Malicious code detection method and device, equipment and storage medium

Abstract

The present disclosure relates to a malicious code detection method, device and equipment and a storage medium. The method is suitable for a cloud server management platform, and includes: in response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file; establishing a first mapping relationship between the identifier of the target image file and the target image kernel data and storing the first mapping relationship in an image mapping table; after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client, extracting the target image kernel data from the image mapping table based on the identifier of the target image file, and sending the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data. The present disclosure can reduce the risk of detection error caused by tampering with the kernel data by collecting the kernel data in the cloud server creation stage and storing the kernel data in the cloud server management platform.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of cloud server, and particularly relates to a malicious code detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of cloud computing technology, cloud servers have become an important infrastructure for enterprise informatization construction due to their flexible resource allocation, efficient cost-effectiveness, and convenient operation and maintenance advantages. However, cloud servers also face many security risks in providing services for users, including Rootkit attacks. Rootkit is a highly covert malicious code that can penetrate the bottom layer of the attacked cloud server, hide itself and its malicious operations, thereby bypassing traditional security detection methods and continuously monitoring, data stealing and other malicious behaviors on the attacked cloud server, posing a great threat to the safe operation of the cloud server.

[0003] Current detection methods for Rootkit attacks mainly include feature code-based detection and kernel symbol table-based detection. The feature code-based detection relies on a feature library of known malicious codes and cannot detect unknown Rootkits, so it is not universally applicable. The kernel symbol table-based detection relies on the acquisition of kernel data and identifies potential tampering behavior by checking whether the information in the system kernel symbol table is consistent with the kernel data. If the kernel data is tampered with by the attacker, it will directly affect the accuracy of the detection. Therefore, how to improve the integrity and authenticity of the kernel data to enhance the detection capability of Rootkit malicious codes is a technical problem to be solved at present. SUMMARY

[0004] To solve the above technical problems, the present disclosure provides a malicious code detection method, device, equipment and storage medium.

[0005] A first aspect of the embodiments of the present disclosure provides a malicious code detection method, which is applicable to a cloud server management platform, and the method comprises:

[0006] In response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file;

[0007] Establishing a first mapping relationship between the identification of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table;

[0008] After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, target image kernel data is extracted from the image mapping table based on an identification of the target image file contained in the kernel data acquisition request, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data.

[0009] A second aspect of the embodiments of the present disclosure provides a malicious code detection device, the device is suitable for a cloud server management platform, and the device comprises:

[0010] An extraction module is configured to extract target image kernel data from a target image file in response to detecting that a user creates a cloud server instance and loads the target image file;

[0011] A first establishment module is configured to establish a first mapping relationship between an identification of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table;

[0012] A first sending module is configured to, after the cloud server instance is put into use, extract the target image kernel data from the image mapping table based on the identification of the target image file contained in a kernel data acquisition request sent by a security client running on the cloud server instance in response to receiving the kernel data acquisition request, and send the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data.

[0013] A third aspect of the embodiments of the present disclosure provides a computer device, comprising a memory and a processor, and a computer program, wherein the memory stores the computer program, and when the computer program is executed by the processor, the malicious code detection method of the first aspect is implemented.

[0014] A fourth aspect of the embodiments of the present disclosure provides a computer readable storage medium, and the storage medium stores a computer program, and when the computer program is executed by the processor, the malicious code detection method of the first aspect is implemented.

[0015] The technical solutions provided by the embodiments of the present disclosure have the following advantages compared with the prior art:

[0016] In the malicious code detection method, device, equipment and storage medium provided by the embodiments of the present disclosure, in response to detecting that a user creates a cloud server instance and loads a target image file, target image kernel data is extracted from the target image file, a first mapping relationship between the identifier of the target image file and the target image kernel data is established, and the first mapping relationship is stored in a pre-created image mapping table. After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, the target image kernel data is extracted from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data. The collection of the kernel data can be completed at the cloud server creation stage when the cloud server instance has not yet formally provided services and the probability of kernel data tampering is relatively low, and the kernel data is stored in a cloud server management platform with higher security level, thereby reducing the risk of kernel data tampering and improving the integrity and authenticity of the kernel data, so as to enhance the detection capability of Rootkit malicious code when detecting attacks based on the kernel data stored in the cloud server management platform. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the disclosure.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0019] Figure 1 is a flowchart of a malicious code detection method provided by an embodiment of the present disclosure;

[0020] Figure 2 is a flowchart of a method for updating a kernel mapping table provided by an embodiment of the present disclosure;

[0021] Figure 3 is a flowchart of another method for updating a kernel mapping table provided by an embodiment of the present disclosure;

[0022] Figure 4 is a flowchart of a method for generating a management report provided by an embodiment of the present disclosure;

[0023] Figure 5 is a structural schematic diagram of a malicious code detection device provided by an embodiment of the present disclosure;

[0024] Figure 6 FIG. 1 is a structural schematic diagram of a computer device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In order to more clearly understand the above-mentioned purposes, features and advantages of the present disclosure, the solutions of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0026] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present disclosure, but the present disclosure can also be implemented in other manners different from those described herein; obviously, the embodiments described in the specification are only a part of the embodiments of the present disclosure, and not all the embodiments.

[0027] It should be understood that each step recorded in the method embodiments of the present disclosure can be executed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the execution of the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] Figure 1 FIG. 2 is a flowchart of a malicious code detection method according to an embodiment of the present disclosure. The method can be executed by a malicious code detection device, which can be arranged in a cloud server management platform. As shown in FIG. 2, the malicious code detection method provided by the present embodiment includes the following steps: Figure 1

[0029] S101, in response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file.

[0030] The kernel data in the embodiments of the present disclosure can be understood as baseline kernel data required for comparing with a kernel symbol table when detecting a Rootkit malicious code based on the kernel symbol table. For example, the kernel data can be a System.map file.

[0031] In the embodiments of the present disclosure, the malicious code detection device can obtain the identification of the target image file contained in the request when receiving the request of creating a cloud server instance submitted by the user, load the target image file from the image warehouse to the cloud server instance based on the identification of the target image file, and extract the target image kernel data from the target image file before the cloud server instance is created. Specifically, the target image kernel data in the target image file can be located and extracted according to the directory mounted by the kernel data.

[0032] ​In an exemplary embodiment of the present disclosure, the malicious code detection apparatus can, in response to detecting that a user creates a cloud server instance and loads a target image file, search for, in a pre-created image mapping table, whether there is kernel data corresponding to an identifier of the target image file, and extract target image kernel data from the target image file when the kernel data corresponding to the identifier of the target image file is not found in the image mapping table.

[0033] S102, establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in the pre-created image mapping table.

[0034] The image mapping table in the present embodiment of the present disclosure can be understood as a table for storing the mapping relationship between the identifier of the image file and the kernel data.

[0035] In the present embodiment of the present disclosure, the malicious code detection apparatus can, after extracting the target image kernel data from the target image file, establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in the pre-created image mapping table. Specifically, the identifier of the target image file can be stored in the image mapping table as an index, and the target image kernel data can be stored as a value.

[0036] In an exemplary embodiment of the present disclosure, the malicious code detection apparatus can add an unavailable label to the cloud server instance created by the user before storing the first mapping relationship between the identifier of the target image file and the target image kernel data in the pre-created image mapping table, and modify the label to available after the first mapping relationship is stored in the image mapping table and the cloud server instance is configured.

[0037] In an exemplary embodiment of the present disclosure, the malicious code detection apparatus can mark the target image file as recorded after storing the first mapping relationship between the identifier of the target image file and the target image kernel data in the pre-created image mapping table, to avoid repeated collection of the target image kernel data in the target image file.

[0038] S103, after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extracting the target image kernel data from the image mapping table based on the identifier of the target image file included in the kernel data acquisition request, and sending the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data.

[0039] In the embodiments of the present disclosure, after the cloud server instance is put into use, the security client running on the cloud server instance runs the Rootkit detection module in the background, and periodically compares the kernel data and the kernel symbol table to detect malicious code. When the security client needs to obtain the kernel data, it sends a kernel data acquisition request containing the identification of the target image file to the cloud server management platform. The malicious code detection device in the cloud server management platform can respond to the kernel data acquisition request, based on the identification of the target image file contained in the request, find and extract the target image kernel data corresponding to the identification of the target image file in the image mapping table, and send the target image kernel data to the security client. The security client can compare the current kernel symbol table with the target image kernel data item by item to detect potential symbol tampering or hidden Rootkit malicious code. If the cloud server instance enables kernel address space layout randomization, the security client can match the dynamic kernel address by analyzing the offset during comparison, and perform corresponding alarm processing when the kernel symbol is found to be inconsistent with the target image kernel data.

[0040] Optionally, the malicious code detection device can, in the case where no kernel version change of the cloud server instance is detected, respond to the kernel data acquisition request sent by the security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on the identification of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client. After the security client detects malicious code based on the target image kernel data, in response to receiving the first alarm information returned by the security client, the target image kernel data is reported to the security platform, and the target image kernel data is updated based on the first verification result corresponding to the target image kernel data in the security platform, and / or the target image kernel data is marked as trusted. The first alarm information is used to represent that the target image kernel data is not marked as trusted, and the target image kernel data does not match the kernel symbol table corresponding to the cloud server instance. The first verification result is obtained by the security engineer verifying the target image kernel data.

[0041] Specifically, the types of the mirror image file can include system built-in and user-defined, when the target mirror image file is a system built-in mirror image file, the malicious code detection device can store the first mapping relationship between the identification of the target mirror image file and the target mirror image kernel data in the pre-created mirror image mapping table, and if the target mirror image file is a system built-in mirror image file, add a trusted mark to the target mirror image kernel data, and after the cloud server instance is put into use, monitor the kernel version change operation of the cloud server instance, and if no kernel version change of the cloud server instance is detected, for the kernel data acquisition request sent by the security client, extract the target mirror image kernel data from the mirror image mapping table, and send the target mirror image kernel data and the mark to the security client, when the security client performs item-by-item comparison between the current kernel symbol table and the target mirror image kernel data, if the current kernel symbol table matches the target mirror image kernel data, no alarm is performed, and the next execution of the malicious code detection is waited; if the current kernel symbol table does not match the target mirror image kernel data, and the target mirror image kernel data is marked as trusted, it is determined that the current kernel symbol table is tampered, the malicious code is detected, and corresponding alarm processing is performed; if the target mirror image kernel data is marked as untrusted (for example, when the target mirror image file is a user-defined mirror image file, the target mirror image kernel data can be marked as to be verified), and the current kernel symbol table does not match the target mirror image kernel data, the first alarm information is returned to the malicious code detection device.

[0042] The malicious code detection device responds to receiving the first alarm information returned by the security client, and reports the target mirror image kernel data to the security platform, and after the security engineer obtains the target mirror image kernel data through the security platform, verifies the target mirror image kernel data, and reports the first verification result to the security platform, the malicious code detection device can update the target mirror image kernel data based on the first verification result corresponding to the target mirror image kernel data in the security platform, if the first verification result is untrusted, the target mirror image kernel data is updated using the kernel data uploaded to the security platform by the security engineer, and the updated target mirror image kernel data is marked as trusted; if the first verification result is trusted, the target mirror image kernel data is marked as trusted.

[0043] The embodiment of the disclosure can extract target image kernel data from the target image file in response to detecting that a user creates a cloud server instance and loads a target image file, establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table. After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, the target image kernel data is extracted from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and the target image kernel data is sent to the security client, so that the security client detects malicious code based on the target image kernel data. The cloud server creation stage, the cloud server instance has not yet officially provided services, and the probability of kernel data tampering is also relatively low. The collection of kernel data is completed at this time, and the kernel data is stored in a cloud server management platform with higher security level, reducing the risk of kernel data tampering and improving the integrity and authenticity of the kernel data. Thus, when subsequent attack detection is performed based on the kernel data stored in the cloud server management platform, the detection capability for Rootkit malicious code is enhanced. The above reporting of the security platform, updating of the target image kernel data, and adding of the mark can further improve the reliability of the kernel data used for malicious code detection, and reduce the risk of detection misjudgment caused by tampering of the kernel data.

[0044] In some embodiments, the type of the image file includes system built-in and user-defined. After the target image kernel data is extracted from the target image file, the malicious code detection device can acquire a target kernel version in the target image file, establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table. Based on the type of the target image file, a mark is added to the target image kernel data in the kernel mapping table. If the type of the target image file is system built-in, the target image kernel data is marked as trusted. If the type of the target image file is user-defined, the target image kernel data is marked as to be verified.

[0045] Specifically, the malicious code detection apparatus can obtain the target kernel version recorded in the target image file after extracting the target image kernel data from the target image file, and establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in the kernel mapping table created in advance. The kernel mapping table can be understood as a table for storing the mapping relationship between the kernel version and the kernel data. Before establishing the second mapping relationship, the malicious code detection apparatus can determine the target image kernel data corresponding to the target kernel version according to the corresponding relationship between the kernel version and the kernel data obtained in advance and the target kernel version of the target image file when the target image file is a system built-in image file, and determine the kernel mapping table that does not contain the kernel data corresponding to the target kernel version when the kernel mapping table is searched based on the target kernel version. When the kernel mapping table does not contain the kernel data corresponding to the target kernel version, the second mapping relationship is established and stored in the kernel mapping table. At the same time, if the target image file is a system built-in image file, a trusted mark is added to the target image kernel data, and if the type of the target image file is a user-defined image file, a to-be-verified mark is added to the target image kernel data. This facilitates subsequent kernel version upgrade during the use of the cloud server instance, enables the current kernel data to be obtained from the kernel mapping table to implement malicious code detection, and further improves the reliability of the kernel data used for detecting malicious code, thereby reducing the risk of detection error caused by tampering with the kernel data.

[0046] Figure 2 is a flowchart of a method for updating a kernel mapping table provided by the embodiments of the present disclosure, as shown in Figure 2 Based on the above-mentioned embodiments, the kernel mapping table can be updated by the following method.

[0047] S201, in response to detecting a kernel version change operation of the cloud server instance, obtaining a changed kernel version and changed kernel data.

[0048] In the embodiments of the present disclosure, the malicious code detection apparatus can periodically scan the cloud server instance to obtain the current kernel version of the cloud server instance, and compare the current kernel version with the last recorded kernel version to check whether the kernel version has changed. When detecting the kernel version change operation of the cloud server instance, the malicious code detection apparatus requests the cloud server instance to obtain the current kernel version and kernel data, and obtains the changed kernel version and changed kernel data.

[0049] S202, searching for reference kernel data corresponding to the changed kernel version in the kernel mapping table.

[0050] The reference kernel data in the embodiments of the present disclosure can be understood as the kernel data corresponding to the changed kernel version stored in the kernel mapping table.

[0051] In the embodiments of the present disclosure, the malicious code detection apparatus can, after obtaining the changed kernel version and the changed kernel data, search for the reference kernel data corresponding to the changed kernel version in the kernel mapping table based on the changed kernel version.

[0052] In S203, if the reference kernel data corresponding to the changed kernel version is not contained in the kernel mapping table, a third mapping relationship between the changed kernel version and the changed kernel data is established, the third mapping relationship is stored in the kernel mapping table, and the changed kernel data is marked as to be verified in the kernel mapping table.

[0053] In the embodiments of the present disclosure, when the reference kernel data corresponding to the changed kernel version is not found in the kernel mapping table, the malicious code detection apparatus can establish a third mapping relationship between the changed kernel version and the changed kernel data, and store the third mapping relationship in the kernel mapping table. Since the security of the kernel version change operation cannot be verified, when the changed kernel data is stored in the kernel mapping table, the changed kernel data needs to be marked as to be verified.

[0054] In S204, if the reference kernel data corresponding to the changed kernel version is contained in the kernel mapping table, the reference kernel data and the changed kernel data are compared, and the kernel mapping table is updated when the reference kernel data and the changed kernel data are inconsistent.

[0055] In the embodiments of the present disclosure, when the reference kernel data corresponding to the changed kernel version is found in the kernel mapping table, the malicious code detection apparatus can compare the reference kernel data in the kernel mapping table with the changed kernel data obtained after the change. If the reference kernel data and the changed kernel data are consistent, the next version change is waited for. If the reference kernel data and the changed kernel data are inconsistent, it means that at least one of the reference kernel data and the changed kernel data is tampered, and further verification is needed. The kernel mapping table is updated according to the verification result.

[0056] The embodiment of the present disclosure can detect the change of the kernel version of the cloud server instance, obtain the changed kernel version and the changed kernel data, find the reference kernel data corresponding to the changed kernel version in the kernel mapping table, if the reference kernel data corresponding to the changed kernel version is not contained in the kernel mapping table, establish a third mapping relationship between the changed kernel version and the changed kernel data, store the third mapping relationship in the kernel mapping table, and mark the changed kernel data as to be verified in the kernel mapping table, if the reference kernel data corresponding to the changed kernel version is contained in the kernel mapping table, compare the reference kernel data with the changed kernel data, and update the kernel mapping table when the reference kernel data is inconsistent with the changed kernel data, which can update the data recorded in the kernel mapping table in time when the kernel version changes, and introduce a verification mechanism to verify the historical reference kernel data and the newly obtained changed kernel data, further improve the reliability of the kernel data used for detecting malicious code, and reduce the risk of detection error caused by tampering of the kernel data.

[0057] Figure 3 is a flowchart of another method for updating a kernel mapping table provided by the present disclosure, as shown in Figure 3 Based on the above embodiment, the kernel mapping table can be updated by the following method.

[0058] S301, in the case that the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as trusted, first reminding information is sent to the cloud server instance, and the first reminding information is used to represent that the changed kernel data is abnormal.

[0059] In the embodiment of the present disclosure, the malicious code detection device can obtain the marking information of the reference kernel data when it is determined that the reference kernel data is inconsistent with the changed kernel data, if the reference kernel data is marked as trusted, it means that the changed kernel data with differences from the reference kernel data is tampered, and the first reminding information is sent to the cloud server instance to remind the user of the cloud server instance that the changed kernel data is abnormal.

[0060] S302, in the case that the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as to be verified, the reference kernel data and the changed kernel data are reported to the security platform, and the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data in the security platform are obtained.

[0061] In the embodiments of the present disclosure, when it is determined that the reference kernel data is inconsistent with the changed kernel data, the malicious code detection apparatus can obtain the marking information of the reference kernel data. If the reference kernel data is marked as to be verified, it indicates that there is at least one tampered kernel data in the reference kernel data and the changed kernel data, and further verification is needed. Therefore, the reference kernel data and the changed kernel data are reported to the security platform. After the security engineers obtain the reference kernel data and the changed kernel data through the security platform, the reference kernel data and the changed kernel data are verified, and after the verification is completed, the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data are reported to the security platform. The malicious code detection apparatus can obtain the second verification result and the third verification result from the security platform.

[0062] In the embodiments of the present disclosure, when the second verification result is trusted and the third verification result is untrusted, the reference kernel data is marked as trusted in the kernel mapping table, and / or the first reminder information is sent to the cloud server instance.

[0063] In the embodiments of the present disclosure, after the malicious code detection apparatus obtains the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data from the security platform, when the second verification result corresponding to the reference kernel data is trusted and the third verification result corresponding to the changed kernel data is untrusted, at least one of the following operations is performed: the reference kernel data is marked as trusted in the kernel mapping table according to the second verification result, and the first reminder information is sent to the cloud server instance to remind the user of the cloud server instance that the changed kernel data is abnormal.

[0064] In the embodiments of the present disclosure, when the third verification result is trusted and the second verification result is untrusted, the fourth mapping relationship between the changed kernel version and the reference kernel data is deleted in the kernel mapping table, the third mapping relationship between the changed kernel version and the changed kernel data is established and stored, and the changed kernel data is marked as trusted, and / or the second reminder information is generated, and the second reminder information is used to represent that the reference kernel data is abnormal.

[0065] In the embodiments of the present disclosure, after the malicious code detection apparatus obtains the second verification result corresponding to the reference kernel data and the third verification result corresponding to the changed kernel data from the security platform, when the third verification result corresponding to the changed kernel data is trusted and the second verification result corresponding to the reference kernel data is untrusted, the fourth mapping relationship between the changed kernel version and the untrusted reference kernel data is deleted in the kernel mapping table, the third mapping relationship between the changed kernel version and the trusted changed kernel data is established and stored, and at least one of the following operations is performed: the changed kernel data is marked as trusted in the kernel mapping table according to the third verification result, and the second reminder information is generated to represent that the early collected reference kernel data is abnormal.

[0066] The embodiments of the present disclosure can send first reminder information to the cloud server instance in the case that the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as trusted, the first reminder information being used to represent that the changed kernel data is abnormal, report the reference kernel data and the changed kernel data to the security platform in the case that the reference kernel data is inconsistent with the changed kernel data and the reference kernel data is marked as to be verified, obtain a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data in the security platform, mark the reference kernel data as trusted in the kernel mapping table and / or send the first reminder information to the cloud server instance when the second verification result is trusted and the third verification result is untrusted, delete a fourth mapping relationship between the changed kernel version and the reference kernel data in the kernel mapping table, establish and store a third mapping relationship between the changed kernel version and the changed kernel data, and mark the changed kernel data as trusted and / or generate second reminder information used to represent that the reference kernel data is abnormal when the third verification result is trusted and the second verification result is untrusted. The reliability of the reference kernel data and the changed kernel data obtained after the version is changed can be verified when they are different, so that the kernel mapping table can be adjusted accordingly, the reliability of the kernel data used to detect malicious code is further improved, and the risk of detection error caused by tampering with the kernel data is reduced.

[0067] In some other embodiments, the malicious code detection apparatus can extract target version kernel data corresponding to a target kernel version of the cloud server instance from the kernel mapping table based on the target kernel version of the cloud server instance included in the kernel data acquisition request in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance after the kernel version of the cloud server instance is changed, and send the target version kernel data to the security client. After the security client detects malicious code based on the target image kernel data, the target version kernel data is reported to the security platform in response to receiving second alarm information returned by the security client, and the target version kernel data is updated based on a fourth verification result corresponding to the target version kernel data in the security platform and / or marked as trusted, wherein the second alarm information is used to represent that the target version kernel data is not marked as trusted and the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

[0068] Specifically, the malicious code detection apparatus can monitor the kernel version change operation of the cloud server instance after the cloud server instance is put into use, and in the case that the kernel version change of the cloud server instance is detected, for the kernel data acquisition request sent by the security client, the target version kernel data corresponding to the target kernel version contained in the request is extracted from the kernel mapping table, and the target version kernel data and the mark are sent to the security client. When the current kernel symbol table and the target version kernel data are compared item by item, if the current kernel symbol table and the target version kernel data match, no alarm is given, and the next time the malicious code detection is performed; if the current kernel symbol table and the target version kernel data do not match, and the target version kernel data is marked as trusted, it is determined that the current kernel symbol table is tampered, the malicious code is detected, and the corresponding alarm processing is performed; if the target version kernel data is marked as untrusted (for example, the target version file is marked as to be verified), and the current kernel symbol table and the target version kernel data do not match, the second alarm information is returned to the malicious code detection apparatus.

[0069] In response to receiving the second alarm information returned by the security client, the malicious code detection apparatus reports the target version kernel data to the security platform, and after the security engineer obtains the target version kernel data through the security platform, verifies the target version kernel data, and reports the fourth verification result to the security platform, the malicious code detection apparatus can update the target version kernel data based on the fourth verification result corresponding to the target version kernel data in the security platform. If the fourth verification result is untrusted, the kernel data uploaded to the security platform by the security engineer is used to update the target version kernel data, and the updated target version kernel data is marked as trusted; if the fourth verification result is trusted, the target version kernel data is marked as trusted, thereby further improving the reliability of the kernel data used for detecting malicious code and reducing the risk of detection error caused by tampering of the kernel data.

[0070] Figure 4 is a flowchart of a method for generating a management report provided by the embodiments of the present disclosure. As shown in Figure 4 on the basis of the above-mentioned embodiments, the management report can be generated by the following method.

[0071] S401, the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification result of the kernel data are stored in a pre-created log file.

[0072] In the embodiments of the present disclosure, the malicious code detection apparatus can sort the kernel version change history of the cloud server instance, store the version change time, the operation user, the reference kernel data and the changed kernel data corresponding to each kernel version, and the verification result of the kernel data in the security platform in the pre-created log file.

[0073] S402, periodically analyze the log file to generate a management report.

[0074] In the embodiments of the present disclosure, the malicious code detection apparatus can periodically analyze the recorded log file, focus on the statistical and correlation analysis of the trusted state of the kernel data and the abnormal detection condition, and generate a management report according to the statistical and analysis results.

[0075] The embodiments of the present disclosure can facilitate the user and the security team of the cloud server instance to review the running and version change of the cloud server instance, so as to enhance the overall security of the cloud server instance, by storing the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version and the verification result of the kernel data into the pre-created log file, periodically analyzing the log file, and generating a management report.

[0076] Figure 5 is a structural schematic diagram of a malicious code detection apparatus provided by the embodiments of the present disclosure. As shown in Figure 5 The malicious code detection apparatus 500 is applicable to a cloud server management platform, and the malicious code detection apparatus 500 comprises an extraction module 510, a first establishing module 520 and a first sending module 530. The extraction module 510 is configured to extract target image kernel data from a target image file in response to detecting that a user creates a cloud server instance and loads the target image file. The first establishing module 520 is configured to establish a first mapping relationship between the identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table. The first sending module 530 is configured to, after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on the identifier of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data.

[0077] Optionally, the first sending module 530 is specifically configured to, in a case where it is detected that no kernel version change occurs in the cloud server instance, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on an identification of the target image file contained in the kernel data acquisition request, and send the target image kernel data to the security client; the malicious code detection apparatus 500 further comprises a first reporting module configured to, in response to receiving first alarm information returned by the security client, report the target image kernel data to a security platform, and update the target image kernel data based on a first verification result corresponding to the target image kernel data in the security platform, and / or mark the target image kernel data as trusted, wherein the first alarm information is used to represent that the target image kernel data is not marked as trusted, and the target image kernel data does not match a kernel symbol table corresponding to the cloud server instance, and the first verification result is obtained by a security engineer verifying the target image kernel data.

[0078] Optionally, the type of the image file includes system built-in and user-defined, and the malicious code detection apparatus 500 further comprises a first obtaining module configured to obtain a target kernel version in the target image file; a second establishing module configured to establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table; and a marking module configured to add a mark for the target image kernel data in the kernel mapping table based on the type of the target image file, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted, and if the type of the target image file is user-defined, the target image kernel data is marked as to be verified.

[0079] Optionally, the malicious code detection apparatus 500 further comprises: a second acquisition module, configured to acquire a changed kernel version and changed kernel data in response to detecting a kernel version changing operation of the cloud server instance after the cloud server instance is put into use; a searching module, configured to search for reference kernel data corresponding to the changed kernel version in the kernel mapping table; a third establishing module, configured to establish a third mapping relationship between the changed kernel version and the changed kernel data if the reference kernel data corresponding to the changed kernel version is not included in the kernel mapping table, store the third mapping relationship in the kernel mapping table, and mark the changed kernel data as to be verified in the kernel mapping table; and a comparing module, configured to compare the reference kernel data with the changed kernel data if the reference kernel data corresponding to the changed kernel version is included in the kernel mapping table, and update the kernel mapping table when the reference kernel data and the changed kernel data are inconsistent.

[0080] Optionally, the comparing module comprises: a sending unit, configured to send first reminding information to the cloud server instance when the reference kernel data and the changed kernel data are inconsistent and the reference kernel data is marked as trusted, the first reminding information being used to represent that the changed kernel data is abnormal; a reporting unit, configured to report the reference kernel data and the changed kernel data to a security platform when the reference kernel data and the changed kernel data are inconsistent and the reference kernel data is marked as to be verified, acquire a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data in the security platform; a first processing unit, configured to mark the reference kernel data as trusted in the kernel mapping table and / or send the first reminding information to the cloud server instance when the second verification result is trusted and the third verification result is untrusted; and a second processing unit, configured to delete a fourth mapping relationship between the changed kernel version and the reference kernel data in the kernel mapping table, establish and store a third mapping relationship between the changed kernel version and the changed kernel data, mark the changed kernel data as trusted, and / or generate second reminding information when the third verification result is trusted and the second verification result is untrusted, the second reminding information being used to represent that the reference kernel data is abnormal.

[0081] Optionally, the malicious code detection device 500 further includes: a second sending module, configured to, after the kernel version of the cloud server instance changes, respond to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract target version kernel data corresponding to the target kernel version from the kernel mapping table based on the target kernel version of the cloud server instance included in the kernel data acquisition request, and send the target version kernel data to the security client; a second reporting module, configured to, in response to receiving a second alarm information returned by the security client, report the target version kernel data to the security platform, update the target version kernel data based on the fourth verification result corresponding to the target version kernel data in the security platform, and / or mark the target version kernel data as trustworthy, wherein the second alarm information is used to indicate that the target version kernel data is not marked as trustworthy, and the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

[0082] Optionally, the malicious code detection device 500 further includes: a recording module, used to store the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification results of the kernel data into a pre-created log file; and an analysis module, used to periodically analyze the log file and generate management reports.

[0083] The malicious code detection device provided in this embodiment can execute the method described in any of the above embodiments. Its execution method and beneficial effects are similar, and will not be repeated here.

[0084] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure.

[0085] like Figure 6 As shown, the computer device may include a processor 610 and a memory 620 storing computer program instructions.

[0086] Specifically, the processor 610 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0087] The memory 620 can include mass storage for data or instructions. As an example and not by way of limitation, the memory 620 can include a Hard Disk Drive (HDD), a floppy disk drive, a flash memory, a Compact Disc (CD) or a Digital Versatile Disc (DVD), a magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Storage memory 620 can include removable or non-removable (or fixed) media, where appropriate. Storage memory 620 can be internal or external to integrated gateway device, where appropriate. In particular embodiments, memory 620 is nonvolatile, solid-state memory. In particular embodiments, the memory 620 includes a Read-Only Memory (ROM). Where appropriate, this ROM can be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, memory 620 can be a compact flash storage card, or another suitable memory card technology, such as a Secure Digital (SD) card or an xD picture card. Memory 620 can also include a nonvolatile memory card, such as a Solid State Disk (SSD) card. In particular embodiments, the memory 620 is a nonvolatile flash memory card.

[0088] The processor 610 performs the steps of malicious code detection method provided by embodiments of the present disclosure by reading and executing computer program instructions stored in the memory 620.

[0089] In one example, the computer device can also include a transceiver 630 and a bus 640. As shown, the processor 610, the memory 620, and the transceiver 630 are connected and communicate with each other through the bus 640. Figure 6

[0090] ​Bus 640 includes a hardware, software, or both that couples components of computer system 600 to each other. As an example without limitation, bus 640 can include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side BUS (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand (IB) interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or some other suitable bus or interconnect, or a combination of two or more of these. Where appropriate, bus 640 can include one or more buses. Although this application describes and shows a particular bus, this application contemplates any suitable bus or interconnect.

[0091] The embodiment of the present disclosure further provides a computer readable storage medium, which can store a computer program. When the computer program is executed by a processor, the processor implements the malicious code detection method provided by the embodiment of the present disclosure.

[0092] The storage medium can for example include a memory 620 storing computer program instructions which can be executed by the processor 610 of the malicious code detection device to implement the malicious code detection method provided by the embodiments of the present disclosure. Optionally, the storage medium can be a non-transitory computer readable storage medium, for example, the non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device, etc. The computer program can be written in any combination of one or more programming languages implementing the procedures according to the embodiments of the present disclosure, including an object-oriented programming language, such as Java, C++, etc., and a conventional procedural programming language, such as a "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0093] It should be noted that, in this document, relational terms such as "first" and "second", and the like, are used solely to distinguish one entity or action from another, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0094] The above description is merely one implementation of the present disclosure, and those skilled in the art will be able to make various modifications to the embodiments without departing from the spirit or scope of the present disclosure. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A malicious code detection method characterized by comprising: The method is suitable for a cloud server management platform, and the method comprises: In response to detecting that a user creates a cloud server instance and loads a target image file, extracting target image kernel data from the target image file; Establishing a first mapping relationship between the identity of the target image file and the target image kernel data, and storing the first mapping relationship in a pre-created image mapping table; After the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extracting the target image kernel data from the image mapping table based on the identity of the target image file contained in the kernel data acquisition request, and sending the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data; The type of the image file includes system built-in and user-defined, and after the target image kernel data is extracted from the target image file, the method further comprises: Obtaining a target kernel version in the target image file; Establishing a second mapping relationship between the target kernel version and the target image kernel data, and storing the second mapping relationship in a pre-created kernel mapping table; Based on the type of the target image file, adding a mark for the target image kernel data in the kernel mapping table, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted, and if the type of the target image file is user-defined, the target image kernel data is marked as to be verified.

2. The method of claim 1, wherein, In response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extracting the target image kernel data from the image mapping table based on the identity of the target image file contained in the kernel data acquisition request, and sending the target image kernel data to the security client, comprising: In the case where no kernel version change of the cloud server instance is detected, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extracting the target image kernel data from the image mapping table based on the identity of the target image file contained in the kernel data acquisition request, and sending the target image kernel data to the security client; The method further comprises: In response to receiving first alarm information returned by the security client, reporting the target image kernel data to a security platform, and updating the target image kernel data based on a first verification result corresponding to the target image kernel data in the security platform, and / or marking the target image kernel data as trusted, wherein the first alarm information is used to represent that the target image kernel data is not marked as trusted, and the target image kernel data does not match a kernel symbol table corresponding to the cloud server instance, and the first verification result is obtained by a security engineer verifying the target image kernel data.

3. The method of claim 1, wherein, After the cloud server instance is put into use, the method further comprises: In response to detecting a kernel version changing operation of the cloud server instance, obtaining a changed kernel version and changed kernel data; In the kernel mapping table, find the reference kernel data corresponding to the changed kernel version; If the reference kernel data corresponding to the changed kernel version is not contained in the kernel mapping table, establish a third mapping relationship between the changed kernel version and the changed kernel data, store the third mapping relationship in the kernel mapping table, and mark the changed kernel data as to be verified in the kernel mapping table; If the reference kernel data corresponding to the changed kernel version is contained in the kernel mapping table, compare the reference kernel data with the changed kernel data, and update the kernel mapping table when the reference kernel data and the changed kernel data are inconsistent.

4. The method of claim 3, wherein, The updating of the kernel mapping table when the reference kernel data and the changed kernel data are inconsistent comprises: In the case that the reference kernel data and the changed kernel data are inconsistent, and the reference kernel data is marked as trusted, sending first reminding information to the cloud server instance, the first reminding information being used to represent that the changed kernel data is abnormal; In the case that the reference kernel data and the changed kernel data are inconsistent, and the reference kernel data is marked as to be verified, reporting the reference kernel data and the changed kernel data to a security platform, obtaining a second verification result corresponding to the reference kernel data and a third verification result corresponding to the changed kernel data in the security platform; In the case that the second verification result is trusted and the third verification result is untrusted, marking the reference kernel data as trusted in the kernel mapping table, and / or sending the first reminding information to the cloud server instance; In the case that the third verification result is trusted and the second verification result is untrusted, deleting a fourth mapping relationship between the changed kernel version and the reference kernel data in the kernel mapping table, establishing and storing a third mapping relationship between the changed kernel version and the changed kernel data, marking the changed kernel data as trusted, and / or generating second reminding information, the second reminding information being used to represent that the reference kernel data is abnormal.

5. The method of claim 3, wherein, After the kernel version of the cloud server instance is changed, the method further comprises: In response to receiving a kernel data obtaining request sent by a security client running on the cloud server instance, based on a target kernel version of the cloud server instance contained in the kernel data obtaining request, extracting target version kernel data corresponding to the target kernel version from the kernel mapping table, and sending the target version kernel data to the security client; The method further comprises: In response to receiving the second alarm information returned by the security client, the target version kernel data is reported to a security platform, and the target version kernel data is updated based on a fourth verification result corresponding to the target version kernel data in the security platform, and / or the target version kernel data is marked as trusted, wherein the second alarm information is used to represent that the target version kernel data is not marked as trusted, and the target version kernel data does not match the kernel symbol table corresponding to the cloud server instance.

6. The method according to any one of claims 3-5, characterized in that, The method further comprises: storing the kernel version change history of the cloud server instance, the kernel data corresponding to each kernel version, and the verification result of the kernel data into a pre-created log file; periodically analyzing the log file to generate a management report.

7. A malicious code detection device characterized by comprising: The device is suitable for a cloud server management platform, and the device comprises: an extraction module configured to extract target image kernel data from a target image file in response to detecting that a user creates a cloud server instance and loads the target image file; a first establishment module configured to establish a first mapping relationship between an identifier of the target image file and the target image kernel data, and store the first mapping relationship in a pre-created image mapping table; a first sending module configured to, after the cloud server instance is put into use, in response to receiving a kernel data acquisition request sent by a security client running on the cloud server instance, extract the target image kernel data from the image mapping table based on an identifier of the target image file included in the kernel data acquisition request, and send the target image kernel data to the security client, so that the security client detects malicious code based on the target image kernel data; The type of the image file includes system built-in and user-defined; the malicious code detection device further comprises: a first acquisition module configured to acquire a target kernel version in the target image file; a second establishment module configured to establish a second mapping relationship between the target kernel version and the target image kernel data, and store the second mapping relationship in a pre-created kernel mapping table; a marking module configured to add a mark for the target image kernel data in the kernel mapping table based on the type of the target image file, wherein if the type of the target image file is system built-in, the target image kernel data is marked as trusted, and if the type of the target image file is user-defined, the target image kernel data is marked as to be verified.

8. A computer device, comprising: comprises: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the malicious code detection method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and when the computer program is executed by the processor, the malicious code detection method of any one of claims 1-6 is implemented.

Images