An interception method, device, system and computer storage medium of operation command

Abstract

The application discloses an interception method, device and system of an operation command and a computer storage medium, and relates to the field of command interception. When an operation command is input, the operation command is intercepted and a sending path and a receiving path are obtained. A kernel virtual machine mounted on a hook of a system kernel is used to determine the sending path and the receiving path corresponding to an actual operation flow of the operation command. Whether the sending path and the receiving path obtained by the two methods are consistent with each other is judged. If yes, the operation command is released; otherwise, the operation command is rejected. The subject and object of the operation command are determined based on information contained in the operation command, and the kernel virtual machine mounted on the kernel hook is used to determine the subject and object of the operation command. The interception is realized by judging whether the subject and object match. The purpose of intercepting unauthorized operations can be realized without embedding a software program into the system kernel. Moreover, the operation table and other data in the kernel do not need to be modified, so that problems caused by modification errors are avoided.

Description

Technical Field

[0001] This invention relates to the field of command interception, and in particular to a method, apparatus, system, and computer storage medium for intercepting operation commands. Background Technology

[0002] In server and computer systems, system files and data files are crucial resources that significantly impact system security and stability. Unauthorized modification of kernel files or user data files can lead to data breaches, financial losses, and system crashes. With the development of internet technology, network attack methods and techniques have increased, necessitating enhanced security protection for all files and the entire system. Current technologies embed software programs into the system kernel to intercept unauthorized operations. When an operation command is input, the kernel's file operation table and inode operation table are retrieved, and their parameters are modified to obtain a corresponding check function. This function checks whether the operation command conforms to preset interception rules; if it does, the command is intercepted; otherwise, it is allowed. While this method can intercept unauthorized operations, it has two drawbacks:

[0003] 1. The entire software program needs to be embedded into the system kernel. If the software program encounters an error, it may cause the entire system to malfunction.

[0004] 2. Every time an operation command is input, two operation tables in the kernel need to be modified. If the modification is incorrect, not only will the file become unusable, but it will also affect the performance and efficiency of the entire system. Summary of the Invention

[0005] The purpose of this invention is to provide a method, apparatus, system, and computer storage medium for intercepting operation commands. This method can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it also avoids problems caused by errors in modifying operation tables and other data in the kernel.

[0006] To solve the above-mentioned technical problems, the present invention provides a method for intercepting operation commands, comprising:

[0007] When an operation command is detected being input into the system kernel, the operation command is intercepted;

[0008] Obtain the first sending path and the first receiving path contained in the operation command;

[0009] By using a kernel virtual machine pre-mounted onto the system kernel, the second sending path and the second receiving path corresponding to the actual operation flow of the operation command are determined;

[0010] Determine whether the first sending path and the second sending path are consistent, and determine whether the first receiving path and the second receiving path are consistent;

[0011] If all are consistent, then the operation command is executed;

[0012] Otherwise, the operation command is rejected.

[0013] On the one hand, after obtaining the first sending path and the first receiving path contained in the operation command, the method further includes:

[0014] Determine all operation types that the operation command needs to execute in the system kernel;

[0015] Invoke the kernel virtual machine on the hook corresponding to each of the operation types.

[0016] On the one hand, determining whether the first sending path and the second sending path are consistent, and determining whether the first receiving path and the second receiving path are consistent, includes:

[0017] Determine whether the first receiving path and the second receiving path are consistent;

[0018] If the first receiving path and the second receiving path are inconsistent, the result is determined to be no, and the step of intercepting the operation command is initiated.

[0019] If the first receiving path and the second receiving path are the same, then determine whether the first sending path and the second sending path are the same;

[0020] If the first sending path and the second sending path are the same, then they are determined to be the same.

[0021] If the first sending path is inconsistent with the second sending path, then the result is determined as no, and the step of intercepting the operation command is initiated.

[0022] On the one hand, before rejecting the operation command, it also includes:

[0023] Determine the current detection mode of the system kernel;

[0024] If it is in interception mode, then proceed to the step of rejecting the operation command;

[0025] If in monitoring mode, the operation command is allowed, and a first log indicating that the operation command has been allowed is generated;

[0026] The detection modes include at least an interception mode and a monitoring mode.

[0027] On the one hand, after rejecting the operation command, it also includes:

[0028] Generate a second log indicating that the operation command is rejected;

[0029] Determine the hazard level of the operation command;

[0030] Determine whether the hazard level is greater than a preset level;

[0031] If so, the second log will be sent to the user terminal.

[0032] On the one hand, obtaining the first sending path and the first receiving path contained in the operation command includes:

[0033] Based on the N historical operation commands preceding the operation command, the M new operation commands following the operation command, and the operation command itself, determine the first sending path and the first receiving path contained in the operation command.

[0034] On the one hand, rejecting the operation command includes:

[0035] The kernel virtual machine is controlled to generate a signal represented by a preset value, and the signal is sent to the system kernel;

[0036] When the system kernel receives the signal, it refuses to execute the operation command.

[0037] On the one hand, determining whether the first sending path and the second sending path are consistent, and determining whether the first receiving path and the second receiving path are consistent, includes:

[0038] The first sending path and the first receiving path are encapsulated to obtain the first path correspondence of the operation command;

[0039] Each of the second sending paths and the second receiving paths corresponding to the second sending paths, which are pre-stored in the kernel virtual machine, are encapsulated to obtain multiple preset second path correspondences;

[0040] Determine whether any of the multiple second path correspondences is consistent with the first path correspondence;

[0041] If they exist, they are considered to be identical;

[0042] Otherwise, it is judged as no.

[0043] This application also provides an operation command interception device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor, used to implement the steps of the method for intercepting operation commands as described above when executing the computer program.

[0046] This application also provides a system for intercepting operation commands, including:

[0047] The first acquisition unit is used to acquire the first sending path and the first receiving path contained in the operation command when an operation command is detected to be input into the system kernel.

[0048] The second acquisition unit is used to determine the second sending path and the second receiving path corresponding to the actual operation flow of the operation command by using a kernel virtual machine pre-mounted on the system kernel.

[0049] The judgment unit is used to determine whether the first sending path and the second sending path are consistent, and to determine whether the first receiving path and the second receiving path are consistent; if they are both consistent, the release unit is triggered; otherwise, the rejection unit is triggered.

[0050] The release unit is used to release the operation command;

[0051] The rejection unit is used to reject the operation command.

[0052] This application also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the operation command interception method described above.

[0053] The beneficial effects of this application are that it provides a method, apparatus, system, and computer storage medium for intercepting operation commands, relating to the field of command interception. When an operation command is input into the system kernel, the operation command is intercepted, and its sending and receiving paths are obtained. Then, using a kernel virtual machine pre-mounted on a hook in the system kernel, the sending and receiving paths corresponding to the actual operation flow of the operation command are determined. It is then determined whether the sending and receiving paths obtained by the two methods are consistent; if they are consistent, the operation command is allowed; otherwise, it is rejected. The subject and object of the operation command are determined based on the information contained in the operation command itself, and the kernel virtual machine mounted on the kernel hook is used to determine the subject and object of the operation command. Interception is achieved by determining whether the two match. This method can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it also avoids problems caused by errors in modifying operation tables or other data in the kernel. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A flowchart illustrating a method for intercepting operation commands provided in this application;

[0056] Figure 2 A flowchart of a method for mounting a kernel virtual machine provided in this application;

[0057] Figure 3 A flowchart of another method for intercepting operation commands provided in this application;

[0058] Figure 4 A flowchart of a log reporting method provided in this application;

[0059] Figure 5 A schematic diagram of the structure of an operation command interception device provided in this application;

[0060] Figure 6 This is a schematic diagram of the structure of an operation command interception system provided in this application. Detailed Implementation

[0061] The core of this invention is to provide a method, apparatus, system, and computer storage medium for intercepting operation commands. It can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it does not require modification of data such as operation tables in the kernel, thus avoiding problems caused by modification errors.

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] In computer and server systems, both directories and files are crucial system resources, playing a key role in system security and stability. The importance of directories and files in practical applications is manifested in the following aspects:

[0064] 1. The system contains a lot of sensitive information, such as user account information, ID card numbers, bank card information, etc. This information needs to be strictly protected, otherwise it will cause financial losses and privacy leaks to users.

[0065] 2. Unauthorized modification, deletion, or destruction of system files may cause system crashes or malfunctions, affecting system stability and reliability and causing unnecessary losses.

[0066] 3. According to relevant laws and regulations, some organizations need to protect certain documents and directories to ensure their confidentiality and integrity; otherwise, information leakage may occur.

[0067] 4. Attackers can exploit vulnerabilities or malware to infiltrate systems, read, modify, or delete critical files, leading to serious system security problems.

[0068] With the rapid development of the Internet, network threats and attacks are also increasing. Against this backdrop, directory and file protection is particularly important.

[0069] In existing technologies, when an operation command arrives, the system kernel retrieves the file operation table and inode operation table of the file. The parameters in these tables are then modified to obtain a pointer result. Based on this pointer result, a rule check number is calculated. A rule check function then determines whether the file operation of this command conforms to preset protection rules. If it does, the operation command is blocked; otherwise, it is completed. This method is inherently intrusive, requiring the entire process to be embedded into the system kernel to modify the operation table. In application, if this process malfunctions, it could potentially cause problems for the entire system. Furthermore, while modifying the operation table is theoretically feasible, in practice, errors can occur due to operator mistakes or sudden interference, potentially rendering the file unusable.

[0070] To solve the above technical problems, please refer to Figure 1 , Figure 1 A flowchart of an operation command interception method provided in this application includes:

[0071] S1: When an operation command is detected being input into the system kernel, the operation command is intercepted;

[0072] To ensure the security of the system itself and all files within it, all operation commands received by the system, regardless of their origin or type, must be intercepted. Interception methods can include: pre-setting a path within the system specifically for storing intercepted commands; upon receiving an operation command, creating a new command to replace it and redirecting it to the aforementioned path for interception; alternatively, a whitelist command library can be pre-loaded and set to an empty library, thus intercepting every operation command.

[0073] S2: Obtain the first sending path and the first receiving path contained in the operation command;

[0074] After intercepting the operation command, since the data information contained in the operation command usually includes features such as header, checksum, and trailer, in addition to the operation that can be performed, these features usually describe which device sent the operation command and which path in the system the operation command needs to be sent to to perform subsequent operations, etc., the subject and object of the operation command can be determined based on this information (for example, the operation command "rm -rf..." usually contains path information of the subject and object), that is, the first sending path and the first receiving path, or the sender and receiver.

[0075] S3: Using a kernel virtual machine pre-mounted onto a hook in the system kernel, determine the second sending path and the second receiving path corresponding to the actual operation flow of the operation command;

[0076] Considering that cyberattacks often disguise themselves, such as impersonating a trusted sender to send operation commands, or disguising paths pointing to important files as paths pointing to unimportant files, a secondary check of the operation commands is necessary.

[0077] To accurately detect operation commands, this application introduces a kernel virtual machine (eBPF, Extended Berkeley Packet Filter, hereinafter referred to as eBPF). eBPF can run within the kernel without obtaining or modifying the system kernel source code. The eBPF code is mainly mounted and runs on hook points in the kernel or applications, including system calls, function entry and exit points, kernel tracepoints, network events, etc., without making any intrusive operations such as modification or embedding into the system kernel itself. If a user wants to use some kernel functions through eBPF, they can make system calls through a user-mode program to load the packet code into eBPF and run it, thus enabling the kernel-mode program to execute the operation corresponding to that packet. Furthermore, eBPF can capture packets from the system temperature protocol stack through only a few simple hook points. Changes in the network protocol code of the system kernel itself do not affect the operation of eBPF, ensuring the relative independence between eBPF and the system kernel and effectively avoiding mutual influence.

[0078] In practical applications, please refer to Figure 2 , Figure 2 The flowchart of a method for mounting a kernel virtual machine provided in this application shows that a YAML file can be used as the carrier of the interception strategy. The YAML file is read and loaded using a CLI (Command Line Interface) tool, parsed into the aforementioned interception strategy, and further parsed into various strategy steps. The interception strategy is then distributed to the system's kernel-mode eBPF program by updating the eBPF Map. The aforementioned interception strategy comprises the steps implemented in this application. Additionally, it may include a list of directories or files to be protected, a whitelist, various interception modes (such as monitoring mode or normal interception mode), and explanatory information for ease of understanding. When an operation command requires determining a second receiving path and a second sending path, the HashMap function in eBPF is used to obtain the directory path of the file being operated on, i.e., the receiver (second receiving path); and the path of the operator operating on that file, i.e., the sender of the operation command (second sending path).

[0079] S4: Determine whether the first sending path and the second sending path are the same, and determine whether the first receiving path and the second receiving path are the same;

[0080] S5: If all are consistent, then the operation command is released;

[0081] S6: Otherwise, refuse the operation command.

[0082] Based on the first send path and first receive path obtained from the operation command itself, and the second send path and second receive path obtained from eBPF, a consistency check is performed between each pair. If the send path is incorrect, it indicates that the sender may be a network attacker impersonating a trusted sender; if the receive path is incorrect, it indicates that the file the network attacker actually wants to attack may be concealed. Therefore, if any of the checks on the first and second send paths or the first and second receive paths is inconsistent, it indicates that the operation command is abnormal and must be rejected to protect system security; only when both checks are consistent will the operation command be allowed.

[0083] In summary, when an operation command is detected input to the system kernel, the operation command is intercepted, and the first sending path and first receiving path contained therein are obtained. Then, using a kernel virtual machine pre-hooked to the system kernel, the second sending path and second receiving path corresponding to the actual operation flow of the operation command are determined. Finally, it is determined whether the first sending path and the second sending path are consistent, and whether the first receiving path and the second receiving path are consistent. If they are consistent, the operation command is allowed; otherwise, the operation command is rejected. By determining the subject and object of the operation command based on the information contained in the operation command itself, and using the kernel virtual machine hooked to the kernel to determine the subject and object of the operation command, interception is achieved by determining whether the two match. This method can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it also avoids problems caused by errors in kernel operation tables.

[0084] Based on the above embodiments:

[0085] In some embodiments, after obtaining the first sending path and the first receiving path contained in the operation command, the method further includes:

[0086] Determine all types of operations that the operation commands need to execute in the system kernel;

[0087] Invoke the kernel virtual machine on the hook corresponding to each operation type.

[0088] To save computation and improve efficiency, this application only mounts eBPF programs at a few key hook points in the kernel. Key hook points refer to programs that will be called by operation commands and programs that the operation commands need to execute. Common key hook points include directory creation, deletion, renaming, file reading and writing, hard links, and soft links. When mounting eBPF programs, one eBPF program is mounted at each hook point. As described in the example above with six hook points, an eBPF program is mounted at each of these six hook points in the system. In practical applications, when user-space operation commands are executed, these hook points are called by the commands. At this time, the various eBPF programs mounted at these called hook points are invoked, meaning the kernel virtual machine jointly enters the subsequent steps of determining the second sending path and the second receiving path. Based on this, only a few eBPF programs at a single hook point need to be called, without triggering functions or programs on the entire system kernel, which significantly saves computation and improves efficiency.

[0089] In some embodiments, determining whether the first transmission path and the second transmission path are consistent, and determining whether the first reception path and the second reception path are consistent, includes:

[0090] Determine whether the first receiving path and the second receiving path are consistent;

[0091] If the first receiving path and the second receiving path are inconsistent, the result is determined as no, and the interception operation command is executed.

[0092] If the first receiving path and the second receiving path are the same, then determine whether the first sending path and the second sending path are the same.

[0093] If the first sending path and the second sending path are the same, then they are determined to be the same.

[0094] If the first sending path and the second sending path are inconsistent, the result is determined as no, and the interception operation command is executed.

[0095] To save computational resources and improve efficiency, this application considers that if either the result of determining the receiving path or the sending path is inconsistent, the operation command must be rejected. Therefore, the judgments can be performed in sequence. Please refer to [reference needed]. Figure 3 , Figure 3 This application provides a flowchart of another method for intercepting operation commands. Furthermore, considering the generally significant harm caused by network attacks masquerading as objects (i.e., inconsistent receiving paths), it is possible to first determine whether the object (receiving path) matches and is consistent. If they do not match, the process directly proceeds to the final step of rejecting the operation command; if they match, the subject (sending path) is then determined. Based on this, computational load can be reduced and efficiency improved.

[0096] In some embodiments, before rejecting the operation command, the method further includes:

[0097] Determine the current detection mode of the system kernel;

[0098] If it is in interception mode, then proceed to the step of rejecting the operation command;

[0099] If in monitoring mode, the operation command is allowed and a first log indicating that the operation command was allowed is generated;

[0100] The detection modes include at least interception mode and monitoring mode.

[0101] To avoid intercepting trusted operations erroneously in practical applications, this application allows setting the system kernel's detection mode to monitoring mode upon initial deployment or as needed. In this mode, the consistency of the receiving and sending paths is still compared. However, if an inconsistency is detected, the operation command is still allowed, and its receiving and sending paths, along with related information, are recorded in the log. Combined with other embodiments, the Ring Buffer function in the ebpf Map program can be used to upload the logs. The purpose of setting the monitoring mode is to allow staff to identify commonly used receiving and sending paths for operation commands through the logs, facilitating focused monitoring of these commonly used paths during practical applications. Please refer to... Figure 3 Please refer to Figure 3 , Figure 3 This is a flowchart illustrating another method for intercepting operation commands provided in this application. In other words, the monitoring mode can be viewed as a training process for the interception mode. Based on this, it is possible to avoid the situation where trusted operations are incorrectly intercepted in practical applications.

[0102] In some embodiments, after rejecting the operation command, the method further includes:

[0103] Generate a second log indicating that the operation command was rejected;

[0104] Determine the hazard level of the operation command;

[0105] Determine whether the hazard level is greater than the preset level;

[0106] If so, the second log will be sent to the user terminal.

[0107] To alert staff, considering the potential dangers of cyberattacks, this application includes a log entry to promptly notify staff of any ongoing cyberattacks so they can strengthen their network security measures. Therefore, upon rejecting an operation command, the log entry will record the receiving and sending paths of the rejected command, as well as the reason for rejection, for staff review. Please refer to [the relevant documentation / reference]. Figure 4 , Figure 4 This application provides a flowchart of a log reporting method. Furthermore, considering the large volume of data exchange and the numerous rejected operation commands in the system, requiring staff to review each one individually would impose a heavy workload. Therefore, since different operation commands have varying degrees of severity, multiple severity levels can be set based on their severity. For example, operation commands targeting files with higher protection levels in the system have higher severity levels. Based on this, for operation commands with lower severity levels, their corresponding second logs can be saved in a designated directory for staff to review when needed. For operation commands with higher severity levels, their corresponding second logs are sent to a user-space program. The user-space program matches the reported subject and object in the second log to the relevant policy, obtains the currently effective policy entries in the kernel, encapsulates the policy name, label, severity, and other information into an alarm file, and forwards the alarm file to the host managing the system or the user terminal via syslog forwarding, allowing users to promptly identify operation commands with higher severity levels. This allows for simple notifications to staff.

[0108] In some embodiments, obtaining the first sending path and the first receiving path contained in the operation command includes:

[0109] Based on the N historical operation commands preceding the operation command, the M new operation commands following the operation command, and the operation command itself, determine the first sending path and the first receiving path contained in the operation command.

[0110] To accurately determine the first sending path and the first receiving path of an operation command, this application utilizes the context information of the received operation command—that is, information from other operation commands—to determine the user ID, PID, PPID, subject path, and object path of the operation command. This is because when a user wants to send commands to the system to achieve certain functions, multiple commands are typically sent consecutively. Therefore, the first sending path and the first receiving path in the current operation command can be determined by combining the context information. Based on this, the first sending path and the first receiving path of the operation command can be accurately determined.

[0111] In some embodiments, denying an operation command includes:

[0112] The control kernel virtual machine generates signals represented by preset values ​​and sends the signals to the system kernel;

[0113] When the system kernel receives the signal, it refuses to execute the operation command.

[0114] To easily reject operation commands, this application predefines a special numerical value to represent the function of rejecting the operation command. For example, "-1" can be used as a preset value. Combined with other embodiments, when intercepting an operation command, the ebpf program directly returns the value -1, and the system kernel returns an error code. Upon receiving this error code, the operation command can be rejected, thus achieving directory and file protection. Furthermore, if the system is a Linux system, the interception function inherent in the LSM (Linux Security Modules) layer of the Linux system can also be invoked to directly achieve interception and rejection at the system call level. Based on this, operation commands can be rejected simply.

[0115] In some embodiments, determining whether the first transmission path and the second transmission path are consistent, and determining whether the first reception path and the second reception path are consistent, includes:

[0116] The first sending path and the first receiving path are encapsulated to obtain the first path correspondence of the operation command;

[0117] The pre-stored second sending paths and corresponding second receiving paths in the kernel virtual machine are encapsulated to obtain multiple preset second path correspondences;

[0118] Determine whether any of the multiple second path correspondences is consistent with the first path correspondence;

[0119] If they exist, they are considered to be identical;

[0120] Otherwise, it is judged as no.

[0121] To improve the efficiency of consistency checks, this application considers the large volume of information exchange and the large number of received operation commands in the system. The consistency check of the receiving and sending paths is actually based on the second sending and receiving paths. It polls the first receiving and first sending paths of all unprocessed operation commands stored in the system kernel twice to find the corresponding operation commands, essentially using string matching to determine if a match exists. This method requires two polls, which is slow. Based on this, and in conjunction with other embodiments, the characteristics of eBPF HashMap can be utilized. A structure object is stored in the key of the eBPF MAP, containing a subject and an object, representing the correspondence between the sending and receiving paths. During matching, the second sending and receiving paths are also encapsulated into an object (a correspondence), and then the eBPF helper functions are used to view the various structure objects in the MAP. Finding the same correspondence enables fast retrieval. This improves the efficiency of consistency checks.

[0122] Please refer to Figure 5 , Figure 5 A schematic diagram of an operation command interception device provided in this application includes:

[0123] Memory 21 is used to store computer programs;

[0124] Processor 22 is configured to implement the steps of the method for intercepting operation commands as described above when executing a computer program.

[0125] For a detailed description of the operation command interception device provided in this application, please refer to the embodiments of the operation command interception method described above; further details will not be repeated here.

[0126] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0127] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 20 is used to store at least the following computer program 201, which, after being loaded and executed by the processor 21, is capable of implementing the relevant steps of the system update method for the HBA card disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, and the storage method may be temporary storage or permanent storage. The operating system 202 may include Windows, Unix, Linux, etc.

[0128] In summary, when an operation command is detected input to the system kernel, the operation command is intercepted, and the first sending path and first receiving path contained therein are obtained. Then, using a kernel virtual machine pre-hooked to the system kernel, the second sending path and second receiving path corresponding to the actual operation flow of the operation command are determined. Finally, it is determined whether the first sending path and the second sending path are consistent, and whether the first receiving path and the second receiving path are consistent. If they are consistent, the operation command is allowed; otherwise, the operation command is rejected. By determining the subject and object of the operation command based on the information contained in the operation command itself, and using the kernel virtual machine hooked to the kernel to determine the subject and object of the operation command, interception is achieved by determining whether the two match. This method can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it also avoids problems caused by errors in kernel operation tables.

[0129] Please refer to Figure 6 , Figure 6 A schematic diagram of an operation command interception system provided in this application includes:

[0130] The first acquisition unit 31 is used to acquire the first sending path and the first receiving path contained in the operation command when an operation command is detected to be input into the system kernel.

[0131] The second acquisition unit 32 is used to determine the second sending path and the second receiving path corresponding to the actual operation flow of the operation command by using the kernel virtual machine pre-mounted on the hook of the system kernel.

[0132] The judgment unit 33 is used to determine whether the first sending path and the second sending path are consistent, and to determine whether the first receiving path and the second receiving path are consistent; if they are consistent, the release unit 34 is triggered; otherwise, the interception unit 35 is triggered.

[0133] Release unit 34 is used for release operation commands;

[0134] Rejection unit 35 is used to reject operation commands.

[0135] For a detailed description of the operation command interception system provided in this application, please refer to the embodiments of the operation command interception method described above; further details will not be repeated here.

[0136] When an operation command is detected input to the system kernel, it is intercepted, and the first sending path and first receiving path contained within it are obtained. Then, using a kernel virtual machine pre-hooked to the system kernel, the second sending path and second receiving path corresponding to the actual operation flow of the operation command are determined. Finally, it is determined whether the first sending path and the second sending path are consistent, and whether the first receiving path and the second receiving path are consistent. If they are consistent, the operation command is allowed; otherwise, the operation command is rejected. This method determines the subject and object of the operation command based on the information contained in the operation command itself, and uses a kernel virtual machine hooked to the kernel to determine the subject and object of the operation command. Interception is achieved by checking whether the two match. This method can accurately intercept unauthorized operations without embedding software programs into the system kernel, and it also avoids problems caused by errors in kernel operation tables.

[0137] Based on the above embodiments:

[0138] In some embodiments, it also includes:

[0139] The type determination unit is used to determine all operation types that the operation command needs to execute in the system kernel after obtaining the first sending path and the first receiving path contained in the operation command;

[0140] The invocation unit is used to invoke the kernel virtual machine on the hook corresponding to each operation type.

[0141] In some embodiments, the determining unit 33 includes:

[0142] The receiving path determination unit is used to determine whether the first receiving path and the second receiving path are consistent; if the first receiving path and the second receiving path are inconsistent, the rejection unit is triggered; if the first receiving path and the second receiving path are consistent, the sending path determination unit is triggered.

[0143] The transmission path determination unit is used to determine whether the first transmission path and the second transmission path are consistent; if the first transmission path and the second transmission path are consistent, the release unit 34 is triggered; if the first transmission path and the second transmission path are inconsistent, the rejection unit 35 is triggered.

[0144] In some embodiments, it also includes:

[0145] The mode determination unit is used to determine the current detection mode of the system kernel before rejecting the operation command; if it is the interception mode, the rejection unit 35 is triggered; if it is the monitoring mode, the allow unit 34 is triggered and a first log indicating that the operation command is allowed is generated.

[0146] The detection modes include at least interception mode and monitoring mode.

[0147] In some embodiments, it also includes:

[0148] The log generation unit is used to generate a second log indicating the rejection of the operation command after the operation command is rejected.

[0149] Hazard level determination unit, used to determine the hazard level of operation commands;

[0150] The hazard assessment unit is used to determine whether the hazard level is greater than the preset level; if so, the sending unit is triggered.

[0151] The sending unit is used to send the second log to the user terminal.

[0152] In some embodiments, the first acquisition unit 31 is specifically used for:

[0153] Based on the N historical operation commands preceding the operation command, the M new operation commands following the operation command, and the operation command itself, determine the first sending path and the first receiving path contained in the operation command.

[0154] In some embodiments, the rejection unit 35 includes:

[0155] The control unit is used to control the kernel virtual machine to generate signals represented by preset values ​​and send the signals to the system kernel;

[0156] The execution denial unit is used to refuse the execution of operation commands when the system kernel receives a signal.

[0157] In some embodiments, the determining unit 33 includes:

[0158] The first encapsulation unit is used to encapsulate the first sending path and the first receiving path to obtain the first path correspondence of the operation command;

[0159] The second encapsulation unit is used to encapsulate each second sending path and the second receiving path corresponding to the second sending path that are pre-stored in the kernel virtual machine, so as to obtain multiple preset second path correspondences.

[0160] The correspondence determination unit is used to determine whether any of the multiple second path correspondences is consistent with the first path correspondence; if it is, the release unit 34 is triggered; otherwise, the rejection unit 35 is triggered.

[0161] This application also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the operation command interception method described above.

[0162] For a detailed description of the computer storage medium provided in this application, please refer to the embodiments of the above-described method for intercepting operation commands; further details will not be repeated here.

[0163] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0164] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0165] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for intercepting operation commands, characterized in that, include: When an operation command is detected being input into the system kernel, the operation command is intercepted; Obtain the first sending path and the first receiving path contained in the operation command; wherein, obtaining the first sending path and the first receiving path contained in the operation command includes: determining the user ID, PID, PPID, subject path and object path of the operation command based on N historical operation commands before the operation command, M new operation commands after the operation command and the operation command, and determining the subject path and the object path as the first sending path and the first receiving path respectively; Using a kernel virtual machine pre-mounted on a hook in the system kernel, a second sending path and a second receiving path corresponding to the actual operation flow of the operation command are determined; wherein, the kernel virtual machine is an eBPF program; determining the second sending path and the second receiving path includes: determining all operation types that the operation command needs to execute in the system kernel, calling the eBPF program mounted on the hook corresponding to each operation type, wherein the operation type includes at least one of directory creation, deletion, renaming, file read / write, hard link, and soft link; using the HashMap function in eBPF to obtain the directory path of the operated file as the second receiving path, and obtaining the operator path of the operated file as the second sending path; The process involves determining whether the first sending path and the second sending path are consistent, and also determining whether the first receiving path and the second receiving path are consistent. The determination process includes: encapsulating the first sending path and the first receiving path to obtain a first path correspondence for the operation command; encapsulating the first path correspondence into a first structure object containing a subject and an object; storing the first structure object as the key in the eBPF Map; encapsulating the second sending path and the second receiving path to obtain a second path correspondence; encapsulating the second path correspondence into a second structure object containing a subject and an object; using eBPF auxiliary functions to search the eBPF Map for a first structure object identical to the second structure object; if it exists, it is determined that they are consistent; otherwise, they are determined to be inconsistent. If all are consistent, then the operation command is executed; Otherwise, the operation command is rejected.

2. The method for intercepting operation commands as described in claim 1, characterized in that, Determining whether the first sending path and the second sending path are consistent, and determining whether the first receiving path and the second receiving path are consistent, includes: Determine whether the first receiving path and the second receiving path are consistent; If the first receiving path and the second receiving path are inconsistent, the result is determined to be no, and the step of intercepting the operation command is initiated. If the first receiving path and the second receiving path are the same, then determine whether the first sending path and the second sending path are the same; If the first sending path and the second sending path are the same, then they are determined to be the same. If the first sending path is inconsistent with the second sending path, then the result is determined as no, and the step of intercepting the operation command is initiated.

3. The method for intercepting operation commands as described in claim 1, characterized in that, Before rejecting the operation command, it also includes: Determine the current detection mode of the system kernel; If it is in interception mode, then proceed to the step of rejecting the operation command; If in monitoring mode, the operation command is allowed, and a first log indicating that the operation command has been allowed is generated; The detection modes include at least an interception mode and a monitoring mode.

4. The method for intercepting operation commands as described in claim 1, characterized in that, After rejecting the operation command, the following is also included: Generate a second log indicating that the operation command is rejected; Determine the hazard level of the operation command; Determine whether the hazard level is greater than a preset level; If so, the second log will be sent to the user terminal.

5. The method for intercepting operation commands as described in claim 1, characterized in that, Denying the operation command includes: The kernel virtual machine is controlled to generate a signal represented by a preset value, and the signal is sent to the system kernel; When the system kernel receives the signal, it refuses to execute the operation command.

6. A device for intercepting operation commands, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the method for intercepting operation commands as described in any one of claims 1 to 5 when executing the computer program.

7. A system for intercepting operation commands, characterized in that, include: The first acquisition unit is configured to acquire a first sending path and a first receiving path contained in the operation command when an operation command is detected to be input into the system kernel; wherein, acquiring the first sending path and the first receiving path contained in the operation command includes: determining the user ID, PID, PPID, subject path and object path of the operation command based on N historical operation commands before the operation command, M new operation commands after the operation command and the operation command, and determining the subject path and the object path as the first sending path and the first receiving path, respectively; The second acquisition unit is used to determine the second sending path and the second receiving path corresponding to the actual operation flow of the operation command by using a kernel virtual machine pre-mounted on a hook to the system kernel; wherein, the kernel virtual machine is an eBPF program; determining the second sending path and the second receiving path includes: determining all operation types that the operation command needs to execute in the system kernel, calling the eBPF program mounted on the hook corresponding to each operation type, wherein the operation type includes at least one of directory creation, deletion, renaming, file read / write, hard link and soft link; using the HashMap function in eBPF to obtain the directory path of the operated file as the second receiving path, and obtaining the operator path of the operated file as the second sending path; The judgment unit is used to determine whether the first sending path and the second sending path are consistent, and to determine whether the first receiving path and the second receiving path are consistent. The judgment process includes: encapsulating the first sending path and the first receiving path to obtain a first path correspondence of the operation command; encapsulating the first path correspondence into a first structure object containing a subject and an object, and storing the first structure object as the key in the eBPF Map; encapsulating the second sending path and the second receiving path to obtain a second path correspondence, and encapsulating the second path correspondence into a second structure object containing a subject and an object; using eBPF auxiliary functions to search in the eBPF Map for a first structure object that is the same as the second structure object; if it exists, it is determined that they are consistent; otherwise, it is determined that they are inconsistent; if they are consistent, the release unit is triggered; otherwise, the rejection unit is triggered. The release unit is used to release the operation command; The rejection unit is used to reject the operation command.

8. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for intercepting operation commands as described in any one of claims 1 to 5.

Images