Intrusion detection method and device, storage medium and equipment

Abstract

The embodiment of the invention discloses an intrusion detection method and device, a storage medium and equipment, and the method comprises the steps: setting a tangent point in a dynamic link library of a JVM (Java Virtual Machine), starting a corresponding tangent plane in a kernel layer of an operating system, and when the tangent plane is triggered, starting the corresponding tangent plane; an operating system kernel queries a method called by a target event of a trigger section in a dynamic link library through stack information and detects whether the target event is the target event according to the method, and due to the fact that the intrusion event is detected through a system layer, even if an intruder directly intrudes from a JDWP protocol layer, the intruder does not intrude from the JDWP protocol layer, the intruder does not intrude from the JDWP protocol layer. System calling generated by intrusion can be sensed, and events can be effectively defended.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an intrusion detection method, device, storage medium and equipment. Background Art

[0002] At present, Java applications have been widely used in various fields. After developers write Java applications, they can debug the Java applications through Java Deployment Kit (JDK), such as Figure 1 shown.

[0003] JDK is used to provide a debugging environment for Java applications, and JDK needs to run on the Java Virtual Machine (JVM) to communicate with the debugged application (i.e., Java application) through the Java Debug Wire Protocol (JDWP) provided by the JVM. In other words, JDK needs the JVM to provide a running environment, and the JVM runs on the operating system kernel. It can be seen that the layers from bottom to top are kernel, JVM, and JDK.

[0004] In order to prevent a Java application being debugged in a JDK from being invaded, the prior art generally uses a Runtime Application Self-Protection (RASP) module in the JDK to achieve the purpose of defense.

[0005] However, by Figure 1 It can be seen that the RASP module is located in the JDK, and it can only defend against external intrusions at the application level. If an intruder directly invades the Java application debugged in the JDK from the JDWP protocol layer, the RASP module cannot perceive the intrusion event and cannot effectively defend against the intrusion.

[0006] Therefore, the embodiments of this specification provide an intrusion detection method, apparatus, storage medium and device. Summary of the invention

[0007] The embodiments of this specification provide an intrusion detection method, device, storage medium and electronic device to partially solve the problems existing in the above-mentioned prior art.

[0008] The embodiments of this specification adopt the following technical solutions:

[0009] This specification provides an intrusion detection method, which is applied to an operating system kernel; the method comprises: setting a cut point in advance in a dynamic link library of a Java virtual machine running on the operating system kernel;

[0010] The operating system kernel starts the aspect according to the point cut;

[0011] When it is detected that the slice is triggered by the Java virtual machine executing a target event, stack information corresponding to the Java virtual machine executing the target event is obtained;

[0012] Determine the method corresponding to the stack information in the dynamic link library;

[0013] The method is audited according to preset rules to detect whether the target event is an intrusion event.

[0014] Optionally, the operating system kernel starts the aspect according to the pointcut, specifically including:

[0015] The operating system kernel adopts at least one of the ebpf uprobe technology, kernel module and GOT table hijacking method to slice the cut point and start the slice.

[0016] Optionally, obtaining stack information corresponding to the Java virtual machine executing the target event specifically includes:

[0017] Traverse the stack frames of the CPU register, and obtain the memory address returned by each stack frame as the stack information corresponding to the Java virtual machine executing the target event.

[0018] Optionally, the method for determining the stack information corresponding to the dynamic link library specifically includes:

[0019] Parse the so file symbol table;

[0020] Determine the method corresponding to the memory address in the dynamic link library.

[0021] Optionally, a Java deployment tool is run on the Java virtual machine, and the Java deployment tool includes a runtime application self-protection module;

[0022] After detecting whether the target event is an intrusion event, the method further includes:

[0023] The detection result is sent to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

[0024] This specification provides an intrusion detection device, which sets a cut point in advance in a dynamic link library of a Java virtual machine running on the device; the device includes:

[0025] A section module, used for starting the section according to the section point;

[0026] A call stack backtracking module is used to obtain stack information corresponding to the Java virtual machine executing the target event when it is detected that the aspect is triggered by the Java virtual machine executing the target event;

[0027] A conversion module, used for determining a method corresponding to the stack information in the dynamic link library;

[0028] The rule matching module is used to audit the method according to preset rules to detect whether the target event is an intrusion event.

[0029] Optionally, the section module is specifically used to use at least one of the ebpf uprobe technology, kernel module and GOT table hijacking method to section the section point and start the section.

[0030] Optionally, a Java deployment tool is run on the Java virtual machine, and the Java deployment tool includes a runtime application self-protection module;

[0031] The rule matching module is also used to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

[0032] This specification provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned intrusion detection method is implemented.

[0033] The present specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned intrusion detection method when executing the program.

[0034] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0035] The embodiment of this specification discloses an intrusion detection method. The method sets a cut point in the dynamic link library of the JVM and starts a corresponding aspect in the kernel layer of the operating system. When the aspect is triggered, the kernel of the operating system queries the method called in the dynamic link library by the target event that triggers the aspect through stack information, and detects whether the target event is the target event based on the method. Since the method detects intrusion events through the system layer, even if the intruder invades directly from the JDWP protocol layer, the system call generated by the intrusion can be perceived, and the event can be effectively defended. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0037] Figure 1 It is a schematic diagram of an intrusion detection system in the prior art;

[0038] Figure 2 A schematic diagram of an intrusion detection process provided in an embodiment of this specification;

[0039] Figure 3 A schematic diagram of an intrusion detection system provided in an embodiment of this specification;

[0040] Figure 4 A schematic diagram of the structure of an intrusion detection device provided in an embodiment of this specification;

[0041] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0043] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0044] Depend on Figure 1It can be seen that when debugging a Java application, a normal debugger usually sets a breakpoint in a target function of the Java application through JDK, obtains some parameters (payload) of the target function at the breakpoint, and then makes certain adjustments to these payloads and continues to run. After adjusting the payload, the Java application calls the method in the dynamic link library of the JVM through JDK, and performs certain operations on the process, file or network instruction in the JVM system. Although the JDK and JVM communicate through the JDWP protocol, normal debuggers do not directly use JDWP, which can also be said that debuggers have no perception of JDWP. An intruder can directly invade the Java application from JDWP, set a breakpoint for the target function, and then directly modify the payload through JDWP, and then call the method in the dynamic link library of the JVM through the modified Java application. Therefore, the embodiment of this specification can detect intrusion events by monitoring the call of the dynamic link library of the JVM at the system level.

[0045] Figure 2 The schematic diagram of an intrusion detection process provided in this specification may include the following steps:

[0046] S200: Setting a cut point in advance in a dynamic link library of a Java virtual machine running on an operating system kernel.

[0047] In the embodiments of this specification, before the detection begins, it is necessary to set a cut-off point in the dynamic link library of the JVM, that is, to insert a stub in the dynamic link library of the JVM. The dynamic link library of the JVM is a code written using the Java Native Interface (JNI) technology, which is used to expand and enhance the functions of the JVM itself. When debugging a Java application using the JDK running the JVM, if an intruder invades the Java application through the JDWP, some methods in the dynamic link library of the JVM will usually be used. Therefore, a cut-off point can be set in the dynamic link library in advance.

[0048] S202: The operating system kernel starts the aspect according to the point of cut.

[0049] In the embodiment of this specification, steps S202 to S208 are all executed by the kernel.

[0050] In step S202, the kernel may use ebpf uprobe technology, kernel module or GOT table hijacking and other methods to slice the cut point in step S200 and start the slice.

[0051] S204: When it is monitored that the slice is triggered by the Java virtual machine executing a target event, stack information corresponding to the Java virtual machine executing the target event is obtained.

[0052] When the method with the cut-point set in the JVM's dynamic link library is called, the kernel can detect that the started aspect is triggered. At this time, it can be considered that the JVM triggered the aspect when executing the target event. The stack frame of the CPU register can be traversed to obtain the memory address returned by each stack frame as the stack information corresponding to the JVM executing the target event.

[0053] S206: Determine the method corresponding to the stack information in the dynamic link library.

[0054] After the kernel obtains the stack information, it can query the methods in the JVM dynamic link library based on the stack information. Specifically, after traversing the stack frames of the CPU registers and obtaining the memory address returned by each stack frame, the kernel can parse the so file symbol table and query the method corresponding to the memory address in the JVM dynamic link library.

[0055] S208: Auditing the method according to preset rules to detect whether the target event is an intrusion event.

[0056] The above-mentioned preset rules can be preset as needed. After the method called in the dynamic link library when the JVM executes the target event is queried in step S206, the queried method can be audited according to the preset rules to determine whether the target event is the target event.

[0057] In addition, in order to be consistent with the prior art of using the RASP module to defend against intrusion at the application layer, after the kernel in this specification detects whether the above target event is an intrusion event and obtains the detection result, it can also send the detection result to the RASP module in the JDK, so that the RASP module processes the target event according to the detection result, such as Figure 3 shown.

[0058] exist Figure 3 In the process, the kernel uses the ebpf uprobe technology to perform sectioning based on the sectioning point. When the sectioning is triggered, the process of the target event in the kernel is terminated, and it is detected whether it is an intrusion event according to the preset rules, and then the detection result is returned to RASP.

[0059] Through the above method, the detection of intrusion events in the kernel state of the operating system can be realized. Even if the intruder launches an intrusion at the JDWP protocol layer, the method provided in this manual can still achieve effective detection and defense.

[0060] The above is an intrusion detection method provided in an embodiment of this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0061] Figure 4 A schematic diagram of an intrusion detection device provided in an embodiment of this specification, the device can be applied to an operating system kernel; a cut point is pre-set in a dynamic link library of a Java virtual machine running on the device; the device includes:

[0062] A section module 401 is used to start the section according to the section point;

[0063] The call stack backtracking module 402 is used to obtain the stack information corresponding to the Java virtual machine executing the target event when it is detected that the slice is triggered by the Java virtual machine executing the target event;

[0064] A conversion module 403, used to determine the method corresponding to the stack information in the dynamic link library;

[0065] The rule matching module 404 is used to audit the method according to preset rules to detect whether the target event is an intrusion event.

[0066] Optionally, the section module 401 is specifically used to use at least one of the ebpf uprobe technology, kernel module and GOT table hijacking method to section the section point and start the section.

[0067] Optionally, the call stack backtracing module 402 is specifically used to traverse the stack frames of the CPU register, and obtain the memory address returned by each stack frame as the stack information corresponding to the Java virtual machine executing the target event.

[0068] Optionally, the conversion module 403 is specifically used to parse the so file symbol table; and determine the method corresponding to the memory address in the dynamic link library.

[0069] Optionally, a Java deployment tool is run on the Java virtual machine, and the Java deployment tool includes a runtime application self-protection module;

[0070] The rule matching module 404 is also used to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

[0071] This specification also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, it can be used to perform the above Figure 1Provides intrusion detection methods.

[0072] based on Figure 1 Based on the Figure 1 The intrusion detection method shown in the present specification also provides Figure 5 The structural diagram of the electronic device shown in FIG. Figure 5 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 2 The intrusion detection method described.

[0073] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0074] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0075] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0076] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0077] For the convenience of description, the above device is described by dividing it into various units according to its functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0078] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0079] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0080] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0082] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0083] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0084] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0085] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0086] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0088] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0089] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. An intrusion detection method, the method being applied to an operating system kernel; the method comprising: Set the cut point in advance in the dynamic link library of the Java virtual machine running on the operating system kernel; The operating system kernel starts the aspect according to the point cut; When it is detected that the slice is triggered by the Java virtual machine executing a target event, stack information corresponding to the Java virtual machine executing the target event is obtained; Determine the method corresponding to the stack information in the dynamic link library; The method is audited according to preset rules to detect whether the target event is an intrusion event.

2. The method according to claim 1, wherein the operating system kernel starts the aspect according to the point cut, specifically comprising: The operating system kernel adopts at least one of the ebpf uprobe technology, kernel module and GOT table hijacking method to slice the cut point and start the slice.

3. The method according to claim 1, obtaining stack information corresponding to the Java virtual machine executing the target event, specifically comprising: Traverse the stack frames of the CPU register, and obtain the memory address returned by each stack frame as the stack information corresponding to the Java virtual machine executing the target event.

4. The method according to claim 3, wherein the method for determining the stack information corresponding to the dynamic link library comprises: Parse the so file symbol table; A method for determining the memory address corresponding to the dynamic link library.

5. The method according to claim 1, wherein a Java deployment tool is running on the Java virtual machine, and the Java deployment tool includes a runtime application self-protection module; After detecting whether the target event is an intrusion event, the method further includes: The detection result is sent to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

6. An intrusion detection device, wherein a cut-off point is pre-set in a dynamic link library of a Java virtual machine running on the device; the device comprises: A section module, used for starting the section according to the section point; A call stack backtracking module is used to obtain stack information corresponding to the Java virtual machine executing the target event when it is detected that the aspect is triggered by the Java virtual machine executing the target event; A conversion module, used for determining a method corresponding to the stack information in the dynamic link library; The rule matching module is used to audit the method according to preset rules to detect whether the target event is an intrusion event.

7. The device as described in claim 6, wherein the section module is specifically used to use at least one of the ebpf uprobe technology, kernel module and GOT table hijacking method to section the section point and start the section.

8. The device according to claim 6, wherein a Java deployment tool is running on the Java virtual machine, and the Java deployment tool includes a runtime application self-protection module; The rule matching module is also used to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

9. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 5.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 5 when executing the program.

Images