A method for monitoring file read and write events under eBPF

Abstract

The present invention relates to the technical field of computer applications, and discloses a method for monitoring file read and write events under eBPF, including: initializing an eBPF program, generating kernel state and user state bytecodes, and loading the kernel state bytecodes into the kernel, inserting piles in the file operation function to monitor file operations; initializing a preset buffer for communication between the kernel state and the user state, and storing the file identifier of the file to be monitored in the eBPF mapping table; when the file operation function is called, reading kernel structure information, obtaining the identifier of the operated file, and matching it with the identifier in the mapping table, if the match fails, discarding the event, if the match succeeds, it is determined that the file is within the monitoring range. Thus, the monitoring of file read and write events under eBPF is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a method for monitoring file read and write events under eBPF. Background Art

[0002] eBPF is developed from BPF technology. BPF (Berkeley Packet Filter) is a primitive interface of the data link layer on Unix-like systems, providing the sending and receiving of primitive link layer packets. Starting from version 3.15, the Linux kernel provides an extended BPF virtual machine called "extended BPF", or eBPF for short. It can be used for non-network-related functions, such as attaching to different tracepoints to obtain a lot of information about the current kernel operation. eBPF is now mainly used in the fields of network, event tracing, and kernel optimization. The eBPF program is divided into two parts: Kernel-state bytecode: The eBPF bytecode program in the kernel is responsible for processing specific events in the kernel, and can send the processing results to the user space through maps or perf-buffers. User-state code: The user-state part has two main functions. One is to load the eBPF bytecode program into the kernel, and the other is to read and write information with the kernel-state eBPF program.

[0003] Existing solutions for monitoring file read and write events based on eBPF technology often have the following technical problems, especially in high-concurrency file operation environments:

[0004] First, in the existing solution, the eBPF kernel-mode bytecode needs to collect complete file event information and perform string matching with the preset path rules through the user-mode code. Since the path matching operation requires frequent string comparisons, the system performance overhead is too large;

[0005] Second, in the existing solution, when eBPF transfers data between kernel bytecode and user mode, the data size is limited. When the number of monitored file events is too large, data loss may occur, and all file events that need to be monitored cannot be accurately captured, resulting in a decrease in monitoring efficiency.

[0006] Third, the existing solutions lack effective optimization mechanisms and cannot perform efficient preprocessing and redundancy removal operations when matching file path rules. Under massive data, eBPF may not be able to process all events in real time, and performance issues are particularly prominent. Summary of the invention

[0007] The summary of the invention is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The summary of the invention is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] The present invention proposes a file read and write event monitoring method under eBPF to solve one or more of the technical problems mentioned in the above background technology part.

[0009] The present invention provides a method for monitoring file read and write events under eBPF, comprising: initializing an eBPF program to obtain an eBPF bytecode, wherein the eBPF bytecode includes a kernel state bytecode and a user state bytecode;

[0010] Load the kernel bytecode and insert a stub in the file operation function to monitor whether the file operation function is called;

[0011] Initialize a preset buffer, which is used for communication between kernel-mode bytecode and user-mode bytecode;

[0012] Obtain the file identifier of the file to be monitored, and store the file identifier of the file to be monitored in the eBPF mapping table;

[0013] If the file operation function is monitored to be called, the kernel structure information is read, and the file identifier of the operated file is obtained from the kernel structure information, and is determined as the operated file identifier;

[0014] The operated file identifier is matched with the file identifier in the eBPF mapping table to obtain a matching result. If the matching result indicates a matching failure, it is determined that the operated file is not in the monitoring range and the event is discarded; if the matching result indicates a matching success, it is determined that the operated file is in the monitoring range.

[0015] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0016] If the operated file is within the monitoring range, the process information corresponding to the operated file and the detailed information of the operated file are obtained, and the event information is obtained, and the event information is stored in a preset buffer so that the user state bytecode reads the event information from the preset buffer.

[0017] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0018] Event information is read from a preset buffer, and a file identifier and a process identifier corresponding to the file identifier in the event information are obtained. Through the process identifier, the process identifier corresponding to the operated file is determined to be the target process, and file access behavior detection is performed on the target process to obtain the target process behavior detection result.

[0019] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0020] Parse the target process behavior detection result, determine the process whose target process behavior is abnormal as an abnormal process, and write the process identifier corresponding to the abnormal process and the file identifier of the operated file into the feedback information table;

[0021] When at least one of the following is met, it is determined that the target process behavior detection result indicates that the target process behavior is abnormal:

[0022] The target process has unauthorized file access behavior;

[0023] The file access frequency of the target process exceeds the preset frequency threshold;

[0024] The target process performs file operations during a preset period of time.

[0025] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0026] Perform file content change detection on abnormal processes to obtain file content change detection results;

[0027] If the file content change detection result indicates that the abnormal process has abnormal activity, the process identifier of the abnormal process and the file identifier of the operated file are written into the feedback information table.

[0028] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0029] Send the feedback information table to the corresponding user terminal.

[0030] Optionally, before initializing the eBPF program, include:

[0031] Perform a running environment test on the server system where the eBPF program is to be deployed to obtain the running environment test results and system information of the server system.

[0032] Optionally, initialize the eBPF program, including:

[0033] If the running environment detection result indicates that the running environment meets the preset running environment requirements, the initialization eBPF program is executed;

[0034] If the operating environment detection result indicates that the operating environment does not meet the preset operating environment requirements, the system information is sent to the corresponding user terminal.

[0035] The present invention has the following beneficial effects: by optimizing the application of eBPF technology in file read and write event monitoring, the performance bottleneck and data loss problems existing in the existing solutions are effectively solved. Compared with the traditional path string matching-based method, the present invention stores the file identifier of the file in the eBPF mapping table and directly performs efficient integer comparison, which greatly reduces the performance overhead and reduces the data transmission burden between the kernel state and the user state, thereby avoiding data loss. In addition, by only collecting file operation events that hit the rules, the event volume is further reduced, so that the system can still maintain efficient operation in a high-concurrency environment. Finally, by supplementing the collected events, such as obtaining process information, file paths, etc., it can provide a more accurate basis for intrusion detection, improve monitoring accuracy and security, and enhance the system's adaptability to large-scale business scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0037] Figure 1 It is a flow chart of a method for monitoring file read and write events under eBPF of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0039] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0040] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0041] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0042] The names of the messages or information exchanged between multiple devices of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0043] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0044] like Figure 1 FIG. 1 is a flowchart of a method for monitoring file read and write events under eBPF according to the present invention, which specifically includes the following steps:

[0045] Step 101, initialize the eBPF program and obtain the eBPF bytecode, which includes kernel state bytecode and user state bytecode.

[0046] In some embodiments, the execution subject may be a server on which an eBPF program is deployed. The execution subject loads the eBPF program and uses a compiler to compile the eBPF program into eBPF bytecode. In practice, the compiler may be clang. Among them, a compiler is a tool that translates source code into machine language or bytecode. clang is an open source compiler front end. Bytecode is an intermediate code between source code and machine code, generated by a compiler. The kernel is the core part of the operating system and is responsible for managing the interaction between hardware and software. Kernel-state bytecode refers to the eBPF program code running in kernel space. The kernel space is responsible for the core functions of the operating system, has high permissions, directly operates hardware, and manages system resources. User-state bytecode refers to the eBPF program code running in user space. The user space runs applications with limited permissions and requests the kernel to provide services through system calls.

[0047] Step 102, load the kernel state bytecode, and insert a stub in the file operation function to monitor whether the file operation function is called.

[0048] In some embodiments, first, the kernel-state bytecode compiled from the eBPF program is loaded into the kernel through the system function bpf(). Subsequently, the kernel-state bytecode is mounted to the entry and exit of the file operation function to implement instrumentation and capture the call information of the file operation function in real time. In practice, the file operation functions are open() and openat(). Among them, bpf() is a system call function and one of the core interfaces of eBPF. open() is a system call function used to open a file and return a file descriptor. openat() is an extension of open(), which allows files to be opened as relative paths without specifying a full path. Instrumentation is a technique for monitoring or modifying program behavior by dynamically inserting code into a program.

[0049] Step 103, initialize a preset buffer, where the preset buffer is used for communication between kernel-mode bytecode and user-mode bytecode.

[0050] In some embodiments, the execution subject uses perf-buffer to create a circular buffer for completing data transmission between kernel-mode bytecode and user-mode bytecode. Among them, perf-buffer is an efficient data transmission mechanism provided by the kernel, which is widely used in eBPF programs. It is used to transfer event data between kernel mode and user mode. Based on the principle of a circular buffer, it is used to store and transfer events or information captured by the kernel. A circular buffer is a buffer with a fixed size. Its characteristic is that the tail of the buffer is connected to the head. The data in the circular buffer is stored and read in a "head-to-tail" manner, which makes the use of memory more efficient and avoids data loss or overflow.

[0051] Step 104: Obtain a file identifier of the file to be monitored, and store the file identifier of the file to be monitored in the eBPF mapping table.

[0052] In some embodiments, the execution subject uses the file operation interface to obtain the file identifier of the file to be monitored, and stores the file identifier of the file to be monitored in the eBPF mapping table. In practice, the file operation interface can be stat(), fstat(), or dentry. Among them, the file operation interface is a set of system call functions for interacting with the file system, which are usually used for operations such as opening, reading, writing, and closing files. stat() is a standard C library function for obtaining file status information related to a specified file path. fstat() is a system call function for obtaining metadata information of a file associated with a file descriptor. Dentry is a data structure in the file system that represents the mapping relationship between directories and files, and each dentry is associated with an inode. Inode is a data structure stored in the file system that contains the metadata of the file, and each file or directory corresponds to a unique inode. The eBPF mapping table is one of the key mechanisms for data interaction between the eBPF program and the kernel. It is used to store and transfer data and allows information to be shared between kernel space and user space.

[0053] Step 105: If it is monitored that the file operation function is called, read the kernel structure information, obtain the file identifier of the operated file from the kernel structure information, and determine it as the operated file identifier.

[0054] In some embodiments, when the instrumented file operation function is called, the kernel creates a kernel structure to save the file information, and then the eBPF bytecode reads the kernel structure information to obtain the identifier of the operated file. In practice, system functions such as bpf_probe_read() can be used to read kernel structure information. Among them, the kernel structure refers to a structure defined in the operating system kernel for representing and storing various system resources or states. bpf_probe_read() is a function in the eBPF program that is used to read data from kernel space and pass it to user space.

[0055] Step 106, the operated file identifier is matched with the file identifier in the eBPF mapping table to obtain a matching result. If the matching result indicates a matching failure, it is determined that the operated file is not in the monitoring range and the event is discarded; if the matching result indicates a matching success, it is determined that the operated file is in the monitoring range.

[0056] In some embodiments, the operated file identifier is first compared with the file identifier pre-stored in the eBPF mapping table. If the operated file identifier does not exist in the eBPF mapping table, it indicates that the operated file is not in the monitoring range; if there is a file identifier that is the same as the operated file identifier in the eBPF mapping table, it indicates that the operated file is in the monitoring range.

[0057] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0058] If the operated file is within the monitoring range, the process information corresponding to the operated file and the detailed information of the operated file are obtained, and the event information is obtained, and the event information is stored in a preset buffer so that the user state bytecode reads the event information from the preset buffer.

[0059] In some embodiments, if the operated file is within the monitoring range, the process information and detailed information corresponding to the operated file are obtained using the system function, determined as event information, and stored in a preset buffer for user-mode bytecode to read the event information. In practice, the metadata of the operated file can be obtained through fstat(), the path corresponding to the operated file can be found using the file identifier, the process information structure corresponding to the operated file can be obtained using current, and the process identifier, process name and other information can be obtained from the process information structure. Among them, metadata is data that describes data. In the file system, metadata refers to information about the file that is not related to the file content, such as file name, file type, file permissions, file identifier and other information. Current is a very important macro in the Linux kernel, which refers to the task_struct structure of the currently executing process. Macros are a mechanism for code simplification and automation that allows developers to define a section of code and represent it with a short identifier. Task_struct is a structure used in the kernel to describe a process, which contains all the key information of the process. The process identifier is a number used by the operating system to uniquely identify a running process. A process is an instance of a program being executed in an operating system and is the basic unit for resource management and task scheduling by the operating system. The Linux kernel is the core part of the Linux operating system and is widely used in servers, embedded devices, personal computers, etc. Linux is an open source operating system kernel that has been widely used in servers, embedded systems, desktop applications, and mobile devices.

[0060] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0061] Event information is read from a preset buffer, and a file identifier and a process identifier corresponding to the file identifier in the event information are obtained. Through the process identifier, the process identifier corresponding to the operated file is determined to be the target process, and file access behavior detection is performed on the target process to obtain the target process behavior detection result.

[0062] In some embodiments, the user-mode bytecode communicates with the kernel-mode bytecode through a preset buffer to obtain event information, read the file identifier and the corresponding process identifier of the operated file from the event information, and determine that the process corresponding to the operated file is the target process through the process identifier of the operated file, and obtain the target process behavior detection result by performing file access behavior detection on the target process. In practice, first, the file identifier and the corresponding process identifier of the operated file are read from the event information, then the configuration rules of auditd are updated using the file identifier and the corresponding process identifier of the operated file, and the operated file and the corresponding process are monitored in detail, and finally, the monitoring information results of auditd are consulted using the ausearch command, and the monitoring information results are generated as the target process behavior detection results using aureport. Among them, file access behavior refers to all operations performed by the target process on the file, and common file access operations include: read, write, delete, rename and execute. The types of file access behavior detection include: unauthorized access, abnormal access to sensitive files, malicious deletion, and abnormal operation frequency. Among them, sensitive files include: / etc / passwd (storing user information), / etc / shadow (storing encrypted passwords), log files, and database files. auditd is a Linux system audit daemon used to record and monitor system events. It collects and manages audit logs, which record various system activities such as system calls, file access, user logins, etc. By configuring audit rules, auditd can monitor specific files, directories, system calls, etc. to meet security and compliance requirements. ausearch is a command line tool provided by auditd for searching and filtering audit logs. With ausearch, users can query audit logs based on specific conditions (such as time range, event type, keywords, etc.) to obtain detailed event information. aureport is a command line tool provided by auditd for generating various audit reports. It can generate detailed statistical reports based on audit log data, including user login reports, file access reports, system call reports, etc.

[0063] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0064] Parse the target process behavior detection result, determine the process whose target process behavior is abnormal as an abnormal process, and write the process identifier corresponding to the abnormal process and the file identifier of the operated file into the feedback information table;

[0065] When at least one of the following is met, it is determined that the target process behavior detection result indicates that the target process behavior is abnormal:

[0066] The target process has unauthorized file access behavior;

[0067] The file access frequency of the target process exceeds the preset frequency threshold;

[0068] The target process performs file operations during a preset period of time.

[0069] In some embodiments, the execution subject reads the target process behavior detection result and analyzes the result type. If the target process behavior detection result satisfies at least one of the following: the target process has unauthorized file access behavior; the file access frequency of the target process exceeds the preset frequency threshold; the target process performs file operations in a preset period of time, the target process is determined as an abnormal process, and the process identifier corresponding to the abnormal process and the file identifier of the operated file are written into the feedback information table. In practice, the unauthorized file access behavior can be that the target process attempts to access files that the target process does not have permission to access, or access sensitive files, such as important configuration files and system files. The preset frequency threshold is the number of accesses to the same file within a preset period of time, for example, the number of accesses to the same file exceeds 10 times per minute. The preset period is a period of non-working days. The feedback information table includes: process identifier, file identifier, file content change type, change time, and operation process information. Among them, the process identifier is the unique identifier of the abnormal process; the file identifier is the identifier of the operated file; the file content change type is file modification, deletion or renaming; the change time records the time when the content of the operated file changes; the operation process information includes the execution path of the abnormal process and the abnormal process user and other information.

[0070] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0071] Perform file content change detection on abnormal processes to obtain file content change detection results;

[0072] If the file content change detection result indicates that the abnormal process has abnormal activity, the process identifier of the abnormal process and the file identifier of the operated file are written into the feedback information table.

[0073] In some embodiments, the execution subject can also perform file content change detection on the abnormal process, obtain the file content change detection result, and write the process identifier of the abnormal process with abnormal activity and the file identifier of the operated file into the feedback information table. In practice, the hash value of the file content can be compared regularly, and if the hash value changes, it is determined that the file content has changed. For example, the hash value of the file is recalculated every thirty minutes and compared with the original hash value to determine whether the file content has changed. If the file content changes and at least one of the following is met: the target process has unauthorized file access behavior; the file access frequency of the target process exceeds the preset frequency threshold; the target process performs file operations during a preset period of time, then the process identifier of the abnormal process and the file identifier of the operated file are written into the feedback information table. Among them, the hash value is a fixed-length string generated by processing a piece of data through a hash algorithm. The hash algorithm is a mathematical algorithm that maps input data of any length to output data of a fixed length.

[0074] Optionally, a method for monitoring file read and write events under eBPF of the present invention further includes:

[0075] Send the feedback information table to the corresponding user terminal.

[0076] In some embodiments, after collecting the feedback information table, the execution subject sends it to the user terminal according to a preset notification method. In practice, the preset notification method can be to use the SMTP (Simple Mail Transfer Protocol) protocol to send an email through the JavaScript library nodemailer. Among them, nodemailer is a widely used JavaScript library that supports multiple email transmission protocols; the SMTP protocol is an Internet standard protocol for transmitting emails, which defines the way emails are transmitted between email servers so that emails can be correctly delivered in the network.

[0077] Optionally, before initializing the eBPF program, include:

[0078] Perform a running environment test on the server system where the eBPF program is to be deployed to obtain the running environment test results and system information of the server system.

[0079] In some embodiments, before deploying the eBPF program, the server system is tested for the operating environment to obtain the operating environment test results and the system information of the server system. In practice, hostnamectl and uname can be used to obtain the system version and kernel version of the server system. The system information includes the system version and the kernel version. The preset operating environment that the eBPF program needs to meet is: centOS version is not less than 7.6 and the corresponding kernel is 3.10.0-957.el7.x86_64, ubuntu version is not less than 18.04 and the corresponding kernel is 4.15.0-213. If the server's operating environment detection result meets one of the following conditions: the system is centOS, the version is lower than 7.6 or the corresponding kernel version is not 3.10.0-957.el7.x86_64, the system is ubuntu, the version is lower than 18.04 or the corresponding kernel version is not 4.15.0-213, then the operating environment detection result indicates that it does not meet the preset operating environment requirements; if the server's operating environment detection result meets one of the following conditions: the system is centOS, the version is not lower than 7.6 and the corresponding kernel version is 3.10.0-957.el7.x86_64, the system is ubuntu, the version is not lower than 18.04 and the corresponding kernel version is 4.15.0-213, then the operating environment detection result indicates that it meets the preset operating environment requirements. Among them, hostnamectl is a command used to obtain and set the host name and other information related to the system host. uname is a command used to display system information, often used to obtain basic information about the operating system and kernel. centOS is a Linux distribution that is mainly aimed at enterprise environments and is used for development, testing, and production systems. Ubuntu is a Linux distribution that is widely used on desktops, servers, and cloud computing environments.

[0080] Optionally, initialize the eBPF program, including:

[0081] If the running environment detection result indicates that the running environment meets the preset running environment requirements, the initialization eBPF program is executed;

[0082] If the operating environment detection result indicates that the operating environment does not meet the preset operating environment requirements, the system information is sent to the corresponding user terminal.

[0083] In some embodiments, if the operating environment of the server meets the preset operating environment requirements, the eBPF program is initialized. If the operating environment of the server does not meet the preset operating environment requirements, the system information is collected and sent to the user terminal. In practice, the preset operating environment requirements are: centOS version is not less than 7.6 and the corresponding kernel is 3.10.0-957.el7.x86_64, ubuntu version is not less than 18.04 and the corresponding kernel is 4.15.0-213. If the operating environment of the server does not meet the preset operating environment requirements, hostnamectl and uname are used to obtain the system version and kernel version of the server system, and SMTP (Simple Mail Transfer Protocol) protocol is used to send emails to the user terminal through the JavaScript library nodemailer.

[0084] In these embodiments, by optimizing the application of eBPF technology in file read and write event monitoring, the performance bottleneck and data loss problems existing in the existing solutions are effectively solved. Compared with the traditional path string matching-based method, the solution greatly reduces the performance overhead by storing the file identifier of the file in the eBPF mapping table and directly performing efficient integer comparison, and reduces the data transmission burden between the kernel state and the user state, thereby avoiding data loss. In addition, by only collecting file operation events that hit the rules, the amount of events is further reduced, so that the system can still maintain efficient operation in a high-concurrency environment. Finally, by supplementing the collected events, such as obtaining process information, file paths, etc., it can provide a more accurate basis for intrusion detection, improve monitoring accuracy and security, and enhance the system's adaptability to large-scale business scenarios.

[0085] The above descriptions are only some preferred embodiments of the present invention and the explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solutions formed by the specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A method for monitoring file read and write events under eBPF, characterized in that: include: Initialize the eBPF program to obtain the eBPF bytecode, wherein the eBPF bytecode includes a kernel state bytecode and a user state bytecode; Loading the kernel state bytecode and inserting a stub in the file operation function to monitor whether the file operation function is called; Initialize a preset buffer, the preset buffer being used for the kernel state bytecode to communicate with the user state bytecode; Obtain a file identifier of a file to be monitored, and store the file identifier of the file to be monitored in an eBPF mapping table; If it is monitored that the file operation function is called, read the kernel structure information, and obtain the file identifier of the operated file from the kernel structure information, and determine it as the operated file identifier; Match the operated file identifier with the file identifier in the eBPF mapping table to obtain a matching result. If the matching result indicates a matching failure, it is determined that the operated file is not within the monitoring range and the event is discarded. If the matching result indicates that the match is successful, it is determined that the operated file is within the monitoring range; If the operated file is within the monitoring range, obtain the process information corresponding to the operated file and the detailed information of the operated file, obtain event information, and store the event information into the preset buffer so that the user state bytecode reads the event information from the preset buffer; Reading the event information from the preset buffer, obtaining a file identifier in the event information and a process identifier corresponding to the file identifier, determining that the process identifier corresponding to the operated file is a target process through the process identifier, performing file access behavior detection on the target process, and obtaining a target process behavior detection result; Parsing the target process behavior detection result, determining the process whose target process behavior is abnormal as indicated by the target process behavior detection result as an abnormal process, and writing the process identifier corresponding to the abnormal process and the file identifier of the operated file into a feedback information table; When at least one of the following is met, it is determined that the target process behavior detection result indicates that the target process behavior is abnormal: The target process has unauthorized file access behavior; The file access frequency of the target process exceeds a preset frequency threshold; The target process performs file operations in a preset time period; Performing file content change detection on the abnormal process to obtain a file content change detection result; If the file content change detection result indicates that the abnormal process has abnormal activity, writing the process identifier of the abnormal process and the file identifier of the operated file into the feedback information table; Before initializing the eBPF program, performing an operating environment detection on the server system on which the eBPF program is to be deployed to obtain an operating environment detection result and system information of the server system; If the operating environment detection result indicates that the operating environment meets the preset operating environment requirements, execute the initialization eBPF program; If the operating environment detection result indicates that the operating environment does not meet the preset operating environment requirement, the system information is sent to the corresponding user terminal.

2. The method for monitoring file read and write events under eBPF according to claim 1, characterized in that: Also includes: The feedback information table is sent to the corresponding user terminal.

Images