Method and device for detecting privilege lifting attack, electronic equipment and storage medium
By obtaining and analyzing the permission information and target file operation information of the process to be detected, and performing power-elevation verification and detection, the existing power-elevation attack detection methods are solved, and more accurate and extensive power-elevation attack detection is achieved.
Patent Information
- Application Number
- CN202311269681.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-26
- Publication Date
- 2025-03-28
AI Technical Summary
The existing power-raising attack detection methods have low detection accuracy and are not universal, and are prone to false alarms.
By obtaining the process permission information of the process to be detected, the process permission information of the child process and the target file operation information, the power hike verification and detection are carried out based on these information to determine whether the process to be detected reads the power hike verification file during the power hike process.
It improves the accuracy and universality of power-elevated attack detection, effectively avoiding false alarms of power-elevated attacks.
Smart Images
Figure CN119720181A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of Internet technology, and in particular to a privilege escalation attack detection method, device, electronic device and storage medium. Background Art
[0002] A user-mode privilege escalation attack is an attack in which an attacker attacks a process with privilege escalation capability in the system and elevates the current ordinary user's privileges to root privileges. In related technologies, during the privilege escalation attack detection process, corresponding feature matching detection is often performed based on the attack instruction features. However, in this method, a detection rule can only be effective for one vulnerability and is not universal. Moreover, it mainly matches the attack payload through regular expressions and cannot detect the essence of the attack behavior. It is very easy to be bypassed, and the accuracy of privilege escalation attack detection is low, which may easily lead to false alarms of privilege escalation attacks. Summary of the invention
[0003] The present application provides a privilege escalation attack detection method, apparatus, device, storage medium and computer program product, which can improve the accuracy of privilege escalation attack detection while improving the versatility of privilege escalation attack detection, and can also effectively avoid false alarms of privilege escalation attack warnings.
[0004] On the one hand, the present application provides a method for detecting privilege escalation attacks, the method comprising:
[0005] Obtaining first process permission information corresponding to a process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected, wherein the process to be detected is a process without root permission;
[0006] When the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has the root permission, based on the target file operation information, a privilege escalation verification test is performed on the process to be detected to obtain a privilege escalation verification test result; the target privilege escalation permission is the permission to obtain the root permission; the privilege escalation verification test result is used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process;
[0007] Based on the privilege escalation check detection result, a privilege escalation attack detection is performed on the process to be detected to obtain a privilege escalation attack detection result.
[0008] On the other hand, a privilege escalation attack detection device is provided, the device comprising:
[0009] An information acquisition module is configured to acquire first process permission information corresponding to a process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected;
[0010] The privilege escalation verification module is configured to perform privilege escalation verification on the process to be detected based on the target file operation information when the first process permission information indicates that the process to be detected has the target privilege escalation permission and the second process permission information indicates that the child process has the root permission, and obtain a privilege escalation verification result; the target privilege escalation permission is the permission to obtain the root permission; the privilege escalation verification result is used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process;
[0011] The privilege escalation attack detection module is configured to perform privilege escalation attack detection on the process to be detected based on the privilege escalation verification detection result to obtain a privilege escalation attack detection result.
[0012] Another aspect provides an electronic device, including: a processor;
[0013] a memory for storing instructions executable by the processor;
[0014] The processor is configured to execute the instructions to implement any of the above-mentioned methods for detecting privilege escalation attacks.
[0015] On the other hand, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above-mentioned privilege escalation attack detection methods.
[0016] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the privilege escalation attack detection method provided in the above various optional implementations.
[0017] The privilege escalation attack detection method, device, equipment, storage medium and computer program product provided by this application have the following technical effects:
[0018] In the process of performing privilege escalation attack detection on a process to be detected that does not have root privileges, the present application obtains first process permission information corresponding to the process to be detected, second process permission information corresponding to the child process of the process to be detected, and target file operation information corresponding to the process to be detected; when the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has root privileges, based on the target file operation information, a privilege escalation verification detection is performed on the process to be detected to obtain a privilege escalation verification detection result indicating whether the process to be detected reads the privilege escalation verification file during the privilege escalation process, and in combination with the privilege escalation verification detection result, a privilege escalation attack detection is performed on the process to be detected, which can realize general user-state privilege escalation attack detection based on the essential characteristics of user-state privilege escalation attack (privilege escalation verification will not be performed during the privilege escalation process), thereby improving the accuracy of privilege escalation attack detection while improving the versatility of privilege escalation attack detection, and thus effectively avoiding false alarms of privilege escalation attack. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0020] Figure 1 It is a schematic diagram of an application environment of a privilege escalation attack detection method provided in an embodiment of the present application;
[0021] Figure 2 It is a flowchart of a privilege escalation attack detection method provided in an embodiment of the present application;
[0022] Figure 3 It is a flowchart of another privilege escalation attack detection method provided in an embodiment of the present application;
[0023] Figure 4 It is a flowchart of another privilege escalation attack detection method provided in an embodiment of the present application;
[0024] Figure 5 It is a structural diagram of a privilege escalation attack detection device provided in an embodiment of the present application;
[0025] Figure 6 It is a block diagram of an electronic device for detecting privilege escalation attacks provided in an embodiment of the present application. DETAILED DESCRIPTION
[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0028] See also Figure 1 , Figure 1 It is a schematic diagram of an application environment of a privilege escalation attack detection method provided in an embodiment of the present application, and the application environment may at least include a terminal 100.
[0029] In an optional embodiment, the terminal 100 can be used to provide business services, and perform privilege escalation attack detection during business processing. Specifically, the terminal 100 may include a detection system 101, which can be used to detect process file operation information and process permission detection; further, the terminal 100 may also include a rule engine 102, and when the detection system 101 detects a change in process permissions, the detected file operation information and process permission information can be sent to the rule engine 102, and accordingly, the rule engine 102 can perform privilege escalation attack detection; optionally, the terminal 100 may also include an alarm module 103, and accordingly, when the rule engine 102 detects the existence of a privilege escalation attack operation, the privilege escalation alarm information can be sent to the alarm module 103, and accordingly, the alarm module 103 can display the privilege escalation alarm information to the user.
[0030] In a specific embodiment, the terminal 100 may include but is not limited to smart phones, desktop computers, tablet computers, laptop computers, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart wearable devices, smart voice interaction devices, smart home appliances, aircraft, vehicle terminals, smart TVs and other types of electronic devices. It can also be software running on the above electronic devices, such as applications, applets, etc. The operating system running on the electronic device in the embodiment of the present application may include but is not limited to Android system, IOS system, Linux (Ubuntu, CentOS), Windows, etc. The embodiment of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.
[0031] In addition, it should be noted that Figure 1 What is shown is only an application environment of the privilege escalation attack detection method, and the embodiments of this specification are not limited to the above. For example, privilege escalation attack detection can also be implemented on a server.
[0032] In the embodiments of this specification, the detection system 101, the rule engine 102 and the alarm module 103 in the above-mentioned terminal 100 can be directly or indirectly connected through wired or wireless communication, and this application does not make any limitation here.
[0033] The following describes a method for detecting privilege escalation attacks in this application. Figure 2 It is a flowchart of a privilege escalation attack detection method provided in an embodiment of the present application. This specification provides method operation steps such as the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or terminal or server product is executed, it can be executed in the order shown in the embodiment or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment). Specifically, Figure 2 As shown, the method may include:
[0034] S201: Acquire first process permission information corresponding to the process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected;
[0035] In a specific embodiment, the process to be detected may be a process without root authority. The child process of the process to be detected may be a process created by the process to be detected.
[0036] In a specific embodiment, the first process permission information may be the process permission information of the process to be detected; the second process permission information may be the process permission information of the above-mentioned child process; specifically, the process permission information may be used to indicate whether the corresponding process has the target privilege escalation permission, and to indicate whether the corresponding process has the root permission. Specifically, the target privilege escalation permission may be the permission to obtain the root permission. Optionally, the process with the target privilege escalation permission may include a suid (setuid, which is a special permission in Linux. During the execution process, the caller will temporarily obtain the root permission) process, and may also include a process with setuid capability.
[0037] In an optional embodiment, if Figure 3 As shown, the above method may also include:
[0038] S207: Load the kernel driver and set a second target hook for calling a preset process creation function, so that when the preset process creation function is called, a mechanism for collecting process permission information of the corresponding process is started.
[0039] In a specific embodiment, the system call table replacement technology can be used to complete the hook (second target hook) for the preset process creation function call. Specifically, the preset process creation function can be a function that needs to be called to create a process. Accordingly, the first process permission information can be obtained in the following manner: when calling the preset process creation function to create the process to be detected, the first process permission information is collected.
[0040] Correspondingly, the second process permission information can be obtained in the following manner: when a preset process creation function is called to create a child process, the second process permission information is collected.
[0041] In a specific embodiment, the above-mentioned target file operation information may be the file operation information corresponding to the process to be detected, and the file operation information may be used to indicate the files operated by the corresponding process, and to indicate the operations performed on the operated files; specifically, the file operation information may include file identification information and operation attributes, the file identification information may be used to identify the file, and the operation attributes may be used to indicate the operations performed on the file, and optionally, the operation attributes may include read attributes, write attributes, etc.
[0042] In an optional embodiment, if Figure 3 As shown, the above method may also include:
[0043] S209: Load the kernel driver and set a first target hook for calling a preset file opening function, so that when the preset file opening function is called, a mechanism for collecting file operation information of the corresponding process is started.
[0044] In a specific embodiment, the system call table replacement technology can be used to complete the hook (first target hook) for calling the preset file opening function. Specifically, the preset file opening function can be a function that needs to be called to open the file. Accordingly, the above target file operation information can be obtained in the following manner:
[0045] When the process to be detected calls the preset file opening function, the target file operation information is collected.
[0046] In a specific embodiment, the detection system can be deployed in advance. Specifically, the administrator can log in to the terminal and deploy the process permission information detection mechanism (a mechanism for collecting process permission information of the corresponding process) and the process file operation information detection mechanism (a mechanism for collecting file operation information of the corresponding process) in the detection system. Accordingly, when the system starts, the process permission information detection mechanism and the process file operation information detection mechanism can be loaded, and then when it is detected that the preset process creation function is called, the process permission information of the currently created process can be collected, and when it is detected that the preset file opening function is called, the current file operation information can be collected.
[0047] In a specific embodiment, when any process calls a preset file opening function, the process identification information of the process can be collected at the same time as the file operation information of the process; accordingly, the target file operation information corresponding to the process and the process identification information of the process can be stored one by one in order to distinguish the file operation information corresponding to different processes.
[0048] In a specific embodiment, when calling a preset process creation function to create any process, the process identification information of the process can be collected at the same time as the process permission information of the process; accordingly, the process permission information corresponding to the process and the process identification information of the process can be stored one by one in order to distinguish the process permission information corresponding to different processes.
[0049] In the above embodiment, the process permission information detection based on the kernel hook mechanism can automatically trigger the process permission information detection when the preset process creation function is called, so as to identify the non-root permission process with the target permission to be elevated in combination with the detected process permission information. In addition, the process file operation information detection based on the kernel hook mechanism can automatically trigger the process file operation information detection when the preset file opening function is called, so as to identify whether to read the permission elevation verification file in combination with the detected file operation information, and then realize the determination of whether to perform the password verification operation in the permission elevation process.
[0050] S203: When the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has the root permission, based on the target file operation information, perform privilege escalation verification on the process to be detected to obtain a privilege escalation verification result.
[0051] In actual applications, when an ordinary user starts a process with the target privilege escalation permission (suid process or process with setuid capability) to switch the current user permission to root permission, the privilege escalation password must be verified. However, when an attacker performs a user-state privilege escalation attack, the root permission switch can be achieved without the privilege escalation password verification. Accordingly, in the embodiments of the present application, combined with the feature that an ordinary user must pass the privilege escalation password verification during the privilege escalation process when starting a process with the target privilege escalation permission, when the process with the target privilege escalation permission is performing privilege escalation, privilege escalation attack detection is performed by detecting whether a privilege escalation verification file is read (because when performing the privilege escalation password verification, the process must first read the privilege escalation verification file, so whether the process has read the privilege escalation verification file is equivalent to whether the privilege escalation password verification is performed).
[0052] In a specific embodiment, the above-mentioned privilege escalation verification test results can be used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process; optionally, the privilege escalation verification file can be a file storing privilege escalation verification information, such as the / etc / shadow file (shadow file), etc.
[0053] In a specific embodiment, when the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has root permission, it can be determined that the process with the target privilege escalation permission (the process to be detected) has triggered the privilege escalation (elevating the permission of the ordinary user account to the root permission). Accordingly, based on the target file operation information of the process to be detected, a privilege escalation verification test can be performed on the process to be detected to obtain a privilege escalation verification test result.
[0054] In an optional embodiment, the target file operation information may include: target file identification information corresponding to at least one operated file and target operation attributes corresponding to at least one operated file;
[0055] Correspondingly, based on the target file operation information, the privilege escalation check is performed on the process to be detected, and the privilege escalation check result may include:
[0056] Determine the file type corresponding to each operated file according to the target file identification information corresponding to each operated file;
[0057] Based on the file type and target operation attributes, a privilege escalation check is performed on the process to be detected to obtain a privilege escalation check result.
[0058] In a specific embodiment, at least one operated file may be a file operated by the process to be detected; specifically, the operation of the process corresponding to the file may include a read operation, a write operation, a delete operation, etc. The target file identification information corresponding to at least one operated file may be the target file identification information corresponding to at least one operated file. The target file identification information corresponding to any operated file may be the file identification information of the operated file. The target operation attribute corresponding to at least one operated file may be the target operation attribute corresponding to at least one operated file. The target operation attribute corresponding to any operated file may be the operation attribute corresponding to the operated file.
[0059] In an optional embodiment, the privilege escalation verification test result may include a first verification result; accordingly, the privilege escalation verification test is performed on the process to be detected based on the file type and the target operation attribute, and the privilege escalation verification test result may include:
[0060] When the file type corresponding to the first operation file indicates that the first operation file is not a privilege escalation verification file, or the target operation attribute corresponding to the first operation file does not include a read attribute, generating a first verification result;
[0061] In a specific embodiment, the file type can be used to indicate whether the target operation file is a privilege escalation verification file. The first operation file can be each operated file in the at least one operated file; the first verification result can be used to indicate that the process to be detected did not read the privilege escalation verification file during the privilege escalation (elevating the privilege to the root privilege) process.
[0062] In an optional embodiment, the privilege escalation verification test result may include a second verification result; accordingly, the privilege escalation verification test is performed on the process to be detected based on the file type and the target operation attribute, and the privilege escalation verification test result may include:
[0063] When the file type corresponding to the target operation file indicates that the target operation file is a privilege escalation verification file, and the target operation attribute corresponding to the target operation file includes a read attribute, generating a second verification result;
[0064] In a specific embodiment, the second operation file is any one of the at least one operated files; the second verification result can be used to indicate that the process to be detected reads the privilege escalation verification file during the privilege escalation process.
[0065] In the above embodiment, in the process of performing privilege escalation verification on the process to be detected based on the target file identification information corresponding to at least one operated file in the target file operation information and the target operation attribute corresponding to at least one operated file, the file type used to indicate whether the corresponding operated file is a privilege escalation verification file is first determined in combination with the target file identification information, and when the file type corresponding to each operated file indicates that the operated file is not a privilege escalation verification file, or the target operation attribute corresponding to each operated file does not include a read attribute, a first verification result is generated to indicate that the process to be detected did not read the privilege escalation verification file during the privilege escalation process; conversely, when the file type corresponding to any operated file indicates that the operated file is a privilege escalation verification file, and the target operation attribute corresponding to the operated file includes a read attribute, a second verification information is generated to indicate that the process to be detected read the privilege escalation verification file during the privilege escalation process, so that it can be accurately identified whether the process to be detected reads the privilege escalation verification file during the privilege escalation process, and then a general user-state privilege escalation attack detection can be performed based on the essential characteristics of the user-state privilege escalation attack (privilege escalation verification will not be performed during the privilege escalation process).
[0066] S205: Based on the privilege escalation check result, perform privilege escalation attack detection on the process to be detected to obtain a privilege escalation attack detection result.
[0067] In a specific embodiment, the above privilege escalation attack detection result can be used to indicate whether the process to be detected performs a privilege escalation attack operation.
[0068] In an optional embodiment, the above-mentioned privilege escalation attack detection result may include a first detection result;
[0069] Accordingly, based on the privilege escalation check detection result, the privilege escalation attack detection is performed on the detected process, and the privilege escalation attack detection result obtained may include:
[0070] When the privilege escalation verification test result indicates that the process to be detected did not read the privilege escalation verification file during the privilege escalation process, a first test result is generated.
[0071] In a specific embodiment, the first detection result may be used to indicate that the process to be detected has performed a privilege escalation attack operation.
[0072] In an optional embodiment, the above-mentioned privilege escalation attack detection result may include a second detection result;
[0073] Accordingly, based on the privilege escalation check detection result, the privilege escalation attack detection is performed on the detected process, and the privilege escalation attack detection result obtained may include:
[0074] When the privilege escalation verification test result indicates that the process to be detected reads the privilege escalation verification file during the privilege escalation process, a second test result is generated.
[0075] In a specific embodiment, the second detection result may be used to indicate that the process to be detected does not perform a privilege escalation attack operation, and accordingly, the user's operation is normal.
[0076] In the above embodiment, when the privilege escalation check result indicates that the process to be detected did not read the privilege escalation check file during the privilege escalation process, a first detection result is generated to indicate that the process to be detected has executed a privilege escalation attack operation; when the privilege escalation check result indicates that the process to be detected has read the privilege escalation check file during the privilege escalation process, a second detection result is generated to indicate that the process to be detected did not execute the privilege escalation attack operation. This can realize general user-state privilege escalation attack detection based on the essential characteristics of user-state privilege escalation attacks, thereby effectively ensuring the generality and accuracy of privilege escalation attack detection.
[0077] In an optional embodiment, when a privilege escalation attack is detected, corresponding feedback may be provided so as to timely perform attack defense; accordingly, the above method may further include:
[0078] When the privilege escalation attack detection result indicates that the process to be detected has performed a privilege escalation attack operation, privilege escalation attack alarm information is fed back.
[0079] In a specific embodiment, after the user logs in to the terminal and executes instructions on the terminal, triggering the process file operation information detection mechanism and the process permission information collection detection mechanism, the privilege escalation attack detection can be performed by combining the first process permission information corresponding to the process to be detected, the second process permission information corresponding to the child process of the process to be detected, and the target file operation information corresponding to the process to be detected. Figure 4 FIG. 1 is a flow chart of another method for detecting privilege escalation attacks provided in an embodiment of the present application. Figure 4 As shown, the privilege escalation attack detection may include the following steps:
[0080] S401: Based on the first process permission information, identify whether the process to be detected has the target privilege escalation permission; if so (that is, the process to be detected has the target privilege escalation permission), proceed to step S403; if not (that is, the process to be detected does not have the target privilege escalation permission), proceed to step S409.
[0081] S403: Based on the second process permission information, identify whether the child process has root permissions; if so (that is, the child process has root permissions), proceed to step S405; if not (that is, the child process does not have root permissions), proceed to step S409.
[0082] S405: Based on the target file operation information, identify whether the process to be detected reads the privilege escalation verification file during the privilege escalation process (i.e., perform privilege escalation verification on the process to be detected); if not (i.e., the process to be detected does not read the privilege escalation verification file during the privilege escalation process), proceed to step S407; if yes (i.e., the process to be detected reads the privilege escalation verification file during the privilege escalation process), proceed to step S409.
[0083] S407: Generate a privilege escalation attack detection result indicating that the process to be detected has performed a privilege escalation attack operation.
[0084] S409: Generate a privilege escalation attack detection result indicating that the process to be detected has not performed a privilege escalation attack operation.
[0085] It can be seen from the technical solutions provided in the above embodiments of this specification that, in the process of performing privilege escalation attack detection on a process to be detected that does not have root permissions, this specification obtains the first process permission information corresponding to the process to be detected, the second process permission information corresponding to the child process of the process to be detected, and the target file operation information corresponding to the process to be detected; when the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has root permissions, based on the target file operation information, a privilege escalation verification test is performed on the process to be detected to obtain a privilege escalation verification test result indicating whether the process to be detected reads the privilege escalation verification file during the privilege escalation process, and in combination with the privilege escalation verification test result, a privilege escalation attack detection is performed on the process to be detected, which can realize general user-state privilege escalation attack detection based on the essential characteristics of user-state privilege escalation attacks (privilege escalation verification will not be performed during the privilege escalation process), while improving the accuracy of privilege escalation attack detection, while improving the versatility of privilege escalation attack detection, and thus can also effectively avoid false alarms of privilege escalation attack alarms and the like.
[0086] The present application also provides a device for detecting privilege escalation attacks. Figure 5 As shown, the above device comprises:
[0087] The information acquisition module 510 is configured to acquire first process permission information corresponding to the process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected;
[0088] The privilege escalation verification module 520 is configured to perform privilege escalation verification on the process to be detected based on the target file operation information when the first process permission information indicates that the process to be detected has the target privilege escalation permission and the second process permission information indicates that the child process has the root permission, and obtain a privilege escalation verification result; the target privilege escalation permission is the permission to obtain the root permission; the privilege escalation verification result is used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process;
[0089] The privilege escalation attack detection module 530 is configured to perform privilege escalation attack detection on the process to be detected based on the privilege escalation verification detection result to obtain a privilege escalation attack detection result.
[0090] In an optional embodiment, the target file operation information is obtained by the following unit:
[0091] The file operation information collection unit is configured to collect the target file operation information when the process to be detected calls a preset file opening function.
[0092] In an optional embodiment, the device further comprises:
[0093] The first target hook setting module is configured to execute loading of the kernel driver and set the first target hook that calls the preset file opening function, so that when the preset file opening function is called, a mechanism for collecting file operation information of the corresponding process is started.
[0094] In an optional embodiment, the first process permission information is obtained by the following unit:
[0095] The first process permission information collection unit is configured to collect the first process permission information when a preset process creation function is called to create the process to be detected.
[0096] In an optional embodiment, the second process permission information is obtained by the following unit:
[0097] The second process permission information collection unit is configured to collect the second process permission information when calling a preset process creation function to create the child process.
[0098] In an optional embodiment, the device further comprises:
[0099] The kernel driver is loaded, and a second target hook for calling the preset process creation function is set, so that when the preset process creation function is called, a mechanism for collecting process permission information of the corresponding process is started.
[0100] In an optional embodiment, the target file operation information includes: target file identification information corresponding to at least one operated file and target operation attributes corresponding to the at least one operated file;
[0101] The privilege escalation verification module 520 includes:
[0102] A file type determination unit, configured to determine the file type corresponding to each operated file according to the target file identification information corresponding to each operated file;
[0103] The privilege escalation verification unit is configured to perform a privilege escalation verification test on the process to be detected based on the file type and the target operation attribute, and obtain a privilege escalation verification test result.
[0104] In an optional embodiment, the privilege escalation verification detection result includes a first verification result; and the privilege escalation verification unit includes:
[0105] A first privilege escalation verification subunit is configured to generate the first verification result when a file type corresponding to a first operation file indicates that the first operation file is not the privilege escalation verification file, or a target operation attribute corresponding to the first operation file does not include a read attribute;
[0106] The first operation file is each operated file in the at least one operated file; and the first verification result is used to indicate that the process to be detected did not read the privilege escalation verification file during the privilege escalation process.
[0107] In an optional embodiment, the privilege escalation verification detection result includes a second verification result; and the privilege escalation verification unit includes:
[0108] A second privilege escalation verification subunit is configured to generate a second verification result when a file type corresponding to a second operation file indicates that the second operation file is the privilege escalation verification file and a target operation attribute corresponding to the second operation file includes a read attribute;
[0109] The second operation file is any operated file among the at least one operated file; and the second verification result is used to indicate that the process to be detected has read the privilege escalation verification file during the privilege escalation process.
[0110] In an optional embodiment, the privilege escalation attack detection result includes a first detection result;
[0111] The privilege escalation attack detection module 530 includes:
[0112] The first privilege escalation attack detection unit is configured to generate the first detection result when the privilege escalation verification detection result indicates that the process to be detected did not read the privilege escalation verification file during the privilege escalation process, and the first detection result is used to indicate that the process to be detected has performed a privilege escalation attack operation.
[0113] In an optional embodiment, the privilege escalation attack detection result includes a second detection result;
[0114] The privilege escalation attack detection module 530 includes:
[0115] The second privilege escalation attack detection unit is configured to generate the second detection result when the privilege escalation verification detection result indicates that the process to be detected has read the privilege escalation verification file during the privilege escalation process, and the second detection result is used to indicate that the process to be detected has not performed a privilege escalation attack operation.
[0116] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.
[0117] Figure 6 is a block diagram of an electronic device for detecting privilege escalation attacks provided by an embodiment of the present application. Optionally, the electronic device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 The terminal may include an RF (Radio Frequency) circuit 610, a memory 620 including one or more computer-readable storage media, an input unit 630, a display unit 640, a sensor 650, an audio circuit 660, a WiFi (wireless fidelity) module 670, a processor 680 including one or more processing cores, and a power supply 690. Those skilled in the art will appreciate that Figure 6 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.
[0118] The RF circuit 610 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the downlink information of the base station, it is handed over to one or more processors 680 for processing; in addition, the data related to the uplink is sent to the base station. Generally, the RF circuit 610 includes but is not limited to an antenna, at least one amplifier, a tuner, one or more oscillators, a user identity module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, etc. In addition, the RF circuit 610 can also communicate with the network and other terminals through wireless communication. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, SMS (Short Messaging Service), etc.
[0119] The memory 620 can be used to store software programs and modules. The processor 680 executes various functional applications and data processing by running the software programs and modules stored in the memory 620. The memory 620 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, application programs required for functions, etc.; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 620 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 620 may also include a memory controller to provide the processor 680 and the input unit 630 with access to the memory 620.
[0120] The input unit 630 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 630 may include a touch-sensitive surface 631 and other input devices 632. The touch-sensitive surface 631, also known as a touch display screen or touchpad, can collect user touch operations on or near it (such as operations performed by users using fingers, styluses, or any other suitable objects or accessories on or near the touch-sensitive surface 631), and drive corresponding connection devices according to a pre-set program. Optionally, the touch-sensitive surface 631 may include a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 680, and can receive and execute commands sent by the processor 680. In addition, the touch-sensitive surface 631 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 631, the input unit 630 may further include other input devices 632. Specifically, the other input devices 632 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.
[0121] The display unit 640 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the terminal, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit 640 may include a display panel 641. Optionally, the display panel 641 may be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. Further, the touch-sensitive surface 631 may cover the display panel 641. When the touch-sensitive surface 631 detects a touch operation on or near it, it is transmitted to the processor 680 to determine the type of touch event, and then the processor 680 provides corresponding visual output on the display panel 641 according to the type of touch event. Among them, the touch-sensitive surface 631 and the display panel 641 can be two independent components to realize input and output functions, but in some embodiments, the touch-sensitive surface 631 and the display panel 641 can also be integrated to realize input and output functions.
[0122] The terminal may also include at least one sensor 650, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 641 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 641 and / or the backlight when the terminal is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the terminal posture (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc. that can be configured in the terminal, they will not be repeated here.
[0123] The audio circuit 660, the speaker 661, and the microphone 662 can provide an audio interface between the user and the terminal. The audio circuit 660 can transmit the received audio data to the speaker 661 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 662 converts the collected sound signal into an electrical signal, which is received by the audio circuit 660 and converted into audio data, and then the audio data is processed by the output processor 680 and sent to another terminal through the RF circuit 610, or the audio data is output to the memory 620 for further processing. The audio circuit 660 may also include an earplug jack to provide communication between an external headset and the terminal.
[0124] WiFi is a short-range wireless transmission technology. The terminal can help users send and receive emails, browse web pages, and access streaming media through the WiFi module 670. It provides users with wireless broadband Internet access. Figure 6 A WiFi module 670 is shown, but it is understandable that it is not an essential component of the terminal and can be omitted as needed without changing the essence of the invention.
[0125] The processor 680 is the control center of the terminal. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal and processes data by running or executing software programs and / or modules stored in the memory 620, and calling data stored in the memory 620, so as to perform overall detection of the terminal. Optionally, the processor 680 may include one or more processing cores; preferably, the processor 680 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 680.
[0126] The terminal also includes a power supply 690 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 680 through a power management system, so that the power management system can manage charging, discharging, and power consumption management. The power supply 690 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.
[0127] Although not shown, the terminal may also include a camera, a Bluetooth module, etc., which will not be described in detail herein. Specifically in this embodiment, the display unit of the terminal is a touch screen display, and the terminal further includes a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors in the method embodiment of the present invention.
[0128] In an exemplary embodiment, an electronic device is also provided, including: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the privilege escalation attack detection method as in the embodiment of the present disclosure.
[0129] In an exemplary embodiment, a computer-readable storage medium is also provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the privilege escalation attack detection method in the embodiment of the present disclosure.
[0130] In an exemplary embodiment, a computer program product or a computer program is also provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the privilege escalation attack detection method provided in the above various optional implementations.
[0131] It is understandable that in the specific implementation of this application, user-related data is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.
[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
[0133] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.
[0134] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims
1. A method for detecting privilege escalation attacks, characterized in that: The method comprises: Obtaining first process permission information corresponding to a process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected, wherein the process to be detected is a process without root permission; When the first process permission information indicates that the process to be detected has the target privilege escalation permission, and the second process permission information indicates that the child process has the root permission, based on the target file operation information, a privilege escalation verification test is performed on the process to be detected to obtain a privilege escalation verification test result; the target privilege escalation permission is the permission to obtain the root permission; the privilege escalation verification test result is used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process; Based on the privilege escalation check detection result, a privilege escalation attack detection is performed on the process to be detected to obtain a privilege escalation attack detection result.
2. The method according to claim 1, characterized in that: The target file operation information is obtained in the following manner: When the process to be detected calls a preset file opening function, the target file operation information is collected.
3. The method according to claim 2, characterized in that The method further comprises: The kernel driver is loaded, and a first target hook for calling the preset file opening function is set, so that when the preset file opening function is called, a mechanism for collecting file operation information of the corresponding process is started.
4. The method according to claim 1, characterized in that: The first process permission information is obtained in the following manner: When the preset process creation function is called to create the process to be detected, the first process permission information is collected.
5. The method according to claim 1, characterized in that The second process permission information is obtained in the following manner: When the preset process creation function is called to create the child process, the second process permission information is collected.
6. The method according to any one of claims 4 or 5, characterized in that: The method further comprises: The kernel driver is loaded, and a second target hook for calling the preset process creation function is set, so that when the preset process creation function is called, a mechanism for collecting process permission information of the corresponding process is started.
7. The method according to any one of claims 1 to 5, characterized in that: The target file operation information includes: target file identification information corresponding to at least one operated file and target operation attributes corresponding to the at least one operated file; The step of performing privilege escalation verification on the process to be detected based on the target file operation information to obtain a privilege escalation verification result includes: Determining the file type corresponding to each operated file according to the target file identification information corresponding to each operated file; Based on the file type and the target operation attribute, a privilege escalation check is performed on the process to be detected to obtain a privilege escalation check result.
8. The method according to claim 7, characterized in that The privilege escalation verification test result includes a first verification result; the privilege escalation verification test is performed on the process to be detected based on the file type and the target operation attribute, and the privilege escalation verification test result obtained includes: When the file type corresponding to the first operation file indicates that the first operation file is not the privilege escalation verification file, or the target operation attribute corresponding to the first operation file does not include a read attribute, generating the first verification result; The first operation file is each operated file in the at least one operated file; and the first verification result is used to indicate that the process to be detected did not read the privilege escalation verification file during the privilege escalation process.
9. The method according to claim 7, characterized in that: The privilege escalation verification test result includes a second verification result; the privilege escalation verification test is performed on the process to be detected based on the file type and the target operation attribute, and the privilege escalation verification test result obtained includes: When the file type corresponding to the second operation file indicates that the second operation file is the privilege escalation verification file, and the target operation attribute corresponding to the second operation file includes a read attribute, generating the second verification result; The second operation file is any operated file among the at least one operated file; and the second verification result is used to indicate that the process to be detected has read the privilege escalation verification file during the privilege escalation process.
10. The method according to any one of claims 1 to 5, characterized in that: The privilege escalation attack detection result includes a first detection result; The performing of privilege escalation attack detection on the process to be detected based on the privilege escalation verification detection result, and obtaining the privilege escalation attack detection result includes: When the privilege escalation verification detection result indicates that the process to be detected did not read the privilege escalation verification file during the privilege escalation process, the first detection result is generated, and the first detection result is used to indicate that the process to be detected has performed a privilege escalation attack operation.
11. The method according to any one of claims 1 to 5, characterized in that: The privilege escalation attack detection result includes a second detection result; The performing of privilege escalation attack detection on the process to be detected based on the privilege escalation verification detection result, and obtaining the privilege escalation attack detection result includes: When the privilege escalation detection result indicates that the process to be detected reads the privilege escalation verification file during the privilege escalation process, the second detection result is generated, and the second detection result is used to indicate that the process to be detected did not perform a privilege escalation attack operation.
12. A privilege escalation attack detection device, characterized in that: The device comprises: An information acquisition module is configured to acquire first process permission information corresponding to a process to be detected, second process permission information corresponding to a subprocess of the process to be detected, and target file operation information corresponding to the process to be detected; The privilege escalation verification module is configured to perform privilege escalation verification on the process to be detected based on the target file operation information when the first process permission information indicates that the process to be detected has the target privilege escalation permission and the second process permission information indicates that the child process has the root permission, and obtain a privilege escalation verification result; the target privilege escalation permission is the permission to obtain the root permission; the privilege escalation verification result is used to indicate whether the process to be detected reads the privilege escalation verification file during the privilege escalation process; The privilege escalation attack detection module is configured to perform privilege escalation attack detection on the process to be detected based on the privilege escalation verification detection result to obtain a privilege escalation attack detection result.
13. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the privilege escalation attack detection method as described in any one of claims 1 to 11.
14. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the privilege escalation attack detection method as described in any one of claims 1 to 11.