File operation behavior detection method and device and related product

Abstract

The invention discloses a file operation behavior detection method and device and a related product. Determining a to-be-detected behavior type of the target file according to file identification information in the operation behavior detection element information; calling a kernel function in a file operation behavior detection system, and collecting operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected; and outputting the operation behavior information of the target file and the process information associated with the operation behavior. Visibly, in the application, by calling the kernel function used for executing the information acquisition function in the file operation behavior detection system, dual acquisition of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be realized; meanwhile, compared with a fanotify system in the related technology, the file operation behavior detection system provided by the invention has the advantages that the detection capability is lower than that of a bottom layer, and the anti-bypassing capability is higher, so that the file operation behavior detection performance is also improved.

Description

Technical Field

[0001] The present application relates to the field of file detection technology, and in particular to a file operation behavior detection method, device and related products. Background Art

[0002] The fanotify system is a process file status detection system that comes with the Linux kernel, which can associate the file status with the process that changes the file status. Currently in the field of file detection technology, people usually use the fanotify system to detect the operation behavior of files. Specifically, when using the fanotify system to detect the operation behavior of files, since the fanotify system can associate the file status with the process that changes the file status, the fanotify system can detect both the file status and the process that changes the file status. However, the fanotify system is poor in detection reliability and can be easily bypassed by attackers. That is, when an attacker modifies the file status, the fanotify system detection is not triggered, resulting in the fanotify system failing to detect the change in the file status and the process that changes the file status.

[0003] Therefore, how to improve the file operation behavior detection performance has become a technical problem that needs to be solved urgently in the current field. Summary of the invention

[0004] The embodiments of the present application provide a file operation behavior detection method, device and related products, aiming to improve the file operation behavior detection performance.

[0005] The first aspect of the present application provides a file operation behavior detection method, comprising:

[0006] Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected;

[0007] When it is detected that the target file has an operation behavior of the behavior type to be detected, calling a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected;

[0008] Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0009] A second aspect of the present application provides a file operation behavior detection device, comprising:

[0010] a target file determination unit, configured to determine a target file according to file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify a file having a file operation behavior to be detected;

[0011] A behavior information collection unit is used to call a kernel function in the file operation behavior detection system for executing an information collection function when it is detected that the target file has an operation behavior of the behavior type to be detected, so as to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected;

[0012] The process information output unit is used to output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0013] A third aspect of the present application provides a file operation behavior detection device, the device comprising a processor and a memory:

[0014] The memory is used to store a computer program and transmit the computer program to the processor;

[0015] The processor is used to execute the steps of the file operation behavior detection method provided in the first aspect according to the instructions in the computer program.

[0016] A fourth aspect of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a file operation behavior detection device, the steps of the file operation behavior detection method provided in the first aspect are implemented.

[0017] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a file operation behavior detection device, implements the steps of the file operation behavior detection method provided in the first aspect.

[0018] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0019] In the technical solution of the present application, firstly, the target file is determined according to the file identification information in the operation behavior detection element information, and the operation behavior detection type associated with the file identification information in the operation behavior detection element information is determined as the behavior type to be detected of the target file; then the target file is detected, and when it is detected that the target file has an operation behavior of the behavior type to be detected, the kernel function used to perform the information collection function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected; because the kernel function in the file operation behavior detection system has the performance of simultaneously collecting the operation behavior information and the process information associated with the operation behavior of the behavior type to be detected, finally the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected are output. It can be seen that in the technical solution of the present application, by calling the kernel function used to perform the information collection function in the file operation behavior detection system, the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be realized. At the same time, the file operation behavior detection system proposed in the present application has a lower detection capability and a stronger anti-bypass capability than the fanotify system in the related art, so as to improve the file operation behavior detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A scenario architecture diagram of a file operation behavior detection method provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a scenario of a file operation behavior detection method provided in an embodiment of the present application;

[0022] Figure 3 A flowchart of a file operation behavior detection method provided in an embodiment of the present application;

[0023] Figure 4 A scenario flow chart of a file operation behavior detection method provided in an embodiment of the present application;

[0024] Figure 5 A scenario flow chart of another file operation behavior detection method provided in an embodiment of the present application;

[0025] Figure 6a A flowchart of another file operation behavior detection method provided in an embodiment of the present application;

[0026] Figure 6b A flowchart of another file operation behavior detection method provided in an embodiment of the present application;

[0027] Figure 7 A flowchart of another file operation behavior detection method provided in an embodiment of the present application;

[0028] Figure 8 A scenario flow chart of another file operation behavior detection method provided in an embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the structure of a file operation behavior detection device provided in an embodiment of the present application;

[0030] Fig.10 A schematic diagram of the structure of another file operation behavior detection device provided in an embodiment of the present application;

[0031] Fig.11 A schematic diagram of the structure of another file operation behavior detection device provided in an embodiment of the present application;

[0032] Fig.12 A schematic diagram of the structure of the server in the embodiment of the present application;

[0033] Fig.13 A schematic diagram of the structure of a terminal device in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The embodiments of the present application are described below in conjunction with the accompanying drawings.

[0035] First, several terms that may be involved in the embodiments of the present application are explained below.

[0036] Ubuntu: Ubuntu is a Linux operating system based on desktop applications.

[0037] centOS (Community Enterprise Operating System): Community Enterprise Operating System is one of the Linux distributions. It is a free, open source, and redistributable open source operating system.

[0038] Hook: Hooking is a powerful programming technique that can obtain software behavior or extend functionality without changing the original code.

[0039] Endpoint Detection and Response (EDR): In network security, it is a proactive endpoint security solution that includes real-time detection and the use of automated threat response mechanisms to collect endpoint security data; by recording endpoint and network events, this information is stored locally on the endpoint or centralized in a database.

[0040] The fanotify system is a process file status detection system that comes with the Linux kernel, which can associate the file status with the process that changes the file status. Currently in the field of file detection technology, people usually use the fanotify system to detect the operation behavior of files. Specifically, when using the fanotify system to detect the operation behavior of files, since the fanotify system can associate the file status with the process that changes the file status, the fanotify system can detect both the file status and the process that changes the file status. However, the fanotify system is poor in detection reliability and can be easily bypassed by attackers. That is, when an attacker modifies the file status, the fanotify system detection is not triggered, resulting in the fanotify system failing to detect the change in the file status and the process that changes the file status.

[0041] It is understandable that an attacker can use certain specific operations, such as bypassing the entrance of the fanotify system, so that the attacker does not trigger the fanotify system detection while modifying the file status. In other words, under the action of the attacker, the initiator of modifying the file status cannot be traced back. Therefore, how to improve the performance of file operation behavior detection has become a technical problem that needs to be solved urgently in the current field.

[0042] In view of the above problems, a file operation behavior detection method, device and related products are provided in the present application, aiming to improve the file operation behavior detection performance. In the technical solution provided in the present application, the target file is first determined according to the file identification information in the operation behavior detection element information, and the operation behavior detection type associated with the file identification information in the operation behavior detection element information is determined as the behavior type to be detected of the target file; then the target file is detected, and when it is detected that the target file has an operation behavior of the behavior type to be detected, the kernel function used to perform the information collection function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected; because the kernel function in the file operation behavior detection system has the performance of collecting the operation behavior information and the process information associated with the operation behavior of the behavior type to be detected at the same time, finally the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected are output. It can be seen that in the technical solution of the present application, by calling the kernel function used to execute the information collection function in the file operation behavior detection system, the dual collection of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be achieved. At the same time, compared with the fanotify system in the related technology, the file operation behavior detection system proposed in the present application has a lower-level detection capability and a stronger anti-bypass capability. In this way, the detection performance of the file operation behavior is also improved.

[0043] The execution subject of the file operation behavior detection method provided in the embodiment of the present application can be a terminal device. For example, the target file is determined on the terminal device according to the file identification information in the operation behavior detection element information, and the operation behavior detection type associated with the file identification information in the operation behavior detection element information is determined as the behavior type to be detected of the target file. As an example, the terminal device can specifically include but is not limited to mobile phones, desktop computers, tablet computers, notebook computers, handheld computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The execution subject of the file operation behavior detection method provided in the embodiment of the present application can also be a server, that is, the target file can be determined on the server according to the file identification information in the operation behavior detection element information, and the operation behavior detection type associated with the file identification information in the operation behavior detection element information is determined as the behavior type to be detected of the target file. The file operation behavior detection method provided in the embodiment of the present application can also be executed collaboratively by the terminal device and the server. Therefore, in the embodiment of the present application, the implementation subject of the technical solution of the present application is not limited.

[0044] Figure 1 The following is an exemplary scenario architecture diagram of a file operation behavior detection method, which includes a server and various terminal devices. Figure 1 The server shown can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. In addition, the server can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0045] Figure 2 A schematic diagram of a scenario of a file operation behavior detection method provided in an embodiment of the present application. Figure 2As shown, in the technical solution of the present application, a new file operation behavior detection system is proposed. In the file operation behavior detection system, by calling the kernel function for executing the information collection function in the file operation behavior detection system, the operation behavior information and the process information associated with the operation behavior of the behavior type to be detected are jointly detected to improve the detection performance of the file operation behavior. Specifically, the file operation behavior detection system first receives the operation behavior detection element information to determine the target file according to the file identification information in the operation behavior detection element, and determines the operation behavior detection type associated with the file identification information as the type to be detected of the target file; then the target file is detected, and when it is detected that the target file has an operation behavior of the behavior type to be detected, the kernel function for executing the information collection function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected; finally, the operation behavior information and the process information associated with the operation behavior of the behavior type to be detected are output. In this way, the dual collection of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected is realized, and the file operation behavior detection performance is improved.

[0046] The file operation behavior detection system can be an inotify system after the kernel function is adjusted, or a detection system with the same performance as the inotify system, which is not specifically limited here, and the corresponding system can be selected according to the actual application. The file operation behavior detection system can be deployed on an Android platform, an Ubuntu platform, or a centos platform, which is not specifically limited here, and the platform to be deployed can be determined in the specific implementation.

[0047] Figure 3 A flowchart of a file operation behavior detection method provided in an embodiment of the present application. Figure 3 The file operation behavior detection method shown includes:

[0048] S301: Determine a target file according to file identification information in operation behavior detection element information, and determine an operation behavior detection type associated with the file identification information in the operation behavior detection element information as a behavior type to be detected for the target file.

[0049] Because in the related art, the existing file operation behavior detection method cannot well realize the dual collection of the target operation behavior information and the process information associated with the operation behavior of the behavior type to be detected, resulting in the problem of low detection performance of the file operation behavior. In view of this, in the technical solution of the present application, the operation behavior detection element information is first preset, and the operation behavior detection element information includes file identification information and the operation behavior detection type associated with the file identification information. The file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected, so that the target file can be determined according to the file identification information, and the behavior type to be detected of the target file has been determined according to the operation behavior detection type associated with the file identification information. Among them, the file identification information can include the file name to determine the target file according to the file name; the file identification information can also include password information to detect whether the password information has been changed according to the operation behavior detection type associated with the password information.

[0050] In an achievable implementation, the terminal threat detection and response device is used to set the operation behavior detection element information. After the operation behavior detection element information is set on the terminal threat detection and response device, the file operation behavior detection system receives the operation behavior detection element information.

[0051] It should be noted that the operation behavior detection type associated with the file identification information includes one or more of the following types: file modification, file deletion or file access. It is understandable that since the fanotify system in the related art does not have the function of detecting file deletion behavior, in view of this, in the technical solution of the present application, it is proposed to enable a new file operation behavior detection system to have the function of detecting file deletion behavior. In this way, compared with the related art, the file operation behavior detection system proposed in the present application can not only detect file deletion behavior, but also has a strong attack reversal capability, thereby improving the file operation behavior detection performance.

[0052] In another feasible implementation, after determining the target file based on the file identification information in the operation behavior detection element information, the operation behavior detection element information is used as the input of the file marking module in the file operation behavior detection system, so as to add an inspection tag to the target file through the file marking module in the file operation behavior detection system.

[0053] Specific, combined Figure 4 This article introduces the specific process of using the operation behavior detection element information as the input of the file operation behavior detection system. Figure 4 A scenario flow chart of a file operation behavior detection method provided in an embodiment of the present application. Figure 4As shown, first, the terminal threat detection and response device is started by the relevant personnel on the terminal, and the operation behavior detection element information is set on the terminal threat detection and response device. When the file operation behavior detection system receives the operation behavior detection element information set on the terminal threat detection and response device, the file operation behavior detection system is started; then the target file is determined according to the file identification information in the operation behavior detection element information, and the operation behavior detection element information is used as the input of the file marking module of the file operation behavior detection system. At this stage, the file marking module of the file operation behavior detection system adds an inspection tag to the target file. At the same time, the kernel function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected. In this way, the file marking module in the new file operation behavior detection system proposed in this application is used to add an inspection tag to the target file, which is more conducive to the detection of file operation behavior, and further has an anti-bypass capability that is superior to the fanotify system.

[0054] S302: When it is detected that the target file has performed an operation behavior of the behavior type to be detected, a kernel function in the file operation behavior detection system for executing an information collection function is called to collect the operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected.

[0055] In this step, the target file is detected in real time. If it is found that the target file has an operation behavior of the behavior type to be detected, the kernel function used to perform the information collection function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected. Further, when the file is detected, it can be detected whether a file status change event occurs on the target file. If a file status change event occurs on the target file, then it is determined whether the information in the event attribute field of the file status change event matches the behavior type to be detected. If the information in the event attribute field of the file status change event matches the behavior type to be detected, it is determined that the target file has an operation behavior of the behavior type to be detected. In an achievable implementation, a file behavior filtering module can also be preset in the file operation behavior detection system to detect whether a file status change event occurs on the target file according to the file behavior filtering module.

[0056] In another achievable implementation, next, in combination Figure 5 This section introduces the specific process of determining whether the target file has undergone the operation behavior of the type of behavior to be detected. Figure 5 A scenario flow chart of another file operation behavior detection method provided in an embodiment of the present application. Figure 5As shown, after adding a check tag to the target file through the file marking module of the file operation behavior detection system, the target file is continuously detected according to the check tag until the file status of the target file changes. Specifically, after the relevant personnel log in to the terminal, they modify the file status of the target file. At this stage, the file behavior filtering module of the file operation behavior detection system detects whether a file status change event occurs on the target file according to the check tag. If a file status change event is detected on the target file, the file behavior filtering module identifies the file behavior type of the target file according to the file status change event. Then, it is determined whether the file behavior type of the target file identified by the file behavior filtering module is consistent with the behavior type to be detected of the target file. When the file behavior filtering module identifies that the file behavior type of the target file is consistent with the behavior type to be detected of the target file, it is determined that the target file has an operation behavior of the behavior type to be detected. Finally, the kernel function in the file operation behavior detection system is called, and the operation behavior information and process information of the target file are collected at the same time. In this way, through the file marking module and the file behavior filtering module in the new file operation behavior detection system proposed in this application, the target file is subjected to file detection and file type judgment, which can have an anti-bypass capability superior to the fanotify system.

[0057] The following is explained with reference to a specific example. In this example, there are personnel A and B. Personnel A logs in to the terminal threat detection and response device, and presets the operation behavior detection element information on the terminal threat detection and response device. Then, the file operation behavior detection system determines the target file and the type of behavior to be detected for the target file based on the file identification information in the operation behavior detection element information, and then uses the operation behavior detection element information as the input of the file marking module to add a check tag to the target file. In this way, when personnel B deletes the target file, the file behavior filtering module will detect whether a file status change event occurs on the target file based on the check tag. If the target file is found to be deleted, the operation behavior information of the target file being deleted and the process information that the person who deleted the target file is personnel B will be reported.

[0058] S303: Outputting the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0059] In step S301, it is introduced that in the technical solution of the present application, the terminal threat detection and response device can be used to set the operation behavior detection element information. Therefore, when it is detected that the target file has an operation behavior of the behavior type to be detected, and it is necessary to output the collected operation behavior information and the process information associated with the operation behavior of the behavior type to be detected, the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be sent to the terminal threat detection and response device through the information channel between the terminal threat detection and response device.

[0060] In this application, there are two methods for calling the kernel function used to perform information collection functions in the file operation behavior detection system. The first calling method is introduced below. Figure 6a Flow chart of another file operation behavior detection method provided in an embodiment of the present application. Figure 6a The file operation behavior detection method shown includes:

[0061] Sa601: Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected for the target file.

[0062] Sa602: Obtain the function name of the first kernel function used to execute the information collection function in the information collection execution code of the file operation behavior detection system.

[0063] Before calling the kernel function used to execute the information collection function in the file operation behavior detection system and collecting the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected, the function name of the first kernel function used to execute the information collection function in the information collection execution code of the file operation behavior detection system will be obtained.

[0064] Sa603: According to the function name of the first kernel function, determine whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior.

[0065] In this step, after obtaining the function name of the first kernel function, it is determined whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior according to the function name. In order to jump to the second kernel function according to the jump instruction in the subsequent process, the operation behavior information and process information of the target file can be directly collected, or after the process information of the target file is collected according to the second kernel function, the first kernel function is continued to be called to collect the operation behavior information of the target file.

[0066] Sa604: If it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, the address of the first kernel function in the information collection execution code is located, and a jump instruction is generated at the address of the first kernel function.

[0067] In this step, the jump instruction is used to instruct the execution flow of the information collection execution code to jump to the address of the second kernel function, and the second kernel function is a function that has the function of collecting process information associated with the operation behavior. After the judgment of step Sa603, it is judged that the first kernel function has the function of collecting operation behavior information, but does not have the function of collecting process information associated with the operation behavior. At this time, the address of the first kernel function in the information collection execution code is located, and a jump instruction is generated at the address of the first kernel function. Correspondingly, if it is judged that the first kernel function does not have the function of collecting operation behavior information, and does not have the function of collecting process information associated with the operation behavior, at this stage, the address of the first kernel function in the information collection execution code is also located, and a jump instruction is generated at the address of the first kernel function, so that in the subsequent process, according to the jump instruction, it can jump to the second kernel function to directly collect the operation behavior information and process information of the target file.

[0068] Sa605: When it is detected that the target file has performed an operation behavior of the behavior type to be detected, the second kernel function in the file operation behavior detection system for performing the information collection function is called to collect process information associated with the operation behavior of the behavior type to be detected, and the first kernel function is called to collect the operation behavior information of the target file.

[0069] In an achievable implementation, the jump instruction is also used to instruct the execution flow of the information collection execution code to return to the address of the first kernel function after ending the call to the second kernel function, so as to continue to call the first kernel function. It can be understood that after the process information of the target file is collected according to the second kernel function, the first kernel function is continued to be called to collect the operation behavior information of the target file. Specifically, calling the kernel function used to perform the information collection function in the file operation behavior detection system to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be expressed as steps Sa1-Sa2 (steps Sa1-Sa2 are not shown in the accompanying drawings):

[0070] Sa1: When the execution process of the information collection execution code reaches the address of the first kernel function, it jumps to the address of the second kernel function according to the jump instruction, and calls the second kernel function to collect process information associated with the operation behavior of the behavior type to be detected.

[0071] It can be understood that when the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, a jump instruction is used to jump from the first kernel function to the second kernel function to call the second kernel function to collect process information associated with the operation behavior of the behavior type to be detected.

[0072] Sa2: When the second kernel function call ends, return to the address of the first kernel function and call the first kernel function to collect the operation behavior information of the target file.

[0073] It can be understood that after calling the second kernel function to collect process information associated with the operation behavior of the behavior type to be detected, the second kernel function may no longer be called to collect the operation behavior information of the target file. At this stage, it is possible to return to the address of the first kernel function and call the first kernel function to collect the operation behavior information of the target file.

[0074] Sa606: Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0075] Among them, steps Sa601 and Sa606 correspond to the aforementioned steps S301 and S303, which have been described in the aforementioned steps. For specific descriptions, please refer to the aforementioned steps S301 and S303. It should be noted that steps Sa602-Sa604 can be executed before step Sa605 or after step Sa605, and can also be set according to actual applications. Figure 6a , set it to be executed before step Sa605.

[0076] Figure 6b Flow chart of another file operation behavior detection method provided in the embodiment of the present application. Figure 6b The file operation behavior detection method shown includes:

[0077] Sb601: Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected for the target file.

[0078] Sb602: Obtain the function name of the first kernel function in the information collection execution code of the file operation behavior detection system for executing the information collection function.

[0079] Sb603: According to the function name of the first kernel function, determine whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior.

[0080] Sb604: If it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, the address of the first kernel function in the information collection execution code is located, and a jump instruction is generated at the address of the first kernel function.

[0081] Sb605: When it is detected that the target file has performed an operation behavior of the behavior type to be detected, the second kernel function for performing the information collection function in the file operation behavior detection system is called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0082] In another achievable implementation, the second kernel function also has the function of collecting operation behavior information, and the jump instruction is also used to instruct the execution flow of the information collection execution code to skip the address of the first kernel function after calling the second kernel function, and no longer continue to call the first kernel function. It can be understood that after jumping to the second kernel function according to the jump instruction, the second kernel function is directly called to collect the operation behavior information and process information of the target file. Specifically, calling the kernel function for executing the information collection function in the file operation behavior detection system to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be expressed as steps Sb1-Sb2 (steps Sb1-Sb2 are not shown in the accompanying drawings):

[0083] Sb1: When the execution process of the information collection execution code reaches the address of the first kernel function, it jumps to the address of the second kernel function according to the jump instruction, and calls the second kernel function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0084] It can be understood that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior. After using the jump instruction to jump from the first kernel function to the second kernel function, the second kernel function can be directly called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0085] Sb2: When the second kernel function call ends, skip the address of the first kernel function.

[0086] Next, the second modification method is introduced: by using the kernel debugging technology of the Linux system, the entry address of the kernel function in the information collection module of the file operation behavior detection system that is responsible for handling information collection matters after the operation behavior detection mechanism is triggered is changed to the address of a kernel function that has operation behavior information collection functions and process information collection functions, wherein the triggering of the operation behavior detection mechanism is associated with the operation behavior detection element information.

[0087] In an achievable implementation, kernel debugging technology may be used to jump to the kernel function, and the kernel debugging technology may include kprobe or ftrace. Using the kernel debugging technology kprobe or ftrace, the kernel function may be jumped to according to the jump instruction, so as to call the second kernel function to collect operation behavior information or collect operation behavior information and process information. Among them, kprobe and ftrace are two hook frameworks provided by the kernel, both of which have hook capabilities.

[0088] Furthermore, calling the kernel function in the file operation behavior detection system for executing the information collection function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be further reflected as follows: after jumping to the second kernel function through a jump instruction, when the kernel's execution program reaches the inotify_handle_event kernel function, since it has jumped from the entry address of the first kernel function inotify_handle_event to the address of the second kernel function, at this stage, the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected can be collected through the second kernel function, thereby realizing the dual collection of operation behavior information and process information.

[0089] Next, we will introduce the basic principle of using kprobe or ftrace to implement inotify_handle_event: the Linux kernel jumps the entry address of the inotify_handle_event function to the address of the second kernel function, and after the second kernel function is executed, it returns to execute inotify_handle_event to complete the remaining functions. When the inotify_handle_event function is triggered, according to the above preparation, it first jumps to execute the second kernel function, and then executes the remaining functions of inotify_handle_event. In addition, this application is implemented by the Linux driver, and there is no need to restart the device when loading, which can ensure the normal and smooth operation of the business without interruption.

[0090] Sb606: Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0091] Among them, steps Sb601, Sb602, Sb603, Sb604 and Sb606 correspond to the aforementioned steps Sa601, Sa602, Sa603, Sa604 and Sa606, which have been described in the aforementioned steps. For specific descriptions, please refer to the aforementioned steps Sa601, Sa602, Sa603, Sa604 and Sa606.

[0092] At this stage, the first calling method has been introduced. Next, the second calling method will be introduced. Figure 7 A flowchart of another file operation behavior detection method provided in an embodiment of the present application. Figure 7 The file operation behavior detection method shown includes:

[0093] S701: Determine a target file according to file identification information in operation behavior detection element information, and determine an operation behavior detection type associated with the file identification information in the operation behavior detection element information as a behavior type to be detected for the target file.

[0094] S702: Obtain the content of the target member in the kernel function set of the file operation behavior detection system.

[0095] In this step, the target member is used to store the address of the kernel function responsible for processing information collection matters after the operation behavior detection mechanism is triggered. The triggering of the operation behavior detection mechanism is associated with the operation behavior detection element information.

[0096] S703: When it is determined that the content is the address of the first kernel function, determine whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior according to the function name of the first kernel function.

[0097] In this step, if the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, execute step S703; correspondingly, if the first kernel function has the function of not collecting operation behavior information and does not have the function of collecting process information associated with the operation behavior, also execute step S703.

[0098] S704: If it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, the content of the target member is updated to include the address of the second kernel function.

[0099] It is understandable that the target member content is the address of the first kernel function updated to the address of the second kernel function, wherein the second kernel function is a function having the functions of collecting process information associated with the operation behavior and collecting the operation behavior information.

[0100] In an achievable implementation, updating the content of the target member can be specifically reflected as: updating inotify_fsnotify_ops->handle_event. Specifically, there is an inotify_fsnotify_ops structure in the kernel function of the information collection module of the file operation behavior detection system, and there is a handle_event target member in the inotify_fsnotify_ops structure, wherein the inotify_fsnotify_ops structure is used to store the function function set required by the inotify mechanism, and the handle_event member is a target member in the function function set, which is used to store the function address of the corresponding processing mechanism after the inotify operation behavior detection element information is triggered. Generally, the function address of inotify_handle_event is used to collect file operation behavior information. In the present application, the content of the handle_event target member in the inotify_fsnotify_ops structure in the kernel function of the information collection module of the file operation behavior detection system is updated from the address of the first kernel function to the address of the second kernel function; wherein the first kernel function is a functional function for realizing the collection of operation behavior information, and the second kernel function is a kernel function for realizing the collection of operation behavior information and process information. It can be understood that the first kernel function only supports the collection of operation behavior information by the file operation behavior detection system, and the second kernel function can support the dual collection of operation behavior information and process information in the file operation behavior detection system.

[0101] Combined with the above content, it can be understood as: after enabling the first kernel function of the file operation behavior detection system, if the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, then the content of the handle_event target member in the inotify_fsnotify_ops structure is updated to the address of the second kernel function. In this way, the execution flow of the kernel jumps to the second kernel function. Since the second kernel function is a kernel function used to implement operation behavior information collection and process information collection, the second kernel function in the file operation behavior detection system can be called to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0102] Furthermore, we combine Figure 8 To introduce the basic principles of the above kernel function update method, Figure 8 A scenario flow chart of another file operation behavior detection method provided in an embodiment of the present application, such as Figure 8As shown. The present application uses a file marking module, a file behavior filtering module and an information collection module of a file operation behavior detection system. The file marking module is used to input operation behavior detection element information and add a check tag to the target file. The file behavior filtering module is used to detect whether a file status change event occurs on the target file according to the check tag and identify the file behavior type of the target file according to the file status change event. The kernel function address in the information collection module is updated, and the first kernel function address representing the implementation of operation behavior information collection is updated to the second kernel function address representing the implementation of operation behavior information collection and process information collection, and the process information is attached during the update to realize the association between operation behavior information and process information. In this way, by updating the content of the handle_event target member in the inotify_fsnotify_ops structure in the kernel function to the second function function address, the execution process of the control kernel can be controlled to jump to the address of the kernel function with operation behavior information collection function and process information collection function, so as to realize the dual collection of operation behavior information and process information, thereby improving the traceability capability and continuous detection capability.

[0103] S705: When it is detected that the target file has performed an operation behavior of the behavior type to be detected, the second kernel function in the file operation behavior detection system is called according to the updated content of the target member to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0104] Furthermore, when it is detected that the target file has undergone an operation behavior of the type of behavior to be detected, the kernel function in the file operation behavior detection system for performing the information collection function is called. Specifically, when it is detected that the target file has undergone an operation behavior of the type of behavior to be detected, the reading of the updated content of the target member, that is, the address of the second kernel function, is triggered. At this stage, the second kernel function is called according to the updated content of the target member.

[0105] S706: Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0106] Among them, steps S701 and S706 correspond to the aforementioned steps S301 and S303, which have been described in the aforementioned steps. For specific descriptions, please refer to the aforementioned steps S301 and S303. It should be noted that steps S702-S704 can be executed before step S705 or after step S705, and can also be set according to actual applications. Figure 7 , set it to be executed before step S705.

[0107] It should be further explained that the second kernel function is used to collect information of the first type field and the second type field, wherein the first type field is an information collection field related to the operation behavior information, the second type field is an information collection field related to the process information, and the second type field is a new field added when it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior. Specifically, the output of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected is performed as follows: the collected operation behavior information of the target file is outputted in accordance with the first type field, and the collected process information associated with the operation behavior of the behavior type to be detected is outputted in accordance with the second type field.

[0108] It can be understood that when the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, at this stage, you can customize the addition of a second type of field. The second type of field can include a process identifier, and the second type of field can also include a process name. No specific limitation is made here, and the second type of field can be added by yourself in actual applications.

[0109] Based on the file operation behavior detection method provided in the above embodiment, the present application also provides a file operation behavior detection device. Fig. 9 Provide explanation. Fig. 9 This is a schematic diagram of the structure of the file operation behavior detection device provided in the embodiment of the present application. Fig. 9 The file operation behavior detection device shown includes:

[0110] The target file determination unit 901 is used to determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected;

[0111] The behavior information collection unit 902 is used to call the kernel function used to perform the information collection function in the file operation behavior detection system when it is detected that the target file has an operation behavior of the behavior type to be detected, so as to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected;

[0112] The process information output unit 903 is used to output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0113] Optionally, the device further comprises:

[0114] A function name acquisition unit, used to acquire the function name of a first kernel function used to execute an information collection function in the information collection execution code of the file operation behavior detection system;

[0115] a collection function determination unit, configured to determine, according to the function name of the first kernel function, whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior;

[0116] A jump instruction generation unit is used to locate the address of the first kernel function in the information collection execution code and generate a jump instruction at the address of the first kernel function if it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior; the jump instruction is used to instruct the execution flow of the information collection execution code to jump to the address of the second kernel function; the second kernel function is a function that has the function of collecting process information associated with the operation behavior. Optionally, the behavior information collection unit 902 is specifically used to:

[0117] When the execution flow of the information collection execution code reaches the address of the first kernel function, jump to the address of the second kernel function according to the jump instruction, and call the second kernel function to collect process information associated with the operation behavior of the behavior type to be detected;

[0118] When the second kernel function call is completed, the address of the first kernel function is returned to call the first kernel function to collect the operation behavior information of the target file.

[0119] Optionally, the behavior information collection unit 902 is specifically used to:

[0120] When the execution process of the information collection execution code reaches the address of the first kernel function, jump to the address of the second kernel function according to the jump instruction, and call the second kernel function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected;

[0121] When the call of the second kernel function ends, the address of the first kernel function is skipped.

[0122] Optionally, the device further comprises:

[0123] A member content acquisition unit, used to acquire the content of a target member in the kernel function set of the file operation behavior detection system; the target member is used to store the address of the kernel function responsible for processing information collection matters after the operation behavior detection mechanism is triggered; the triggering of the operation behavior detection mechanism is associated with the operation behavior detection element information;

[0124] a function name determination unit, configured to determine, when determining that the content is the address of a first kernel function, whether the first kernel function has a function of collecting operation behavior information and process information associated with the operation behavior according to the function name of the first kernel function;

[0125] A function address updating unit, configured to update the content of the target member to include the address of the second kernel function if it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior; the second kernel function is a function that has the function of collecting process information associated with the operation behavior and collecting operation behavior information;

[0126] The behavior information collection unit 902 includes:

[0127] A content trigger reading unit, configured to trigger reading of updated content of the target member when detecting that the target file has an operation of the type of behavior to be detected;

[0128] A kernel function calling unit is used to call the second kernel function according to the updated content of the target member.

[0129] Optionally, the device further comprises:

[0130] A check tag adding unit, configured to add a check tag to the target file according to the file identification information in the operation behavior detection element information;

[0131] The behavior information collection unit 902 includes:

[0132] A detection file determination unit, configured to determine, based on the inspection tag added to the target file, that the target file is a file for which a file operation behavior is to be detected;

[0133] A change event detection unit, used for detecting a file status change event occurring on the target file;

[0134] The operation behavior determination unit is used to determine whether the information of the event attribute field of the file status change event matches the behavior type to be detected, and if so, determine that the target file has undergone an operation behavior of the behavior type to be detected.

[0135] Optionally, the device further comprises:

[0136] An element information receiving unit, used to receive operation behavior detection element information set on the terminal threat detection and response device;

[0137] The process information output unit 903 is specifically used to:

[0138] The operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected are sent to the terminal threat detection and response device through an information channel between the terminal threat detection and response device.

[0139] Optionally, the process information output unit 903 is specifically used to:

[0140] The collected operation behavior information of the target file is outputted in accordance with the first type field, and the collected process information associated with the operation behavior of the behavior type to be detected is outputted in accordance with the second type field.

[0141] The present application also provides a corresponding file operation behavior detection device. Fig.10 Provide explanation. Fig.10 A schematic diagram of the structure of another file operation behavior detection device provided in an embodiment of the present application. Fig.10 The file behavior operation detection device shown includes:

[0142] The target file determination unit 1001 is used to determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file;

[0143] A function name acquisition unit 1002 is used to acquire the function name of a first kernel function used to execute the information collection function in the information collection execution code of the file operation behavior detection system;

[0144] The collection function determination unit 1003 is used to determine whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior according to the function name of the first kernel function;

[0145] The jump instruction generating unit 1004 is used to locate the address of the first kernel function in the information collection execution code and generate a jump instruction at the address of the first kernel function if it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior;

[0146] The behavior information collection unit 1005 is used to call the kernel function used to perform the information collection function in the file operation behavior detection system when it is detected that the target file has an operation behavior of the behavior type to be detected, so as to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected;

[0147] The process information output unit 1006 is used to output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0148] The present application also provides another file operation behavior detection device. Fig.11 Provide explanation. Fig.11 A schematic diagram of the structure of another file operation behavior detection device provided in an embodiment of the present application. Fig.11 The file behavior operation detection device shown includes:

[0149] The target file determination unit 1101 is used to determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected;

[0150] The member content acquisition unit 1102 is used to acquire the content of the target member in the kernel function set of the file operation behavior detection system; the target member is used to store the address of the kernel function responsible for processing information collection matters after the operation behavior detection mechanism is triggered; the triggering of the operation behavior detection mechanism is associated with the operation behavior detection element information;

[0151] The function name determination unit 1103 is used to determine whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior according to the function name of the first kernel function when the content is determined to be the address of the first kernel function;

[0152] The function address updating unit 1104 is used to update the content of the target member to include the address of the second kernel function if it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior;

[0153] The behavior information collection unit 1105 is used to call the kernel function in the file operation behavior detection system for executing the information collection function when it is detected that the target file has an operation behavior of the behavior type to be detected, so as to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected;

[0154] The process information output unit 1106 is used to output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0155] An embodiment of the present application provides a file operation behavior detection device, which may be a server. Fig.12 : This is a schematic diagram of a server structure provided in an embodiment of the present application. The server 900 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 922 (for example, one or more processors) and a memory 932, and one or more storage media 930 (for example, one or more mass storage devices) storing application programs 942 or data 944. Among them, the memory 932 and the storage medium 930 can be short-term storage or permanent storage. The program stored in the storage medium 930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 922 can be configured to communicate with the storage medium 930 and execute a series of instruction operations in the storage medium 930 on the server 900.

[0156] The server 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input and output interfaces 958, and / or one or more operating systems 941, such as Windows Server 2000. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0157] The CPU 922 is used to execute the following steps:

[0158] Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected;

[0159] When it is detected that the target file has an operation behavior of the behavior type to be detected, calling a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected;

[0160] Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0161] The present application embodiment also provides another file operation behavior detection device, which can be a terminal device. Fig.13 For the sake of convenience, only the parts related to the embodiments of the present application are shown. For specific technical details not disclosed, please refer to the method part of the embodiments of the present application. Take the terminal device as a mobile phone as an example:

[0162] Fig.13 The block diagram shows a partial structure of a mobile phone provided in an embodiment of the present application. Fig.13 The mobile phone includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090. Those skilled in the art can understand that Fig.13 The mobile phone structure shown in the figure does not constitute a limitation on the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0163] Combine the following Fig.13 A detailed introduction to the various components of the mobile phone:

[0164] The RF circuit 1010 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the downlink information of the base station, it is sent to the processor 1080 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit 1010 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (full name: LowNoiseAmplifier, English abbreviation: LNA), a duplexer, etc. In addition, the RF circuit 1010 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communications may use any communication standard or protocol, including but not limited to Global System of Mobile communications (Global System of Mobile communication, English abbreviation: GSM), General Packet Radio Service (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, English abbreviation: CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (Long Term Evolution, English abbreviation: LTE), e-mail, Short Messaging Service (SMS), etc.

[0165] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 1020. The memory 1020 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 1020 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0166] The input unit 1030 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 1031 or near the touch panel 1031 using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 1080, and can receive and execute commands sent by the processor 1080. In addition, the touch panel 1031 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 1031, the input unit 1030 may further include other input devices 1032. Specifically, the other input devices 1032 may include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

[0167] The display unit 1040 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 1040 may include a display panel 1041. Optionally, the display panel 1041 may be configured in the form of a liquid crystal display (full name in English: Liquid Crystal Display, English abbreviation: LCD), an organic light-emitting diode (full name in English: Organic Light-Emitting Diode, English abbreviation: OLED), etc. Further, the touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it is transmitted to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides a corresponding visual output on the display panel 1041 according to the type of touch event. Although in Fig.13 In the embodiment, the touch panel 1031 and the display panel 1041 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0168] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1041 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1041 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0169] The audio circuit 1060, the speaker 1061, and the microphone 1062 can provide an audio interface between the user and the mobile phone. The audio circuit 1060 can transmit the received audio data to the speaker 1061 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 1062 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1060 and converted into audio data, and then the audio data is output to the processor 1080 for processing, and then sent to another mobile phone through the RF circuit 1010, or the audio data is output to the memory 1020 for further processing.

[0170] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse web pages and access streaming media through the WiFi module 1070. It provides users with wireless broadband Internet access. Fig.13 A WiFi module 1070 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0171] The processor 1080 is the control center of the mobile phone. It uses various interfaces and lines to connect various parts of the entire mobile phone. By running or executing software programs and / or modules stored in the memory 1020, and calling data stored in the memory 1020, it executes various functions of the mobile phone and processes data, thereby collecting overall data and information of the mobile phone. Optionally, the processor 1080 may include one or more processing units; preferably, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1080.

[0172] The mobile phone also includes a power supply 1090 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0173] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0174] In the embodiment of the present application, the processor 1080 included in the mobile phone also has the following functions:

[0175] Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; the file identification information in the operation behavior detection element information is used to identify the file with the file operation behavior to be detected;

[0176] When it is detected that the target file has an operation behavior of the behavior type to be detected, calling a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected;

[0177] Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

[0178] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program. When the computer program is run on a file operation behavior detection device, the file operation behavior detection device executes any one of the implementation methods of a file operation behavior detection method described in the aforementioned embodiments.

[0179] An embodiment of the present application also provides a computer program product including a computer program, which, when executed on a file operation behavior detection device, enables the file operation behavior detection device to execute any one of the implementation methods of a file operation behavior detection method described in the aforementioned embodiments.

[0180] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0181] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the system is only a logical function division. There may be other division methods in actual implementation, such as multiple systems can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0182] The systems described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0184] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store computer programs.

[0185] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A file operation behavior detection method, characterized in that: include: Determine the target file according to the file identification information in the operation behavior detection element information, and determine the operation behavior detection type associated with the file identification information in the operation behavior detection element information as the behavior type to be detected of the target file; The file identification information in the operation behavior detection element information is used to identify the file whose file operation behavior is to be detected; When it is detected that the target file has an operation behavior of the behavior type to be detected, calling a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and process information associated with the operation behavior of the behavior type to be detected; Output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

2. The file operation behavior detection method according to claim 1, characterized in that: The method further comprises: Obtaining the function name of a first kernel function in the information collection execution code of the file operation behavior detection system for executing the information collection function; According to the function name of the first kernel function, determining whether the first kernel function has the function of collecting operation behavior information and process information associated with the operation behavior; If it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, the address of the first kernel function in the information collection execution code is located, and a jump instruction is generated at the address of the first kernel function; the jump instruction is used to instruct the execution flow of the information collection execution code to jump to the address of the second kernel function; the second kernel function is a function that has the function of collecting process information associated with the operation behavior.

3. The file operation behavior detection method according to claim 2, characterized in that: The jump instruction is also used to instruct the execution process of the information acquisition execution code to return to the address of the first kernel function after the second kernel function is called to continue calling the first kernel function; The calling of a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected includes: When the execution flow of the information collection execution code reaches the address of the first kernel function, jump to the address of the second kernel function according to the jump instruction, and call the second kernel function to collect process information associated with the operation behavior of the behavior type to be detected; When the second kernel function call is completed, the address of the first kernel function is returned to call the first kernel function to collect the operation behavior information of the target file.

4. The file operation behavior detection method according to claim 2, characterized in that: The second kernel function also has the function of collecting operation behavior information; the jump instruction is also used to instruct the execution process of the information collection execution code to skip the address of the first kernel function after the second kernel function is called, and the first kernel function is no longer called; The calling of a kernel function in the file operation behavior detection system for executing an information collection function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected includes: When the execution process of the information collection execution code reaches the address of the first kernel function, jump to the address of the second kernel function according to the jump instruction, and call the second kernel function to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected; When the call of the second kernel function ends, the address of the first kernel function is skipped.

5. The file operation behavior detection method according to claim 1, characterized in that: Also includes: Obtaining the content of a target member in a kernel function set of the file operation behavior detection system; The target member is used to store the address of the kernel function responsible for processing information collection matters after the operation behavior detection mechanism is triggered; the triggering of the operation behavior detection mechanism is associated with the operation behavior detection element information; When it is determined that the content is the address of the first kernel function, judging whether the first kernel function has the function of collecting the operation behavior information and the process information associated with the operation behavior according to the function name of the first kernel function; If it is determined that the first kernel function has the function of collecting operation behavior information but does not have the function of collecting process information associated with the operation behavior, updating the content of the target member to include the address of the second kernel function; the second kernel function is a function that has the function of collecting process information associated with the operation behavior and collecting operation behavior information; When it is detected that the target file has an operation behavior of the type of behavior to be detected, calling a kernel function in the file operation behavior detection system for executing an information collection function includes: When it is detected that the target file has an operation behavior of the behavior type to be detected, triggering reading of the updated content of the target member; The second kernel function is called according to the updated content of the target member.

6. The file operation behavior detection method according to any one of claims 1 to 5, characterized in that: The method further comprises: adding a check tag to the target file according to the file identification information in the operation behavior detection element information; Detecting that the target file has an operation behavior of the behavior type to be detected includes: According to the inspection tag added to the target file, determining that the target file is a file whose file operation behavior is to be detected; Detecting a file status change event occurring on the target file; It is determined whether the information in the event attribute field of the file status change event matches the behavior type to be detected; if so, it is determined that the target file has undergone an operation behavior of the behavior type to be detected.

7. The file operation behavior detection method according to any one of claims 1 to 5, characterized in that: The method further comprises: Receive operation behavior detection element information set on the terminal threat detection and response device; The outputting of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected specifically includes: The operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected are sent to the terminal threat detection and response device through an information channel between the terminal threat detection and response device.

8. The file operation behavior detection method according to claim 4 or 5, characterized in that: The second kernel function is used to collect information of a first type field and information of a second type field, wherein the first type field is an information collection field related to operation behavior information, the second type field is an information collection field related to process information, and the second type field is a new field added when it is determined that the first kernel function has a function of collecting operation behavior information but does not have a function of collecting process information associated with the operation behavior; The outputting of the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected includes: The collected operation behavior information of the target file is outputted in accordance with the first type field, and the collected process information associated with the operation behavior of the behavior type to be detected is outputted in accordance with the second type field.

9. A file operation behavior detection device, characterized in that: include: a target file determining unit, configured to determine a target file according to file identification information in the operation behavior detection element information, and determine an operation behavior detection type associated with the file identification information in the operation behavior detection element information as a behavior type to be detected for the target file; The file identification information in the operation behavior detection element information is used to identify the file whose file operation behavior is to be detected; A behavior information collection unit is used to call a kernel function in the file operation behavior detection system for executing an information collection function when it is detected that the target file has an operation behavior of the behavior type to be detected, so as to collect the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected; The process information output unit is used to output the operation behavior information of the target file and the process information associated with the operation behavior of the behavior type to be detected.

10. A file operation behavior detection device, characterized in that: The device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is used to execute the steps of the file operation behavior detection method according to any one of claims 1 to 8 according to the instructions in the computer program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed by a file operation behavior detection device, the steps of the file operation behavior detection method according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that It comprises a computer program, which, when executed by a file operation behavior detection device, implements the steps of the file operation behavior detection method according to any one of claims 1 to 8.

Images