A Linux system process self-protection method and system

Abstract

The application discloses a Linux system process self-protection method and system, and relates to the field of process self-protection, which randomly selects a process name through a system core process, modifies the original name of a process to be hidden into the selected process name through a process management function, so as to complete the name camouflage of the process, and randomly modifies each process parameter in a process parameter array argc and a memory position pointed by environ, so that an intruder cannot directly find the hidden process through system commands such as ps, top and ls, and further cannot stop the protected process through system commands such as killall and kill, and the process hiding protection is realized without loading a kernel module.

Description

Technical Field

[0001] This invention relates to the field of process self-protection, and more particularly to a method and system for process self-protection in Linux systems. Background Technology

[0002] With the rapid development of the internet, data has become an integral part of personal assets. However, many hackers have capitalized on the importance of these assets, using various methods to infiltrate user hosts, obtain user data, and profit from it. In this context, protecting critical user processes and frequently used processes is paramount. Currently, most Linux process protection technologies are implemented at the kernel level, such as hooking system calls, kernel signal blocking, and rootkits (malware that enables process hiding and privilege escalation). However, these methods are not suitable for systems with multiple kernel versions or modified kernels, and they increase adaptation costs. Therefore, developing a user-space process protection method that is independent of kernel versions is more suitable for this scenario. Summary of the Invention

[0003] To achieve user-mode process protection without depending on the kernel version and to improve the universality of the protection method, this invention proposes a Linux system process self-protection method, including:

[0004] S01: Start the process. Obtain the running mode of the started process through the IPC mechanism and determine whether the running mode is independent. If so, proceed to the next step.

[0005] S02: Determine if the process hiding function is enabled. If so, proceed to the next step.

[0006] S03: Randomly select a process name through the system core process, obtain the original name of the currently started process (i.e., the process to be hidden) by calling the process management function, and back it up. Modify the original name of the process to be hidden to the selected process name by calling the process management function. Back up the process parameter array argc of the command line corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modify each process parameter in the process parameter array argc and the memory location pointed to by environ.

[0007] S04: Determine if the process file protection function is enabled. If yes, proceed to the next step.

[0008] S05: Monitor the dependency files of the currently started process through a user-space lightweight file monitoring mechanism.

[0009] Furthermore, S05 specifically includes:

[0010] Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden.

[0011] Furthermore, the system core processes in step S03 include: pid 1-500.

[0012] Furthermore, the method further includes the step of:

[0013] S06: Run the application corresponding to the process to be hidden.

[0014] Furthermore, in step S02, it is determined whether the process hiding function is enabled; if not, the process jumps to step S04. In step S04, it is determined whether the process file protection function is enabled; if not, the process jumps to step S06.

[0015] Furthermore, the method also includes:

[0016] When the process hiding function is disabled, the process name of the corresponding process is restored using the backup data;

[0017] When the process file protection function is turned off, the process parameters in the corresponding process parameter array argc and the memory location pointed to by environ are restored by backing up the data.

[0018] This invention also proposes a Linux system process self-protection system, comprising:

[0019] The startup module is used to start processes. It obtains the running mode of the started process through the IPC mechanism, and enters the hidden function module when the running mode is independent.

[0020] The hidden function judgment module is used to determine whether the process hiding function is enabled;

[0021] The hiding module is used to randomly select a process name through the system kernel process when the process hiding function is enabled. It obtains and backs up the original name of the currently started process (i.e., the process to be hidden) by calling the process management function. It then modifies the original name of the process to be hidden to the selected process name by calling the process management function. It also backs up the process parameter array argc corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modifies each process parameter in the process parameter array argc and the memory location pointed to by environ.

[0022] The file protection function judgment module is used to determine whether the process file protection function is enabled.

[0023] The file monitoring module is used to monitor the dependent files of the currently started process through a user-space lightweight file monitoring mechanism when the process file protection function is enabled.

[0024] Furthermore, the file monitoring module is specifically used for:

[0025] Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden.

[0026] Furthermore, the system core processes in the hidden module include: pid 1-500.

[0027] Furthermore, the system also includes a running module for running the application corresponding to the process to be hidden.

[0028] Compared with the prior art, the present invention has at least the following beneficial effects:

[0029] (1) This invention randomly selects process names through the system core process, and modifies the original name of the process to be hidden to the selected process name by calling the process management function, thereby completing the name disguise of the process. It also randomly modifies each process parameter in the process parameter array argc and the memory location pointed to by environ, so that the intruder cannot directly find the hidden process through system commands such as ps, top, ls, etc., and thus cannot stop the protected process through system commands such as killall, kill, etc. It achieves process hiding and protection without loading kernel modules.

[0030] (2) This invention monitors the dependent files of the currently started process through a user-mode lightweight file monitoring mechanism, so that intruders cannot view or modify the configuration files (including the process running directory under the proc file system) and dependent libraries (including dependent files) related to the protected process through system commands such as ls, cat, and vim. Thus, without loading kernel modules, it prevents intruders from stopping the critical process by destroying the critical process dependent files (i.e., anti-tampering).

[0031] (3) The process self-protection method and system proposed in this invention greatly reduce the dependence on kernel version, improve system compatibility, and reduce adaptation costs. Attached Figure Description

[0032] Figure 1 A flowchart of a Linux system process self-protection method;

[0033] Figure 2 This is a diagram of a Linux system process self-protection system module;

[0034] Figure 3 A structural diagram of the existing traditional process hiding scheme. Detailed Implementation

[0035] The following are specific embodiments of the present invention, which are described in conjunction with the accompanying drawings. However, the present invention is not limited to these embodiments.

[0036] Example 1

[0037] like Figure 3 As shown, traditional process hiding schemes use kernel-mode process hiding, which filters the corresponding process names by modifying system calls. Although the corresponding processes cannot be found using system commands such as ps and top, this scheme requires loading kernel modules and cannot be used on systems with different kernel versions. It requires providing the corresponding version of the kernel module, thus reducing availability.

[0038] In this regard, such as Figure 1As shown, this invention proposes a method for self-protection of Linux system processes that does not require loading a kernel module, comprising:

[0039] S01: Start the process. Obtain the running mode of the started process through the IPC mechanism and determine whether the running mode is independent. If so, proceed to the next step.

[0040] S02: Determine if the process hiding function is enabled. If so, proceed to the next step.

[0041] In step S02, it is determined whether the process hiding function has been enabled. If not, the process jumps to step S04.

[0042] S03: Randomly select a process name through the system kernel process, obtain the original name of the currently started process (i.e., the process to be hidden) by calling the process management function (specifically: prctl(PR_GET_NAME), where PR_GET_NAME is the original name returned by the function), and back it up. Modify the original name of the process to be hidden to the selected process name by calling the process management function (specifically: prctl(PR_SET_NAME), where PR_SET_NAME is the process name returned by the function). Back up the process parameter array argc of the command line corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modify each process parameter in the process parameter array argc and the memory location pointed to by environ.

[0043] The system core processes in step S03 include: pid 1-500.

[0044] Specifically, a process name (i.e., a disguised name) is randomly selected from the system kernel process (PID 1-500) and the command line (which is also part of the process name) as the process name of the process to be hidden. The original name of the process to be hidden is changed to the selected process name by calling the process management function.

[0045] S04: Determine if the process file protection function is enabled. If yes, proceed to the next step.

[0046] In step S04, it is determined whether the process file protection function is enabled. If not, the process jumps to step S06.

[0047] S05: Monitor the dependency files of the currently started process through a user-space lightweight file monitoring mechanism.

[0048] This invention implements a technical solution for process hiding and anti-tampering of dependent files in user space. In addition, this invention is often applied to the self-protection function of client processes.

[0049] It should be noted that the process hiding function is controlled through inter-process communication (IPC) mechanisms (such as shared memory, pipes, semaphores, configuration files, etc.) without requiring a process restart.

[0050] Specifically, S05 is:

[0051] Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden.

[0052] Fanotify is a lightweight user-space file monitoring mechanism. It is supported by kernel version 2.6.32 and offers high compatibility. Using Fanotify file monitoring technology provides stability, reliability, high real-time performance, and low overhead.

[0053] Compared with existing technologies, this invention can reduce the dependence on the system kernel, improve compatibility with different kernel versions, enhance security, and avoid the possibility of system crashes caused by introducing kernel modules.

[0054] The method further includes the following steps:

[0055] S06: Run the application corresponding to the process to be hidden.

[0056] The method further includes:

[0057] When the process hiding function is disabled, the process name of the corresponding process is restored using the backup data;

[0058] When the process file protection function is turned off, the process parameters in the corresponding process parameter array argc and the memory location pointed to by environ are restored by backing up the data.

[0059] This invention masquerades the process name by randomly selecting a process name from the system's core process and then modifying the original name of the process to be hidden to the selected name by calling a process management function. It also randomly modifies the process parameters in the `argc` array and the memory location pointed to by `environ`, preventing intruders from directly finding the hidden process using system commands like `ps`, `top`, and `ls`, and thus preventing them from stopping the protected process using commands like `killall` and `kill`. Furthermore, this invention monitors the dependent files of the currently running process through a lightweight user-space file monitoring mechanism. This prevents intruders from viewing and modifying configuration files (including the process's runtime directory under the `proc` filesystem) and dependent libraries (including dependent files) related to the protected process using system commands like `ls`, `cat`, and `vim`. This prevents intruders from stopping critical processes by corrupting their dependent files (i.e., preventing tampering). In short, this invention achieves dual protection for processes by combining process hiding with process file protection (fanotify monitoring) without loading kernel modules. Simultaneously, the process self-protection method proposed in this invention significantly reduces the system's dependence on kernel versions, improving system compatibility and reducing adaptation costs.

[0060] Example 2

[0061] like Figure 2 As shown, this invention also proposes a Linux system process self-protection system, comprising:

[0062] The startup module is used to start processes. It obtains the running mode of the started process through the IPC mechanism, and enters the hidden function module when the running mode is independent.

[0063] The hidden function judgment module is used to determine whether the process hiding function is enabled;

[0064] The hiding module is used to randomly select a process name through the system kernel process when the process hiding function is enabled. It obtains and backs up the original name of the currently started process (i.e., the process to be hidden) by calling the process management function. It then modifies the original name of the process to be hidden to the selected process name by calling the process management function. It also backs up the process parameter array argc corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modifies each process parameter in the process parameter array argc and the memory location pointed to by environ.

[0065] The system core processes in the hidden module include: pid 1-500.

[0066] The file protection function judgment module is used to determine whether the process file protection function is enabled.

[0067] The file monitoring module is used to monitor the dependent files of the currently started process through a user-space lightweight file monitoring mechanism when the process file protection function is enabled.

[0068] The file monitoring module is specifically used for:

[0069] Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden.

[0070] The system also includes a running module for running the application corresponding to the process to be hidden.

[0071] It should be noted that this system is written in C language, relies on the fanotify file monitoring mechanism, and requires an operating system with a kernel version of 2.6.32 or higher. There are no special requirements for the system's CPU and memory.

[0072] The process self-protection system proposed in this invention does not depend on kernel modules, has high compatibility, and is more suitable for cloud servers. At the same time, it adopts a method that combines process hiding and anti-tampering of dependent files, which not only ensures the integrity of the process running environment, but also reduces the dependence on kernel versions and the cost of adaptation.

[0073] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0074] Furthermore, in this invention, descriptions involving terms such as "first," "second," and "a" are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0075] In this invention, unless otherwise explicitly specified and limited, the terms "connection," "fixed," etc., should be interpreted broadly. For example, "fixed" can mean a fixed connection, a detachable connection, or an integral part; it can mean a mechanical connection or an electrical connection; it can mean a direct connection or an indirect connection through an intermediate medium; it can mean the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0076] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

Claims

1. A method for self-protection of Linux system processes, characterized in that, include: S01: Start the process. Obtain the running mode of the started process through the IPC mechanism and determine whether the running mode is independent. If so, proceed to the next step. S02: Determine if the process hiding function is enabled. If so, proceed to the next step. S03: Randomly select a process name through the system core process, obtain the original name of the currently started process (i.e., the process to be hidden) by calling the process management function, and back it up. Modify the original name of the process to be hidden to the selected process name by calling the process management function. Back up the process parameter array argc of the command line corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modify each process parameter in the process parameter array argc and the memory location pointed to by environ. S04: Determine if the process file protection function is enabled. If yes, proceed to the next step. S05: Monitor the dependency files of the currently started process through the user-space lightweight file monitoring mechanism; Specifically, S05 is: Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden. The method further includes the following steps: S06: Run the application corresponding to the process to be hidden; In step S02, it is determined whether the process hiding function has been enabled. If not, the process jumps to step S04. In step S04, it is determined whether the process file protection function has been enabled. If not, proceed to step S06. The method further includes: When the process hiding function is disabled, the process name of the corresponding process is restored using the backup data; When the process file protection function is turned off, the process parameters in the corresponding process parameter array argc and the memory location pointed to by environ are restored by backing up the data.

2. The Linux system process self-protection method according to claim 1, characterized in that, The system core processes in step S03 include: pid 1-500.

3. A Linux system process self-protection system, the system being used to execute the method as described in claim 1, characterized in that, include: The startup module is used to start processes. It obtains the running mode of the started process through the IPC mechanism, and enters the hidden function module when the running mode is independent. The hidden function judgment module is used to determine whether the process hiding function is enabled; The hiding module is used to randomly select a process name through the system kernel process when the process hiding function is enabled. It obtains and backs up the original name of the currently started process (i.e., the process to be hidden) by calling the process management function. It then modifies the original name of the process to be hidden to the selected process name by calling the process management function. It also backs up the process parameter array argc corresponding to the process to be hidden and the memory location pointed to by the runtime environment variable pointer environ, and randomly modifies each process parameter in the process parameter array argc and the memory location pointed to by environ. The file protection function judgment module is used to determine whether the process file protection function is enabled. The file monitoring module is used to monitor the dependent files of the currently started process through a user-space lightweight file monitoring mechanism when the process file protection function is enabled.

4. A Linux system process self-protection system according to claim 3, characterized in that, The file monitoring module is specifically used for: Add the dependent files of the process to be hidden and the process running directory under the proc file system to the fanotify monitoring, and set the FAN_ACCESS_PERM and FAN_OPEN_PERM flags. The read and write permissions of the dependent files and the process running directory of the process to be hidden are controlled in real time through the flags, and read and write events of the dependent files and the process running directory are received in real time. The FAN_ACCESS_PERM flag is used to control the access permissions of the dependent files and the process running directory of the process to be hidden, and the FAN_OPEN_PERM flag is used to control the open status of the dependent files and the process running directory of the process to be hidden.

5. A Linux system process self-protection system according to claim 4, characterized in that, The system core processes in the hidden module include: pid 1-500.

6. A Linux system process self-protection system according to claim 5, characterized in that, The system also includes a running module for running the application corresponding to the process to be hidden.

Images