A program detection method, device, equipment, storage medium and program product

Abstract

Embodiments of the present application disclose a program detection method, device, equipment, storage medium and program product. The present application relates to the technical field of computers. The method comprises: detecting a calling operation of an eBPF user state program on a kernel state; obtaining a calling attribute parameter corresponding to the calling operation; wherein the calling attribute parameter comprises an original calling attribute parameter and first signature data, the first signature data being obtained by signing the original calling attribute parameter by the eBPF user state program; verifying the calling attribute parameter to obtain a verification result; and sending the verification result to the kernel state, so that the kernel state processes the calling operation based on the verification result. The program detection method provided in the embodiments verifies the calling attribute parameter corresponding to the calling operation, determines whether the eBPF user state program is illegal according to the verification result, can accurately detect illegal eBPF programs, and improves the security of the eBPF system.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer technology, and particularly relate to a program detection method and device, equipment, storage medium and program product. BACKGROUND

[0002] In recent years, with the rise of the Extended Berkeley Packet Filter (eBPF) technology, eBPF has been favored by many Internet companies for its advantages in network monitoring, network observation, network tracking, performance analysis and security, and has landed many eBPF-based products. At the same time, the emergence of eBPF also provides attackers with new attack means, such as bypassing system firewalls by modifying network packets, obtaining system sensitive data by modifying system call parameters, etc. The eBPF-based attack means has the characteristics of secrecy, and the existing protection means is difficult to discover. How to identify malicious eBPF and establish a perfect defense system is imminent. SUMMARY

[0003] Embodiments of the present application provide a program detection method, device, equipment, storage medium and program product, which can accurately detect illegal eBPF programs and improve the security of eBPF systems.

[0004] In a first aspect, embodiments of the present application provide a program detection method, comprising:

[0005] detecting a call operation of an eBPF user state program to a kernel state;

[0006] obtaining a call attribute parameter corresponding to the call operation; wherein the call attribute parameter includes an original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user state program;

[0007] verifying the call attribute parameter to obtain a verification result; wherein the verification result includes verification pass and verification fail;

[0008] sending the verification result to the kernel state, so that the kernel state processes the call operation based on the verification result.

[0009] In a second aspect, embodiments of the present application also provide a program detection device, comprising:

[0010] a call operation detection module configured to detect a call operation of an eBPF user state program to a kernel state;

[0011] The calling attribute parameter acquisition module is configured to acquire calling attribute parameters corresponding to the calling operation; the calling attribute parameters include original calling attribute parameters and first signature data, and the first signature data is obtained by signing the original calling attribute parameters by the eBPF user mode program;

[0012] The signature verification result acquisition module is configured to perform signature verification on the calling attribute parameters to obtain a signature verification result; the signature verification result includes signature verification pass and signature verification fail.

[0013] The calling operation processing module is configured to send the signature verification result to the kernel mode, so that the kernel mode processes the calling operation based on the signature verification result.

[0014] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the program detection method as described in the embodiments of the present application when executing the program.

[0015] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the program implements the program detection method as described in the embodiments of the present application when executed by a processor.

[0016] In a fifth aspect, a computer program product is provided, which includes a computer program, and the computer program implements the program detection method as described in the embodiments of the present application when executed by a processor.

[0017] The embodiments of the present application disclose a program detection method, device, equipment, storage medium and program product. A calling operation of an eBPF user mode program on a kernel mode is detected. Calling attribute parameters corresponding to the calling operation are acquired. The calling attribute parameters include original calling attribute parameters and first signature data, and the first signature data is obtained by signing the original calling attribute parameters by the eBPF user mode program. Signature verification is performed on the calling attribute parameters to obtain a signature verification result. The signature verification result includes signature verification pass and signature verification fail. The signature verification result is sent to the kernel mode, so that the kernel mode processes the calling operation based on the signature verification result. The program detection method provided in the embodiments can accurately detect illegal eBPF programs and improve the security of an eBPF system by detecting a calling operation of an eBPF user mode program on a kernel mode, performing signature verification on calling attribute parameters corresponding to the calling operation, and determining whether the eBPF user mode program is illegal according to a signature verification result. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0019] Figure 1 A flow chart of a program detection method provided by the embodiments of the present application is shown in FIG. 4.

[0020] Figure 2 A principle diagram of obtaining the calling attribute parameters corresponding to the calling operation provided by the embodiments of the present application is shown in FIG. 5.

[0021] Figure 3 A flow chart of a program detection method provided by the embodiments of the present application is shown in FIG. 4.

[0022] Figure 4 A structural schematic diagram of a program detection device provided by the embodiments of the present application is shown in FIG. 6.

[0023] Figure 5 A structural schematic diagram of an electronic device provided by the embodiments of the present application is shown in FIG. 7. DETAILED DESCRIPTION

[0024] The present application will be further described in detail below in combination with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, and not to limit the present application. In addition, it should be noted that, in order to facilitate the description, only the parts related to the present application are shown in the drawings, and not all the structures.

[0025] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solutions of the present application all comply with the relevant provisions of national laws and regulations. It should be noted that, in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be regarded as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0026] In the prior art, the detection method of eBPF program mainly includes the following two ways: one is to sign the eBPF bytecode, and to verify the signature when the bytecode is loaded; the other is to sign the eBPF user state program, and the user state program can only be executed when the signature verification is passed.

[0027] For the first way, since the eBPF bytecode is not loaded as a whole, the eBPF bytecode is divided into multiple sections. From the perspective of the kernel state, the eBPF object loaded into the kernel state is divided into: eBPF instructions and eBPF maps; the eBPF user state program obtains the eBPF instruction Sec and the map Sec by analyzing the eBPF bytecode, and then calls the loading into the kernel, so that the eBPF bytecode is signed, and then the signature is verified in the kernel, which requires a large change to the eBPF kernel mechanism, affecting the stability of the system. For the second way, the eBPF user state program is signed, which can alleviate some eBPF bytecode loading problems, but when using the system native command (tc\ip\bpftool, etc.) to load, it still faces threats.

[0028] Figure 1 A flowchart of a program detection method provided by an embodiment of the present application, which can be applied to the case of detecting the legality of the eBPF user state program, and the method can be executed by a program detection device, which can be implemented in the form of software and / or hardware, and can be implemented by an electronic device, which can be a mobile terminal, a PC terminal, or a server, etc. As shown in the figure, the method comprises: Figure 1

[0029] S110, detecting the calling operation of the eBPF user state program to the kernel state.

[0030] ​In an operating system (such as a Linux system), virtual memory is usually divided into two blocks: user space and kernel space. The eBPF user program refers to a program running in the user space. These programs use the eBPF (Extended Berkeley Packet Filter) technology to interact with the kernel space through the interfaces provided by the kernel state, and achieve monitoring and analysis of system kernel state or network data. The eBPF technology allows developers to write program code close to C language. After the code is loaded by the kernel, it can be executed when certain system events are triggered, such as network packet filtering, system call tracking, etc. eBPF user programs are usually written and loaded through libraries such as libbpf. These libraries provide interfaces and tools for interacting with the kernel, allowing user programs to define and deploy eBPF programs to monitor and analyze the underlying behavior of the system. The kernel mode is the state of the operating system that runs operating system programs and operates hardware, with the highest privileges. It allows the operating system to directly access and operate hardware devices, execute privileged instructions, and manage various resources of the system. The interaction between user mode and kernel mode is mainly realized through system calls. System calls are a way for user programs to request services or perform specific operations provided by the kernel mode through specific interfaces. When an application needs to perform some operations that can only be executed by the kernel mode, such as reading and writing to the disk, network communication, etc., it will pass control to the kernel mode through system calls, and wait for the kernel to complete the corresponding operation before returning to the user mode.

[0031] The calling operation includes any one of the following: a mapping table creation operation, a mapping table processing operation, a BPF program loading operation, a BPF program mounting operation, a BPF program unloading operation, a BPF program mapping mounting into a target operation, a BPF program lookup operation, and a BPF information verification operation. The operation type of the calling operation can be reflected by an operation type parameter (CommandPrompt, cmd). The function of the mapping table creation operation is to create a BPF mapping, and the cmd parameter thereof indicates BPF_MAP_CREATE. The mapping table processing operation can include a mapping table query operation, a mapping table update operation, a mapping table deletion operation, and a mapping table traversal operation, and the cmd parameters thereof are BPF_MAP_LOOKUP_ELEM, BPF_MAP_UPDATE_ELEM, BPF_MAP_DELETE_ELEM, and BPF_MAP_NEXT_KEY, respectively. The function of the BPF program loading operation is to verify and load a BPF program, and the cmd parameter thereof indicates BPF_PROG_LOAD. The function of the BPF program mounting operation is to mount a BPF program on a kernel event, and the cmd parameter thereof indicates BPF_PROG_ATTACH. The function of the BPF program unloading operation is to unload a BPF program from a kernel event, and the cmd parameter thereof indicates BPF_PROG_DETACH. The function of the BPF program mapping mounting into a target operation is to mount a BPF mapping or into the / sys / fs / bpf target in the sysfs, which is commonly used to keep a BPF program in the kernel, and the cmd parameter thereof indicates BPF_OBJ_PIN. The function of the BPF program lookup operation is to find a BPF program from the / sys / fs / bpf target, and the cmd parameter thereof indicates BPF_OBJ_get. The function of the BPF information verification operation is to verify and load BTF information, and the cmd parameter thereof indicates BPF_BTF_LOAD. The BTF information mainly refers to BPF Type Format (BTF), which is a format used to describe data types and function signatures in a BPF program.

[0032] The BPF program is composed of a BPF instruction set, which can be understood as a program instruction composed of eBPF bytecode.

[0033] In this embodiment, the trace bpf system call in the eBPF technology is used to monitor the calling operation of the eBPF user mode program on the kernel mode, and the monitoring program is legal, i.e., trusted, to the eBPF system.

[0034] S120, obtaining a calling attribute parameter corresponding to the calling operation.

[0035] The calling attribute parameter includes an original calling attribute parameter and first signature data, and the first signature data is obtained by signing the original calling attribute parameter by the eBPF user mode program. That is, the calling attribute parameter is obtained by signing the original calling attribute parameter by the eBPF user mode program.

[0036] In this embodiment, the calling attribute parameter is obtained in the following manner: the eBPF user mode program receives a system call request; performs a hash operation on the original calling attribute parameter to obtain first signature data; and splices the first signature data and the original calling attribute parameter to obtain the calling attribute parameter.

[0037] The first signature data includes a preset number of characters, for example, 256. The system call request includes an original calling attribute parameter, which is determined by the type of the calling operation. Different calling operations correspond to different original calling attribute parameters. The specific original calling attribute parameters corresponding to each calling operation can be referred to the existing eBPF technology, which is not limited herein. For example, if the calling operation is a BPF program loading operation (BPF_PROG_LOAD), the original calling attribute parameter can include: a BPF program type, a pointer to an instruction array, an instruction quantity, a log output buffer, a log buffer size, and a log level; if the calling operation is a mapping table creation operation (BPF_MAP_CREATE), the original calling attribute parameter can include: a mapping table type, an object pointed to by the mapping table, a key byte, a value byte, a maximum number of mapping entries, and the like.

[0038] In this embodiment, if the eBPF user mode program is a legal user mode program, the eBPF user mode program will perform a hash operation on the original calling attribute parameter by using a preset hash algorithm to obtain the message digest corresponding to the original calling attribute parameter, that is, the first signature data, and finally add the first signature data to a preset position of the original calling attribute parameter, that is, splice the first signature data and the original calling attribute parameter to obtain the calling attribute parameter. The preset hash algorithm is set in the eBPF system in advance, and each legal program in the eBPF system is signed according to the preset hash algorithm.

[0039] If the eBPF user mode program is an illegal user mode program, the eBPF user mode program will perform a hash operation on the original calling attribute parameter by using a non-preset hash algorithm to obtain an illegal message digest corresponding to the original calling attribute parameter, that is, illegal first signature data, and splice the illegal first signature data and the original calling attribute parameter to obtain an illegal calling attribute parameter. Alternatively, the illegal user mode program does not perform a hash operation on the original calling attribute parameter, and directly uses the original calling attribute parameter as the calling attribute parameter.

[0040] Optionally, the first signature data and the original call attribute parameter are spliced to obtain the call attribute parameter, and the splicing manner can be that the first signature data is added before or after the original call attribute parameter to obtain the call attribute parameter.

[0041] The splicing manner of the first signature data and the original call attribute parameter is pre-set in the eBPF system, and each legal program in the eBPF system follows the manner to splice or split the first signature data and the original call attribute parameter. In this embodiment, in order to quickly split the first signature data and the original call attribute parameter in the subsequent signature verification process, the first signature data can be added before or after the original call attribute parameter. That is, the call attribute parameter can be represented as: original call attribute parameter + first signature data, or first signature data + original call attribute parameter.

[0042] The system call request further includes an operation type parameter (cmd parameter); after the first signature data and the original call attribute parameter are spliced to obtain the call attribute parameter, the call attribute parameter is sent to the kernel state, and the operation type parameter corresponding call operation is performed on the kernel state.

[0043] In this embodiment, when the call operation of the eBPF user state program on the kernel state is detected, the call attribute parameter corresponding to the call operation is obtained from the kernel state.

[0044] Specifically, the manner of obtaining the call attribute parameter corresponding to the call operation can be that a mapping table creation request is sent to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and the call attribute parameter is written into the mapping table; the call attribute parameter corresponding to the call operation is read from the mapping table.

[0045] The mapping table creation request includes information such as the type of the mapping table to be created, the signature verification key type in the mapping table, and the signature verification value type. After receiving the mapping table creation request sent by the monitoring program, the kernel state creates a mapping table based on the mapping table creation request, and writes the call attribute parameter sent by the user state program into the mapping table. The monitoring program reads the call attribute parameter corresponding to the call operation from the mapping table. Exemplarily, Figure 2 is a schematic diagram of obtaining the call attribute parameter corresponding to the call operation, as shown in Figure 2 The detected user state program initiates a call operation to the kernel state, and the monitoring program reads the call attribute parameter from the kernel state through the mapping table (map).

[0046] S130, signature verification is performed on the call attribute parameter to obtain a signature verification result.

[0047] The signature verification result includes signature verification pass and signature verification fail. In this embodiment, the purpose of verifying the call attribute parameter is to detect whether the eBPF user space program that initiates the call operation to the kernel mode is legal.

[0048] Optionally, the manner of verifying the call attribute parameter to obtain the signature verification result can be: splitting the call attribute parameter into the original call attribute parameter and the first signature data; verifying the first signature data based on the original call attribute parameter to obtain the signature verification result.

[0049] In this embodiment, if the eBPF user space program that initiates the call operation to the kernel mode is legal, the call attribute parameter is spliced from the original call attribute parameter and the legal first signature data; if the eBPF user space program that initiates the call operation to the kernel mode is illegal, the call attribute parameter is spliced from the original call attribute parameter and the illegal first signature data, or the call attribute parameter is only composed of the original call attribute parameter. For the monitoring program, whether the eBPF user space program is legal or not, the call attribute parameter is split in a preset manner, and the two parts of data are one part of the original call attribute parameter and the other part of the first signature data.

[0050] Specifically, the manner of splitting the call attribute parameter into the original call attribute parameter and the first signature data can be: extracting data of a preset number of characters from the beginning or the end of the call attribute parameter to determine as the first signature data; determining the data other than the first signature data in the call attribute parameter as the original call attribute parameter.

[0051] In this embodiment, if the splicing manner of the original call attribute parameter and the first signature data is to add the first signature data before the original call attribute parameter, data of a preset number of characters is extracted from the beginning of the call attribute parameter as the first signature data. If the splicing manner of the original call attribute parameter and the first signature data is to add the first signature data after the original call attribute parameter, data of a preset number of characters is extracted from the end of the call attribute parameter as the first signature data.

[0052] Optionally, the manner of verifying the first signature data based on the original call attribute parameter to obtain the signature verification result can be: performing a hash operation on the original call attribute parameter to obtain second signature data; comparing the second signature data with the first signature data; if the second signature data is the same as the first signature data, the signature verification result is signature verification pass; if the second signature data is not the same as the first signature data, the signature verification result is signature verification fail.

[0053] In this embodiment, the monitoring program performs hash operation on the original call parameter according to the preset hash algorithm to obtain the second information digest of the original call attribute parameter, that is, the second signature data. The second signature data is compared with the first signature data. If the second signature data is the same as the first signature data, it indicates that the eBPF user state program initiating the call operation to the kernel state is legal, that is, the signature verification result is that the signature verification is passed. If the second signature data is not the same as the first signature data, it indicates that the eBPF user state program initiating the call operation to the kernel state is illegal, that is, the signature verification result is that the signature verification is not passed.

[0054] In this embodiment, the reason why the second signature data is not the same as the first signature data can be that the first signature data is obtained by using a non-preset hash algorithm for hash operation (that is, the illegal eBPF user state program uses a non-preset hash algorithm for signature), or the split first signature data is actually part of the correct original call attribute parameter, and the split original call attribute parameter is actually another part of the correct original call attribute parameter (that is, the illegal eBPF user state program does not perform signature).

[0055] S140, the signature verification result is sent to the kernel state, so that the kernel state processes the call operation based on the signature verification result.

[0056] Specifically, the kernel state processes the call operation based on the signature verification result. If the signature verification result is that the signature verification is not passed, the kernel state interrupts the call operation and generates a reminder information. If the signature verification result is that the signature verification is passed, the kernel state does not perform any processing, that is, the eBPF user state program is allowed to continue to perform the call operation to the kernel state.

[0057] On the basis of the above embodiment, Figure 3 is a flowchart of a program detection method provided by an embodiment of the present application, as shown in Figure 3 The method comprises the following steps:

[0058] S310, the eBPF user state program receives a system call request, performs hash operation on the original call attribute parameter in the system call request to obtain first signature data.

[0059] S320, the first signature data is added before or after the original call attribute parameter to obtain a call attribute parameter, the call attribute parameter is sent to the kernel state, and the kernel state is executed with an operation type parameter corresponding to the call operation.

[0060] S330, the monitoring program detects the call operation of the eBPF user state program to the kernel state.

[0061] S340, send a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and writes the call attribute parameter into the mapping table; read the call attribute parameter corresponding to the call operation from the mapping table.

[0062] S350, extract data of a preset number of characters from the beginning or the end of the call attribute parameter, and determine the data as first signature data; determine other data in the call attribute parameter except the first signature data as original call attribute parameter.

[0063] S360, perform a hash operation on the split original call attribute parameter to obtain second signature data; compare the second signature data with the split first signature data; if the second signature data is the same as the first signature data, the signature verification result is that the signature verification passes; if the second signature data is not the same as the first signature data, the signature verification result is that the signature verification fails.

[0064] S370, send the signature verification result to the kernel state, and if the signature verification result is that the signature verification fails, the kernel state interrupts the call operation.

[0065] In the embodiment, by signing the call attribute parameter of the call operation, the illegal eBPF program can be effectively prevented from being loaded into the system, and the malicious attack can be directly blocked from the source.

[0066] The technical scheme of the embodiment detects the call operation of the eBPF user state program to the kernel state; obtains the call attribute parameter corresponding to the call operation; wherein the call attribute parameter includes original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user state program; performs signature verification on the call attribute parameter to obtain a signature verification result; wherein the signature verification result includes signature verification pass and signature verification fail; and sends the signature verification result to the kernel state, so that the kernel state processes the call operation based on the signature verification result. The program detection method provided in the embodiment detects the call operation of the eBPF user state program to the kernel state, performs signature verification on the call attribute parameter corresponding to the call operation, and determines whether the eBPF user state program is illegal according to the signature verification result, so that the illegal eBPF program can be accurately detected, and the security of the eBPF system is improved.

[0067] Figure 4 is a structural schematic diagram of a program detection device provided by an embodiment of the present application, as shown in the figure, the device comprises: Figure 4

[0068] The call operation detection module 410 is configured to detect the call operation of the eBPF user state program to the kernel state.

[0069] ​The calling attribute parameter obtaining module 420 is configured to obtain calling attribute parameters corresponding to the calling operation, wherein the calling attribute parameters include original calling attribute parameters and first signature data, and the first signature data is obtained by signing the original calling attribute parameters by the eBPF user space program.

[0070] The signature verification result obtaining module 430 is configured to verify the calling attribute parameters to obtain a signature verification result, wherein the signature verification result includes a signature verification pass and a signature verification fail.

[0071] The calling operation processing module 440 is configured to send the signature verification result to the kernel state, so that the kernel state processes the calling operation based on the signature verification result.

[0072] Optionally, the calling attribute parameter obtaining module 420 is further configured to:

[0073] send a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and writes the calling attribute parameters into the mapping table;

[0074] read the calling attribute parameters corresponding to the calling operation from the mapping table.

[0075] Optionally, the signature verification result obtaining module 430 is further configured to:

[0076] split the calling attribute parameters into the original calling attribute parameters and the first signature data;

[0077] verify the first signature data based on the original calling attribute parameters to obtain a signature verification result.

[0078] Optionally, the signature verification result obtaining module 430 is further configured to:

[0079] extract data of a preset number of characters from the beginning or the end of the calling attribute parameters to determine as the first signature data;

[0080] determine other data in the calling attribute parameters except the first signature data as the original calling attribute parameters.

[0081] Optionally, the signature verification result obtaining module 430 is further configured to:

[0082] perform a hash operation on the original calling attribute parameters to obtain second signature data;

[0083] compare the second signature data with the first signature data;

[0084] If the second signature data is same as the first signature data, the signature verification result is signature verification pass; if the second signature data is not same as the first signature data, the signature verification result is signature verification fail.

[0085] Optionally, the calling operation processing module 440 is further configured to:

[0086] If the signature verification result is signature verification fail, information of the signature verification fail is sent to the kernel mode, so that the kernel mode interrupts the calling operation.

[0087] Optionally, the calling attribute parameter is obtained in the following manner:

[0088] The eBPF user mode program receives a system call request; wherein the system call request comprises an original calling attribute parameter;

[0089] The original calling attribute parameter is subjected to a hash operation to obtain first signature data;

[0090] The first signature data and the original calling attribute parameter are spliced to obtain a calling attribute parameter.

[0091] Optionally, the first signature data and the original calling attribute parameter are spliced to obtain a calling attribute parameter, comprising:

[0092] The first signature data is added before or after the original calling attribute parameter to obtain a calling attribute parameter.

[0093] Optionally, the system call request further comprises an operation type parameter; after the first signature data and the original calling attribute parameter are spliced to obtain a calling attribute parameter, the method further comprises:

[0094] The calling attribute parameter is sent to the kernel mode, and the kernel mode is executed with the calling operation corresponding to the operation type parameter.

[0095] Optionally, the calling operation comprises any one of the following: a mapping table creation operation, a mapping table processing operation, a BPF program loading operation, a BPF program mounting operation, a BPF program unloading operation, a BPF program mapping mounting operation into a target, a BPF program lookup operation, and a BTF information verification operation.

[0096] Optionally, the BPF program is composed of a BPF instruction set.

[0097] The above device can execute the method provided by all the foregoing embodiments of the present application, and has corresponding function modules and beneficial effects for executing the above method. Technical details not described in detail in the present embodiment can be referred to the method provided by all the foregoing embodiments of the present application.

[0098] Figure 5 A structural diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.

[0099] As shown in Figure 5 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected to the at least one processor 11 in communication, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded into the random access memory (RAM) 13 from the storage unit 18. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0100] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, speakers, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0101] The processor 11 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the program detection method.

[0102] In some embodiments, the program detection method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the program detection method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the program detection method by way of other means, e.g., by way of firmware.

[0103] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0104] Computer programs implementing methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0105] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0107] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0108] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0109] The embodiment of the present application further provides a computer program product comprising a computer program which, when executed by a processor, implements the program detection method provided in any embodiment of the present application.

[0110] The computer program product can be written in one or more programming languages or combinations of languages including object-oriented languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0111] Note that the above only describes the preferred embodiments of the present application and the applied technical principles. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A program detection method characterized by comprising: The method comprises: detecting a call operation of an extended Berkeley data packet filter (eBPF) user space program to a kernel state; obtaining a call attribute parameter corresponding to the call operation; wherein the call attribute parameter comprises an original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user space program; verifying the call attribute parameter to obtain a verification result; wherein the verification result comprises verification pass and verification fail; sending the verification result to the kernel state, so that the kernel state processes the call operation based on the verification result; wherein the call attribute parameter is obtained in the following manner: the eBPF user space program receives a system call request; wherein the system call request comprises an original call attribute parameter; performing a hash operation on the original call attribute parameter to obtain first signature data; splicing the first signature data and the original call attribute parameter to obtain the call attribute parameter; the system call request further comprises an operation type parameter; after splicing the first signature data and the original call attribute parameter to obtain the call attribute parameter, the following steps are further included: sending the call attribute parameter to the kernel state and performing the call operation corresponding to the operation type parameter on the kernel state.

2. The method of claim 1, wherein, Obtaining the call attribute parameter corresponding to the call operation comprises: sending a mapping table creation request to the kernel state, so that the kernel state creates a mapping table based on the mapping table creation request, and writes the call attribute parameter into the mapping table; reading the call attribute parameter corresponding to the call operation from the mapping table.

3. The method of claim 1, wherein, Verifying the call attribute parameter to obtain a verification result comprises: splitting the call attribute parameter into an original call attribute parameter and first signature data; verifying the first signature data based on the original call attribute parameter to obtain a verification result.

4. The method of claim 3, wherein, Splitting the call attribute parameter into an original call attribute parameter and first signature data comprises: extracting data of a predetermined number of characters from the beginning or end of the call attribute parameter to determine the first signature data; determining the data other than the first signature data in the call attribute parameter as the original call attribute parameter.

5. The method of claim 3, wherein, Verifying the first signature data based on the original call attribute parameter to obtain a verification result comprises: performing a hash operation on the original call attribute parameter to obtain second signature data; comparing the second signature data with the first signature data; if the second signature data is the same as the first signature data, the verification result is verification pass; if the second signature data is not the same as the first signature data, the verification result is verification fail.

6. The method of claim 1, wherein, Sending the verification result to the kernel state, so that the kernel state processes the call operation based on the verification result, comprises: if the verification result is verification fail, sending information of the verification fail to the kernel state, so that the kernel state interrupts the call operation.

7. The method of claim 1, wherein, Splicing the first signature data and the original call attribute parameter to obtain a call attribute parameter, including: Adding the first signature data before or after the original call attribute parameter to obtain a call attribute parameter.

8. The method of claim 1, wherein, The call operation includes any one of the following: a mapping table creation operation, a mapping table processing operation, a BPF program loading operation, a BPF program mounting operation, a BPF program unloading operation, a BPF program mapping mounting into a target operation, a BPF program lookup operation, and a BTF information verification operation.

9. The method of claim 8, wherein, The BPF program is composed of a BPF instruction set.

10. A program detection device for executing the program detection method according to any one of claims 1 to 9, characterized by Including: A call operation detection module is configured to detect a call operation of an extended Berkeley Packet Filter (eBPF) user space program to a kernel space; A call attribute parameter acquisition module is configured to acquire a call attribute parameter corresponding to the call operation; wherein the call attribute parameter includes an original call attribute parameter and first signature data, and the first signature data is obtained by signing the original call attribute parameter by the eBPF user space program; A signature verification result acquisition module is configured to verify the call attribute parameter to obtain a signature verification result; wherein the signature verification result includes a signature verification pass and a signature verification fail; A call operation processing module is configured to send the signature verification result to the kernel space, so that the kernel space processes the call operation based on the signature verification result.

11. An electronic device, comprising: The computer program is stored in the memory and executable by the processor, and when the processor executes the computer program, the program detection method of any one of claims 1-9 is implemented.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the program detection method of any one of claims 1-9.

13. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the program detection method of any one of claims 1-9.

Images