A Linux host command auditing method, system and device based on ftrace

Abstract

The present invention relates to the technical field of command line auditing, and provides a Linux host command auditing method, system and device based on ftrace, including: sending a control message to a user-state Agent deployed on a Linux host through a control module; when the control message contains an instruction to turn on command line auditing, the user-state Agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host; when the user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set plug-in; the user-state Agent continuously receives the command line operation log from the ringbuffer of the Linux kernel, enriches the command line operation log, and sends the command line operation log after data enrichment to the audit module for auditing; when the control message contains an instruction to turn off command line auditing, the user-state Agent clears the plug-in set in the Linux kernel and the bash binary program of the Linux host. The present invention can provide a highly efficient, real-time, difficult to bypass and highly customized security monitoring solution for the Linux system.

Description

Technical Field

[0001] The present invention relates to the technical field of command line auditing, and in particular to a Linux host command auditing method, system and device based on ftrace. Background Art

[0002] Implementing Linux host command line auditing usually faces the challenge of how to obtain enough information for effective monitoring and analysis without affecting system performance. As a multi-user environment, Linux system administrators need to monitor the system to determine which users have executed certain commands, which is crucial for ensuring system security, tracking potential misconfigurations, and auditing user operations.

[0003] Although existing user-space auditing tools can record user operations, they have a certain impact on system performance and can be bypassed for various reasons. For example, tools that rely on the bash shell history mechanism or syslog logging can be modified or disabled by users or malware.

[0004] Therefore, how to provide a more secure command audit method, reduce audit intrusion, and provide higher scalability and real-time performance has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a Linux host command auditing method, system and device based on ftrace.

[0006] According to a first aspect of the present invention, a Linux host command auditing method based on ftrace is provided, the method comprising:

[0007] Send control messages to the user-mode Agent deployed on the Linux host through the control module;

[0008] When the control message contains an instruction to enable command line auditing, the user-mode agent sets up stubs in the Linux kernel and the bash binary program of the Linux host;

[0009] When the user executes a command in the Linux system, the command line operation log is written into the Linux kernel's ringbuffer according to the configured instrumentation;

[0010] The user-state agent continuously receives command line operation logs from the Linux kernel's ringbuffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module for auditing;

[0011] When the control message contains an instruction to turn off command line auditing, the user-mode agent clears the instrumentation set in the Linux kernel and the bash binary program of the Linux host.

[0012] Preferably, in the ftrace-based Linux host command auditing method of the present invention, when the control message contains an instruction to enable command line auditing, the user-state Agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host, including: when the received control message contains an instruction to enable command line auditing, the user-state Agent retrieves and queries the bash binary program of the Linux host, calculates the offset of the readline function in the bash binary program, sets a kernel-state ftrace uprobe plug-in in the Linux kernel according to the calculated offset through the ftrace uprobe configuration interface, and sets a hook plug-in in the bash binary program.

[0013] Preferably, in the ftrace-based Linux host command auditing method of the present invention, a kernel-state ftrace uprobe stub is set in the Linux kernel according to the calculated offset through the ftrace uprobe configuration interface, including: registering the kernel-state ftrace uprobe stub with the Linux kernel by sending a registration message to the ftrace uprobe configuration interface.

[0014] Preferably, in the Linux host command auditing method based on ftrace of the present invention, when the user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set plug-in, including: when the user executes a command in the Linux system, the bash binary program executes the readline function to read the command line content input by the user, and before the readline function returns the execution result, the hook plug-in set in the bash binary program is used to call the kernel state ftrace uprobe plug-in set in the kernel state to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written into the ringbuffer of the Linux kernel, and the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time and command line information.

[0015] Preferably, in the Linux host command auditing method based on ftrace of the present invention, the user state Agent continuously receives the command line operation log from the ringbuffer of the Linux kernel, enriches the command line operation log, and sends the command line operation log after data enrichment to the audit module for auditing, including:

[0016] The user-state agent continuously receives command line operation logs from the Linux kernel's ringbuffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module;

[0017] The audit module continuously receives the data-enriched command line operation log sent by the user-state Agent, matches the received data-enriched command line operation log with malicious rules, and when the received data-enriched command line operation log matches the malicious rules, sends the data-enriched command line operation log to the alarm module.

[0018] Preferably, in the Linux host command auditing method based on ftrace of the present invention, the command line operation log after data enrichment includes: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal and login IP address.

[0019] Preferably, in the Linux host command auditing method based on ftrace of the present invention, malicious rule matching includes regular rule matching and Flink model matching.

[0020] Preferably, in the Linux host command auditing method based on ftrace of the present invention, when the alarm module receives the command line operation log that has been enriched with data and matches the malicious rules sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template, and sends the alarm information to the configured operation and maintenance user.

[0021] Preferably, in the ftrace-based Linux host command auditing method of the present invention, when the control message contains an instruction to turn off command line auditing, the user-state Agent clears the plug-ins set in the Linux kernel and the bash binary program of the Linux host, including: when the control message received by the user-state Agent contains an instruction to turn off command line auditing, clearing the kernel-state ftrace uprobe plug-ins set in the Linux kernel and the hook plug-ins set in the bash binary program by sending a logout message to the ftraceuprobe configuration interface.

[0022] According to a second aspect of the present invention, there is provided a Linux host command audit system based on ftrace, the system comprising an audit server, the audit server being used for: sending a control message to a user-state Agent deployed on a Linux host through a control module; when the control message contains an instruction to enable command line auditing, the user-state Agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host; when a user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set plug-in; the user-state Agent continuously receives the command line operation log from the ringbuffer of the Linux kernel, enriches the command line operation log, and sends the command line operation log after data enrichment to the audit module for auditing; when the control message contains an instruction to disable command line auditing, the user-state Agent clears the plug-in set in the Linux kernel and the bash binary program of the Linux host.

[0023] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0024] The ftrace-based Linux host command auditing method and system according to the embodiment of the present invention provide a highly efficient, real-time, difficult to bypass and highly customized security monitoring solution for the Linux system through the kernel-level command line auditing technology, which not only improves the security of the system, but also improves the efficiency and effectiveness of risk management. Specifically, it has the following beneficial technical effects:

[0025] 1. Efficient monitoring capabilities: By leveraging the kernel-level ftrace and uprobes mechanisms, it can efficiently monitor and record command line operations on Linux systems. Compared with traditional log file or terminal session capture methods, it achieves monitoring closer to the bottom layer of the system and can capture command line activities with extremely low overhead.

[0026] 2. Real-time and accuracy: By setting probes at the execution point of the readline function in bash, the real-time capture and recording of user input commands is ensured. Compared with the audit system based on log analysis, it can reflect the actual command execution of the system more accurately and timely.

[0027] 3. Higher security and difficult to bypass: Since the probe is set through the kernel's uprobes mechanism rather than relying on any user space tools or services, even users with higher permissions find it difficult to bypass the monitoring of the audit system, enhancing the security of the system, especially in the face of attacks such as advanced persistent threats (APT).

[0028] 4. Enriched log information: In addition to basic command line activity records, richer context information is provided by enriching the collected data, including process name, path, execution user, execution time, parent process PID, login terminal, login IP and complete process tree information. It provides rich data support for subsequent log analysis and behavior analysis, and helps to deeply understand the background and causes of security incidents.

[0029] 5. Customized alarm mechanism: In actual applications, the alarm module can customize alarm rules according to different audit requirements and security strategies, and promptly notify operation and maintenance personnel and security operations personnel of potential security threats through multiple channels (such as SMS, email, social software, etc.), thereby improving response speed and processing efficiency.

[0030] 6. Easy to integrate and expand: Through modular design, the coupling between various components such as control module, agent, audit module and alarm module is low, which is easy to integrate into the existing security architecture, and also convenient for functional expansion and optimization as needed. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 An example diagram of a Linux host command audit system based on ftrace according to an embodiment of the present invention;

[0033] Figure 2 A schematic diagram of the technical principle of a Linux host command auditing method based on ftrace according to an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0035] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0036] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0037] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0038] Figure 1 FIG. 4 is an example diagram of a Linux host command audit system based on ftrace according to an embodiment of the present invention. Figure 1 As shown, the system may include an audit server 101, a communication network 102 and / or one or more audit clients 103. Figure 1 The example shown is multiple audit clients 103.

[0039] In this embodiment, ftrace is the official tracing system of the Linux Kernel, which supports the tracing of function trace, static tracepoint, and dynamic tracepoint, and also provides various tracers for counting the maximum irq delay, the maximum function call stack size, and scheduling events. The ftrace framework built into the Linux kernel provides a lightweight and efficient method to trace function calls in the kernel and applications. The characteristics of ftrace are that it is less invasive to the system, and it allows the tracepoint to be dynamically turned on and off without recompiling the kernel or loading a special kernel module. It has good compatibility and can support most Linux operating systems.

[0040] The audit server 101 can be any suitable server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the audit server 101 can perform appropriate functions. For example, in some embodiments, the audit server 101 can be used to audit Linux host commands based on ftrace. As an optional example, in some embodiments, the audit server 101 can be used to implement a Linux host command audit method based on ftrace by setting stubs in the Linux kernel and the bash binary program of the Linux host. For example, the audit server 101 can be used to: send a control message to a user-state agent deployed on a Linux host through a control module; when the control message contains an instruction to enable command line auditing, the user-state agent sets up plug-ins in the Linux kernel and the bash binary program of the Linux host; when a user executes a command in the Linux system, the command line operation log is written to the ringbuffer of the Linux kernel according to the set plug-ins; the user-state agent continuously receives the command line operation log from the ringbuffer of the Linux kernel, enriches the command line operation log, and sends the enriched command line operation log to the audit module for auditing; when the control message contains an instruction to disable command line auditing, the user-state agent clears the plug-ins set up in the Linux kernel and the bash binary program of the Linux host.

[0041] As another example, in some embodiments, the audit server 101 may send an ftrace-based Linux host command audit method to the audit client 103 for user use based on a request from the audit client 103 .

[0042] As an optional example, in some embodiments, the audit client 103 is used to provide a visual audit interface, which is used to receive a user's selection input operation for auditing Linux host commands based on ftrace, and, in response to the selection input operation, obtain an audit interface corresponding to the option selected by the selection input operation from the audit server 101 and display the audit interface, wherein the audit interface at least displays information on auditing Linux host commands based on ftrace and operation options for the information on auditing Linux host commands based on ftrace.

[0043] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The audit client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the audit service end 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the audit client 103 and the audit service end 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0044] The audit client 103 may include any one or more clients that present an interface related to ftrace-based Linux host command auditing in an appropriate form for use and operation by a user. In some embodiments, the audit client 103 may include any suitable type of device. For example, in some embodiments, the audit client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0045] Although the audit server 101 is illustrated as one device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the audit server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the audit server 101. Alternatively, the functions of the audit server 101 may be implemented using a cloud service.

[0046] Based on the above system, an embodiment of the present invention provides a Linux host command auditing method based on ftrace, which is described below through the following embodiments.

[0047] Figure 2 The technical principle diagram of the ftrace-based Linux host command auditing method according to an embodiment of the present invention is shown in FIG. The ftrace-based Linux host command line auditing method provided in this embodiment has low system intrusion, high security, excellent scalability and real-time performance, and can deeply capture command line operations on Linux hosts, especially sensitive business servers, and record their execution context to detect whether the command line operations are compliant, and has minimal impact on system performance.

[0048] like Figure 2As shown, the Linux host command audit method based on ftrace of this embodiment can be executed on the audit server, and the Linux host command audit method based on ftrace includes:

[0049] In the method of this embodiment, a control message is sent to the user-mode Agent deployed on the Linux host through the control module.

[0050] When the control message contains an instruction to enable command line auditing, the user-state agent sets up plug-ins in the Linux kernel and the bash binary program of the Linux host. As an optional example, when the received control message contains an instruction to enable command line auditing, the user-state agent retrieves and queries the bash binary program of the Linux host, calculates the offset of the readline function in the bash binary program, sets the kernel-state ftrace uprobe plug-in in the Linux kernel according to the calculated offset through the ftrace uprobe configuration interface, and sets the hook plug-in in the bash binary program. In actual applications, the kernel-state ftrace uprobe plug-in is registered with the Linux kernel by sending a registration message to the ftrace uprobe configuration interface. In this embodiment, the readline function is an important component of the Linux bash program, which is used to obtain input from the user and is usually used together with the command line interface to provide richer user input processing functions, such as command line editing, history recording, etc.

[0051] In this embodiment, uprobe is a user space probe that allows dynamic insertion in user space programs, and the insertion locations include: function entry, specific offset, and function return. When the user defines uprobe, the kernel will create a fast breakpoint instruction on the attached instruction. When the program executes the instruction, the kernel will trigger an event, the program will fall into the kernel state, and call the probe function as a callback function. After executing the probe function, it will return to the user state to continue executing the subsequent instructions. In the method of this embodiment, the bash binary program is a command line environment Shell program in Unix and Linux systems that provides a dialogue with the user, which is used to receive commands entered by the user, send the commands to the operating system for execution, and return the results to the user.

[0052] In the present embodiment method, when the user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set plug-in. As an optional example, when the user executes a command in the Linux system, the bash binary program executes the readline function to read the command line content input by the user, and before the readline function returns the execution result, the hook plug-in set in the bash binary program is used to call the kernel state ftrace uprobe plug-in set in the kernel state to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written into the ringbuffer of the Linux kernel, and the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time and command line information. In the Linux system, ringbuffer is an important kernel data structure, which is widely used in kernel log recording and event tracking and other occasions. It is a circular buffer (Circular Buffer), which is mainly used to store logs or temporary data, and has the characteristics of first-in first-out (FIFO). Due to its circular design, when the buffer is full, the new data will overwrite the earliest data, thereby allowing continuous data to be written without causing data overflow or requiring frequent buffer cleaning operations.

[0053] In the method of this embodiment, the user-state Agent continuously receives command line operation logs from the ringbuffer of the Linux kernel, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module for auditing.

[0054] As an optional example, in the method of this embodiment, the user-state Agent continuously receives command line operation logs from the ringbuffer of the Linux kernel, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module, wherein the enriched command line operation logs include: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal, and login IP address. The audit module continuously receives the enriched command line operation logs sent by the user-state Agent, performs malicious rule matching on the received enriched command line operation logs, and when the received enriched command line operation logs match the malicious rules, the enriched command line operation logs are sent to the alarm module. In the method of this embodiment, malicious rule matching includes regular rule matching and Flink model matching.

[0055] When the alarm module receives the data-enriched command line operation log that matches the malicious rule sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template and sends the alarm information to the configured operation and maintenance user.

[0056] When the control message contains an instruction to turn off command line auditing, the user-state agent clears the stubs set in the Linux kernel and the bash binary program of the Linux host. As an optional example, when the control message received by the user-state agent contains an instruction to turn off command line auditing, the kernel-state ftrace uprobe stub set in the Linux kernel and the hook stub set in the bash binary program are cleared by sending a logout message to the ftrace uprobe configuration interface.

[0057] The ftrace-based Linux host command auditing method and system according to the embodiment of the present invention provide a highly efficient, real-time, difficult to bypass and highly customized security monitoring solution for the Linux system through the kernel-level command line auditing technology, which not only improves the security of the system, but also improves the efficiency and effectiveness of risk management. Specifically, it has the following beneficial technical effects:

[0058] 1. Efficient monitoring capabilities: By leveraging the kernel-level ftrace and uprobes mechanisms, it can efficiently monitor and record command line operations on Linux systems. Compared with traditional log file or terminal session capture methods, it achieves monitoring closer to the bottom layer of the system and can capture command line activities with extremely low overhead.

[0059] 2. Real-time and accuracy: By setting probes at the execution point of the readline function in bash, the real-time capture and recording of user input commands is ensured. Compared with the audit system based on log analysis, it can reflect the actual command execution of the system more accurately and timely.

[0060] 3. Higher security and difficult to bypass: Since the probe is set through the kernel's uprobes mechanism rather than relying on any user space tools or services, even users with higher permissions find it difficult to bypass the monitoring of the audit system, enhancing the security of the system, especially in the face of attacks such as advanced persistent threats (APT).

[0061] 4. Enriched log information: In addition to basic command line activity records, richer context information is provided by enriching the collected data, including process name, path, execution user, execution time, parent process PID, login terminal, login IP and complete process tree information. It provides rich data support for subsequent log analysis and behavior analysis, and helps to deeply understand the background and causes of security incidents.

[0062] 5. Customized alarm mechanism: In actual applications, the alarm module can customize alarm rules according to different audit requirements and security strategies, and promptly notify operation and maintenance personnel and security operations personnel of potential security threats through multiple channels (such as SMS, email, social software, etc.), thereby improving response speed and processing efficiency.

[0063] 6. Easy to integrate and expand: Through modular design, the coupling between various components such as control module, agent, audit module and alarm module is low, which is easy to integrate into the existing security architecture, and also convenient for functional expansion and optimization as needed.

[0064] like Figure 3 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned Linux host command auditing method based on ftrace by running the executable computer program.

[0065] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0066] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0067] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0068] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A Linux host command auditing method based on ftrace, characterized in that: The method comprises: Send control messages to the user-mode Agent deployed on the Linux host through the control module; When the control message contains an instruction to enable command line auditing, the user-mode agent sets up stubs in the Linux kernel and the bash binary program of the Linux host; When the user executes a command in the Linux system, the command line operation log is written to the Linux kernel's ringbuffer according to the set stub; The user-state agent continuously receives command line operation logs from the Linux kernel's ringbuffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module for auditing; When the control message contains an instruction to turn off command line auditing, the user-mode agent clears the instrumentation set in the Linux kernel and the bash binary program of the Linux host; When the control message contains an instruction to enable command line auditing, the user-state agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host, including: when the received control message contains an instruction to enable command line auditing, the user-state agent retrieves and queries the bash binary program of the Linux host, calculates the offset of the readline function in the bash binary program, sets a kernel-state ftrace uprobe plug-in in the Linux kernel according to the calculated offset through the ftrace uprobe configuration interface, and sets a hook plug-in in the bash binary program; When a user executes a command in a Linux system, a command line operation log is written into the ringbuffer of the Linux kernel according to a set plug-in, including: when a user executes a command in a Linux system, a bash binary program executes a readline function to read the command line content input by the user, and before the readline function returns the execution result, a hook plug-in set in the bash binary program is used to call a kernel-state ftrace uprobe plug-in set in the kernel state to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written into the ringbuffer of the Linux kernel, wherein the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time and command line information.

2. The ftrace-based Linux host command auditing method according to claim 1, characterized in that: A kernel-state ftrace uprobe stub is set in the Linux kernel according to the calculated offset through the ftrace uprobe configuration interface, including: registering the kernel-state ftraceuprobe stub with the Linux kernel by sending a registration message to the ftrace uprobe configuration interface.

3. The Linux host command auditing method based on ftrace according to claim 1, characterized in that: The user-state agent continuously receives command line operation logs from the Linux kernel's ringbuffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module for auditing, including: The user-state agent continuously receives command line operation logs from the Linux kernel's ringbuffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module; The audit module continuously receives the data-enriched command line operation log sent by the user-state Agent, matches the received data-enriched command line operation log with malicious rules, and sends the data-enriched command line operation log to the alarm module when the received data-enriched command line operation log matches the malicious rules.

4. The ftrace-based Linux host command auditing method according to claim 3, characterized in that: The enriched command line operation logs include: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal, and login IP address.

5. The ftrace-based Linux host command auditing method according to claim 3, characterized in that: Malicious rule matching includes regular rule matching and Flink model matching.

6. The ftrace-based Linux host command auditing method according to claim 1, characterized in that: When the alarm module receives the data-enriched command line operation log that matches the malicious rule sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template and sends the alarm information to the configured operation and maintenance user.

7. The ftrace-based Linux host command auditing method according to claim 1, characterized in that: When the control message contains an instruction to turn off command line auditing, the user-state Agent clears the stubs set in the Linux kernel and the bash binary program of the Linux host, including: when the control message received by the user-state Agent contains an instruction to turn off command line auditing, the kernel-state ftraceuprobe stub set in the Linux kernel and the hook stub set in the bash binary program are cleared by sending a logout message to the ftrace uprobe configuration interface.

8. A Linux host command audit system based on ftrace, characterized in that: The system includes an audit service end, which is used to: send a control message to a user-state agent deployed on a Linux host through a control module; when the control message contains an instruction to turn on command line auditing, the user-state agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host; when a user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set plug-in; the user-state agent continuously receives the command line operation log from the ringbuffer of the Linux kernel, enriches the command line operation log, and sends the command line operation log after data enrichment to the audit module for auditing; when the control message contains an instruction to turn off command line auditing, the user-state agent clears the plug-in set in the Linux kernel and the bash binary program of the Linux host; when the control message contains an instruction to turn on command line auditing, the user-state agent sets a plug-in in the Linux kernel and the bash binary program of the Linux host, including: when the received control message contains an instruction to turn on command line auditing, the user-state agent retrieves and queries the bash binary program of the Linux host, calculates the offset of the readline function in the bash binary program, and uses ftrace to check the offset of the readline function in the bash binary program. The uprobe configuration interface sets a kernel-state ftrace uprobe stub in the Linux kernel according to the calculated offset, and sets a hook stub in the bash binary program; when the user executes a command in the Linux system, the command line operation log is written into the ringbuffer of the Linux kernel according to the set stub, including: when the user executes a command in the Linux system, the bash binary program executes a readline function to read the command line content input by the user, and before the readline function returns the execution result, the hook stub set in the bash binary program is used to call the kernel-state ftrace uprobe stub set in the kernel state to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written into the ringbuffer of the Linux kernel, wherein the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time and command line information.

Images