Process monitoring method based on NETLINKCONNECTOR

Abstract

The invention discloses a process monitoring method based on NETLINKCONNECTOR, and belongs to the field of process monitoring. The method is applied to an application layer, establishes communication with a kernel layer through an NETLINKCONNECTOR interface, and comprises the following steps: receiving a newly started process ID reported by a kernel in real time by using the NETLINKCONNECTOR interface; based on the newly started process ID, obtaining related information of the process from the system; and determining a process detection result based on the related information of the process. According to the scheme, the new startup process ID of the kernel is obtained by connecting the open NETLINKCONNECTOR interface of the kernel, process detection does not need to be carried out by utilizing a kernel program module, and related information of the process is obtained in the application layer according to the process ID so as to carry out process detection, so that risks can be timely and automatically found, kernel resources do not need to be occupied, and the stability of a system is not influenced.

Description

Technical Field

[0001] The present invention relates to the field of process monitoring, and in particular to a process monitoring method based on NETLINK_CONNECTOR. Background Art

[0002] System security is particularly important in all industries. If some unsafe processes are running in the system, it will not only increase system risks, but also consume machine resources and affect the normal operation of important processes.

[0003] For system security, maintenance personnel usually conduct regular inspections or block them through kernel program modules, which have certain defects and cannot be discovered and handled in time. Setting kernel program modules will occupy kernel resources, affect system stability, and easily cause system crashes.

[0004] Therefore, there is an urgent need to provide a new process monitoring method. Summary of the invention

[0005] In order to solve the problem that the existing kernel module process monitoring method occupies kernel resources, affects system stability, and easily causes system crash, an embodiment of the present invention provides a process monitoring method based on NETLINK_CONNECTOR.

[0006] On the one hand, a process monitoring method based on NETLINK_CONNECTOR is provided, which is applied to the application layer and establishes communication with the kernel layer through the NETLINK_CONNECTOR interface. The method includes:

[0007] Use the NETLINK_CONNECTOR interface to receive the new startup process ID reported by the kernel in real time;

[0008] Based on the newly started process ID, obtain relevant information of the process from the system;

[0009] Based on the relevant information of the process, a process detection result is determined.

[0010] On the other hand, a process monitoring device based on NETLINK_CONNECTOR is provided, which is used to implement the steps described in any method embodiment of the specification, is set at the application layer, and establishes communication with the kernel layer through the NETLINK_CONNECTOR interface. The device includes:

[0011] The receiving unit is connected to the NETLINK_CONNECTOR interface and is used to receive the new startup process ID reported by the kernel in real time by using the NETLINK_CONNECTOR interface;

[0012] An acquisition unit, used for acquiring relevant information of the process from the system based on the ID of the newly started process;

[0013] The detection unit is used to determine a process detection result based on the relevant information of the process.

[0014] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0015] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0016] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0018] By connecting to the NETLINK_CONNECTOR interface opened by the kernel, the ID of the newly started kernel process is obtained. There is no need to use the kernel program module for process detection. At the application layer, relevant information of the process is obtained according to the process ID to perform process detection. This can not only automatically discover risks with high timeliness, but also does not occupy kernel resources and will not affect the stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flow chart of a process monitoring method based on NETLINK_CONNECTOR provided by an embodiment of the present invention;

[0021] Figure 2 It is a structural diagram of a process monitoring device based on NETLINK_CONNECTOR provided by an embodiment of the present invention;

[0022] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The specific implementation of the above concept is described below.

[0025] Please refer to Figure 1 , a process monitoring method based on NETLINK_CONNECTOR provided by an embodiment of the present invention is applied to the application layer, and establishes communication with the kernel layer through the NETLINK_CONNECTOR interface. The method includes:

[0026] Step 100: Use the NETLINK_CONNECTOR interface to receive the new startup process ID reported by the kernel in real time;

[0027] Step 102: Based on the newly started process ID, obtain relevant information of the process from the system;

[0028] Step 104: Determine a process detection result based on the relevant information of the process.

[0029] In an embodiment of the present invention, by connecting to the NETLINK_CONNECTOR interface opened by the kernel, the kernel newly started process ID is obtained, and there is no need to use the kernel program module to perform process detection. At the application layer, relevant information of the process is obtained according to the process ID to perform process detection. This can not only automatically discover risks with high timeliness, but also does not occupy kernel resources and will not affect the stability of the system.

[0030] Described below Figure 1 How the various steps are performed.

[0031] For step 100:

[0032] The embodiment of the present invention runs at the application layer, which can be an application layer software program of the system. When the software program is started, it is connected to the NETLINK_CONNECTOR interface opened by the kernel, so that communication with the kernel can be established through the NETLINK_CONNECTOR interface. Whenever a new process is run in the kernel, the kernel can send the newly started process ID to the application layer software program. It can be seen that this step only needs to obtain the process ID from the kernel through the NETLINK_CONNECTOR interface and perform process detection at the application layer. There is no need to set up a kernel program module for process detection throughout the process, no need to occupy kernel resources, no damage to the stability of the system, and no system crash.

[0033] Regarding step 102:

[0034] In some implementations, step 102 may include:

[0035] Based on the newly started process ID, relevant information of the process is obtained from the proc file system of the application layer; wherein the relevant information at least includes the absolute path name of the process, the startup parameters of the process and the process content.

[0036] In this embodiment, the kernel NETLINK_CONNECTOR interface and the proc file system are used to obtain relevant information of the newly started process, so that the process information can be quickly obtained, and the proc file system is located at the application layer. Therefore, in the process of obtaining relevant information based on the newly started process ID, the kernel does not need to be involved and kernel resources do not need to be occupied.

[0037] Regarding step 104:

[0038] In some implementations, step 104 may include S1-S4:

[0039] S1, based on the relevant information, generates a unique fingerprint of the process;

[0040] S2, using the unique fingerprint to find out whether the process is in the current blacklist;

[0041] S3, if not, use the unique fingerprint to find out whether the process is in the current whitelist;

[0042] S4, obtain the process detection result.

[0043] In this embodiment, the startup process ID is obtained from the kernel through NETLINK_CONNECTOR, and then the process information is obtained in combination with the proc file system, and the security of the process is checked in combination with the preloaded authenticated whitelist and the user-marked blacklist. This can not only achieve the purpose of protecting the system, but also make the entire process of process detection located at the application layer, without the participation of the kernel, without occupying kernel resources, and avoiding affecting system stability.

[0044] It is understandable that the blacklist and whitelist are also located at the application layer. Using fingerprint matching blacklist and whitelist can improve the efficiency and accuracy of detection.

[0045] In some embodiments, before step S1, the method further includes:

[0046] Check whether the process is the kernel's own process;

[0047] If so, trust it absolutely and do nothing;

[0048] If not, the execution generates a unique fingerprint of the process based on the relevant information.

[0049] In this embodiment, in order to save matching time and reduce the size of the whitelist, it is not necessary to add the kernel's own process fingerprint to the whitelist. Therefore, before generating a unique fingerprint of a newly started process, it is necessary to check whether the process is a kernel's own process.

[0050] In some implementations, after step S4, the method further includes:

[0051] If the process detection result is on the blacklist, the process will be terminated and a danger alert will be issued with the highest priority;

[0052] If the process detection result is in the whitelist, the process is trusted to run normally;

[0053] If the process detection result is not in the whitelist or blacklist, an alarm will be issued that the process has not passed the security authentication. The user decides whether to continue the process and adds the process to the blacklist or whitelist based on the user's decision.

[0054] In this embodiment, corresponding measures are automatically executed based on the process detection results, and when the newly started process is not in the whitelist or blacklist, the user makes a decision, and the blacklist or whitelist is automatically updated according to the user's decision result. For example, if the user decides not to execute the newly started process, the process is added to the blacklist; if the user decides to execute the newly started process, the process is added to the whitelist, which improves the degree of automation and saves the user's manual operation time.

[0055] In some implementations, the whitelist is generated as follows:

[0056] When a whitelist is generated for the first time, the executable files in the secure system are scanned and fingerprint information is generated based on the file content to generate the initial whitelist:

[0057] During subsequent runs, the user manually adds the fingerprint information of the new process to the whitelist.

[0058] In this embodiment, when the whitelist is generated for the first time, if the system is confirmed to be safe, the executable files in the system are searched, and unique fingerprint information is generated based on the file content, thereby generating a whitelist of trusted executable programs; processes added by users later can be manually added to the whitelist.

[0059] When users handle alarms, they can generate unique fingerprint information for highly harmful processes and manually add them to the blacklist.

[0060] Please refer to Figure 2 The embodiment of the present invention provides a process monitoring device based on NETLINK_CONNECTOR, which is used to implement the steps of any method embodiment in the specification. The device is set at the application layer and establishes communication with the kernel layer through the NETLINK_CONNECTOR interface. The device includes:

[0061] The receiving unit 201 is connected to the NETLINK_CONNECTOR interface and is used to receive the new startup process ID reported by the kernel in real time using the NETLINK_CONNECTOR interface;

[0062] The acquisition unit 202 is used to acquire relevant information of the process from the system based on the ID of the newly started process;

[0063] The detection unit 203 is used to determine a process detection result based on the relevant information of the process.

[0064] In one embodiment of the present invention, the acquisition unit 202 is used to execute:

[0065] Based on the newly started process ID, relevant information of the process is obtained from the proc file system of the application layer; wherein the relevant information at least includes the absolute path name of the process, the startup parameters of the process and the process content.

[0066] In one embodiment of the present invention, the detection unit 203 is used to perform:

[0067] Based on the relevant information, a unique fingerprint of the process is generated;

[0068] Use the unique fingerprint to find out whether the process is in the current blacklist;

[0069] If not, use the unique fingerprint to find out whether the process is in the current whitelist;

[0070] Get the process detection result.

[0071] In one embodiment of the present invention, before the detection unit 203 generates a unique fingerprint of the process based on the relevant information, it is further configured to:

[0072] Check whether the process is the kernel's own process;

[0073] If so, trust it absolutely and do nothing;

[0074] If not, the execution generates a unique fingerprint of the process based on the relevant information.

[0075] In one embodiment of the present invention, after obtaining the process detection result, the detection unit 203 is further configured to execute:

[0076] If the process detection result is on the blacklist, the process will be terminated and a danger alert will be issued with the highest priority;

[0077] If the process detection result is in the whitelist, the process is trusted to run normally;

[0078] If the process detection result is not in the whitelist or blacklist, an alarm will be issued that the process has not passed the security authentication. The user decides whether to continue the process and adds the process to the blacklist or whitelist based on the user's decision.

[0079] In one embodiment of the present invention, the whitelist in the detection unit 203 is generated in the following manner:

[0080] When a whitelist is generated for the first time, the executable files in the secure system are scanned and fingerprint information is generated based on the file content to generate the initial whitelist:

[0081] During subsequent runs, the user manually adds the fingerprint information of the new process to the whitelist.

[0082] It should be noted that: the process monitoring device based on NETLINK_CONNECTOR provided in the above embodiment is only illustrated by the division of the above functional units. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0083] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the process monitoring method based on NETLINK_CONNECTOR provided in the above-mentioned method embodiments.

[0084] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the NETLINK_CONNECTOR-based process monitoring method provided in the above-mentioned method embodiments.

[0085] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes any of the NETLINK_CONNECTOR-based process monitoring methods in the above embodiments.

[0086] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0087] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application or some parts of the embodiments.

[0088] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0089] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A process monitoring method based on NETLINK_CONNECTOR, characterized in that: Applied to the application layer, establishing communication with the kernel layer through the NETLINK_CONNECTOR interface, the method includes: Use the NETLINK_CONNECTOR interface to receive the new startup process ID reported by the kernel in real time; Based on the newly started process ID, obtain relevant information of the process from the system; Based on the relevant information of the process, a process detection result is determined.

2. The method according to claim 1, characterized in that The process of obtaining relevant information of the newly started process from the system based on the ID of the newly started process includes: Based on the newly started process ID, relevant information of the process is obtained from the proc file system of the application layer; wherein the relevant information at least includes the absolute path name of the process, the startup parameters of the process and the process content.

3. The method according to claim 1, characterized in that The determining a process detection result based on the relevant information of the process includes: Based on the relevant information, generate a unique fingerprint of the process; Using the unique fingerprint to find out whether the process is in the current blacklist; If not, use the unique fingerprint to find out whether the process is in the current whitelist; Get the process detection result.

4. The method according to claim 3, characterized in that Before generating a unique fingerprint of the process based on the relevant information, the method further includes: Check whether the process is the kernel's own process; If so, trust it absolutely and do nothing; If not, the step of generating a unique fingerprint of the process based on the relevant information is performed.

5. The method according to claim 3, characterized in that After obtaining the process detection result, the method further includes: If the process detection result is that it is in the blacklist, the process is terminated and a danger alert is issued with the highest priority; If the process detection result is in the whitelist, the process is trusted to run normally; If the process detection result is that it is not in the whitelist and the blacklist, an alarm is given that the process has not passed the security authentication, and the user decides whether to continue the process, and the process is added to the blacklist or the whitelist according to the user's decision result.

6. The method according to claim 3, characterized in that The whitelist is generated in the following way: When a whitelist is generated for the first time, the executable files in the secure system are scanned and fingerprint information is generated based on the file content to generate the initial whitelist: During subsequent runs, the user manually adds the fingerprint information of the new process to the whitelist.

7. A process monitoring device based on NETLINK_CONNECTOR, used to implement the steps of any method described in claims 1-6 above, characterized in that: Set up at the application layer, establish communication with the kernel layer through the NETLINK_CONNECTOR interface, the device includes: The receiving unit is connected to the NETLINK_CONNECTOR interface and is used to receive the new startup process ID reported by the kernel in real time by using the NETLINK_CONNECTOR interface; An acquisition unit, used for acquiring relevant information of the process from the system based on the ID of the newly started process; The detection unit is used to determine a process detection result based on the relevant information of the process.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-6.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images