Generally, it can be regarded as a lightweight sandbox virtual machine in the Linux system kernel. Developers can utilize specific kernel resources by running BPF bytecodes in this lightweight sandbox virtual machine. eBPF is part of the mainline kernel. Using the eBPF method for instrumentation does not require introducing third-party modules and is compatible with multiple versions of the Linux system, facilitating its application in different business scenarios.

[0037] Instrumentation refers to inserting an executable program at the instrumentation position. In this application, it specifically means introducing a predetermined file monitoring policy for the target file targeted by the file modification operation. Here, the introduced predetermined file monitoring policy is an executable program. In this technical solution, every time a file modification operation is detected, the instrumentation operation can be triggered in real time. Through the instrumentation operation, the monitoring of the target file targeted by the file modification operation can be achieved. Thus, all file modification operations in the system kernel layer can be dynamically monitored, which helps to cope with attacks on files in the kernel layer.

[0038] Step 104, if the instrumentation is successful, obtain the associated information of the target file.

[0039] If the instrumentation is successful, then execute a predetermined file monitoring policy on the target file. In this predetermined file monitoring policy, the associated information of the target file needs to be obtained first. The associated information of the target file is used to reflect the characteristics of the target file itself, and this characteristic can be used to determine whether it is necessary to protect the target file against this file modification operation.

[0040] Specifically, the associated information of the target file includes the file path and file type of the target file. Obtaining the associated information of the target file means obtaining the file path and file type of the target file. Among them, the file path of the target file refers to the path experienced when accessing the target file, and the file type of the target file can be selected as the suffix of the target file, such as xml, etc.

[0041] Step 106, monitor whether the associated information meets the predetermined file protection conditions.

[0042] Step 108, if the associated information of the file modification operation meets the predetermined file protection conditions, call the eBPF helper function to intercept the file modification operation.

[0043] The predefined file protection condition refers to the requirements that the associated information of the target file should meet when protecting the file modification operation for the target file. If the associated information of the file modification operation meets the predefined file protection condition, file protection can be implemented. Conversely, if the associated information of the file modification operation does not meet the predefined file protection condition, there is no need to implement file protection for the target file.

[0044] In a possible design, the predefined file protection condition means that both the associated information does not match the predefined associated information in the predefined whitelist and the file modification operation exceeds the predefined modification permission range of the target file. Specifically, if the associated information does not match the predefined associated information in the predefined whitelist and the file modification operation exceeds the predefined modification permission range of the target file, it is determined that the associated information of the file modification operation meets the predefined file protection condition.

[0045] Among them, the predefined whitelist stores the associated information corresponding to files with relatively high security that do not need to be monitored for file modification operations. If the associated information does not match the predefined associated information in the predefined whitelist, it indicates that the target file is not the file involved in the predefined whitelist, and there is still a need to monitor the file modification operation to ensure security.

[0046] Furthermore, each file is set with a predefined modification permission range. Modifying the file within this predefined modification permission range does not affect the security of the file. Therefore, when it is verified that the target file needs to be monitored for file modification operations to ensure security, if the file modification operation exceeds the predefined modification permission range of the target file, it indicates that the file modification operation is an insecure factor for the target file and needs to be intercepted.

[0047] Thus, it is possible to effectively identify the situations where file modification operations at the kernel layer need to be intercepted, which helps to protect the security of files.

[0048] Among them, the way to implement file protection is to call the eBPF helper function to intercept the file modification operation. The eBPF helper function refers to a function used to interact with the kernel layer of the system for the content instrumented in the eBPF manner. Here, the interaction between the content instrumented in the eBPF manner and the kernel layer of the system is manifested as intercepting file modification operations at the kernel layer.

[0049] In a possible design, the specific way to call the eBPF helper function to intercept the file modification operation includes: calling the eBPF helper function to prevent the file modification operation from writing the file modification information in the buffer to the system memory.

[0050] In other words, the eBPF auxiliary function is used to prevent the file modification operation from writing the file modification information in the buffer to the system memory. By preventing the file modification information in the buffer from being written to the system memory, the file is also prevented from being modified, thereby intercepting the file modification operation and improving the security of the target file.

[0051] In addition, after intercepting the file modification operation, protection result feedback information is generated; the protection result feedback information covers the modification result feedback information for the file modification operation in the system. In the original logic of the system, after executing the file modification operation, modification result feedback information will be generated and fed back in time, and after intercepting the file modification operation, the original logic of the system can be replaced with the generation and feedback of protection result feedback information, so as to timely reflect the protection results for the target file and timely display the actual security situation currently faced by the target file.

[0052] On this basis, if the protection result feedback information fails to overwrite the modification result feedback information, a second warning message is generated. When the protection result feedback information cannot overwrite the modification result feedback information, it means that the file modification operation may not be effectively intercepted. At this time, a warning should be issued in time to increase the attention paid to the target file, which has a positive impact on protecting the security of the target file.

[0053] The above technical solution effectively utilizes the eBPF that comes with the Linux system, and inserts a stub for each file modification operation of the system to realize the monitoring and protection of the file modification operation at the kernel layer of the system, which can effectively intercept attacks from the kernel layer, among which, attacks on files from rootkits or lkm kernel modules can be effectively intercepted. At the same time, since eBPF comes with the Linux system, the method of intercepting kernel layer attacks in this application can not affect the normal operation of the system. Moreover, since eBPF is compatible with multiple versions of Linux systems, the method of intercepting kernel layer attacks in this application also has low cost and high compatibility. In summary, the technical solution of the present application can safely and effectively protect files from kernel layer attacks, improve the scope of file security protection, and effectively increase file security.

[0054] In one possible design, step 102 includes: verifying whether the intermediate file compiled by the eBPF bytecode meets the predetermined activation rules in the system; if the intermediate file meets the predetermined activation rules, inserting the eBPF executable program on the target file targeted by the file modification operation at the kernel layer, wherein the eBPF executable program is used to reflect the predetermined file monitoring policy.

[0055] Specifically, the essence of eBPF technology is to run BPF bytecode (hereinafter referred to as bytecode) to utilize specific kernel resources. For the system, it is necessary to first verify whether the eBPF bytecode is safe and available. Specifically, a predetermined enabling rule is set in the system as a verification standard for verifying whether the bytecode is safe and available.

[0056] Furthermore, the bytecode can be compiled into an intermediate file convenient for the Linux system to read through the libBPF compiler, and then the Linux system verifies whether the intermediate file meets the predetermined enabling rule.

[0057] Among them, the predetermined enabling rule includes but is not limited to that the source compilation object of the bytecode corresponding to the intermediate file is in the specified compilation object whitelist, the specific kernel resources required to be utilized by the bytecode corresponding to the intermediate file are non-disabled resources, the functions called by the bytecode corresponding to the intermediate file during the process of utilizing specific kernel resources are non-disabled functions, etc. Of course, the predetermined enabling rule can also be customized according to the actual security protection requirements of the system, and is not limited to the above examples.

[0058] Through the above technical solutions, the security of the instrumentation can be effectively verified, the system can be prevented from being maliciously instrumented, and the security of the system is improved.

[0059] In a possible design, if the instrumentation fails, a first warning message is generated to prompt the failure of the instrumentation, and timely reflect the situation that the system cannot dynamically monitor and protect the file modification operation on the file.

[0060] It should be added that if the associated information matches the predetermined associated information in the predetermined whitelist, the file modification operation is allowed to be executed; and if the associated information does not match the predetermined associated information in the predetermined whitelist, when the file modification operation is within the predetermined modification permission range of the target file, the file modification operation is allowed to be executed. Among them, if the associated information does not match the predetermined associated information in the predetermined whitelist, it means that the target file still needs to be monitored for file modification operations to ensure security, and further verification is carried out. Next, if the file modification operation is within the predetermined modification permission range of the target file, it means that this file modification operation has sufficient security for the target file, so the file modification operation is allowed to be executed.

[0061] Figure 2 The block diagram of a file protection device according to an embodiment of the present application is shown.

[0062] As Figure 2As shown, a file protection device 200 according to an embodiment of the present application includes: a dynamic patching unit 202, configured to, in response to a file modification operation issued by the system, patch a target file targeted by the file modification operation in the kernel layer in an eBPF manner, where the patching is used to execute a predetermined file monitoring policy; an association information acquisition unit 204, configured to, if the patching is successful, acquire the association information of the target file; a protection monitoring unit 206, configured to monitor whether the association information meets a predetermined file protection condition; and a modification operation interception unit 208, configured to, if the association information of the file modification operation meets the predetermined file protection condition, call an eBPF auxiliary function to intercept the file modification operation.

[0063] In a possible design, the dynamic patching unit 202 is configured to: verify whether an intermediate file obtained by compiling the bytecode of eBPF meets a predetermined enabling rule in the system; if the intermediate file meets the predetermined enabling rule, patch an eBPF executable program for the target file targeted by the file modification operation in the kernel layer, where the eBPF executable program is used to reflect a predetermined file monitoring policy.

[0064] In a possible design, the modification operation interception unit 208 is configured to: call an eBPF auxiliary function to prevent the file modification operation from writing file modification information in the buffer to the system memory.

[0065] In a possible design, the file protection device 200 further includes: a feedback information generation unit, configured to generate protection result feedback information after intercepting the file modification operation; and a feedback information overwrite unit, configured to overwrite the modification result feedback information for the file modification operation in the system with the protection result feedback information.

[0066] In a possible design, the file protection device 200 further includes: a first warning unit, configured to generate a first warning information if the patching fails; and a second warning unit, configured to generate a second warning information if it fails to overwrite the modification result feedback information with the protection result feedback information.

[0067] In a possible design, the association information acquisition unit 204 is configured to: acquire the file path and file type of the target file; and the protection monitoring unit 206 is configured to: if the association information does not match the predetermined association information in a predetermined whitelist and the file modification operation exceeds the predetermined modification permission range of the target file, determine that the association information of the file modification operation meets the predetermined file protection condition.

[0068] In a possible design, the file protection device 200 further includes: a first execution unit, configured to allow the file modification operation to be executed if the associated information matches the predetermined associated information in the predetermined whitelist; a second execution unit, configured to allow the file modification operation to be executed if the associated information does not match the predetermined associated information in the predetermined whitelist and when the file modification operation is within the predetermined modification permission range of the target file.

[0069] The file protection device 200 uses the solution described in any one of the above embodiments, and thus has all the above technical effects, which will not be elaborated herein.

[0070] Figure 3 The block diagram of an electronic device according to an embodiment of the present application is shown.

[0071] As Figure 3 shown, an electronic device 300 according to an embodiment of the present application includes at least one memory 302; and a processor 304 communicatively connected to the at least one memory 302; wherein, the memory stores instructions executable by the at least one processor 304, and the instructions are configured to execute the solution described in any one of the above embodiments. Therefore, the electronic device 300 has the same technical effects as any one of the above embodiments, which will not be elaborated herein.

[0072] The electronic devices in the embodiments of the present application exist in various forms, including but not limited to:

[0073] (1) Mobile communication devices: These devices are characterized by having mobile communication functions and mainly aim to provide voice and data communication. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones, etc.

[0074] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have the characteristic of mobile Internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as iPad.

[0075] (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video players (such as iPod), handheld game consoles, e-books, and smart toys and portable vehicle navigation devices.

[0076] (4) Servers: Devices that provide computing services. The composition of a server includes a processor, a hard disk, a memory, a system bus, etc. Servers are similar to general computer architectures, but due to the need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc.

[0077] (5) Other electronic devices with data interaction functions.

[0078] In addition, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, and the computer-executable instructions are used to perform the following steps: in response to a file modification operation issued by the system, use the eBPF method to perform instrumentation on the target file targeted by the file modification operation, and the instrumentation is used to execute a predetermined file monitoring policy; if the instrumentation is successful, obtain the associated information of the target file; monitor whether the associated information meets a predetermined file protection condition; if the associated information of the file modification operation meets the predetermined file protection condition, call the eBPF helper function to intercept the file modification operation.

[0079] It should be noted that the functions or steps that can be achieved by the above computer-readable storage medium or electronic device can be correspondingly referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described in detail here.

[0080] The technical solution of the present application has been described in detail above with reference to the accompanying drawings. The technical solution of the present application effectively utilizes the eBPF provided by the Linux system to perform instrumentation on each file modification operation of the system to monitor and protect the file modification operation in the system kernel layer, and can effectively intercept attacks from the kernel layer. At the same time, since eBPF is provided by the Linux system, this method of intercepting kernel layer attacks in the present application does not affect the normal operation of the system. Moreover, since eBPF is compatible with multiple versions of the Linux system, this method of intercepting kernel layer attacks in the present application also has low cost and high compatibility. In summary, the technical solution of the present application can safely and effectively protect files from kernel layer attacks, expand the scope of file security protection, and effectively increase file security.

[0081] It should be understood that although the terms first, second, etc. may be used to describe warning information in the embodiments of the present application, these warning information should not be limited to these terms. These terms are only used to distinguish warning information from each other. For example, without departing from the scope of the embodiments of the present application, the first warning information may also be referred to as the second warning information, and similarly, the second warning information may also be referred to as the first warning information.

[0082] Depending on the context, the word "if" as used herein can be interpreted as "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detecting (stated condition or event)" can be interpreted as "when determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)".

[0083] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "the", and "said" used in the embodiments of the present application and the appended claims are also intended to include the plural forms unless the context clearly dictates otherwise.

[0084] In several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling, direct coupling, or communication connection between each other can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be in electrical, mechanical, or other forms.

[0085] In addition, each functional unit in the various embodiments of the present application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of a combination of hardware and software functional units.

[0086] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided by the present application can include non-volatile and / or volatile memories. Non-volatile memories can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memories can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0087] The above-described embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A file protection method, characterized in that, Including: In response to a file modification operation issued by the system, use the eBPF method to instrument the target file targeted by the file modification operation at the kernel layer, where the instrumentation is used to execute a predetermined file monitoring policy; If the instrumentation is successful, obtain the associated information of the target file; Monitor whether the associated information meets the predetermined file protection conditions; If the associated information of the file modification operation meets the predetermined file protection conditions, call the eBPF helper function to intercept the file modification operation; Among them, the using the eBPF method to instrument the target file targeted by the file modification operation at the kernel layer includes: Verify whether the intermediate file compiled from the bytecode of eBPF meets the predetermined enabling rules within the system; If the intermediate file meets the predetermined enabling rules, instrument the target file targeted by the file modification operation with an eBPF executable program at the kernel layer, where the eBPF executable program is used to reflect the predetermined file monitoring policy; Among them, the calling the eBPF helper function to intercept the file modification operation includes: Call the eBPF helper function to prevent the file modification operation from writing the file modification information in the buffer to the system memory; Among them, the obtaining the associated information of the target file includes: Obtain the file path and file type of the target file; The monitoring whether the associated information meets the predetermined file protection conditions includes: If the associated information does not match the predetermined associated information in the predetermined whitelist and the file modification operation exceeds the predetermined modification permission range of the target file, determine that the associated information of the file modification operation meets the predetermined file protection conditions.

2. The document protection method according to claim 1, characterized in that, Also including: After intercepting the file modification operation, generate protection result feedback information; Use the protection result feedback information to overwrite the modification result feedback information for the file modification operation in the system.

3. The file protection method according to claim 2, characterized in that, Also including: If the instrumentation fails, generate a first warning message; And If it fails to overwrite the modification result feedback information with the protection result feedback information, generate a second warning message.

4. The file protection method according to claim 1, characterized in that, Also including: If the associated information matches the predetermined associated information in the predetermined whitelist, allow the file modification operation to be executed; And If the associated information does not match the predetermined associated information in the predetermined whitelist and the file modification operation is within the predetermined modification permission range of the target file, allow the file modification operation to be executed.

5. A file protection device, characterized in that, Including: A dynamic instrumentation unit, configured to, in response to a file modification operation issued by the system, use the eBPF method to instrument the target file targeted by the file modification operation at the kernel layer, where the instrumentation is used to execute a predetermined file monitoring policy; An associated information obtaining unit, configured to obtain the associated information of the target file if the instrumentation is successful; A protection monitoring unit, configured to monitor whether the associated information meets the predetermined file protection conditions; A modification operation interception unit, configured to call the eBPF helper function to intercept the file modification operation if the associated information of the file modification operation meets the predetermined file protection conditions; Among them, the method of using the eBPF method to instrument the target file targeted by the file modification operation at the kernel layer includes: Verify whether the intermediate file obtained by compiling the bytecode of eBPF meets the predetermined enabling rules within the system; If the intermediate file meets the predetermined enabling rules, instrument the target file targeted by the file modification operation with an eBPF executable program at the kernel layer, where the eBPF executable program is used to reflect a predetermined file monitoring policy; Among them, the method of calling the eBPF helper function to intercept the file modification operation includes: Call the eBPF helper function to prevent the file modification operation from writing the file modification information in the buffer to the system memory; Among them, the method of obtaining the associated information of the target file includes: Obtain the file path and file type of the target file; The method of monitoring whether the associated information meets the predetermined file protection conditions includes: If the associated information does not match the predetermined associated information in the predetermined whitelist and the file modification operation exceeds the predetermined modification permission range of the target file, determine that the associated information of the file modification operation meets the predetermined file protection conditions.

6. An electronic device, characterized in that, Includes: At least one processor; And a memory communicatively connected to the at least one processor; Among them, the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in any one of claims 1 to 4 above.

7. A computer-readable storage medium, characterized in that, Stores computer-executable instructions for executing the method described in any one of claims 1 to 4.

Images