A process provenance method, system, and computer-readable storage medium

Abstract

The application discloses a process tracing method, a system and a computer readable storage medium. The method comprises the following steps: obtaining container configuration information of a container to obtain a container service starting process number; obtaining process information of a target process, filtering the process information to obtain a parent process number of the target process; comparing the container service starting process number with the parent process number of the target process or a parent process number of a parent process of the target process, traversing the parent process number of the event until the parent process number is 0 or 1, if the comparison is consistent, the target process belongs to a container process, and the target process is located according to a corresponding container; if the comparison is inconsistent, the target process belongs to a host process. Through the parent-child process number attribution relationship, the target process can be identified to originate from a specific container or a host. For suspicious or malicious processes, container information can be quickly and efficiently associated for tracing analysis.

Description

A process tracing method, system, and computer-readable storage medium Technical Field

[0001] This invention relates to the field of computers, and more specifically to a method for tracing the source of malicious processes within a container on a host machine. Background Technology

[0002] After infiltrating the system, hackers exploit the kernel's communication mechanisms to attack process creation events, tampering with or deleting computer command execution information. With the rise of microservices, containers are also being used in production environments, allowing for the isolation of different microservices.

[0003] Containers on the Linux operating system use the Linux Namespace mechanism for isolation, but its isolation is limited rather than complete. When malicious processes appear, we need to locate the source and origin of the malicious process to provide valuable information to the user. The current mainstream solution in the industry is to first obtain the process ID (PID) of the process corresponding to the container, and then determine which container it belongs to based on the namespace (node) to which the process belongs.

[0004] However, when processes within a container need to interact with resources on the host machine, the namespaces of these processes are the same, leading to errors where the container process is mistakenly identified as belonging to the host machine. When retrieving file samples from a container, the path to the container's internal file system root directory is retrieved, not a path relative to the host machine's root directory. If accessed directly from the host machine, this will result in file non-existence or incorrect access, causing access failure. While the process PID (PID) of the container in the configuration file provided by the container service manager is fixed (i.e., the initial process PID), new processes may emerge running concurrently with existing processes during subsequent service operation. These newly added parallel processes are not recorded, potentially leading to omissions. Summary of the Invention

[0005] To address the technical challenges of process tracing, this application provides a process tracing method.

[0006] A process tracing method includes the following steps:

[0007] Obtain the container configuration information of the container to get the container service startup process ID;

[0008] Obtain the process information of the target process, filter the process information, and obtain the parent process ID of the target process;

[0009] The process ID of the container service startup process is compared with the parent process ID of the target process or the parent process ID of the target process's parent process. The parent process IDs of the events are traversed until the parent process ID is 0 or 1. If they match, the target process belongs to the container process, and the target process is located according to the corresponding container. If they do not match, the target process belongs to the host process.

[0010] Furthermore, it also includes a method for obtaining the path: if the process belongs to the host machine process, the path of the process is read directly; if the process belongs to the container process, the container file system storage location in the container configuration information is concatenated with the read path of the process to obtain an accessible process path.

[0011] Further, comparing the container service startup process ID with the parent process ID of the target process or the parent process ID of the target process's parent process specifically includes:

[0012] The process ID of the container service startup process is compared with the parent process ID of the target process. If they match, the target process belongs to the container process; otherwise, ...

[0013] The process ID of the container service startup process is compared with the process ID of the parent process of the target process. If they match, the target process belongs to the container process; otherwise, ...

[0014] Continue searching upwards for the parent process ID of the parent process and compare it with the process ID of the container service startup process. Repeat this process until the parent process ID is 0 or 1. If the process ID is still inconsistent when the process stops, then the target process belongs to the host machine process.

[0015] Furthermore, the container configuration information includes: container name, container ID, container initial process ID, and container file system storage location.

[0016] Furthermore, obtaining the container service startup process ID specifically includes: obtaining the container service startup process ID through the process file system based on the container initial process ID.

[0017] Furthermore, the process information includes the executing user, process name, process path, process ID, parent process ID, event type, or command line.

[0018] Furthermore, filtering the process information specifically includes: filtering the process name, process path, process ID, and parent process ID of the target event based on the event type.

[0019] Furthermore, it also includes: if the parent process ID of the target process has been marked as a container process, then the target process belongs to the container process.

[0020] The advantages of this method are:

[0021] By identifying the parent-child process IDs, it's possible to pinpoint the specific container or host machine from which a target process originates. For suspicious or malicious processes, container information can be quickly and efficiently associated for source tracing and analysis. Furthermore, accessible paths for events within the container can be constructed, making them accessible to the host machine and preventing access failures on the host side. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 is a flowchart of this method;

[0024] Figure 2 is a flowchart illustrating one possible scenario of this method;

[0025] Figure 3 is a flowchart illustrating another scenario of this method;

[0026] Figure 4 is a flowchart of an optimization scheme of this method. Detailed Implementation

[0027] To make the purpose, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0029] Example 1

[0030] This embodiment discloses a process tracing method for locating and determining the ownership of a new process, and also for obtaining the accessible path address of a file running in a container. It includes the following steps:

[0031] S1: Obtain the container configuration information of the container and get the container service startup process ID.

[0032] S2, obtain the process information of the target process, filter the process information, and obtain the parent process ID of the target process.

[0033] S3. Compare the container service startup process number obtained in step S1 with the parent process number of the target process obtained in step S2, or the parent process number of the target process's parent process obtained by looping through the event's parent process number until the parent process number is 0 or 1.

[0034] If the comparison matches, the target process belongs to the container process, and the target process is located according to the corresponding container; if they do not match, the target process belongs to the host process.

[0035] Step S1 specifically includes:

[0036] Container configuration information is obtained through the socket service, specifically including: container name, container ID, container initial process ID, and container file system storage location. The container name is a user-defined name; the container ID is a string automatically generated using the SHA256 algorithm; the container initial process ID, also known as the container initial process PID, is the ID assigned to the microservice process by the system after the container service startup program starts the microservice; and the container file system storage location is a path string indicating the address from the host machine's perspective. This information can be obtained by using HTTP GET requests to the interfaces " / containers / json" and " / containers / {id} / json".

[0037] When a container service engine starts a container, it creates a new process to launch the container process; this new process is called the container service launcher. For example, the Docker hypervisor creates a new process, such as `containerd-shim-runc`, to launch the container process. This container service launcher configures the hardware resources, namespace isolation conditions, Linux permissions, network settings, etc., required by the microservice according to pre-configured information. Furthermore, the container service launcher and the microservice process have a parent-child relationship; that is, the container service launcher process creates the microservice process. This rule is fixed, so it has higher accuracy and wider applicability than relying on Linux namespaces to determine process ownership.

[0038] Based on the container's initial process ID, the parent process ID of the container's initial process can be obtained through the parent-child relationship in the system's current process tree; this is the process ID of the container service startup process. This can be read from the operating system's process filesystem, / proc / . <pid>Get it from the / status file.

[0039] Step S2 specifically includes:

[0040] Process information can be captured and processed using Netlink Connector, eBPF, Syscall Hook, etc. This embodiment demonstrates the use of the Netlink Connector mechanism. Process information includes the executing user, process name, process path, process ID, parent process ID, event type, or command line. Filters are used to select events with the types "PROC_EVENT_EXEC" and "PROC_EVENT_FORK," and the process name, process path, process ID (PID), and parent process ID (PPID) are extracted from these events.

[0041] Step S3 specifically includes:

[0042] 1) Compare the container service startup process ID with the target process's parent process ID. If they match, the target process belongs to the container process. If they do not match, then...

[0043] 2) Compare the container service startup process ID with the parent process ID of the target process's parent process. If they match, the target process belongs to the container process. As shown in Figure 2, the container service startup process ID is 1319, the target process's process ID is 2399, and its parent process ID is 2169. They do not match. The parent process ID of process ID 2169 is 1319, which matches the container service startup process ID. Therefore, the target process is determined to be a container process. If they do not match, then...

[0044] 3) Continue searching upwards for the parent process ID of the parent process, comparing it with the container service startup process ID. This process is repeated until the parent process ID is 0 or 1. If the parent process ID still does not match when the traversal stops, then the target process belongs to the host machine. As shown in Figure 3, if none of the parent process IDs match the container service startup process ID, then the target process is a host machine process.

[0045] The optimized scheme also includes a list of container process PIDs. If the parent process ID of the target process has been marked as a process within the container and stored in the container process PID list, then the target process belongs to the container process. As shown in Figure 4, the container service startup process ID is 1319. Previously, a process with process ID 2169 was identified as a process within the container. When the target process's process ID is 2399 and its parent process ID is 2169, the target container is directly identified as a container process. This approach reduces the number of loop iterations when multiple layers of process creation exist within the container.

[0046] By following the steps above, we can identify which specific container or host machine the target process originated from. For suspicious or malicious processes, we can quickly and efficiently associate container information for source tracing and analysis.

[0047] In other embodiments, when it is necessary to obtain the path, step S4, path acquisition, can be added.

[0048] S4, Get the path.

[0049] If the process belongs to the host machine, the path of the process is read directly; if the process belongs to the container process, the container file system storage location in the container configuration information is concatenated with the read path of the process to obtain an accessible process path.

[0050] In step S2, the program path carried by the process inside the container is an internal path within the container, not a path on the host machine. The program file cannot be directly accessed from the host machine because the path is incorrect for Su. Therefore, the path needs to be corrected or completed when passed to the host machine; otherwise, the sample object cannot be accessed correctly.

[0051] In step S1, the container file system storage location of a certain container has been obtained, for example, the path expression " / var / lib / docker / overlay2 / 919d59e1500c0f4a5a284fcdb2e4f861ea554dc8485f88b0e0f7a18da17ae5e1 / merged". The sample path parameter carried by the kernel process event is expressed as " / bin / bash". The container file system storage location is concatenated with the path inside the container to obtain the final path accessible from the host machine, which is " / var / lib / docker / overlay2 / 919d59e1500c0f4a5a284fcdb2e4f861ea554dc8485f88b0e0f7a18da17ae5e1 / merged / bin / bash". The combined path is a path that the host machine's monitoring program can access normally, and the required computer program sample can be extracted through this path.

[0052] Example 2

[0053] This embodiment discloses a process tracing system for implementing the process tracing method in Embodiment 1. It includes:

[0054] The container acquisition unit is used to obtain the container configuration information of the container and obtain the container service startup process ID. This container service startup process ID is then sent to the comparison and judgment unit.

[0055] The process acquisition unit is used to acquire process information of the target process, filter the process information, and obtain the parent process ID of the target process. The parent process ID of the target process is then sent to the comparison and judgment unit.

[0056] The comparison and judgment unit receives the container service startup process number obtained by the container acquisition unit, and the parent process number of the time process obtained by the process acquisition unit.

[0057] The process ID of the container service startup process is compared with the parent process ID of the target process or the parent process ID of the target process's parent process. The parent process IDs of the events are traversed until the parent process ID is 0 or 1. If they match, the target process belongs to the container process, and the target process is located according to the corresponding container. If they do not match, the target process belongs to the host process.

[0058] Example 3

[0059] This embodiment discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can implement the process tracing method in Embodiment 1.

[0060] The computer-readable storage medium may take the form of: an electrical connection having one or more wire segments, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

[0061] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units may be combined or integrated into another device, or some features may be ignored or not executed.

[0062] The units may or may not be physically separate. The components shown as units can be one or more physical units, meaning they can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0063] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0064] In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless segments, wire segments, optical cables, RF, etc., or any suitable combination thereof.

[0065] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.< / pid>

Claims

1. A process tracing method, characterized in that, Includes the following steps: The process involves obtaining container configuration information to get the container service startup process ID; obtaining process information of the target process, filtering the process information to get the parent process ID of the target process; comparing the container service startup process ID with the parent process ID of the target process or the parent process ID of the target process's parent process, traversing the parent process IDs of events until the parent process ID is 0 or 1, and stopping when the comparison is consistent. If they match, the target process belongs to the container process, and the target process is located according to the corresponding container; if they do not match, the target process belongs to the host process; the process also includes a method for obtaining the path. If the process belongs to the host process, the path of the process is directly read; if the process belongs to the container process, the container file system storage location in the container configuration information is compared with the read path of the target process. The paths are concatenated to obtain an accessible process path; the container service startup process ID is compared with the parent process ID of the target process or the parent process ID of the target process's parent process. Specifically, this includes: comparing the container service startup process ID with the parent process ID of the target process; if they match, the target process belongs to the container process; if they do not match, the container service startup process ID is compared with the parent process ID of the target process's parent process; if they match, the target process belongs to the container process; if they do not match, the search continues upwards for the parent process ID of the parent process, comparing it with the container service startup process ID, and this process is repeated until the parent process ID is 0 or 1. If they still do not match when the traversal stops, the target process belongs to the host process.

2. The process tracing method according to claim 1, characterized in that, The container configuration information includes: container name, container ID, container initial process ID, and container file system storage location.

3. The process tracing method according to claim 2, characterized in that, Obtaining the container service startup process ID specifically includes: obtaining the container service startup process ID through the process file system based on the container's initial process ID.

4. The process tracing method according to claim 1, characterized in that, The process information includes the executing user, process name, process path, process ID, parent process ID, event type, or command line.

5. The process tracing method according to claim 4, characterized in that, Filtering the process information specifically includes: filtering the process name, process path, process ID, and parent process ID of the target event based on the event type.

6. The process tracing method according to claim 1, characterized in that, Also includes: If the parent process ID of the target process has been marked as a container process, then the target process belongs to the container process.

7. A process tracing system, characterized in that, include: The system includes a container acquisition unit for acquiring container configuration information and obtaining the container service startup process ID; a process acquisition unit for acquiring process information of a target process, filtering the process information, and obtaining the parent process ID of the target process; a comparison and determination unit for comparing the container service startup process ID with the parent process ID of the target process or the parent process ID of the target process's parent process, traversing the parent process IDs of events until the parent process ID is 0 or 1, and stopping when the comparison matches, the target process belongs to a container process, and the target process is located according to the corresponding container; if they do not match, the target process belongs to a host process; and a method for obtaining a path is also included: if the process belongs to a host process, the path of the process is directly read; if the process belongs to a container process, the container file in the container configuration information is retrieved. The system storage location is concatenated with the path of the read process to obtain an accessible process path; the container service startup process ID is compared with the parent process ID of the target process or the parent process ID of the target process's parent process. Specifically, this includes: comparing the container service startup process ID with the parent process ID of the target process; if they match, the target process belongs to the container process; if they do not match, the container service startup process ID is compared with the parent process ID of the target process's parent process; if they match, the target process belongs to the container process; if they do not match, the search continues upwards for the parent process ID of the parent process, comparing it with the container service startup process ID, and this process is repeated until the parent process ID is 0 or 1. If they still do not match when the traversal stops, the target process belongs to the host process.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-6.

Images