Program detection method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention discloses a program detection method and device, equipment, a storage medium and a program product. The invention relates to the technical field of computers. The method comprises the following steps: detecting a calling operation of an eBPF user mode program on a kernel mode; obtaining a calling attribute parameter corresponding to the calling operation; wherein the calling attribute parameter comprises an original calling attribute parameter and first signature data, and the first signature data is obtained by signing the original calling attribute parameter by the eBPF user mode program; performing signature verification on the calling attribute parameter to obtain a signature verification result; and sending the signature verification result to the kernel mode, so that the kernel mode processes the calling operation based on the signature verification result. According to the program detection method provided by the embodiment of the invention, the calling attribute parameter corresponding to the calling operation is subjected to signature verification, and whether the eBPF user mode program is illegal or not is determined according to the signature verification result, so that an illegal eBPF program can be accurately detected, and the security of an eBPF system is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a program detection method, apparatus, device, storage medium, and program product. Background Art

[0002] In recent years, with the rise of Extended Berkeley Packet Filter (eBPF) technology, eBPF has been favored by major Internet companies for its advantages in network monitoring, network observation, network tracking, performance analysis, and security, and many eBPF-based products have been launched. At the same time, the emergence of eBPF also provides attackers with new attack methods, such as bypassing system firewalls by modifying network data packets, and obtaining system sensitive data by modifying system call parameters. Attack methods based on eBPF are secretive and difficult to detect with existing protection methods. How to identify malicious eBPF and establish a complete defense system is imminent. Summary of the invention

[0003] The embodiments of the present invention provide a program detection method, apparatus, device, storage medium and program product, which can accurately detect illegal eBPF programs and improve the security of the eBPF system.

[0004] In a first aspect, an embodiment of the present invention provides a program detection method, comprising:

[0005] Detect the call operation of eBPF user-mode program to kernel-mode;

[0006] Obtaining a call attribute parameter corresponding to the call operation; wherein the call attribute parameter includes an original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user state program;

[0007] Verify the signature of the calling attribute parameter to obtain a verification result; wherein the verification result includes a verification pass and a verification fail;

[0008] The signature verification result is sent to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

[0009] In a second aspect, an embodiment of the present invention further provides a program detection device, including:

[0010] The call operation detection module is used to detect the call operation of the eBPF user state program to the kernel state;

[0011] A call attribute parameter acquisition module, used to obtain the call attribute parameters corresponding to the call operation; wherein the call attribute parameters include original call attribute parameters and first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters;

[0012] A signature verification result acquisition module, used to verify the signature of the call attribute parameter and obtain a signature verification result; wherein the signature verification result includes a signature verification pass and a signature verification fail;

[0013] The calling operation processing module is used to send the signature verification result to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the program detection method as described in the embodiment of the present invention is implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the program detection method as described in the embodiment of the present invention is implemented.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which implements the program detection method as described in the embodiment of the present invention when executed by a processor.

[0017] The embodiment of the present invention discloses a program detection method, device, equipment, storage medium and program product. Detect the call operation of the eBPF user state program to the kernel state; obtain the call attribute parameters corresponding to the call operation; wherein the call attribute parameters include the original call attribute parameters and the first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters; verify the call attribute parameters to obtain the verification result; wherein the verification result includes the verification pass and the verification fail; send the verification result to the kernel state, so that the kernel state processes the call operation based on the verification result. The program detection method provided in this embodiment, when the eBPF user state program detects the call operation of the kernel state, verifies the call attribute parameters corresponding to the call operation, and determines whether the eBPF user state program is illegal according to the verification result, which can accurately detect illegal eBPF programs and improve the security of the eBPF system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of a program detection method provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of obtaining call attribute parameters corresponding to a call operation provided by an embodiment of the present invention;

[0021] Figure 3 A flowchart of a program detection method provided by an embodiment of the present invention;

[0022] Figure 4 is a structural schematic diagram of a program detection device provided by an embodiment of the present invention;

[0023] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0025] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. The purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0026] In the prior art, the detection method for eBPF programs mainly includes the following two methods: one is to sign the eBPF bytecode and verify the signature when the bytecode is loaded; the other is to sign the eBPF user-mode program, and the user-mode program can only be executed when the signature verification passes.

[0027] For the first method, since the eBPF bytecode is not loaded as a whole, the eBPF bytecode is divided into multiple sections. From the kernel state perspective, what is loaded into the kernel state is the eBPF object, which is divided into: eBPF instructions and eBPF mappings; the ebpf user state program parses the eBPF bytecode, obtains the eBPF instruction Sec and mapping Sec, and then calls and loads it into the kernel. Therefore, by signing the eBPF bytecode and then verifying the signature in the kernel, it is necessary to make major changes to the eBPF kernel mechanism, affecting system stability. For the second method, the eBPF user state program is signed. This solution can alleviate some problems with the loading of eBPF bytecode, but it is still threatened if it is loaded using system native commands (tc\ip\bpftool, etc.).

[0028] Figure 1 The present invention provides a flowchart of a program detection method, which is applicable to the case of detecting the legitimacy of an eBPF user-mode program. The method can be executed by a program detection device, which can be implemented in the form of software and / or hardware, and optionally, by an electronic device, which can be a mobile terminal, a PC, or a server. Figure 1 As shown, the method includes:

[0029] S110, detecting the calling operation of the eBPF user state program to the kernel state.

[0030] In an operating system (such as Linux), virtual memory is usually divided into two blocks: user space and kernel space. Among them, eBPF user-mode programs refer to programs running in user space. These programs use eBPF (Extended Berkeley Packet Filter) technology to interact with kernel space through the interface provided by kernel mode to monitor and analyze the system kernel status or network data. eBPF technology allows developers to write program codes close to C language. After these codes are loaded by the kernel, they can be executed when specific system events are triggered, such as filtering of network data packets and tracing of system calls. eBPF user-mode programs are usually written and loaded through libraries such as libbpf. These libraries provide interfaces and tools for interacting with the kernel, allowing user-mode programs to define and deploy eBPF programs to monitor and analyze the underlying behavior of the system. Kernel mode is the state in the operating system where operating system programs run and hardware is operated, and it has the highest authority. It allows the operating system to directly access and operate hardware devices, execute privileged instructions, and manage various resources of the system. The interaction between user state and kernel state is mainly achieved through system calls. System calls are the way user state programs request kernel state to provide services or perform specific operations through specific interfaces. When an application needs to perform some operations that can only be performed by kernel state, such as reading and writing disks, network communication, etc., it will pass control to kernel state through system calls and wait for the kernel to complete the corresponding operations before returning to user state.

[0031] Among them, the call operation includes any of the following: mapping table creation operation, mapping table processing operation, BPF program loading operation, BPF program mounting operation, BPF program unloading operation, BPF program mapping and mounting operation to the target, BPF program search operation and BPF information verification operation. The operation type of the call operation can be reflected by the operation type parameter (CommandPrompt, cmd). The function of the mapping table creation operation is to create a BPF mapping, and its cmd parameter is represented by: BPF_MAP_CREATE. The mapping table processing operation may include mapping table query operation, mapping table update operation, mapping table deletion operation and mapping table traversal operation, and its cmd parameters are respectively represented by: BPF_MAP_LOOKUP_ELEM, BPF_MAP_UPDATE_ELEM, BPF_MAP_DELETE_ELEM and BPF_MAP_NEXT_KEY. The function of the BPF program loading operation is to verify and load the BPF program, and its cmd parameter is represented by: BPF_PROG_LOAD. The function of the BPF program mount operation is to mount the BPF program to the kernel event, and its cmd parameter is expressed as: BPF_PROG_ATTACH. The function of the BPF program uninstall operation is to uninstall the BPF program from the kernel time, and its cmd parameter is expressed as: BPF_PROG_DETACH. The function of the BPF program mapping and mounting operation to the target is to map or mount the BPF to the / sys / fs / bpf target in sysfs, which is often used to keep the BPF program stored in the kernel, and its cmd parameter is expressed as: BPF_OBJ_PIN. The function of the BPF program search operation is to search for the BPF program from the / sys / fs / bpf target, and its cmd parameter is expressed as: BPF_OBJ_get. The function of the BPF information verification operation is to verify and load the BTF information, and its cmd parameter is expressed as: BPF_BTF_LOAD, where BTF information mainly refers to the BPF type information (BPF Type Format, BTF), which is a format used to describe data types and function signatures in BPF programs.

[0032] The BPF program is composed of a BPF instruction set, and the BPF instruction set can be understood as program instructions composed of eBPF bytecodes.

[0033] In this embodiment, the trace bpf system call in the eBPF technology is used to monitor the calling operation of the eBPF user state program on the kernel state. The monitoring program is legal to the eBPF system, that is, it is trustworthy.

[0034] S120, obtaining a call attribute parameter corresponding to the call operation.

[0035] The call attribute parameters include the original call attribute parameters and the first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters. That is, the call attribute parameters are obtained by the eBPF user state program signing the original call attribute parameters.

[0036] In this embodiment, the method for obtaining the call attribute parameters is as follows: the eBPF user state program receives the system call request; a hash operation is performed on the original call attribute parameters to obtain the first signature data; the first signature data and the original call attribute parameters are concatenated to obtain the call attribute parameters.

[0037] Among them, the first signature data includes a preset number of characters, for example: 256. The system call request includes an original call attribute parameter, which is determined by the type of the call operation. Different call operations correspond to different original call attribute parameters. The original call parameters corresponding to each call operation can refer to the existing eBPF technology, which is not limited here. Exemplarily, if the call operation is a BPF program loading operation (BPF_PROG_LOAD), its original call parameters may include: BPF program type, pointer to instruction array, number of instructions, log output buffer, log buffer size and log level, etc.; if the call operation is a mapping table creation operation (BPF_MAP_CREATE), its original call parameters may include: mapping table type, object pointed to by the mapping table, bytes occupied by key, bytes occupied by value, maximum number of mapping entries, etc.

[0038] In this embodiment, if the eBPF user-state program is a legitimate user-state program, the eBPF user-state program will use a preset hash algorithm to perform a hash operation on the original call attribute parameters to obtain the information summary corresponding to the original call attribute parameters, that is, the first signature data, and finally add the first signature data to the preset position of the original call attribute parameters, that is, concatenate the first signature data and the original call attribute parameters to obtain the call attribute parameters. Among them, the preset hash algorithm is pre-set in the eBPF system, and each legitimate program in the eBPF system is signed according to the preset hash algorithm.

[0039] If the eBPF user-state program is an illegal user-state program, the eBPF user-state program will use a non-preset hash algorithm to perform a hash operation on the original call attribute parameters to obtain an illegal information digest corresponding to the original call attribute parameters, that is, an illegal first signature data, and concatenate the illegal first signature data and the original call attribute parameters to obtain illegal call attribute parameters. Alternatively, the illegal user-state program does not perform a hash operation on the original call attribute parameters and directly uses the original call attribute parameters as call attribute parameters.

[0040] Optionally, the first signature data and the original call attribute parameters are concatenated to obtain the call attribute parameters by adding the first signature data before or after the original call attribute parameters to obtain the call attribute parameters.

[0041] Among them, the splicing method of the first signature data and the original call attribute parameters is pre-set in the eBPF system, and each legal program in the eBPF system follows this method to splice or split the first signature data and the original call attribute parameters. In this embodiment, in order to quickly split the first signature data and the original call attribute parameters in the subsequent signature verification process, the first signature data can be added before or after the original call attribute parameters. That is, the call attribute parameters can be expressed as: original call attribute parameters + first signature data, or, first signature data + original call attribute parameters.

[0042] Among them, the system call request also includes an operation type parameter (cmd parameter); after splicing the first signature data and the original call attribute parameter to obtain the call attribute parameter, it also includes: sending the call attribute parameter to the kernel state, and executing the call operation corresponding to the operation type parameter on the kernel state.

[0043] In this embodiment, when a call operation of the eBPF user state program to the kernel state is detected, a call attribute parameter corresponding to the call operation is obtained from the kernel state.

[0044] Specifically, the method for obtaining the call attribute parameters corresponding to the call operation can be: sending a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request and writes the call attribute parameters into the mapping table; reading the call attribute parameters corresponding to the call operation from the mapping table.

[0045] The mapping table creation request includes information such as the type of the mapping table to be created is a signature verification mapping table, the signature verification key type and the signature verification value type in the mapping table. After receiving the mapping table creation request sent by the monitoring program, the kernel state creates a mapping table based on the mapping table creation request and writes the call attribute parameters sent by the user state program into the mapping table. The monitoring program reads the call attribute parameters corresponding to the call operation from the mapping table. For example, Figure 2 This is a schematic diagram of obtaining the call attribute parameters corresponding to the call operation, such as Figure 2 As shown, the detected user state program initiates a call operation to the kernel state, and the monitoring program reads the call attribute parameters from the kernel state by means of a mapping table (map).

[0046] S130, verify the signature of the calling attribute parameter to obtain the signature verification result.

[0047] The signature verification result includes the signature verification passing and the signature verification failing. In this embodiment, the purpose of the signature verification of the call attribute parameter is to detect whether the eBPF user mode program that initiates the call operation to the kernel mode is legal.

[0048] Optionally, the call attribute parameters are verified and the verification result is obtained by: splitting the call attribute parameters into original call attribute parameters and first signature data; and verifying the first signature data based on the original call attribute parameters to obtain the verification result.

[0049] In this embodiment, if the eBPF user-mode program that initiates a call operation to the kernel state is legal, the call attribute parameters are composed of the original call attribute parameters and the legal first signature data; if the eBPF user-mode program that initiates a call operation to the kernel state is illegal, the call attribute parameters are composed of the original call attribute parameters and the illegal first signature data, or the call attribute parameters are composed of only the original call attribute parameters. For the monitoring program, regardless of whether the eBPF user-mode program is legal, the call attribute parameters must be split in a preset manner, and one of the two split parts of data is used as the original call attribute parameters, and the other part is used as the first signature data.

[0050] Specifically, the method of splitting the call attribute parameters into the original call attribute parameters and the first signature data can be: extracting data with a preset number of characters from the beginning or end of the call attribute parameters, and determining them as the first signature data; and determining the other data in the call attribute parameters except the first signature data as the original call attribute parameters.

[0051] In this embodiment, if the original calling attribute parameter and the first signature data are concatenated in such a way that the first signature data is added before the original calling attribute parameter, a preset number of characters of data are extracted from the head end of the calling attribute parameter as the first signature data. If the original calling attribute parameter and the first signature data are concatenated in such a way that the first signature data is added after the original calling attribute parameter, a preset number of characters of data are extracted from the end of the calling attribute parameter as the first signature data.

[0052] Optionally, the first signature data is verified based on the original call attribute parameters, and the verification result is obtained by: performing a hash operation on the original call attribute parameters to obtain second signature data; comparing the second signature data with the first signature data; if the second signature data is the same as the first signature data, the verification result is that the verification passed; if the second signature data is different from the first signature data, the verification result is that the verification failed.

[0053] In this embodiment, the monitoring program performs a hash operation on the original call parameters according to a preset hash algorithm to obtain a second information summary of the original call attribute parameters, that is, the second signature data. The second signature data is compared with the first signature data. If the second signature data is the same as the first signature data, it indicates that the eBPF user-mode program that initiates the call operation to the kernel state is legal, that is, the signature verification result is passed. If the second signature data is different from the first signature data, it indicates that the eBPF user-mode program that initiates the call operation to the kernel state is illegal, that is, the signature verification result is failed.

[0054] In this embodiment, the reason why the second signature data is different from the first signature data may be that: the first signature data is obtained by hashing using a non-preset hash algorithm (that is, the illegal eBPF user-state program is signed using a non-preset hash algorithm); or, the split first signature data is actually a part of the correct original call attribute parameters, and the split original call attribute parameters are actually another part of the correct original call attribute parameters (that is, the illegal eBPF user-state program is not signed).

[0055] S140: Send the signature verification result to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

[0056] Specifically, the kernel state processes the call operation based on the signature verification result in the following manner: if the signature verification result is a signature failure, the kernel state interrupts the call operation and generates a reminder message. If the signature verification result is a signature verification success, the kernel state does not perform any processing, that is, the eBPF user state program is allowed to continue to execute the call operation to the kernel state.

[0057] Based on the above embodiments, Figure 3 is a flow chart of a program detection method provided by an embodiment of the present invention, such as Figure 3 As shown, the method comprises the following steps:

[0058] S310, the eBPF user mode program receives a system call request, performs a hash operation on original call attribute parameters in the system call request, and obtains first signature data.

[0059] S320, adding the first signature data before or after the original call attribute parameter, obtaining the call attribute parameter, sending the call attribute parameter to the kernel state, and performing a call operation corresponding to the operation type parameter on the kernel state.

[0060] S330: The monitoring program detects a call operation of the eBPF user-mode program to the kernel-mode program.

[0061] S340, sending a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request and writes the call attribute parameters into the mapping table; reading the call attribute parameters corresponding to the call operation from the mapping table.

[0062] S350, extracting data of a preset number of characters from the beginning or the end of the calling attribute parameter and determining it as the first signature data; and determining the other data in the calling attribute parameter except the first signature data as the original calling attribute parameter.

[0063] S360, perform a hash operation on the split original call attribute parameters to obtain second signature data; compare the second signature data with the split first signature data; if the second signature data is the same as the first signature data, the signature verification result is passed; if the second signature data is different from the first signature data, the signature verification result is failed.

[0064] S370, sending the signature verification result to the kernel state. If the signature verification result is failure, the kernel state interrupts the calling operation.

[0065] In this embodiment, by signing the call attribute parameters of the call operation, it is possible to effectively prevent illegal eBPF programs from being loaded into the system, and can directly block malicious attacks at the source.

[0066] The technical solution of this embodiment is to detect the call operation of the eBPF user state program to the kernel state; obtain the call attribute parameters corresponding to the call operation; wherein the call attribute parameters include the original call attribute parameters and the first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters; verify the call attribute parameters to obtain the verification result; wherein the verification result includes the verification pass and the verification fail; send the verification result to the kernel state, so that the kernel state processes the call operation based on the verification result. The program detection method provided in this embodiment, when the eBPF user state program detects the call operation of the kernel state, verifies the call attribute parameters corresponding to the call operation, and determines whether the eBPF user state program is illegal according to the verification result, which can accurately detect illegal eBPF programs and improve the security of the eBPF system.

[0067] Figure 4 is a schematic diagram of the structure of a program detection device provided by an embodiment of the present invention, such as Figure 4 As shown, the device comprises:

[0068] A call operation detection module 410 is used to detect the call operation of the eBPF user state program to the kernel state;

[0069] A call attribute parameter acquisition module 420 is used to obtain the call attribute parameters corresponding to the call operation; wherein the call attribute parameters include original call attribute parameters and first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters;

[0070] The signature verification result acquisition module 430 is used to verify the signature of the call attribute parameter and obtain the signature verification result; wherein the signature verification result includes the signature verification passing and the signature verification failing;

[0071] The call operation processing module 440 is used to send the signature verification result to the kernel state, so that the kernel state processes the call operation based on the signature verification result.

[0072] Optionally, calling the attribute parameter acquisition module 420 is further used to:

[0073] Sending a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and writes the call attribute parameters into the mapping table;

[0074] Read the call attribute parameters corresponding to the call operation from the mapping table.

[0075] Optionally, the signature verification result acquisition module 430 is further configured to:

[0076] Splitting the call attribute parameter into original call attribute parameter and first signature data;

[0077] The first signature data is verified based on the original call attribute parameters to obtain a verification result.

[0078] Optionally, the signature verification result acquisition module 430 is further configured to:

[0079] Extracting data of a preset number of characters from the beginning or the end of the calling attribute parameter and determining it as the first signature data;

[0080] The other data in the calling attribute parameters except the first signature data are determined as original calling attribute parameters.

[0081] Optionally, the signature verification result acquisition module 430 is further configured to:

[0082] Performing a hash operation on the original call attribute parameter to obtain second signature data;

[0083] Comparing the second signature data with the first signature data;

[0084] If the second signature data is the same as the first signature data, the verification result is passed; if the second signature data is different from the first signature data, the verification result is failed.

[0085] Optionally, the calling operation processing module 440 is further used to:

[0086] If the signature verification result is that the signature verification fails, the information that the signature verification fails is sent to the kernel state, so that the kernel state interrupts the calling operation.

[0087] Optionally, the calling attribute parameter is obtained in the following manner:

[0088] The eBPF user mode program receives a system call request; wherein the system call request includes an original call attribute parameter;

[0089] Performing a hash operation on the original call attribute parameter to obtain first signature data;

[0090] The first signature data and the original call attribute parameters are concatenated to obtain the call attribute parameters.

[0091] Optionally, concatenating the first signature data and the original call attribute parameters to obtain the call attribute parameters includes:

[0092] The first signature data is added before or after the original calling attribute parameter to obtain the calling attribute parameter.

[0093] Optionally, the system call request further includes an operation type parameter; after the first signature data and the original call attribute parameter are concatenated to obtain the call attribute parameter, the system call request further includes:

[0094] The calling attribute parameters are sent to the kernel state, and a calling operation corresponding to the operation type parameters is performed on the kernel state.

[0095] Optionally, the calling operation includes any one of the following: a mapping table creation operation, a mapping table processing operation, a BPF program loading operation, a BPF program mounting operation, a BPF program unloading operation, a BPF program mapping and mounting operation to a target, a BPF program search operation, and a BTF information verification operation.

[0096] Optionally, the BPF program consists of a BPF instruction set.

[0097] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0098] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0099] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0100] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0101] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the program detection method.

[0102] In some embodiments, the program detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the program detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the program detection method in any other appropriate manner (e.g., by means of firmware).

[0103] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0105] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0107] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0108] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0109] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the program detection method provided in any embodiment of the present application.

[0110] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0111] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A program detection method, characterized in that: include: Detect the call operation of the extended Berkeley Packet Filter eBPF user-mode program to the kernel mode; Obtaining a call attribute parameter corresponding to the call operation; wherein the call attribute parameter includes an original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user state program; Verify the signature of the calling attribute parameter to obtain a verification result; wherein the verification result includes a verification pass and a verification fail; The signature verification result is sent to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

2. The method according to claim 1, characterized in that: Obtain the call attribute parameters corresponding to the call operation, including: Sending a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and writes the call attribute parameters into the mapping table; Read the call attribute parameters corresponding to the call operation from the mapping table.

3. The method according to claim 1, characterized in that Verify the signature of the calling attribute parameter to obtain the verification result, including: Splitting the call attribute parameter into original call attribute parameter and first signature data; The first signature data is verified based on the original call attribute parameters to obtain a verification result.

4. The method according to claim 3, characterized in that Splitting the call attribute parameter into the original call attribute parameter and the first signature data includes: Extracting data of a preset number of characters from the beginning or the end of the calling attribute parameter and determining it as the first signature data; The other data in the calling attribute parameters except the first signature data are determined as original calling attribute parameters.

5. The method according to claim 3, characterized in that: Verifying the first signature data based on the original call attribute parameter to obtain a verification result includes: Performing a hash operation on the original call attribute parameter to obtain second signature data; Comparing the second signature data with the first signature data; If the second signature data is the same as the first signature data, the verification result is passed; if the second signature data is different from the first signature data, the verification result is failed.

6. The method according to claim 1, characterized in that Sending the signature verification result to the kernel state, so that the kernel state processes the call operation based on the signature verification result, includes: If the signature verification result is that the signature verification fails, the information that the signature verification fails is sent to the kernel state, so that the kernel state interrupts the calling operation.

7. The method according to claim 1, characterized in that The method for obtaining the calling attribute parameters is as follows: The eBPF user mode program receives a system call request; wherein the system call request includes an original call attribute parameter; Performing a hash operation on the original call attribute parameter to obtain first signature data; The first signature data and the original call attribute parameters are concatenated to obtain the call attribute parameters.

8. The method according to claim 7, characterized in that The first signature data and the original call attribute parameters are concatenated to obtain the call attribute parameters, including: The first signature data is added before or after the original calling attribute parameter to obtain the calling attribute parameter.

9. The method according to claim 7, characterized in that: The system call request also includes an operation type parameter; after the first signature data and the original call attribute parameter are concatenated to obtain the call attribute parameter, the system call request also includes: The calling attribute parameters are sent to the kernel state, and a calling operation corresponding to the operation type parameters is performed on the kernel state.

10. The method according to claim 1, characterized in that The calling operation includes any one of the following: a mapping table creation operation, a mapping table processing operation, a BPF program loading operation, a BPF program mounting operation, a BPF program unloading operation, a BPF program mapping and mounting operation to a target, a BPF program search operation, and a BTF information verification operation.

11. The method according to claim 10, characterized in that The BPF program is composed of a BPF instruction set.

12. A program detection device, characterized in that: include: A call operation detection module is used to detect the call operation of the extended Berkeley packet filter eBPF user state program to the kernel state; A call attribute parameter acquisition module, used to obtain the call attribute parameters corresponding to the call operation; wherein the call attribute parameters include original call attribute parameters and first signature data, and the first signature data is obtained by the eBPF user state program signing the original call attribute parameters; A signature verification result acquisition module, used to verify the signature of the call attribute parameter and obtain a signature verification result; wherein the signature verification result includes a signature verification pass and a signature verification fail; The calling operation processing module is used to send the signature verification result to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

13. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the program detection method according to any one of claims 1 to 11 when executing the computer program.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the program detection method as described in any one of claims 1 to 11 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the program detection method according to any one of claims 1 to 11.

Images