An intrusion detection method, device, storage medium and equipment

Abstract

The embodiment of the specification discloses an intrusion detection method, device, storage medium and equipment. The method sets a pointcut in a dynamic link library of JVM, starts a corresponding aspect in an operating system kernel layer, when the aspect is triggered, the operating system kernel queries a method called by a target event in the dynamic link library through stack information, and detects whether the target event is a target event according to the method. Since the method detects the intrusion event through the system layer, even if an intruder directly intrudes from the JDWP protocol layer, the system call generated by the intrusion can be perceived, and the event can be effectively defended.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to an intrusion detection method, apparatus, storage medium and device. Background Technology

[0002] Currently, Java applications are widely used in various fields. After developers write a Java application, they can debug it using the Java Deployment Kit (JDK). Figure 1 As shown.

[0003] The JDK provides a debugging environment for Java applications. The JDK, in turn, runs on the Java Virtual Machine (JVM) and communicates with the application being debugged (i.e., the Java application) through the Java Debug Wire Protocol (JDWP) provided by the JVM. In other words, the JDK requires a runtime environment provided by the JVM, which runs on top of the operating system kernel. Therefore, the hierarchy from bottom to top is kernel, JVM, and JDK.

[0004] To prevent Java applications debugged in the JDK from being compromised, existing technologies typically use the Runtime Application Self-Protection (RASP) module in the JDK for defense.

[0005] However, by Figure 1 As can be seen, the RASP module is located in the JDK and can only defend against external intrusions at the application level. However, if an intruder directly intrudes into the Java application being debugged in the JDK through the JDWP protocol layer, the RASP module will not be able to detect the intrusion event and will therefore be unable to effectively defend against the intrusion.

[0006] Therefore, embodiments of this specification provide an intrusion detection method, apparatus, storage medium, and device. Summary of the Invention

[0007] This specification provides an intrusion detection method, apparatus, storage medium, and electronic device to partially solve the problems existing in the prior art.

[0008] The embodiments in this specification adopt the following technical solutions:

[0009] This specification provides an intrusion detection method applied to an operating system kernel; the method includes: setting a pointcut in the dynamic link library of a Java Virtual Machine running on the operating system kernel in advance;

[0010] The operating system kernel initiates the aspect based on the point of attack;

[0011] When it is detected that the aspect is triggered by a target event executed by the Java Virtual Machine, the stack information corresponding to the execution of the target event by the Java Virtual Machine is obtained;

[0012] A method for determining the corresponding stack information in the dynamic link library;

[0013] The method is audited according to preset rules to detect whether the target event is an intrusion event.

[0014] Optionally, the operating system kernel initiates the aspect based on the pointcut, specifically including:

[0015] The operating system kernel uses at least one of the following: ebpf uprobe technology, kernel modules, and GOT table hijacking method to perform aspecting on the pointcut and initiate the aspect.

[0016] Optionally, obtaining the stack information corresponding to the Java Virtual Machine executing the target event specifically includes:

[0017] Traverse the stack frames of the CPU registers and obtain the memory address returned by each stack frame, which serves as the stack information corresponding to the Java Virtual Machine executing the target event.

[0018] Optionally, the method for determining the stack information corresponding to the dynamic link library specifically includes:

[0019] Parse the symbol table of a .so file;

[0020] A method for determining the corresponding memory address in a dynamic link library.

[0021] Optionally, the Java Virtual Machine runs a Java deployment tool, which includes a runtime application self-protection module;

[0022] After detecting whether the target event is an intrusion event, the method further includes:

[0023] The detection result is sent to the runtime application self-protection module, so that the runtime application self-protection module processes the target event based on the detection result.

[0024] This specification provides an intrusion detection device, in which a pointcut is pre-set in the dynamic link library of the Java Virtual Machine running on the device; the device includes:

[0025] The slicing module is used to initiate slicing based on the slicing point;

[0026] The call stack backtracking module is used to obtain the stack information corresponding to the Java Virtual Machine's execution of the target event when it is detected that the aspect is triggered by the Java Virtual Machine's execution of the target event;

[0027] A conversion module is used to determine the method corresponding to the stack information in the dynamic link library;

[0028] The rule matching module is used to audit the method according to preset rules in order to detect whether the target event is an intrusion event.

[0029] Optionally, the aspect module is specifically used to aspect the point using at least one of ebpf uprobe technology, kernel module, and GOT table hijacking method, and to initiate the aspect.

[0030] Optionally, the Java Virtual Machine runs a Java deployment tool, which includes a runtime application self-protection module;

[0031] The rule matching module is further configured to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module can process the target event according to the detection result.

[0032] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned intrusion detection method.

[0033] This specification provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the intrusion detection method described above.

[0034] The above-described at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects:

[0035] This specification discloses an intrusion detection method. This method sets a pointcut in the JVM's dynamic link library and starts the corresponding aspect at the operating system kernel layer. When the aspect is triggered, the operating system kernel queries the stack information to find the method called in the dynamic link library by the target event that triggered the aspect, and detects whether the target event is the target event. Since this method detects intrusion events at the system layer, even if the intruder directly intrudes from the JDWP protocol layer, the system calls generated by the intrusion can be detected, which can effectively defend against the event. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0037] Figure 1 This is a schematic diagram of an intrusion detection system in the prior art;

[0038] Figure 2 This is a schematic diagram of an intrusion detection process provided in an embodiment of this specification;

[0039] Figure 3 This is a schematic diagram of an intrusion detection system provided in the embodiments of this specification;

[0040] Figure 4 A schematic diagram of an intrusion detection device provided in an embodiment of this specification;

[0041] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0043] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0044] Depend on Figure 1As can be seen, when debugging Java applications, normal debuggers typically set breakpoints in a target function of the Java application using the JDK, obtain some parameters (payloads) of the target function at that breakpoint, modify these payloads, and continue running. The modified Java application then uses the JDK to call methods in the JVM's dynamic link libraries to perform certain operations on processes, files, or network instructions in the JVM system. Although the JDK and JVM communicate via the JDWP protocol, normal debuggers do not directly use JDWP; in other words, debuggers are unaware of JDWP. However, intruders can directly compromise the Java application through JDWP, set breakpoints in the target function, modify the payload directly through JDWP, and then call methods in the JVM's dynamic link libraries through the modified Java application. Therefore, the embodiments in this specification can detect intrusion events by monitoring the invocation of JVM dynamic link libraries at the system level.

[0045] Figure 2 This specification provides a flowchart of an intrusion detection process, which may specifically include the following steps:

[0046] S200: Sets pointcuts in the dynamic link libraries of the Java Virtual Machine running on the operating system kernel in advance.

[0047] In the embodiments described in this specification, before the detection begins, a pointcut needs to be set in the JVM's dynamic link library; that is, instrumentation is performed in the JVM's dynamic link library. The JVM's dynamic link library is code written using Java Native Interface (JNI) technology to extend and enhance the functionality of the JVM itself. When debugging Java applications using the JDK running on the JVM, if an intruder compromises the Java application via JDWP, they will typically use certain methods in the JVM's dynamic link library. Therefore, pointcuts can be set in this dynamic link library beforehand.

[0048] S202: The operating system kernel initiates the aspect based on the stated point.

[0049] In the embodiments described in this specification, steps S202 to S208 are all executed by the kernel.

[0050] In step S202, the kernel may use methods such as ebpf uprobe technology, kernel module or GOT table hijacking to perform aspecting on the point in step S200 and start the aspect.

[0051] S204: When it is detected that the aspect is triggered by the Java Virtual Machine executing the target event, obtain the stack information corresponding to the Java Virtual Machine executing the target event.

[0052] When a method with a pointcut set in a JVM dynamic link library is called, the kernel can detect that the startup aspect has been triggered. At this time, it can be assumed that the JVM triggered the aspect when executing the target event. Then, the stack frames in the CPU registers can be traversed to obtain the memory address returned by each stack frame, which can be used as the stack information corresponding to the JVM executing the target event.

[0053] S206: Method for determining the stack information corresponding to the dynamic link library.

[0054] After obtaining the stack information, the kernel can query the methods in the JVM dynamic link library based on the stack information. Specifically, after traversing the stack frames of the CPU registers and obtaining the memory address returned by each stack frame, the kernel can parse the symbol table of the .so file and look up the corresponding method in the JVM dynamic link library for that memory address.

[0055] S208: Audit the method according to preset rules to detect whether the target event is an intrusion event.

[0056] The aforementioned preset rules can be pre-set as needed. After querying the methods called in the dynamic link library when the JVM executes the target event through step S206, the queried methods can be audited according to the preset rules to determine whether the target event is indeed the target event.

[0057] Furthermore, to maintain consistency with existing technologies that use the RASP module for application-layer intrusion defense, this specification describes a kernel that, after detecting whether the aforementioned target event is an intrusion event and obtaining the detection result, can also send the detection result to the RASP module in the JDK. This allows the RASP module to process the target event based on the detection result, such as... Figure 3 As shown.

[0058] exist Figure 3 In the kernel, the EBPF uprobe technology is used to perform aspecting based on the pointcut. When the aspect is triggered, the process of the target event in the kernel is terminated, and the kernel checks whether it is an intrusion event according to preset rules, and then returns the detection result to RASP.

[0059] The above methods enable the detection of intrusion events in the operating system kernel mode. Even if an intruder launches an intrusion at the JDWP protocol layer, the methods provided in this manual can still achieve effective detection and defense.

[0060] The above is an example of an intrusion detection method provided in this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0061] Figure 4 This is a schematic diagram of an intrusion detection device provided in an embodiment of this specification. The device can be applied to an operating system kernel; pointcuts are pre-set in the dynamic link library of a Java Virtual Machine running on the device; the device includes:

[0062] The cutting module 401 is used to initiate cutting based on the cutting point;

[0063] The call stack backtracking module 402 is used to obtain the stack information corresponding to the Java Virtual Machine executing the target event when it is detected that the aspect is triggered by the Java Virtual Machine executing the target event;

[0064] Conversion module 403 is used to determine the method corresponding to the stack information in the dynamic link library;

[0065] The rule matching module 404 is used to audit the method according to preset rules in order to detect whether the target event is an intrusion event.

[0066] Optionally, the aspect module 401 is specifically used to aspect the point using at least one of ebpf uprobe technology, kernel module and GOT table hijacking method, and to initiate the aspect.

[0067] Optionally, the call stack backtracking module 402 is specifically used to traverse the stack frames of the CPU registers and obtain the memory address returned by each stack frame as the stack information corresponding to the Java Virtual Machine executing the target event.

[0068] Optionally, the conversion module 403 is specifically used to parse the symbol table of the .so file and determine the method corresponding to the memory address in the dynamic link library.

[0069] Optionally, the Java Virtual Machine runs a Java deployment tool, which includes a runtime application self-protection module;

[0070] The rule matching module 404 is further configured to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module processes the target event according to the detection result.

[0071] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the above-described actions. Figure 1The provided intrusion detection method.

[0072] based on Figure 1 The following is based on Figure 1 The intrusion detection method shown in this specification also provides embodiments that provide... Figure 5 The diagram shows the structure of the electronic device. Figure 5 At the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then executes it to achieve the above. Figure 2 The aforementioned intrusion detection method.

[0073] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0074] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0075] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0076] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0077] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0078] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0079] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0080] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0082] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0083] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0084] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0085] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0086] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0088] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0089] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An intrusion detection method, the method being applied to an operating system kernel; the method comprising: Pointcuts are set in the dynamic link libraries of the Java Virtual Machine that runs on the operating system kernel in advance; The operating system kernel initiates the aspect based on the point of attack; When it is detected that the aspect is triggered by a target event executed by the Java Virtual Machine, the stack information corresponding to the execution of the target event by the Java Virtual Machine is obtained; A method for determining the corresponding stack information in the dynamic link library; The method is audited according to preset rules to detect whether the target event is an intrusion event.

2. The method as described in claim 1, wherein the operating system kernel initiates the aspect based on the pointcut, specifically including: The operating system kernel uses at least one of the following: ebpf uprobe technology, kernel modules, and GOT table hijacking method to perform aspecting on the pointcut and initiate the aspect.

3. The method as described in claim 1, wherein obtaining the stack information corresponding to the Java Virtual Machine executing the target event specifically includes: Traverse the stack frames of the CPU registers and obtain the memory address returned by each stack frame, which serves as the stack information corresponding to the Java Virtual Machine executing the target event.

4. The method of claim 3, wherein determining the stack information corresponding to the dynamic link library, specifically includes: Parse the symbol table of a .so file; A method for determining the corresponding memory address in a dynamic link library.

5. The method as described in claim 1, wherein the Java Virtual Machine runs a Java deployment tool, and the Java deployment tool includes a runtime application self-protection module; After detecting whether the target event is an intrusion event, the method further includes: The detection result is sent to the runtime application self-protection module, so that the runtime application self-protection module processes the target event based on the detection result.

6. An intrusion detection device, wherein a pointcut is pre-set in the dynamic link library of a Java Virtual Machine running on the device; the device comprises: The slicing module is used to initiate slicing based on the slicing point; The call stack backtracking module is used to obtain the stack information corresponding to the Java Virtual Machine's execution of the target event when it is detected that the aspect is triggered by the Java Virtual Machine's execution of the target event; A conversion module is used to determine the method corresponding to the stack information in the dynamic link library; The rule matching module is used to audit the method according to preset rules in order to detect whether the target event is an intrusion event.

7. The apparatus of claim 6, wherein the aspect module is specifically configured to aspect the point using at least one of ebpf uprobe technology, kernel module and GOT table hijacking method, and to initiate the aspect.

8. The apparatus of claim 6, wherein the Java Virtual Machine runs a Java deployment tool, and the Java deployment tool includes a runtime application self-protection module; The rule matching module is further configured to, after detecting whether the target event is an intrusion event, send the detection result to the runtime application self-protection module, so that the runtime application self-protection module can process the target event according to the detection result.

9. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1-5.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1-5.

Images