Malicious code detection method and device, equipment and storage medium

Abstract

The invention relates to a malicious code detection method, device and equipment and a storage medium, the method is suitable for a cloud server management platform, and the method comprises the following steps: in response to detection that a user creates a cloud server instance and loads a target mirror image file, extracting target mirror image kernel data from the target mirror image file; establishing a first mapping relation between the identifier of the target mirror image file and the target mirror image kernel data, and storing the first mapping relation into a mirror image mapping table; and after the cloud server instance is put into use, in response to a received kernel data acquisition request sent by the security client, extracting target mirror image kernel data from the mirror image mapping table based on the identifier of the target mirror image file, and sending the target mirror image kernel data to the security client, and the security client detects the malicious code based on the target mirror kernel data. According to the method and the device, the kernel data are collected in the cloud server creation stage and are stored in the cloud server management platform, so that the risk of detection misjudgment caused by tampering of the kernel data can be reduced.

Description

Technical Field

[0001] The present disclosure relates to the technical field of cloud servers, and in particular to a malicious code detection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of cloud computing technology, cloud servers have become an important infrastructure for enterprise information construction due to their flexible resource allocation, efficient cost-effectiveness, and convenient operation and maintenance management. However, cloud servers also face many security risks in the process of providing services to users, including rootkit attacks. Rootkit is a highly concealed malicious code that can sneak into the underlying layer of the attacked cloud server, hide itself and the malicious operations it performs, thereby bypassing traditional security detection methods, and continuously monitor, steal data and other malicious behaviors on the attacked cloud server, posing a huge threat to the safe operation of the cloud server.

[0003] The current detection methods for Rootkit attacks mainly include signature-based detection and kernel symbol table-based detection. Signature-based detection relies on the signature library of known malicious code, cannot detect unknown Rootkits, and is not universally applicable. Kernel symbol table-based detection relies on the acquisition of kernel data, and identifies potential tampering behaviors by checking whether the information in the system kernel symbol table is consistent with the kernel data. If the kernel data is tampered by the attacker, it will directly affect the accuracy of the detection. Therefore, how to improve the integrity and authenticity of kernel data to enhance the detection capability of Rootkit malicious code is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In order to solve the above technical problems, the present disclosure provides a malicious code detection method, device, equipment and storage medium.

[0005] A first aspect of an embodiment of the present disclosure provides a malicious code detection method, which is applicable to a cloud server management platform. The method includes:

[0006] In response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file;

[0007] Establishing a first mapping relationship between the identifier of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table;

[0008] After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on the identifier of the target image file contained in the kernel data acquisition request, the target image kernel data is extracted from the image mapping table, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data.

[0009] A second aspect of an embodiment of the present disclosure provides a malicious code detection device, which is applicable to a cloud server management platform, and includes:

[0010] An extraction module, configured to extract target image kernel data from the target image file in response to detecting that a user has created a cloud server instance and loaded a target image file;

[0011] A first establishing module, used for establishing a first mapping relationship between the identifier of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table;

[0012] The first sending module is used to, after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client, so that the security client can detect malicious code based on the target image kernel data.

[0013] A third aspect of an embodiment of the present disclosure provides a computer device, including a memory and a processor, and a computer program, wherein the computer program is stored in the memory, and when the computer program is executed by the processor, the malicious code detection method as described in the first aspect above is implemented.

[0014] A fourth aspect of an embodiment of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the malicious code detection method as described in the first aspect above is implemented.

[0015] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0016] In the malicious code detection method, apparatus, device and storage medium provided in the embodiments of the present disclosure, in response to detecting that a user creates a cloud server instance and loads a target image file, the target image kernel data is extracted from the target image file, a first mapping relationship between the identifier of the target image file and the target image kernel data is established, and the first mapping relationship is stored in a pre-created image mapping table. After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on the identifier of the target image file included in the kernel data acquisition request, the target image kernel data is extracted from the image mapping table, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data. The kernel data collection work can be completed at the cloud server creation stage, when the cloud server instance has not yet officially provided services and the probability of kernel data being tampered is also low, and the kernel data is stored in a cloud server management platform with a higher security level, thereby reducing the risk of kernel data being tampered with and improving the integrity and authenticity of the kernel data, thereby enhancing the detection capability of Rootkit malicious code when attack detection is subsequently performed based on the kernel data stored in the cloud server management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 is a flow chart of a malicious code detection method provided by an embodiment of the present disclosure;

[0020] Figure 2 is a flow chart of a method for updating a kernel mapping table provided by an embodiment of the present disclosure;

[0021] Figure 3 is a flowchart of another method for updating a kernel mapping table provided by an embodiment of the present disclosure;

[0022] Figure 4 is a flow chart of a method for generating a management report provided by an embodiment of the present disclosure;

[0023] Figure 5 It is a schematic diagram of the structure of a malicious code detection device provided by an embodiment of the present disclosure;

[0024] Figure 6 It is a structural diagram of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0026] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] Figure 1 1 is a flowchart of a malicious code detection method provided by an embodiment of the present disclosure. The method can be executed by a malicious code detection device, which can be set in a cloud server management platform. Figure 1 As shown, the malicious code detection method provided in this embodiment includes the following steps:

[0029] S101. In response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file.

[0030] The kernel data in the embodiment of the present disclosure may be understood as the baseline kernel data required for comparison with the kernel symbol table when detecting Rootkit malicious code based on the kernel symbol table. For example, the kernel data may be a System.map file.

[0031] In the disclosed embodiment, when receiving a request for creating a cloud server instance submitted by a user, the malicious code detection device can obtain an identifier of the target image file contained in the request, load the target image file from the image repository to the cloud server instance based on the identifier of the target image file, and extract the target image kernel data from the target image file before the cloud server instance is created. Specifically, the target image kernel data in the target image file can be located and extracted according to the directory where the kernel data is mounted.

[0032] In an exemplary implementation of the embodiments of the present disclosure, the malicious code detection device can, in response to detecting that a user has created a cloud server instance and loaded a target image file, search in a pre-created image mapping table whether there is kernel data corresponding to the identifier of the target image file, and when the kernel data corresponding to the identifier of the target image file is not found in the image mapping table, extract the target image kernel data from the target image file.

[0033] S102: Establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table.

[0034] The image mapping table in the embodiment of the present disclosure may be understood as a table for storing the mapping relationship between the identifier of the image file and the kernel data.

[0035] In the disclosed embodiment, the malicious code detection device can, after extracting the target image kernel data from the target image file, establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table. Specifically, the identifier of the target image file can be used as an index, and the target image kernel data can be stored in the image mapping table as a value.

[0036] In an exemplary implementation of the disclosed embodiment, the malicious code detection device may add an unavailable label to the cloud server instance created by the user before storing the first mapping relationship between the identifier of the target image file and the target image kernel data in a pre-created image mapping table, until the first mapping relationship is stored in the image mapping table and the cloud server instance is configured, and the label is modified to available.

[0037] In an exemplary implementation of the embodiment of the present disclosure, the malicious code detection device can mark the target image file as recorded after storing the first mapping relationship between the identifier of the target image file and the target image kernel data in a pre-created image mapping table, thereby avoiding repeated collection of the target image kernel data in the target image file.

[0038] S103. After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on the identifier of the target image file contained in the kernel data acquisition request, extract the target image kernel data from the image mapping table, and send the target image kernel data to the security client, so that the security client can detect malicious code based on the target image kernel data.

[0039] In the disclosed embodiment, after the cloud server instance is put into use, the security client running on the cloud server instance will run a Rootkit detection module in the background, and regularly compare the kernel data and the kernel symbol table to detect malicious code. When the security client needs to obtain kernel data, it will send a kernel data acquisition request containing the identifier of the target image file to the cloud server management platform. The malicious code detection device in the cloud server management platform can respond to the kernel data acquisition request, based on the identifier of the target image file contained in the request, search and extract the target image kernel data corresponding to the identifier of the target image file in the image mapping table, and send the target image kernel data to the security client. The security client can compare the current kernel symbol table with the target image kernel data item by item to detect potential symbol tampering or hidden Rootkit malicious code. If the cloud server instance has enabled kernel address space layout randomization, the security client can match the dynamic kernel address by parsing the offset during the comparison, and perform corresponding alarm processing when it is found that the kernel symbol is inconsistent with the target image kernel data.

[0040] Optionally, the malicious code detection device can, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client, and after the security client detects malicious code based on the target image kernel data, in response to receiving a first alarm message returned by the security client, report the target image kernel data to the security platform, and update the target image kernel data based on a first verification result corresponding to the target image kernel data in the security platform, and / or mark the target image kernel data as trusted, wherein the first alarm message is used to characterize that the target image kernel data is not marked as trusted, and the target image kernel data does not match the kernel symbol table corresponding to the cloud server instance, and the first verification result is obtained by a security engineer verifying the target image kernel data.

[0041] Specifically, the types of image files may include system built-in and user defined. When the target image file is a system built-in image file, the malicious code detection device may store the first mapping relationship between the identifier of the target image file and the target image kernel data in a pre-created image mapping table. If the target image file is a system built-in image file, a trusted mark is added to the target image kernel data. After the cloud server instance is put into use, the kernel version change operation of the cloud server instance is monitored. If no kernel version change of the cloud server instance is detected, for the kernel data acquisition request sent by the security client, the target image kernel data is extracted from the image mapping table, and the target image kernel data and the mark are sent together to The security client compares the current kernel symbol table with the target image kernel data item by item. If the current kernel symbol table matches the target image kernel data, no alarm is issued and the malicious code detection is waited for the next execution; if the current kernel symbol table does not match the target image kernel data, and the target image kernel data is marked as credible, it is determined that the current kernel symbol table has been tampered with, malicious code is detected, and corresponding alarm processing is performed; if the target image kernel data is marked as untrustworthy (for example, when the target image file is a user-defined image file, the target image kernel data can be marked as pending verification), and the current kernel symbol table does not match the target image kernel data, a first alarm message is returned to the malicious code detection device.

[0042] In response to receiving the first alarm information returned by the security client, the malicious code detection device reports the target image kernel data to the security platform. After the security engineer obtains the target image kernel data through the security platform, the target image kernel data is verified and the first verification result is reported to the security platform. The malicious code detection device can update the target image kernel data based on the first verification result corresponding to the target image kernel data in the security platform. If the first verification result is unreliable, the target image kernel data is updated using the kernel data uploaded to the security platform by the security engineer, and the updated target image kernel data is marked as credible; if the first verification result is credible, the target image kernel data is marked as credible.

[0043] The disclosed embodiment extracts target image kernel data from the target image file in response to detecting that a user has created a cloud server instance and loaded a target image file, establishes a first mapping relationship between the identifier of the target image file and the target image kernel data, and stores the first mapping relationship in a pre-created image mapping table. After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on the identifier of the target image file included in the kernel data acquisition request, the target image kernel data is extracted from the image mapping table, and the target image kernel data is sent to the security client, so that the security client can detect malicious code based on the target image kernel data. During the cloud server creation phase, when the cloud server instance has not yet officially provided services and the probability of kernel data being tampered with is also low, kernel data collection is completed and stored in a cloud server management platform with a higher security level, reducing the risk of kernel data being tampered with and improving the integrity and authenticity of kernel data. In this way, when subsequent attack detection is performed based on the kernel data stored in the cloud server management platform, the detection capability of Rootkit malicious code is enhanced. The above-mentioned operations of reporting to the security platform, updating the target image kernel data and adding tags can further improve the reliability of the kernel data used for malicious code detection and reduce the risk of misjudgment of detection due to kernel data tampering.

[0044] In some embodiments, the types of image files include system built-in and user defined. After extracting the target image kernel data from the target image file, the malicious code detection device can obtain the target kernel version in the target image file, establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table. Based on the type of the target image file, a mark is added to the kernel mapping table for the target image kernel data, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted, and if the type of the target image file is user defined, the target image kernel data is marked as to be verified.

[0045] Specifically, after extracting the target image kernel data from the target image file, the malicious code detection device can obtain the target kernel version recorded in the target image file, establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table, wherein the kernel mapping table can be understood as a form for storing the mapping relationship between the kernel version and the kernel data. Before establishing the second mapping relationship, the malicious code detection device can determine the target image kernel data corresponding to the target kernel version based on the type of the target image file, when the target image file is a system-built-in image file, based on the correspondence between the pre-acquired kernel version and the kernel data, and the target kernel version of the target image file, and When the kernel mapping table is searched for the target kernel version and it is determined that the kernel mapping table does not contain the kernel data corresponding to the target kernel version, the second mapping relationship is established and stored in the kernel mapping table. At the same time, if the target image file is a system-built-in image file, a trusted tag is added to the target image kernel data. If the type of the target image file is a user-defined image file, a to-be-verified tag is added to the target image kernel data. This facilitates subsequent kernel version upgrades during the use of the cloud server instance, and enables the current kernel data to be obtained from the kernel mapping table to detect malicious code. At the same time, by setting trusted tags and to-be-verified tags, the reliability of the kernel data used for detecting malicious code is further improved, and the risk of misjudgment of detection due to tampering of kernel data is reduced.

[0046] Figure 2 is a flow chart of a method for updating a kernel mapping table provided by an embodiment of the present disclosure, such as Figure 2 As shown, based on the above embodiment, the kernel mapping table can be updated by the following method.

[0047] S201. In response to detecting a kernel version change operation of a cloud server instance, obtaining a changed kernel version and changed kernel data.

[0048] In the disclosed embodiment, the malicious code detection device can periodically scan the cloud server instance, obtain the current kernel version of the cloud server instance, and compare the current kernel version with the last recorded kernel version to check whether the kernel version has changed, and upon detecting the kernel version change operation of the cloud server instance, request the cloud server instance to obtain the current kernel version and kernel data, and obtain the changed kernel version and changed kernel data.

[0049] S202: Search the kernel mapping table for reference kernel data corresponding to the changed kernel version.

[0050] The reference kernel data in the embodiment of the present disclosure may be understood as kernel data stored in the kernel mapping table and corresponding to the changed kernel version.

[0051] In the disclosed embodiment, after acquiring the changed kernel version and the changed kernel data, the malicious code detection device may search for reference kernel data corresponding to the changed kernel version in the kernel mapping table based on the changed kernel version.

[0052] S203: If the kernel mapping table does not contain the reference kernel data corresponding to the changed kernel version, establish a third mapping relationship between the changed kernel version and the changed kernel data, store the third mapping relationship in the kernel mapping table, and mark the changed kernel data as pending verification in the kernel mapping table.

[0053] In the disclosed embodiment, the malicious code detection device can establish a third mapping relationship between the changed kernel version and the changed kernel data when the reference kernel data corresponding to the changed kernel version is not found in the kernel mapping table, and store the third mapping relationship in the kernel mapping table. Since the security of the kernel version change operation cannot be verified, when the changed kernel data is stored in the kernel mapping table, the changed kernel data needs to be marked as pending verification.

[0054] S204: If the kernel mapping table contains reference kernel data corresponding to the changed kernel version, the reference kernel data is compared with the changed kernel data, and the kernel mapping table is updated when the reference kernel data is inconsistent with the changed kernel data.

[0055] In the disclosed embodiment, the malicious code detection device can find the reference kernel data corresponding to the changed kernel version in the kernel mapping table, and compare the reference kernel data in the kernel mapping table with the changed kernel data obtained after the change. If the reference kernel data is consistent with the changed kernel data, wait for the next version change. If the reference kernel data is inconsistent with the changed kernel data, it means that there is at least one tampered kernel data in the reference kernel data and the changed kernel data, which needs further verification, and update the kernel mapping table according to the verification result.

[0056] The disclosed embodiment obtains the changed kernel version and changed kernel data after the change in response to detecting a kernel version change operation of a cloud server instance, searches for reference kernel data corresponding to the changed kernel version in a kernel mapping table, and if the kernel mapping table does not contain the reference kernel data corresponding to the changed kernel version, establishes a third mapping relationship between the changed kernel version and the changed kernel data, stores the third mapping relationship in the kernel mapping table, and marks the changed kernel data as to be verified in the kernel mapping table; if the kernel mapping table contains reference kernel data corresponding to the changed kernel version, compares the reference kernel data with the changed kernel data, and updates the kernel mapping table when the reference kernel data is inconsistent with the changed kernel data. When a kernel version change occurs, the data recorded in the kernel mapping table can be updated in a timely manner. At the same time, a verification mechanism is introduced to verify the historically stored reference kernel data and the newly acquired changed kernel data, so as to further improve the reliability of the kernel data used for detecting malicious code and reduce the risk of misjudgment of detection due to tampering of kernel data.

[0057] Figure 3 is a flowchart of another method for updating a kernel mapping table provided by an embodiment of the present disclosure. Figure 3 As shown, based on the above embodiment, the kernel mapping table can be updated by the following method.

[0058] S301. When the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as credible, send a first reminder message to the cloud server instance, where the first reminder message is used to indicate that the changed kernel data is abnormal.

[0059] In the disclosed embodiment, the malicious code detection device can obtain the marking information of the reference kernel data when determining that the reference kernel data is inconsistent with the changed kernel data. If the reference kernel data is marked as credible, it means that the changed kernel data that is different from the reference kernel data has been tampered with, and send a first reminder message to the cloud server instance to remind the user of the cloud server instance that there is an abnormality in the changed kernel data.

[0060] S302. When the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as to be verified, the reference kernel data and the changed kernel data are reported to the security platform to obtain the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data in the security platform.

[0061] In the disclosed embodiment, the malicious code detection device can obtain the marking information of the reference kernel data when determining that the reference kernel data and the changed kernel data are inconsistent. If the reference kernel data is marked as to be verified, it means that there is at least one tampered kernel data in the reference kernel data and the changed kernel data, which needs further verification. Therefore, the reference kernel data and the changed kernel data are reported to the security platform. After the security engineer obtains the reference kernel data and the changed kernel data through the security platform, the reference kernel data and the changed kernel data are verified, and after the verification is completed, the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data are reported to the security platform. The malicious code detection device can obtain the second verification result and the third verification result from the security platform.

[0062] S303: When the second verification result is credible and the third verification result is uncredible, mark the reference kernel data as credible in the kernel mapping table, and / or send a first reminder message to the cloud server instance.

[0063] In the disclosed embodiment, after obtaining the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data from the security platform, the malicious code detection device may, when the second verification result corresponding to the reference kernel data is credible and the third verification result corresponding to the changed kernel data is uncredible, perform at least one of the following operations: mark the reference kernel data as credible in the kernel mapping table according to the second verification result, and send a first reminder message to the cloud server instance to remind the user of the cloud server instance that there is an abnormality in changing the kernel data.

[0064] S304. When the third verification result is credible and the second verification result is uncredible, delete the fourth mapping relationship between the changed kernel version and the reference kernel data in the kernel mapping table, establish and store the third mapping relationship between the changed kernel version and the changed kernel data, mark the changed kernel data as credible, and / or generate a second reminder message, which is used to characterize the abnormality of the reference kernel data.

[0065] In an embodiment of the present disclosure, after obtaining the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data from the security platform, when the third verification result corresponding to the changed kernel data is credible and the second verification result corresponding to the reference kernel data is untrustworthy, the malicious code detection device can delete the fourth mapping relationship between the changed kernel version and the untrustworthy reference kernel data in the kernel mapping table, establish and store the third mapping relationship between the changed kernel version and the credible changed kernel data, and perform at least one of the following operations: mark the changed kernel data as credible in the kernel mapping table according to the third verification result, and generate a second reminder message for characterizing the abnormality of the reference kernel data collected earlier.

[0066] The disclosed embodiment sends a first reminder message to the cloud server instance when the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as credible, the first reminder message is used to characterize the abnormality of the changed kernel data, and when the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as pending verification, reports the reference kernel data and the changed kernel data to the security platform, obtains a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data in the security platform, and when the second verification result is credible and the third verification result is uncredible, marks the reference kernel data as credible in the kernel mapping table, and / or sends the first reminder message to the cloud server instance. Information, when the third verification result is credible and the second verification result is untrustworthy, the fourth mapping relationship between the changed kernel version and the reference kernel data is deleted in the kernel mapping table, the third mapping relationship between the changed kernel version and the changed kernel data is established and stored, and the changed kernel data is marked as credible, and / or a second reminder information is generated, the second reminder information is used to characterize the abnormality of the reference kernel data, and when the reference kernel data collected earlier is different from the changed kernel data obtained after the version change, the reliability of the two can be verified, so as to make corresponding adjustments to the kernel mapping table, further improve the reliability of the kernel data used for detecting malicious code, and reduce the risk of misdetection due to tampering of the kernel data.

[0067] In other embodiments, after a kernel version change occurs in a cloud server instance, the malicious code detection device may, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target version kernel data corresponding to the target kernel version from the kernel mapping table based on the target kernel version of the cloud server instance contained in the kernel data acquisition request, and send the target version kernel data to the security client. After the security client detects malicious code based on the target image kernel data, in response to receiving a second alarm message returned by the security client, the target version kernel data is reported to the security platform, and the target version kernel data is updated based on a fourth verification result corresponding to the target version kernel data in the security platform, and / or the target version kernel data is marked as trusted, wherein the second alarm message is used to characterize that the target version kernel data is not marked as trusted and that the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

[0068] Specifically, the malicious code detection device can monitor the kernel version change operation of the cloud server instance after the cloud server instance is put into use. When it is detected that the kernel version of the cloud server instance has changed, for the kernel data acquisition request sent by the security client, the target version kernel data corresponding to the target kernel version contained in the request is extracted from the kernel mapping table, and the target version kernel data and the mark are sent to the security client together. When the security client compares the current kernel symbol table with the target version kernel data item by item, if the current kernel symbol table matches the target version kernel data, no alarm is issued and the malicious code detection is executed next time; if the current kernel symbol table does not match the target version kernel data, and the target version kernel data is marked as credible, it is determined that the current kernel symbol table has been tampered with, malicious code is detected, and corresponding alarm processing is performed; if the target version kernel data is marked as untrustworthy (for example, when the target version file is marked as pending verification), and the current kernel symbol table does not match the target version kernel data, a second alarm message is returned to the malicious code detection device.

[0069] In response to receiving the second alarm information returned by the security client, the malicious code detection device reports the target version kernel data to the security platform. After the security engineer obtains the target version kernel data through the security platform, the target version kernel data is verified and the fourth verification result is reported to the security platform. The malicious code detection device can update the target version kernel data based on the fourth verification result corresponding to the target version kernel data in the security platform. If the fourth verification result is unreliable, the target version kernel data is updated using the kernel data uploaded to the security platform by the security engineer, and the updated target version kernel data is marked as reliable; if the fourth verification result is reliable, the target version kernel data is marked as reliable, thereby further improving the reliability of the kernel data used to detect malicious code and reducing the risk of misdetection due to tampering of the kernel data.

[0070] Figure 4 FIG. 1 is a flow chart of a method for generating a management report provided by an embodiment of the present disclosure. Figure 4 As shown, based on the above embodiment, a management report can be generated by the following method.

[0071] S401. Store the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification result of the kernel data into a pre-created log file.

[0072] In the disclosed embodiment, the malicious code detection device can organize the kernel version change history of the cloud server instance, and store the version change time, operating user, reference kernel data and changed kernel data corresponding to each kernel version, and the verification results of the kernel data in the security platform into a pre-created log file.

[0073] S402. Regularly analyze the log files and generate management reports.

[0074] In the disclosed embodiment, the malicious code detection device can regularly analyze the recorded log files, focusing on the statistics and correlation analysis of the trust status and abnormal detection conditions of the kernel data, and generate a management report based on the statistical and analysis results.

[0075] The disclosed embodiment stores the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification results of the kernel data in a pre-created log file, regularly analyzes the log file, and generates a management report. This makes it convenient for users and security teams of the cloud server instance to review the operation and version changes of the cloud server instance, so as to enhance the overall security of the cloud server instance.

[0076] Figure 5 Schematic diagram of a malicious code detection device provided by an embodiment of the present disclosure. Figure 5 As shown, the malicious code detection device 500 is suitable for a cloud server management platform, and the malicious code detection device 500 includes: an extraction module 510, a first establishment module 520, and a first sending module 530, wherein the extraction module 510 is used to extract target image kernel data from the target image file in response to detecting that a user has created a cloud server instance and loaded a target image file; the first establishment module 520 is used to establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table; the first sending module 530 is used to extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, and send the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data.

[0077] Optionally, the first sending module 530 is specifically used to extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request in response to receiving a kernel data acquisition request sent by the security client running on the cloud server instance, and send the target image kernel data to the security client; the malicious code detection device 500 also includes: a first reporting module, which is used to report the target image kernel data to the security platform in response to receiving a first alarm message returned by the security client, and update the target image kernel data based on the first verification result corresponding to the target image kernel data in the security platform, and / or mark the target image kernel data as credible, wherein the first alarm message is used to indicate that the target image kernel data is not marked as credible, and the target image kernel data does not match the kernel symbol table corresponding to the cloud server instance, and the first verification result is obtained by a security engineer verifying the target image kernel data.

[0078] Optionally, the types of the image file include system built-in and user defined, and the malicious code detection device 500 also includes: a first acquisition module, used to obtain the target kernel version in the target image file; a second establishment module, used to establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table; a marking module, used to add a mark to the target image kernel data in the kernel mapping table based on the type of the target image file, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted, and if the type of the target image file is user defined, the target image kernel data is marked as to be verified.

[0079] Optionally, the malicious code detection device 500 also includes: a second acquisition module, which is used to obtain the changed kernel version and changed kernel data in response to detecting the kernel version change operation of the cloud server instance after the cloud server instance is put into use; a search module, which is used to search the kernel mapping table for reference kernel data corresponding to the changed kernel version; a third establishment module, which is used to establish a third mapping relationship between the changed kernel version and the changed kernel data if the kernel mapping table does not contain the reference kernel data corresponding to the changed kernel version, store the third mapping relationship in the kernel mapping table, and mark the changed kernel data as to be verified in the kernel mapping table; a comparison module, which is used to compare the reference kernel data with the changed kernel data if the kernel mapping table contains the reference kernel data corresponding to the changed kernel version, and update the kernel mapping table when the reference kernel data is inconsistent with the changed kernel data.

[0080] Optionally, the comparison module includes: a sending unit, used to send a first reminder message to the cloud server instance when the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as credible, wherein the first reminder message is used to characterize that the changed kernel data is abnormal; a reporting unit, used to report the reference kernel data and the changed kernel data to the security platform when the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as to be verified, and obtain a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data in the security platform; a first processing unit, used When the second verification result is credible and the third verification result is untrustworthy, the reference kernel data is marked as credible in the kernel mapping table, and / or the first reminder information is sent to the cloud server instance; a second processing unit is used to delete the fourth mapping relationship between the changed kernel version and the reference kernel data in the kernel mapping table, establish and store the third mapping relationship between the changed kernel version and the changed kernel data, and mark the changed kernel data as credible, and / or generate a second reminder information, wherein the second reminder information is used to characterize the abnormality of the reference kernel data.

[0081] Optionally, the malicious code detection device 500 also includes: a second sending module, which is used to, after a kernel version change occurs in the cloud server instance, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target version kernel data corresponding to the target kernel version from the kernel mapping table based on the target kernel version of the cloud server instance contained in the kernel data acquisition request, and send the target version kernel data to the security client; a second reporting module, which is used to report the target version kernel data to the security platform in response to receiving a second alarm message returned by the security client, and update the target version kernel data based on a fourth verification result corresponding to the target version kernel data in the security platform, and / or mark the target version kernel data as trusted, wherein the second alarm message is used to characterize that the target version kernel data is not marked as trusted, and that the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

[0082] Optionally, the malicious code detection device 500 also includes: a recording module, used to store the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification results of the kernel data into a pre-created log file; an analysis module, used to regularly analyze the log file and generate a management report.

[0083] The malicious code detection device provided in this embodiment can execute the method described in any of the above embodiments. Its execution method and beneficial effects are similar and will not be described in detail here.

[0084] Figure 6 It is a structural diagram of a computer device provided in an embodiment of the present disclosure.

[0085] like Figure 6 As shown, the computer device may include a processor 610 and a memory 620 storing computer program instructions.

[0086] Specifically, the processor 610 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0087] The memory 620 may include a large capacity memory for information or instructions. By way of example and not limitation, the memory 620 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 620 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 620 may be inside or outside the integrated gateway device. In a particular embodiment, the memory 620 is a non-volatile solid-state memory. In a particular embodiment, the memory 620 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or a flash memory, or a combination of two or more of these.

[0088] The processor 610 reads and executes the computer program instructions stored in the memory 620 to perform the steps of the malicious code detection method provided in the embodiment of the present disclosure.

[0089] In one example, the computer device may further include a transceiver 630 and a bus 640. Figure 6 As shown, the processor 610, the memory 620 and the transceiver 630 are connected via a bus 640 and communicate with each other.

[0090] The bus 640 includes hardware, software, or both. For example, but not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 640 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0091] The embodiments of the present disclosure also provide a computer-readable storage medium, which may store a computer program. When the computer program is executed by a processor, the processor implements the malicious code detection method provided by the embodiments of the present disclosure.

[0092] The above-mentioned storage medium may, for example, include a memory 620 of computer program instructions, and the above-mentioned instructions may be executed by the processor 610 of the malicious code detection device to complete the malicious code detection method provided by the embodiment of the present disclosure. Optionally, the storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, a random access memory (Random Access Memory, RAM), a compact disc read-only memory (Compact DiscROM, CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device, etc. The above-mentioned computer program may be written in any combination of one or more programming languages ​​to perform the program code of the operation of the embodiment of the present disclosure, and the programming language includes an object-oriented programming language, such as Java, C++, etc., and also includes a conventional procedural programming language, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device, partially on the remote computing device, or entirely on the remote computing device or server.

[0093] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0094] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A malicious code detection method, characterized in that: The method is applicable to a cloud server management platform, and the method includes: In response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file; Establishing a first mapping relationship between the identifier of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table; After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on the identifier of the target image file contained in the kernel data acquisition request, the target image kernel data is extracted from the image mapping table, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data.

2. The method according to claim 1, characterized in that The method of extracting the target image kernel data from the image mapping table based on the identifier of the target image file included in the kernel data acquisition request in response to receiving the kernel data acquisition request sent by the security client running on the cloud server instance, and sending the target image kernel data to the security client includes: In the case where no kernel version change of the cloud server instance is detected, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extracting the target image kernel data from the image mapping table based on the identifier of the target image file included in the kernel data acquisition request, and sending the target image kernel data to the security client; The method further comprises: In response to receiving the first alarm information returned by the security client, the target image kernel data is reported to the security platform, and the target image kernel data is updated based on the first verification result corresponding to the target image kernel data in the security platform, and / or the target image kernel data is marked as trusted, wherein the first alarm information is used to characterize that the target image kernel data is not marked as trusted, and the target image kernel data does not match the kernel symbol table corresponding to the cloud server instance, and the first verification result is obtained by a security engineer verifying the target image kernel data.

3. The method according to claim 1, characterized in that The types of the image files include system built-in and user-defined. After extracting the target image kernel data from the target image file, the method further includes: Obtain the target kernel version in the target image file; Establishing a second mapping relationship between the target kernel version and the target image kernel data, and storing the second mapping relationship in a pre-created kernel mapping table; Based on the type of the target image file, a mark is added to the target image kernel data in the kernel mapping table, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted; if the type of the target image file is user-defined, the target image kernel data is marked as to be verified.

4. The method according to claim 3, characterized in that After the cloud server instance is put into use, the method further includes: In response to detecting a kernel version change operation of the cloud server instance, acquiring a changed kernel version and changed kernel data after the change; Searching the kernel mapping table for reference kernel data corresponding to the changed kernel version; If the kernel mapping table does not contain the reference kernel data corresponding to the changed kernel version, establishing a third mapping relationship between the changed kernel version and the changed kernel data, storing the third mapping relationship in the kernel mapping table, and marking the changed kernel data as to be verified in the kernel mapping table; If the kernel mapping table contains reference kernel data corresponding to the changed kernel version, the reference kernel data is compared with the changed kernel data, and the kernel mapping table is updated when the reference kernel data is inconsistent with the changed kernel data.

5. The method according to claim 4, characterized in that The updating of the kernel mapping table when the reference kernel data is inconsistent with the changed kernel data includes: When the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as credible, sending first reminder information to the cloud server instance, wherein the first reminder information is used to indicate that the changed kernel data is abnormal; When the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as pending verification, the reference kernel data and the changed kernel data are reported to the security platform, and a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data are obtained from the security platform; When the second verification result is credible and the third verification result is uncredible, marking the reference kernel data as credible in the kernel mapping table, and / or sending the first reminder information to the cloud server instance; When the third verification result is credible and the second verification result is uncredible, the fourth mapping relationship between the changed kernel version and the reference kernel data is deleted in the kernel mapping table, the third mapping relationship between the changed kernel version and the changed kernel data is established and stored, and the changed kernel data is marked as credible, and / or a second reminder message is generated, wherein the second reminder message is used to characterize that the reference kernel data is abnormal.

6. The method according to claim 4, characterized in that After the kernel version of the cloud server instance is changed, the method further includes: In response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, based on a target kernel version of the cloud server instance included in the kernel data acquisition request, extracting target version kernel data corresponding to the target kernel version from the kernel mapping table, and sending the target version kernel data to the security client; The method further comprises: In response to receiving the second alarm information returned by the security client, the target version kernel data is reported to the security platform, and the target version kernel data is updated based on the fourth verification result corresponding to the target version kernel data in the security platform, and / or the target version kernel data is marked as trusted, wherein the second alarm information is used to characterize that the target version kernel data is not marked as trusted, and the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

7. The method according to any one of claims 4 to 6, characterized in that: The method further comprises: Storing the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification result of the kernel data in a pre-created log file; The log files are analyzed regularly to generate management reports.

8. A malicious code detection device, characterized in that: The device is applicable to a cloud server management platform, and the device includes: An extraction module, configured to extract target image kernel data from the target image file in response to detecting that a user has created a cloud server instance and loaded a target image file; A first establishing module, used for establishing a first mapping relationship between the identifier of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table; The first sending module is used to, after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client, so that the security client can detect malicious code based on the target image kernel data.

9. A computer device, characterized in that: include: Memory; processor; And a computer program; wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the malicious code detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the malicious code detection method according to any one of claims 1 to 7 is implemented.

Images