Real-time detection method and device for time stamps of modified files of Linux system

Abstract

The invention discloses a real-time detection method and device for a timestamp of a modified file of a Linux system, and the detection method comprises the following steps: obtaining the call information of a utime system in real time through a secrityinodesetr callback function of an LSM, and obtaining the file modification information of a to-be-modified file in the call information of the utime system; judging whether the file modification time in the file modification information is less than the current system access time or not; if yes, it is judged that the timestamp in the file modification information is illegally modified, and an illegal intrusion risk exists; and if not, judging that the timestamp in the file modification information is in a normal state. According to the method, the call information of the utime system is obtained in real time through the secrityinodesetr callback function of the LSM, the intrusion trace cleaning behavior is detected in real time based on the comparison result of the timestamp and the current system time, and the method has a good application prospect in the field of host security.

Description

Technical Field

[0001] The present invention relates to the technical field of Linux detection methods, and in particular to a real-time detection method and device for modifying file timestamps in a Linux system. Background Art

[0002] During the intrusion process, in order to better hide themselves, attackers often need to clean up the traces of the intrusion process. Common methods include modifying file times, deleting sensitive log records, etc. These methods all involve modifying the file timestamp. On a normal system, the modification of the file timestamp is based on the current system time. Generally, there is no modification of the timestamp of a file to a previous time point. If there is such an operation, there may be some illegal intrusion operations. In the prior art, no method for real-time detection of modified file timestamps has been found. Summary of the invention

[0003] The purpose of the embodiment of the present invention is to provide a real-time detection method and device for modifying file timestamps in a Linux system, obtain utime system call information in real time through the security_inode_setattr callback function of LSM, detect intrusion trace cleaning behavior in real time based on the comparison result between the timestamp and the current system time, and further block the operation of the behavior, which has a good application prospect in the field of host security.

[0004] To solve the above technical problems, a first aspect of an embodiment of the present invention provides a real-time detection method for modifying file timestamps in a Linux system, comprising the following steps:

[0005] Obtain the utime system call information in real time through the security_inode_setattr callback function of LSM, and obtain the file modification information of the file to be modified in the utime system call information;

[0006] Determine whether the file modification time in the file modification information is less than the current system access time;

[0007] If yes, it is determined that the timestamp in the file modification information has been illegally modified, and there is a risk of illegal intrusion;

[0008] If not, it is determined that the timestamp in the file modification information is in a normal state.

[0009] Further, the obtaining of the file modification information of the file to be modified in the utime system call information includes:

[0010] Get the calling parameters of the utime system call information;

[0011] Acquire the path of the file to be modified based on the calling parameters;

[0012] The file modification information of the file to be modified is obtained through the path of the file to be modified.

[0013] Furthermore, after determining that the timestamp in the file modification information is illegally modified, the method further includes:

[0014] Based on a preset false alarm detection library, determining whether the timestamp modification process is the same as any one of several preset false alarm processes in the preset false alarm detection library;

[0015] If so, it is determined that the timestamp modification process is a false alarm;

[0016] If not, it is determined that the timestamp modification process has a risk of illegal intrusion, and the risk information of the timestamp modification process is sent to the client.

[0017] Furthermore, after determining that the timestamp in the file modification information is illegally modified, the method further includes:

[0018] Based on a preset processing strategy library, determining whether the to-be-modified file type and the corresponding timestamp modification process are the same as a plurality of preset processing strategies in the preset processing strategy library;

[0019] If yes, blocking the modification process of the file to be modified;

[0020] If not, the modification process of the modified file is allowed to execute normally.

[0021] Furthermore, before obtaining the utime system call information in real time through the security_inode_setattr callback function of the LSM, it also includes:

[0022] Receive request information from the client to establish a communication link;

[0023] After the communication link is established, the processing strategy information and the false alarm whitelist sent by the client are received, and the preset false alarm detection library and the preset processing strategy library are updated.

[0024] Accordingly, a second aspect of an embodiment of the present invention provides a real-time detection device for modifying file timestamps in a Linux system, comprising:

[0025] An information calling module is used to obtain utime system call information in real time through the security_inode_setattr callback function of LSM, and obtain file modification information of the file to be modified in the utime system call information;

[0026] A timestamp modification judgment module, which is used to judge whether the file modification time in the file modification information is less than the current system access time;

[0027] A process control module, which is used to determine that the timestamp in the file modification information is illegally modified and there is a risk of illegal intrusion when it is determined that the file modification time in the file modification information is less than the current system access time;

[0028] The process control module is also used to determine that the timestamp in the file modification information is in a normal state when it is determined that the file modification time in the file modification information is equal to the current system access time.

[0029] Furthermore, the information calling module includes:

[0030] A parameter acquisition unit, which is used to obtain the call parameters of the utime system call information;

[0031] A path acquisition unit, used for acquiring the path of the file to be modified based on the calling parameter;

[0032] The information acquisition unit is used to acquire the file modification information of the file to be modified through the path of the file to be modified.

[0033] Furthermore, the real-time detection device for modifying file timestamps in the Linux system further includes: a false alarm judgment module, the false alarm judgment module including:

[0034] a false alarm judgment unit, which is used to judge whether the timestamp modification process is the same as any one of several preset false alarm processes in the preset false alarm detection library based on a preset false alarm detection library;

[0035] a false alarm control unit, configured to determine that the timestamp modification process is a false alarm when the timestamp modification process is the same as any one of a plurality of preset false alarm processes in the preset false alarm detection library;

[0036] The false alarm control unit is also used to determine that the timestamp modification process has an illegal intrusion risk when the timestamp modification process is different from any of several preset false alarm processes in the preset false alarm detection library, and send the risk information of the timestamp modification process to the client.

[0037] Furthermore, the real-time detection device for modifying file timestamps in the Linux system further includes: a disposal strategy module, the disposal strategy module including:

[0038] A processing strategy judgment unit, which is used to judge whether the type of the file to be modified and the corresponding timestamp modification process are the same as any one of several preset processing strategies in the preset processing strategy library based on the preset processing strategy library;

[0039] A processing strategy control unit, which is used to block the modification process of the file to be modified when the type of the file to be modified and the corresponding timestamp modification process are the same as any one of the several preset processing strategies in the preset processing strategy library;

[0040] The handling strategy control unit is further configured to allow the modification process of the modified file to be executed normally when the type of the file to be modified and the corresponding timestamp modification process are different from any of the preset handling strategies in the preset handling strategy library.

[0041] Furthermore, the real-time detection device for modifying file timestamps in the Linux system further includes: an information updating module, the information updating module including:

[0042] A link establishing unit, which is used to receive a request message from a client to establish a communication link;

[0043] The information updating unit is used to receive the handling strategy information and the false alarm whitelist sent by the client after the communication link is established, and to update the preset false alarm detection library and the preset handling strategy library.

[0044] Correspondingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned real-time detection method for modifying file timestamps in the Linux system.

[0045] Correspondingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-mentioned real-time detection method for modifying file timestamps in the Linux system.

[0046] The above technical solution of the embodiment of the present invention has the following beneficial technical effects:

[0047] 1. Through the security_inode_setattr callback function of the Linux Security Module (LSM), this method can capture and analyze the utime system call in real time to monitor the modification behavior of the file timestamp;

[0048] 2. By comparing the modification time of the file with the current system time, this method can identify situations where the timestamp has been modified in the opposite direction, which is usually a sign of illegal intrusion or malicious behavior;

[0049] 3. It can timely determine the normal status or illegal tampering of file timestamps, thereby providing key information to system administrators to help them take preventive measures to enhance the integrity and security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flow chart of a real-time detection method for modifying file timestamps in a Linux system provided by an embodiment of the present invention;

[0051] Figure 2 It is a judgment logic diagram of a real-time detection method for modifying file timestamps in a Linux system provided by an embodiment of the present invention;

[0052] Figure 3 It is a module block diagram of a real-time detection device for modifying file timestamps in a Linux system provided by an embodiment of the present invention;

[0053] Figure 4 is a block diagram of an information calling module provided by an embodiment of the present invention;

[0054] Figure 5 is a block diagram of a false alarm judgment module provided by an embodiment of the present invention;

[0055] Figure 6 is a block diagram of a processing strategy module provided by an embodiment of the present invention;

[0056] Figure 7 It is a block diagram of an information updating module provided by an embodiment of the present invention.

[0057] Reference numerals:

[0058] 1. Information calling module, 11. Parameter acquisition unit, 12. Path acquisition unit, 13. Information acquisition unit, 2. Timestamp modification judgment module, 3. Process control module, 4. False alarm judgment module, 41. False alarm judgment unit, 42. False alarm control unit, 5. Disposal strategy module, 51. Disposal strategy judgment unit, 52. Disposal strategy control unit, 6. Information update module, 61. Link establishment unit, 62. Information update unit. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0060] After the attack of the Linux system intrusion process is completed, the attacker needs to clear the logs and attack path. If all log files are cleared, it is too easy for the administrator to notice. If only some key log information is deleted or replaced, and the file timestamp is restored to a previous time, then the traces of the attack can be perfectly hidden.

[0061] Please refer to Figure 1 In order to solve the above problem, a first aspect of an embodiment of the present invention provides a real-time detection method for modifying file timestamps in a Linux system, comprising the following steps:

[0062] Step S100, obtaining utime system call information in real time through the security_inode_setattr callback function of LSM, and obtaining file modification information of the file to be modified in the utime system call information.

[0063] Step S200, determining whether the file modification time in the file modification information is less than the current system access time.

[0064] Step S300: If yes, it is determined that the timestamp in the file modification information has been illegally modified, and there is a risk of illegal intrusion.

[0065] Step S400: If not, it is determined that the timestamp in the file modification information is in a normal state.

[0066] The present invention intercepts the utime system call through the kernel hook technology under Linux, obtains the corresponding parameters of the file modification, and judges whether the modification time is less than the current system time. If so, there is a risk, and if not, it is normal.

[0067] By monitoring file attribute change requests in real time, in particular, by capturing the utime system call through the security_inode_setattr callback function in the Linux Security Module (LSM), potential illegal modifications to file timestamps are detected. When it is detected that the modification time of a file is earlier than the current system time, it indicates that someone is trying to tamper with the file timestamp to cover up illegal activities or intrusion traces, thereby triggering a security alert. On the contrary, if the file modification time is the latest, this usually indicates that the timestamp is updated normally. The above implementation effectively enhances system security and helps prevent and identify system intrusions and data tampering by detecting and responding to abnormal changes in file timestamps in real time.

[0068] Specifically, before step S100, an initialization step is performed to register the callback function of the security_inode_setattr point of the LSM, and the utime system call is intercepted here.

[0069] After the system detection process is completed, the module is written and the callback function of the security_inode_setattr point of the LSM is unregistered when the kernel module is unloaded.

[0070] Specifically, obtaining the file modification information of the file to be modified in the utime system call information in step S100 includes:

[0071] Step S110, obtaining the calling parameters of the utime system call information.

[0072] Step S120, obtaining the path of the file to be modified based on the calling parameters.

[0073] Step S130: obtaining file modification information of the file to be modified through the path of the file to be modified.

[0074] Step S100 involves intercepting the utime system call through the security_inode_setattr callback function of the Linux Security Module (LSM). This process first collects the parameters of the call in step S110, and then uses these parameters to determine the path of the target file in step S120. Finally, in step S130, the current modification information of the file is retrieved according to this path. The above steps accurately identify and record any behavior that attempts to change the file timestamp, thereby providing strong protection for the integrity and security of the file system. Through this continuous monitoring and data acquisition, the system is able to detect potential security threats in real time, such as malware attacks or unauthorized file tampering, ensuring comprehensive monitoring of file timestamp changes and appropriate security responses.

[0075] In addition, before obtaining the utime system call information in real time through the security_inode_setattr callback function of the LSM in step S100, the following steps are also included:

[0076] Step S101: receiving a request from a client to establish a communication link.

[0077] Step S102: after the communication link is established, receiving the handling strategy information and the false alarm whitelist sent by the client, and updating the preset false alarm detection library and the preset handling strategy library.

[0078] After receiving the handling strategy information and false alarm whitelist sent by the client, the preset false alarm detection library and preset handling strategy library are updated, which can make the system more flexible to adapt to different application scenarios and needs. The updated false alarm detection library can more accurately identify false alarms, reduce unnecessary interference and misjudgment; and the updated handling strategy library can provide more effective response measures according to the actual situation, improving the security and reliability of the system. Optional, please refer to Figure 2After determining in step S300 that the timestamp in the file modification information is illegally modified, the method further includes:

[0079] Step S510: Based on the preset false alarm detection library, it is determined whether the timestamp modification process is the same as any of the preset false alarm processes in the preset false alarm detection library.

[0080] Step S520: If yes, then determine that the timestamp modification process is a false alarm.

[0081] Step S530: If not, it is determined that the timestamp modification process has a risk of illegal intrusion, and the risk information of the timestamp modification process is sent to the client.

[0082] After detecting that the file timestamp may have been illegally modified, the system conducts further analysis through the preset false alarm detection library to distinguish between real security threats and false alarms. Specifically, the system compares the process that triggers the timestamp modification with the known false alarm processes in the false alarm detection library. If the two are found to match, the timestamp modification is judged as a false alarm, thereby avoiding unnecessary security alerts; if they do not match, it is confirmed that there is a potential risk of illegal intrusion, which requires further security measures to deal with. This logic ensures that the system can maintain high security while reducing the impact of false alarms on normal operations.

[0083] False positive processes in the false positive detection library usually refer to legitimate processes that are mistakenly marked as malicious or abnormal. These processes may be misjudged by the security detection system due to normal system behavior or specific application operations. The following are some examples of processes that may be false positives: 1. System log service processes: For example, logrotate, rsyslogd, syslogd, these processes may modify the timestamp of the file and be mistakenly reported as malicious behavior. 2. Legitimate decompression programs: such as tar, unzip and other tools, they may be mistaken as intrusions due to the decompression requirements, which require the file time to be retained during compression and the file time to be restored to a previous time during decompression.

[0084] Optional, see Figure 2 After determining in step S300 that the timestamp in the file modification information is illegally modified, the method further includes:

[0085] Step S610: Based on the preset processing strategy library, it is determined whether the type of the file to be modified and the corresponding timestamp modification process are the same as several preset processing strategies in the preset processing strategy library.

[0086] Step S620: If yes, the modification process of the file to be modified is blocked.

[0087] Step S630: If not, the modification process of the modified file is allowed to execute normally.

[0088] After detecting that the file timestamp may have been illegally modified, the type of file to be modified and its modification process will be analyzed by referring to the preset disposal policy library. This process involves comparing the file attributes and modification process with the policies defined in the library to determine whether there is a match. If a matching policy is found, the corresponding blocking measures are executed to prevent the potential malicious behavior from continuing.

[0089] These policies may include blocking file write operations, isolating files, or notifying administrators for further analysis. On the contrary, if no matching policy is found, the file modification operation will be allowed to continue, ensuring that normal file operations are not affected, thereby protecting system security while avoiding unnecessary interference with legitimate operations. This policy-based response mechanism improves the efficiency and accuracy of handling security incidents. The following is a specific example of the preset disposal policies that may be adopted:

[0090] For example: 1. Intercept the modification behavior and send an alert. 2. Send an alert without intercepting. 3. Allow the process to modify the file timestamp.

[0091] Accordingly, please refer to Figure 3 A second aspect of an embodiment of the present invention provides a real-time detection device for modifying file timestamps in a Linux system, comprising:

[0092] Information calling module 1, which is used to obtain utime system call information in real time through the security_inode_setattr callback function of LSM, and obtain file modification information of the file to be modified in the utime system call information;

[0093] A timestamp modification judgment module 2 is used to judge whether the file modification time in the file modification information is less than the current system access time;

[0094] Process control module 3, which is used to determine that the timestamp in the file modification information is illegally modified and there is a risk of illegal intrusion when it is determined that the file modification time in the file modification information is less than the current system access time;

[0095] The process control module 3 is further configured to determine that the timestamp in the file modification information is in a normal state when it is determined that the file modification time in the file modification information is equal to the current system access time.

[0096] For further information, please refer to Figure 4 , the information calling module 1 includes:

[0097] A parameter acquisition unit 11 is used to acquire call parameters of the utime system call information;

[0098] A path acquisition unit 12, which is used to acquire the path of the file to be modified based on the calling parameters;

[0099] The information acquisition unit 13 is used to acquire the file modification information of the file to be modified through the path of the file to be modified.

[0100] For further information, please refer to Figure 5 The real-time detection device for modifying the file timestamp of the Linux system also includes: a false alarm judgment module 4, and the false alarm judgment module 4 includes:

[0101] A false alarm determination unit 41, which is used to determine whether the timestamp modification process is the same as any of several preset false alarm processes in the preset false alarm detection library based on the preset false alarm detection library;

[0102] A false alarm control unit 42, which is used to determine that the timestamp modification process is a false alarm when the timestamp modification process is the same as any of a plurality of preset false alarm processes in a preset false alarm detection library;

[0103] The false alarm control unit 42 is also used to determine that the timestamp modification process has an illegal intrusion risk when the timestamp modification process is different from any of several preset false alarm processes in the preset false alarm detection library, and send the risk information of the timestamp modification process to the client.

[0104] For further information, please refer to Figure 6 The real-time detection device for modifying the file timestamp of the Linux system also includes: a processing strategy module 5, and the processing strategy module 5 includes:

[0105] A processing strategy determination unit 51 is used to determine whether the type of the file to be modified and the corresponding timestamp modification process are the same as any of the preset processing strategies in the preset processing strategy library based on the preset processing strategy library;

[0106] A processing strategy control unit 52, which is used to block the modification process of the file to be modified when the file type to be modified and the corresponding timestamp modification process are the same as any of the preset processing strategies in the preset processing strategy library;

[0107] The handling strategy control unit 52 is further used to allow the modification process of the modified file to be executed normally when the type of the file to be modified and the corresponding timestamp modification process are different from any of the preset handling strategies in the preset handling strategy library.

[0108] Furthermore, the real-time detection device for modifying file timestamps in the Linux system further includes: an information updating module 6, which includes:

[0109] A link establishing unit 61, which is used to receive a request message from a client to establish a communication link;

[0110] The information updating unit 62 is used to receive the handling strategy information and the false alarm whitelist sent by the client after the communication link is established, and update the preset false alarm detection library and the preset handling strategy library.

[0111] Accordingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned real-time detection method for modifying file timestamps in the Linux system.

[0112] Correspondingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-mentioned real-time detection method for modifying file timestamps in the Linux system.

[0113] The embodiment of the present invention aims to protect a real-time detection method and device for modifying file timestamps in a Linux system. The detection method includes the following steps: obtaining utime system call information in real time through the security_inode_setattr callback function of LSM, and obtaining file modification information of the file to be modified in the utime system call information; judging whether the file modification time in the file modification information is less than the current system access time; if so, judging that the timestamp in the file modification information is illegally modified and there is a risk of illegal intrusion; if not, judging that the timestamp in the file modification information is in a normal state. The above technical solution has the following effects:

[0114] 1. Through the security_inode_setattr callback function of the Linux Security Module (LSM), this method can capture and analyze the utime system call in real time to monitor the modification behavior of the file timestamp;

[0115] 2. By comparing the modification time of the file with the current system time, this method can identify situations where the timestamp has been modified in the opposite direction, which is usually a sign of illegal intrusion or malicious behavior;

[0116] 3. It can timely determine the normal status or illegal tampering of file timestamps, thereby providing key information to system administrators to help them take preventive measures to enhance the integrity and security of the system.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A real-time detection method for modifying file timestamps in a Linux system, characterized in that: The steps include: Obtain the utime system call information in real time through the security_inode_setattr callback function of LSM, and obtain the file modification information of the file to be modified in the utime system call information; Determine whether the file modification time in the file modification information is less than the current system access time; If yes, it is determined that the timestamp in the file modification information has been illegally modified, and there is a risk of illegal intrusion; If not, it is determined that the timestamp in the file modification information is in a normal state.

2. The real-time detection method for modifying file timestamps in a Linux system according to claim 1, characterized in that: The step of obtaining the file modification information of the file to be modified in the utime system call information includes: Get the calling parameters of the utime system call information; Acquire the path of the file to be modified based on the calling parameters; The file modification information of the file to be modified is obtained through the path of the file to be modified.

3. The real-time detection method for modifying file timestamps in a Linux system according to claim 2, characterized in that: After determining that the timestamp in the file modification information is illegally modified, the method further includes: Based on a preset false alarm detection library, determining whether the timestamp modification process is the same as any one of several preset false alarm processes in the preset false alarm detection library; If so, it is determined that the timestamp modification process is a false alarm; If not, it is determined that the timestamp modification process has a risk of illegal intrusion, and the risk information of the timestamp modification process is sent to the client.

4. The real-time detection method for modifying file timestamps in a Linux system according to claim 2, characterized in that: After determining that the timestamp in the file modification information is illegally modified, the method further includes: Based on a preset processing strategy library, determining whether the to-be-modified file type and the corresponding timestamp modification process are the same as a plurality of preset processing strategies in the preset processing strategy library; If yes, blocking the modification process of the file to be modified; If not, the modification process of the modified file is allowed to execute normally.

5. The real-time detection method for modifying file timestamps in a Linux system according to claim 2, characterized in that: Before obtaining the utime system call information in real time through the security_inode_setattr callback function of LSM, it also includes: Receive request information from the client to establish a communication link; After the communication link is established, the processing strategy information and the false alarm whitelist sent by the client are received, and the preset false alarm detection library and the preset processing strategy library are updated.

6. A real-time detection device for modifying file timestamps in a Linux system, characterized in that: include: An information calling module is used to obtain utime system call information in real time through the security_inode_setattr callback function of LSM, and obtain file modification information of the file to be modified in the utime system call information; A timestamp modification judgment module, which is used to judge whether the file modification time in the file modification information is less than the current system access time; A process control module, which is used to determine that the timestamp in the file modification information is illegally modified and there is a risk of illegal intrusion when it is determined that the file modification time in the file modification information is less than the current system access time; The process control module is also used to determine that the timestamp in the file modification information is in a normal state when it is determined that the file modification time in the file modification information is equal to the current system access time.

7. The real-time detection device for modifying file timestamps in Linux system according to claim 6, characterized in that: The information calling module includes: A parameter acquisition unit, which is used to obtain the call parameters of the utime system call information; A path acquisition unit, used for acquiring the path of the file to be modified based on the calling parameter; The information acquisition unit is used to acquire the file modification information of the file to be modified through the path of the file to be modified.

8. The real-time detection device for modifying file timestamps in Linux system according to claim 7, characterized in that: Also includes: A false alarm judgment module, the false alarm judgment module comprising: a false alarm judgment unit, which is used to judge whether the timestamp modification process is the same as any one of several preset false alarm processes in the preset false alarm detection library based on a preset false alarm detection library; a false alarm control unit, configured to determine that the timestamp modification process is a false alarm when the timestamp modification process is the same as any one of a plurality of preset false alarm processes in the preset false alarm detection library; The false alarm control unit is also used to determine that the timestamp modification process has an illegal intrusion risk when the timestamp modification process is different from any of several preset false alarm processes in the preset false alarm detection library, and send the risk information of the timestamp modification process to the client.

9. The real-time detection device for modifying file timestamps in Linux system according to claim 7, characterized in that: Also includes: A disposal strategy module, the disposal strategy module comprising: A processing strategy judgment unit, which is used to judge whether the type of the file to be modified and the corresponding timestamp modification process are the same as any one of several preset processing strategies in the preset processing strategy library based on the preset processing strategy library; A processing strategy control unit, which is used to block the modification process of the file to be modified when the type of the file to be modified and the corresponding timestamp modification process are the same as any one of the several preset processing strategies in the preset processing strategy library; The handling strategy control unit is further configured to allow the modification process of the modified file to be executed normally when the type of the file to be modified and the corresponding timestamp modification process are different from any of the preset handling strategies in the preset handling strategy library.

10. The real-time detection device for modifying file timestamps in Linux system according to claim 7, characterized in that: Also includes: An information updating module, wherein the information updating module comprises: A link establishing unit, which is used to receive a request message from a client to establish a communication link; The information updating unit is used to receive the handling strategy information and the false alarm whitelist sent by the client after the communication link is established, and to update the preset false alarm detection library and the preset handling strategy library.

Images