User mode privilege lifting attack detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a user mode privilege lifting attack detection method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring a process behavior identification request; the process behavior recognition request is responded, function historical calling information of the user process is obtained, the function historical calling information is used for representing the calling behavior of the user process on a verification function before the privilege extraction sub-process is established, and the verification function is used for verifying the legality of establishing the privilege extraction sub-process; the rule engine is called to conduct behavior attribute judgment on the calling behavior of the verification function to obtain a judgment result, a judgment rule is predefined in the rule engine, and the judgment result is used for representing whether the calling behavior of the verification function meets the judgment rule or not; and determining whether the privilege lifting behavior belongs to a user state normal privilege lifting behavior or a user state privilege lifting attack behavior based on a judgment result. According to the method and the device, the technical problem of low detection accuracy of the user mode privilege lifting attack is solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a method, device, storage medium and electronic device for detecting user-mode privilege escalation attacks. Background Art

[0002] In the detection scenario of user-level privilege escalation attacks, special adaptation is usually made to abnormal process behaviors. A rule can only be effective for one type of abnormal process behavior and is not universal, which leads to the problem of low detection accuracy of user-level privilege escalation attacks. Therefore, there is a problem of low detection accuracy of user-level privilege escalation attacks.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device, storage medium and electronic device for detecting user-mode privilege escalation attacks, so as to at least solve the technical problem of low detection accuracy of user-mode privilege escalation attacks.

[0005] According to one aspect of an embodiment of the present application, a method for detecting a user-state privilege escalation attack is provided, comprising: obtaining a process behavior identification request, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior executed by a user process in user state belongs to normal user-state privilege escalation behavior or user-state privilege escalation attack behavior, and the privilege escalation behavior includes a process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution authority of the user process in the user state; in response to the process behavior identification request, obtaining function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of a verification function by the user process before creating the privilege escalation subprocess, and the verification function is used to verify the legality of creating the privilege escalation subprocess; calling a rule engine to judge the behavior attribute of the calling behavior of the verification function to obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule; and determining, based on the judgment result, whether the privilege escalation behavior belongs to normal user-state privilege escalation behavior or user-state privilege escalation attack behavior.

[0006] According to another aspect of an embodiment of the present application, a detection device for a user-state privilege escalation attack is also provided, including: a first acquisition unit, used to obtain a process behavior identification request, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior performed by a user process in user state belongs to normal privilege escalation behavior in user state or behavior of a user-state privilege escalation attack, wherein the privilege escalation behavior includes a process behavior of creating a privilege escalation subprocess, wherein the privilege escalation subprocess is used to enhance the execution authority of the user process in the user state; a second acquisition unit, used to respond to the process behavior identification request, and obtain function history call information of the user process, wherein the function history call information The historical call information is used to indicate the calling behavior of the verification function by the above-mentioned user process before creating the above-mentioned privilege escalation sub-process, and the above-mentioned verification function is used to verify the legality of creating the above-mentioned privilege escalation sub-process; the first determination unit is used to call the rule engine to judge the behavior attribute of the calling behavior of the above-mentioned verification function, and obtain the judgment result, wherein the judgment rule has been pre-defined in the above-mentioned rule engine, and the above-mentioned judgment result is used to indicate whether the calling behavior of the above-mentioned verification function complies with the above-mentioned judgment rule; the second determination unit is used to determine whether the above-mentioned privilege escalation behavior belongs to the above-mentioned user-state normal privilege escalation behavior or the above-mentioned user-state privilege escalation attack behavior based on the above-mentioned judgment result.

[0007] As an optional scheme, the above-mentioned second acquisition unit includes: a detection module, which is used to continuously detect all behaviors of calling the above-mentioned verification function in the above-mentioned user process to obtain the detection result, wherein the above-mentioned detection result is used to indicate the calling behavior of the above-mentioned user process to the above-mentioned verification function, and the above-mentioned function history calling information includes the above-mentioned detection result.

[0008] As an optional scheme, the above-mentioned detection module includes at least one of the following: a first detection submodule, which is used to use the hook function in the dynamic library loaded into the above-mentioned user process to continuously detect the calling behavior of the above-mentioned verification function, wherein the above-mentioned hook function has the same name as the above-mentioned verification function, and the above-mentioned dynamic library is provided with a continuous detection function, and the above-mentioned continuous detection function is used to record the calling behavior of the above-mentioned user process to the above-mentioned hook function, and the above-mentioned hook function replaces the calling behavior executed on the above-mentioned verification function, and the above-mentioned hook function is configured with a function pointer of the above-mentioned verification function, and the above-mentioned function pointer is used to call the above-mentioned verification function when the above-mentioned hook function is called; a second detection submodule, which is used to use the detection rules set by the above-mentioned continuous detection service to continuously detect the calling behavior of the above-mentioned verification function when the above-mentioned user process is configured with a continuous detection service, wherein the continuous detection service is used to continuously detect various operation behaviors in the system where the above-mentioned user process is located, and the above-mentioned various operation behaviors include the calling behavior of the above-mentioned verification function.

[0009] As an optional solution, the above-mentioned device also includes: a first request unit, used to trigger the above-mentioned process behavior identification request before the above-mentioned process behavior identification request is obtained, when the above-mentioned user process has created the above-mentioned privilege escalation sub-process; or, a second request unit, used to trigger the above-mentioned process behavior identification request before the above-mentioned process behavior identification request is obtained, when the above-mentioned user process requests to create the above-mentioned privilege escalation sub-process.

[0010] As an optional scheme, the above-mentioned device also includes: a deleting unit, which is used to delete the created privilege escalation sub-process after it is determined based on the above-mentioned judgment result that the above-mentioned privilege escalation behavior belongs to the above-mentioned normal privilege escalation behavior in user state or the above-mentioned privilege escalation attack behavior, and the above-mentioned user process has created the above-mentioned privilege escalation sub-process; or, a blocking unit, which is used to block the request response to create the above-mentioned privilege escalation sub-process after it is determined based on the above-mentioned judgment result that the above-mentioned privilege escalation behavior belongs to the above-mentioned normal privilege escalation behavior in user state or the above-mentioned privilege escalation attack behavior, and the above-mentioned user process requests to create the above-mentioned privilege escalation sub-process.

[0011] As an optional scheme, the above-mentioned device also includes: a third determination unit, which is used to determine the above-mentioned first process as the above-mentioned user process before the above-mentioned request for obtaining process behavior identification, if the first process is a target permission process that allows the execution permission to be elevated, wherein the above-mentioned target permission process is set to call the above-mentioned verification function before creating the above-mentioned elevated sub-process; a fourth determination unit, which is used to determine the above-mentioned second process as the above-mentioned user process before the above-mentioned request for obtaining process behavior identification, if the second process is a process with the above-mentioned target permission function, wherein the above-mentioned target permission function is a function that allows the execution permission to be elevated, and the process with the above-mentioned target permission function is set to call the above-mentioned verification function before creating the above-mentioned elevated sub-process.

[0012] As an optional solution, the above-mentioned device also includes: a security unit, which is used to send the abnormal information associated with the above-mentioned process behavior to the process security center after determining that the above-mentioned privilege escalation behavior belongs to the above-mentioned normal privilege escalation behavior in the user state or the above-mentioned privilege escalation attack behavior based on the above-mentioned judgment result, if the above-mentioned privilege escalation behavior belongs to the above-mentioned user state privilege escalation attack behavior, and the above-mentioned process security center performs abnormal repair processing on the above-mentioned user process.

[0013] As an optional scheme, the above-mentioned second determination unit includes: a determination module, which is used to determine that the above-mentioned privilege escalation behavior belongs to the above-mentioned normal privilege escalation behavior in the user state when the above-mentioned judgment result indicates that the calling behavior of the above-mentioned verification function complies with the above-mentioned judgment rule, wherein the above-mentioned judgment rule is used to stipulate that the above-mentioned verification function must be called before creating the above-mentioned privilege escalation sub-process, and the legitimacy of the above-mentioned verification function must be checked.

[0014] As an optional scheme, the above-mentioned determination module includes: a determination sub-module, which is used to determine that the above-mentioned process behavior belongs to the above-mentioned normal privilege escalation behavior in the above-mentioned user state when the above-mentioned function history call information indicates that the above-mentioned user process has called the above-mentioned verification function and passed the verification of the password information under preset conditions, wherein the above-mentioned password information is the information displayed when the above-mentioned verification function is called, and is used to verify the legality of creating the above-mentioned privilege escalation sub-process.

[0015] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above method for detecting user-mode privilege escalation attacks.

[0016] According to another aspect of an embodiment of the present application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the method for detecting user-mode privilege escalation attacks through the computer program.

[0017] In an embodiment of the present application, a process behavior identification request is obtained, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior performed by a user process in user mode belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, and the privilege escalation behavior includes process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution authority of the user process in the user mode; in response to the process behavior identification request, historical function call information of the user process is obtained, wherein the historical function call information is used to indicate the calling behavior of the verification function by the user process before creating the privilege escalation subprocess, and the verification function is used to verify the legality of creating the privilege escalation subprocess; a rule engine is called to judge the behavior attribute of the calling behavior of the verification function to obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule; based on the judgment result, it is determined that the privilege escalation behavior belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode.

[0018] Taking into account the abnormal process behavior of elevating execution permissions, it is necessary to bypass the verification of abnormal process behavior, and the verification of abnormal process behavior usually requires calling the above-mentioned verification function, and further using whether to call the above-mentioned verification function as a basis for judging the abnormal process behavior, thereby achieving the purpose of accurately judging the abnormal process behavior based on the essence of the abnormal process behavior, and then achieving the technical effect of improving the detection accuracy of user-state privilege escalation attacks, and further solving the technical problem of low detection accuracy of user-state privilege escalation attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 It is a schematic diagram of an application environment of an optional method for detecting user-mode privilege escalation attacks according to an embodiment of the present application;

[0021] Figure 2 It is a schematic diagram of the process of an optional method for detecting a user-mode privilege escalation attack according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional method for detecting a user-mode privilege escalation attack according to an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of another optional method for detecting user-mode privilege escalation attacks according to an embodiment of the present application;

[0024] Figure 5 is a schematic diagram of another optional method for detecting user-mode privilege escalation attacks according to an embodiment of the present application;

[0025] Figure 6 is a schematic diagram of another optional method for detecting user-mode privilege escalation attacks according to an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of an optional detection device for user-mode privilege escalation attacks according to an embodiment of the present application;

[0027] Figure 8 is a schematic diagram of another optional detection device for user-mode privilege escalation attack according to an embodiment of the present application;

[0028] Fig. 9 is a schematic diagram of another optional detection device for user-mode privilege escalation attack according to an embodiment of the present application;

[0029] Fig.10It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] According to one aspect of an embodiment of the present application, a method for detecting a user-mode privilege escalation attack is provided. Optionally, as an optional implementation, the method for detecting a user-mode privilege escalation attack can be, but is not limited to, applied to: Figure 1 In the environment shown, the environment may include, but is not limited to, a user device 102 and a server 112 . The user device 102 may include, but is not limited to, a display 104 , a processor 106 , and a memory 108 . The server 112 includes a database 114 and a processing engine 116 .

[0033] The specific process can be as follows:

[0034] Step S102, the user device 102 obtains a process behavior identification request;

[0035] Step S104, sending the process behavior identification request to the server 112 via the network 110;

[0036] Step S106, the server 112 responds to the process behavior identification request through the processing engine 116, and obtains the function call history information of the user process, specifically, continuously detects all the behaviors of calling the verification function in the user process to obtain the detection result; continuously detects the calling behavior of the verification function using the hook function in the dynamic library loaded into the user process; and when the user process is configured with a continuous detection service, continuously detects the calling behavior of the verification function using the detection rules set by the continuous detection service;

[0037] Step S108, the server 112 further obtains the detection result of the user state privilege escalation attack according to the function history call information through the processing engine 116, specifically, when the function history call information indicates that the user process has called the verification function and passed the verification of the password information under the preset conditions, it is determined that the process behavior belongs to the normal user state privilege escalation behavior;

[0038] Step S110, sending the recognition result to the user device 102 via the network 110;

[0039] In addition, before obtaining the process behavior identification request, it also includes step S112-2, in which, when the user process has created a privileged child process, the process behavior identification request is triggered; or, step S112-4, in which, when the user process requests to create a privileged child process, the process behavior identification request is triggered; or, step S114-2, in which, when the first process is a target permission process that allows the execution permission to be elevated, the first process is determined as a user process; or, step S114-4, in which, when the second process is a process with a target permission function, the second process is determined as a user process;

[0040] After determining that the process behavior is a user-mode privilege escalation attack, it also includes step S116-2, in which, if the user process has created a privilege escalation sub-process, the created privilege escalation sub-process is deleted; step S116-4, in which, if the user process requests to create a privilege escalation sub-process, the request response to create a privilege escalation sub-process is blocked; step S118, the abnormal information associated with the process behavior is sent to the process security center, and the process security center performs abnormal repair processing on the user process.

[0041] remove Figure 1In addition to the examples shown, the above steps can be completed independently by the user device or the server, or by the user device and the server in collaboration, such as the user device 102 executing the above steps S108-S110, thereby reducing the processing pressure of the server 112. The user device 102 includes but is not limited to handheld devices (such as mobile phones), laptops, tablet computers, desktop computers, vehicle-mounted devices, smart TVs, etc., and the present application does not limit the specific implementation of the user device 102. The server 112 can be a single server or a server cluster consisting of multiple servers, or a cloud server.

[0042] Optionally, as an optional implementation, as Figure 2 As shown, the detection method of user-mode privilege escalation attack can be executed by an electronic device, such as Figure 1 The user device or server shown in the figure comprises:

[0043] S202, obtaining a process behavior identification request, wherein the process behavior identification request is used to request detection of whether a privilege escalation behavior performed by a user process in user mode belongs to a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, wherein the privilege escalation behavior includes a process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in user mode;

[0044] S204, in response to the process behavior identification request, obtaining the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation sub-process, and the verification function is used to verify the legitimacy of creating the privilege escalation sub-process;

[0045] S206, calling a rule engine to judge the behavior attribute of the calling behavior of the verification function, and obtaining a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule;

[0046] S208, determining, based on the judgment result, whether the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode.

[0047] Optionally, in this embodiment, the above-mentioned user-mode privilege escalation attack detection method can be but is not limited to being applied in the protection scenario of user-mode privilege escalation attack, such as an attacker elevates the current ordinary user privilege to root privilege (process behavior) by attacking the suid (set user id) process in the Linux system or a process (user process) with setuid capability, wherein the Linux system is an open source operating system with a high degree of customizability and flexibility, allowing users to freely modify and distribute, and the suid process can be but is not limited to being understood as a permission mechanism in the Linux system, allowing ordinary users to execute certain programs or commands as super users. When a program is set to a suid process, it will have the privileges of its owner when executed, rather than the privileges of the user executing the program, and is usually used to perform operations that require privileges, such as changing system configuration or accessing sensitive resources; and a process with setuid capability The process of capability is similar, and can perform certain operations as a super user, but the capability is more refined, and the permissions of the process can be more finely controlled; in the Linux system, root is the super user, also known as the system administrator. The root user has all permissions in the system, including modifying system configuration, installing and uninstalling software, accessing and modifying system files, etc. When operations that require root permissions are required, the sudo command or su command can be used to obtain root permissions. The sudo command can temporarily grant root permissions to ordinary users, while the su command requires the root user's password to switch to the root user.

[0048] It should be noted that when an ordinary user starts a suid process or a process with setuid capability to switch the current user's permissions, a password check must be performed. For example, when an ordinary user uses sudo bash to switch the current permissions, a password check must be performed. However, when an attacker performs a user-mode privilege escalation attack, the permission switch can be achieved without a password check. This can be used as a detection feature to achieve general detection of user-mode privilege escalation. At the same time, because when performing a password check, the current process must first call the getspnam function (check function) to obtain the password information, so whether the current process calls the getspnam function is equivalent to a password check.

[0049] Optionally, in this embodiment, the process behavior identification request is used to request identification of whether the process behavior of a user process creating a privilege escalation sub-process belongs to normal user-state privilege escalation behavior or user-state privilege escalation attack behavior. In response to the process behavior identification request, the system's continuous detection program can be controlled to identify and report such process behavior, so that the administrator can take timely measures to prevent the system from being attacked. The process behavior identification request can be but is not limited to a passive or active triggered request, such as the process behavior identification request is set to be passively triggered when a user process creates or requests to create a privilege escalation sub-process, or the administrator can set a preset time to automatically trigger the process behavior identification request, or the administrator can actively trigger a process behavior identification request for a specific user process.

[0050] Optionally, in this embodiment, a user process may refer to, but is not limited to, a process started by a user, usually a process started by an ordinary user, running in a user space, and not having super user privileges. A user process can perform various tasks, such as running applications, executing scripts, accessing files and network resources, etc. A user process corresponds to a system process, which is a process started by the system kernel, usually started by a super user, with higher privileges, and can access system resources and configurations. System processes are usually used to manage and maintain the system, such as starting system services, continuously detecting system status, and executing system tasks.

[0051] Optionally, in this embodiment, the privilege escalation subprocess is used to elevate the execution privilege of the user process, and is usually created and started by the user process to perform operations that require superuser privileges, such as modifying system configuration files, accessing protected files, etc. The privilege escalation subprocess can obtain superuser privileges through a suid process or a process with setuid capability.

[0052] Optionally, in this embodiment, the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation subprocess, such as the system call, library function, application programming interface (API) called by the user process, and the parameters and return values ​​of these calls. By analyzing the function history call information, the behavior of the user process before creating the privilege escalation subprocess can be understood, including which functions are called, and the parameters and return values ​​of these functions. This information can be used to detect and identify malicious behavior. For example, if the user process calls some abnormal functions or passes abnormal parameters, this may be a sign of malicious behavior.

[0053] Optionally, in this embodiment, the verification function can be, but is not limited to, a function used to check whether the user process has sufficient permissions to create an elevated subprocess, such as obtaining password information used to verify the legitimacy of creating an elevated subprocess. Specifically, when a process using SUID or a process with setuid capability creates an elevated subprocess, the system will call the verification function to check whether the user process has sufficient permissions to perform this operation.

[0054] Optionally, in this embodiment, when the user process calls the verification function, the system will check whether the user process has sufficient permissions to perform the corresponding operation. This usually happens before the user process creates an elevated sub-process to ensure that the user process has sufficient permissions when performing sensitive operations. In this embodiment, by determining whether the user process calls the verification function, it checks whether the user process has sufficient permissions to create an elevated sub-process. If the user process has called the verification function and passed the permission check, then the elevated sub-process can be created and the corresponding operation can be performed as a super user.

[0055] Optionally, in this embodiment, determining whether the process behavior is a user-state privilege escalation attack requires comprehensive consideration of multiple factors. Further, in this embodiment, when the function history call information indicates that the user process has not called the verification function, after determining that the process behavior is a user-state privilege escalation attack, a secondary identification may be performed without limitation, such as using the frequency of the behavior (if the behavior frequency of a process is abnormally high or abnormally low, it may be a user-state privilege escalation attack), the background and environment of the behavior (if the behavior of a process is inconsistent with the current background and environment, it may be a user-state privilege escalation attack. For example, accessing a bank website at night may be more suspicious than accessing it during the day), the type of behavior (if the behavior type of a process is inconsistent with the behavior type of a normal process, it may be a user-state privilege escalation attack. For example, if an ordinary text editor suddenly starts to access network resources, it may be a user-state privilege escalation attack), and the impact of the behavior (if the behavior of a process has an abnormal impact on the system or other processes, it may be a user-state privilege escalation attack) as indicators for determining whether the process behavior is a user-state privilege escalation attack.

[0056] Optionally, in this embodiment, judgment rules have been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rules, such as defining the input and output parameters of the verification function, including the data type, data range and data format of the input parameters, and the data type and data format of the output parameters; defining the input and output data models of the rule engine according to the input and output parameters of the verification function, including the data type, data range and data format of the input data model, and the data type and data format of the output data model; defining rules in the rule engine to judge and process the input and output parameters of the verification function to obtain the behavioral attributes of the verification function.

[0057] To further illustrate, for example, specific judgment rules can be optionally defined. When the input parameter exceeds the data range or the format is incorrect, the "input error" attribute is returned; when the output parameter does not meet expectations, the "output error" attribute is returned; when the verification function is frequently called, the "abnormal behavior" attribute is returned, etc.; according to the behavioral attributes of the verification function, corresponding rules and policies are defined to perform security control and risk assessment. For example, for a verification function with the "abnormal behavior" attribute, measures such as limiting the calling frequency and increasing access control can be taken to reduce potential security risks; according to the behavioral attributes of the verification function, corresponding rules and policies are defined to perform security control and risk assessment. For example, for a verification function with the "abnormal behavior" attribute, measures such as limiting the calling frequency and increasing access control can be taken to reduce potential security risks.

[0058] It should be noted that, considering the abnormal process behavior of elevating execution permissions, it is necessary to bypass the verification of abnormal process behavior, and the verification of abnormal process behavior usually requires calling a verification function. Whether to call the verification function can be further used as a basis for judging the abnormal process behavior, thereby achieving the purpose of accurately judging the abnormal process behavior based on the essence of the abnormal process behavior, and then achieving the technical effect of improving the detection accuracy of user-state privilege escalation attacks.

[0059] To further illustrate, the optional Figure 3As shown, a process behavior identification request is obtained, wherein the process behavior identification request is used to request identification of whether the process behavior of the user process 302 in creating the privilege escalation sub-process 304 belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, and the privilege escalation sub-process 304 is used to enhance the execution authority of the user process 302; in response to the process behavior identification request, the function history call information 306 of the user process 302 is obtained, wherein the function history call information 306 is used to indicate the calling behavior of the user process 302 to the verification function 308 before creating the privilege escalation sub-process 304, and the verification function 308 is used to obtain password information, and the password information is used to verify the legality of creating the privilege escalation sub-process 304; when the function history call information 306 indicates that the user process 302 has called the verification function 308, it is determined that the process behavior of the user process 302 belongs to normal privilege escalation behavior in user mode; when the function history call information 306 indicates that the user process 302 has not called the verification function 308, it is determined that the process behavior of the user process 302 belongs to user mode privilege escalation attack behavior.

[0060] Through the embodiments provided by the present application, a process behavior identification request is obtained, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior executed by a user process in user mode belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, and the privilege escalation behavior includes process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution authority of the user process in user mode; in response to the process behavior identification request, historical function call information of the user process is obtained, wherein the historical function call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation subprocess, and the verification function is used to verify the legality of creating the privilege escalation subprocess; a rule engine is called to judge the behavior attribute of the calling behavior of the verification function to obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule; based on the judgment result, it is determined that the privilege escalation behavior belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, thereby achieving the purpose of accurately judging the abnormal process behavior based on the essence of the abnormal process behavior, and thus achieving the technical effect of improving the detection accuracy of the user mode privilege escalation attack.

[0061] As an optional solution, obtain the historical function call information of the user process, including:

[0062] Continuously detect all behaviors of calling the verification function in the user process to obtain the detection result, wherein the detection result is used to indicate the calling behavior of the user process to the verification function, and the function historical call information includes the detection result.

[0063] Optionally, in this embodiment, all behaviors of calling verification functions in the user process are continuously detected, which can be achieved by but not limited to adding log records or using continuous detection tools. The detection results can be obtained by analyzing the logs or the output of the continuous detection tool, which can help understand the behavior of the user process and evaluate and improve security.

[0064] It should be noted that in order to improve the timeliness of the historical function call information, all behaviors of calling the verification function in the user process are continuously detected to obtain the calling behavior of the user process on the verification function.

[0065] Through the embodiments provided in the present application, all behaviors of calling the verification function in the user process are continuously detected to obtain the detection results, wherein the detection results are used to indicate the calling behavior of the user process on the verification function, and the function history call information includes the detection results, thereby achieving the technical effect of improving the timeliness of the function history call information.

[0066] As an optional solution, all behaviors of calling the verification function in the user process are continuously detected to obtain the detection results, including at least one of the following:

[0067] S1-1, using a hook function in a dynamic library loaded into a user process to continuously detect the calling behavior of a verification function, wherein the hook function and the verification function have the same name, and a continuous detection function is provided in the dynamic library, and the continuous detection function is used to record the calling behavior of the user process to the hook function, and the hook function replaces the calling behavior executed on the verification function, and the hook function is configured with a function pointer of the verification function, and the function pointer is used to call the verification function when the hook function is called;

[0068] S1-2, when the user process is configured with a continuous detection service, the detection rules set by the continuous detection service are used to continuously detect the calling behavior of the verification function, wherein the continuous detection service is used to continuously detect various operation behaviors in the system where the user process is located, and various operation behaviors include the calling behavior of the verification function.

[0069] Optionally, in this embodiment, the hook function may, but is not limited to, refer to a technology commonly used in software development, which is used to intercept specific events or operations during program execution, process or modify them, and then continue to execute. The hook function is usually provided by the operating system or application program, and can be used to implement various functions, such as persistence detection, interception, filtering, modification, etc. In the operating system, the hook function can be used to intercept system messages, keyboard and mouse events, etc., and is often used to implement security persistence detection, anti-virus, keyboard logging and other functions. In the application program, the hook function can be used to intercept specific API calls, window messages, etc., and is often used to implement automated testing, window management, input method and other functions.

[0070] Furthermore, hook functions can be of two types but are not limited to: global hooks and local hooks. Global hooks can intercept system-level events and operations, have higher permissions, but have a certain impact on system performance and stability; local hooks can only intercept events and operations of the current process, have lower permissions, but have less impact on system performance and stability.

[0071] Optionally, in this embodiment, the continuous detection service is used to continuously detect various operation behaviors in the system where the user process is located, and the detection rules set by the continuous detection service determine the call detection method of the verification function in the user process.

[0072] To further illustrate, it is optional to set corresponding detection rules according to the characteristics and usage scenarios of the verification function. For example, rules can be set to detect the number of calls, call parameters, call time, etc. of the verification function in the user process. Set corresponding detection rules according to the characteristics and usage scenarios of the verification function. For example, rules can be set to detect the number of calls, call parameters, call time, etc. of the verification function in the user process. The continuous detection service will continuously perform continuous detection on the user process and generate corresponding detection results according to the detection rules. The detection results can be obtained by viewing the log file, the output of the continuous detection tool, or the customized alarm mechanism. The detection results are analyzed and processed to timely detect abnormal situations and take corresponding treatment measures. For example, the detection results can be analyzed to find that the verification function is called by a malicious program, or that the verification function is frequently called, so as to repair or optimize it in time.

[0073] It should be noted that in order to improve the diversity of continuous detection, this embodiment provides multiple continuous detection methods to adapt to different process environments, and uses the hook function in the dynamic library loaded into the user process to continuously detect the calling behavior of the verification function, or when the user process is configured with a continuous detection service, the detection rules set by the continuous detection service are used to continuously detect the calling behavior of the verification function.

[0074] Through the embodiments provided by the present application, a hook function in a dynamic library loaded into a user process is used to perform continuous detection on the calling behavior of a verification function, wherein the hook function has the same name as the verification function, and a continuous detection function is provided in the dynamic library, the continuous detection function is used to record the calling behavior of the user process to the hook function, the hook function replaces the calling behavior executed on the verification function, the hook function is configured with a function pointer of the verification function, and the function pointer is used to call the verification function when the hook function is called; when the user process is configured with a continuous detection service, the calling behavior of the verification function is continuously detected using the detection rules set by the continuous detection service, wherein the continuous detection service is used to continuously detect various operation behaviors in the system where the user process is located, and the various operation behaviors include the calling behavior of the verification function, thereby achieving the purpose of providing multiple continuous detection methods to adapt to different process environments, thereby achieving the technical effect of improving the diversity of continuous detection.

[0075] As an optional solution, before obtaining the process behavior identification request, the method further includes:

[0076] S2-1, triggering a process behavior identification request when the user process has created a privileged child process; or,

[0077] S2-2, when a user process requests to create a privileged child process, a process behavior identification request is triggered.

[0078] It should be noted that in order to increase the diversity of triggering process behavior identification requests, the triggering of process behavior identification requests is set in multiple situations, such as triggering the process behavior identification request when the user process has created or requested to create a privileged sub-process. At the same time, when the user process requests to create a privileged sub-process, the process behavior identification request is triggered again, which can also improve the timeliness of the triggering of the process behavior identification request, and prevent the triggering of the process behavior identification request from not being timely enough, resulting in more losses due to the failure to timely identify the user-mode privilege escalation attack behavior.

[0079] Through the embodiments provided by the present application, when a user process has created a privileged sub-process, a process behavior identification request is triggered; or, when a user process requests to create a privileged sub-process, a process behavior identification request is triggered, thereby achieving the purpose of setting the triggering of process behavior identification requests in multiple situations, thereby realizing the technical effect of increasing the triggering diversity of process behavior identification requests.

[0080] As an optional solution, after determining based on the judgment result that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, the method further includes:

[0081] S3-1: If the privilege escalation behavior is a user-mode privilege escalation attack and the user process has created a privilege escalation subprocess, delete the created privilege escalation subprocess; or

[0082] S3-2, when the privilege escalation behavior is a user-mode privilege escalation attack and the user process requests to create a privilege escalation sub-process, the request response to create the privilege escalation sub-process is blocked.

[0083] It should be noted that in order to reduce the negative impact caused by user-mode privilege escalation attacks, targeted processing is performed on the created privilege escalation sub-processes or requests for privilege escalation sub-processes according to different situations. For example, if a user process has created a privilege escalation sub-process, the created privilege escalation sub-process is deleted, or if a user process requests to create a privilege escalation sub-process, the request response to create a privilege escalation sub-process is blocked.

[0084] Through the embodiments provided by the present application, when the privilege escalation behavior belongs to the behavior of user-state privilege escalation attack and the user process has created a privilege escalation sub-process, the created privilege escalation sub-process is deleted; or, when the privilege escalation behavior belongs to the behavior of user-state privilege escalation attack and the user process requests to create a privilege escalation sub-process, the request response to create the privilege escalation sub-process is blocked, thereby achieving the purpose of treating the created privilege escalation sub-process according to different situations, thereby realizing the technical effect of reducing the negative impact caused by the behavior of user-state privilege escalation attack.

[0085] As an optional solution, before obtaining the process behavior identification request, the method further includes:

[0086] S4-1, when the first process is a target permission process that allows elevated execution permissions, determining the first process as a user process, wherein the target permission process is set to call a verification function before creating an elevated permission child process;

[0087] S4-2, when the second process is a process with a target permission function, the second process is determined as a user process, wherein the target permission function is a function that allows the execution permission to be elevated, and the process with the target permission function is set to call a verification function before creating an elevated child process.

[0088] It should be noted that in order to improve the detection accuracy of user-mode privilege escalation attacks, a judgment is also made as to whether it belongs to a user process. For example, when the first process is a target permission process that allows the execution permission to be elevated, the first process is determined to be a user process; or when the second process is a process with the target permission function, the second process is determined to be a user process.

[0089] To further illustrate, optionally, if the continuously detected process is a suid process (first process) or a process with setuid capability (target permission function) (second process), and a process with root privileges (privileged child process) is created without calling the getspnam function, the current behavior is determined to be abnormal process behavior.

[0090] Through the embodiments provided by the present application, when the first process is a target permission process that allows the escalation of execution permissions, the first process is determined to be a user process, wherein the target permission process is set to call a verification function before creating a privilege escalation sub-process; when the second process is a process with a target permission function, the second process is determined to be a user process, wherein the target permission function is a function that allows the escalation of execution permissions, and the process with the target permission function is set to call a verification function before creating a privilege escalation sub-process, thereby achieving the purpose of also making a judgment on whether it is a user process, thereby realizing the technical effect of improving the detection accuracy of user-state privilege escalation attacks.

[0091] As an optional solution, after determining based on the judgment result that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, the method further includes:

[0092] In the case where the privilege escalation behavior is a user-mode privilege escalation attack, the abnormal information associated with the process behavior is sent to the process security center, and the process security center performs abnormal repair processing on the user process.

[0093] Optionally, in this embodiment, the process security center can be used, but not limited to, to detect and respond to security threats and attack behaviors on terminal devices (such as personal computers, servers, etc.). For example, by installing an agent program or kernel module on the terminal device, various activities on the device are continuously detected and recorded, such as process creation, file operations, network connections, etc., so as to timely discover user-mode privilege escalation attack behaviors and security threats; using machine learning, behavioral analysis and other technologies, the activities on the terminal device are analyzed and detected to discover known and unknown security threats and generate corresponding alarms and reports; responding to and handling discovered security threats, such as isolating infected devices, stopping malicious processes, deleting malicious files, etc., to minimize the impact and loss of security incidents; recording and managing detected security incidents, including event classification, priority assessment, response measures, replay analysis, etc., so as to follow up and manage security incidents, etc.

[0094] It should be noted that in order to improve the timeliness of handling abnormal process behavior, the abnormal information associated with the process behavior is sent to the process security center, and the process security center performs abnormal repair processing on the user process.

[0095] Through the embodiments provided by the present application, when the privilege escalation behavior is a user-mode privilege escalation attack, the abnormal information associated with the process behavior is sent to the process security center, and the process security center performs abnormal repair processing on the user process, thereby achieving the technical effect of improving the timeliness of processing abnormal process behavior.

[0096] As an optional solution, based on the judgment result, it is determined that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, including:

[0097] When the judgment result indicates that the calling behavior of the verification function meets the judgment rule, it is determined that the privilege escalation behavior belongs to the normal privilege escalation behavior in user mode, where the judgment rule is used to stipulate that the verification function must be called before creating the privilege escalation sub-process and pass the legitimacy check of the verification function.

[0098] Optionally, in this embodiment, the judgment rule is used to stipulate that a verification function must be called before creating a privilege escalation sub-process and pass the legitimacy check of the verification function, and then the calling behavior that meets the judgment rule can be understood but not limited to as having called the verification function before creating the privilege escalation sub-process and passing the legitimacy check of the verification function.

[0099] It should be noted that, considering the abnormal process behavior of elevating execution permissions, it is necessary to bypass the verification of abnormal process behavior, and the verification of abnormal process behavior usually requires calling a verification function. Whether to call the verification function can be further used as a basis for judging the abnormal process behavior, thereby achieving the purpose of accurately judging the abnormal process behavior based on the essence of the abnormal process behavior, and then achieving the technical effect of improving the detection accuracy of user-state privilege escalation attacks.

[0100] Through the embodiments provided by the present application, when the judgment result indicates that the calling behavior of the verification function complies with the judgment rules, it is determined that the privilege escalation behavior belongs to the normal privilege escalation behavior in the user state, wherein the judgment rules are used to stipulate that the verification function must be called before creating the privilege escalation sub-process, and the legitimacy of the verification function is checked, thereby achieving the purpose of accurately judging the abnormal process behavior based on the essence of the abnormal process behavior, and further achieving the technical effect of improving the detection accuracy of user-state privilege escalation attacks.

[0101] As an optional solution, when the function call history information indicates that the user process has called the verification function, the process behavior is determined to be a normal privilege escalation behavior in user mode, including:

[0102] When the function call history information indicates that the user process has called the verification function and passed the verification of the password information under preset conditions, it is determined that the process behavior is a normal privilege escalation behavior in user mode.

[0103] Optionally, in this embodiment, when performing password verification, the verification can only be passed after the correct password is entered. Therefore, if the process can pass the password verification, it means that it has legal access rights and its behavior can be considered normal. However, just passing the password verification does not necessarily fully guarantee the legality and security of the process behavior, and the preset conditions may also include additional conditions for entering the correct password information, such as the length of time and frequency of entering the password information.

[0104] It should be noted that in order to improve the verification accuracy of process behavior, while verifying the password information, preset conditions are also used to further improve the verification capability of the password information.

[0105] Through the embodiments provided by the present application, when the function history call information indicates that the user process has called the verification function and passed the verification of the password information under preset conditions, it is determined that the process behavior belongs to the normal privilege escalation behavior in the user state, thereby achieving the purpose of further improving the verification capability of the password information using preset conditions while verifying the password information, thereby achieving the technical effect of improving the verification accuracy of the process behavior.

[0106] As an optional solution, for ease of understanding, the above-mentioned user-mode privilege escalation attack detection method is applied to the scenario of detecting the behavior of user-mode privilege escalation attacks on processes in the Linux system. This embodiment starts from the essential characteristics of user-mode privilege escalation and does not make special adaptations to attack instructions or payloads. When the rules of this embodiment are triggered, it must represent that a normal permission process that has not been password-verified has completed an abnormal permission change, and no false positives will occur. This embodiment starts from the essential characteristics of user-mode privilege escalation, and attackers cannot bypass detection by modifying attack instructions or payloads.

[0107] Optionally, in this embodiment, if Figure 4As shown, the detection system of this embodiment can be deployed on platforms of various versions (such as Android, Ubuntu, CentOS, etc.). When the detection system is started, it will continuously detect the getspnam function call behavior and process permissions, and then determine whether the current process behavior is a user-state privilege escalation attack behavior through the rule engine, and pass the abnormal process information as an alarm to EDR (Endpoint Detection and Response). The specific behavior is as follows: In the user-state privilege escalation vulnerability general detection system, normal user A, attacker B, device P; normal user A logs in to device P (Linux server or Linux desktop distribution or Android phone) and loads the detection system; the detection system collects getspnam function call behavior and process permission information, and passes the information to the rule engine; normal user A executes the instruction sudo bash, enter the password to complete the root permission switch. The rule engine creates a root child process based on the fact that the current user process is a suid process. At the same time, the current user process has the getspnam function call behavior. These three features determine that the current behavior is a normal user state privilege escalation behavior. Attacker B performs a privilege escalation attack, starts a suid process, and creates a root child process. However, the current user process does not have the behavior of calling the getspnam function, and the engine rule finds a threat. The detection system reports this incident to the EDR, and the EDR displays the alarm to the user.

[0108] It should be noted that the main system workflow of the detection system in this embodiment mainly includes two main links: the deployment of the detection system and the processing of information data by the rule engine when the terminal user executes instructions.

[0109] To further illustrate, the optional Figure 5 As shown, the administrator logs in to the terminal. The administrator deploys a user-mode privilege escalation general detection system. When the system starts, it will load the getspnam function call behavior continuous detection based on the dynamic library hook / process continuous detection based on the audit mechanism. The process of continuous detection of getspnam function call behavior includes: implementing the getspnam function with the same name (the specific function is to jump back to execute the real getspnam function after executing the getspnam function call continuous detection function), and compiling it into the getspnam_hook.so dynamic library. Modify the content of the / etc / ld.so.conf file and insert the getspnam_hook.so path in the first line. When the Linux process is started, the getspnam function with the same name in getspnam_hook.so will replace the real getspnam function to complete the hook. When the process calls the getspnam function, the getspnam function call information will be passed to the rule engine through the information transmission channel.

[0110] The process of loading the process monitoring mechanism includes: starting the Linux auditd system service. Using auditctl to design rules to continuously detect suid processes / processes with setuid caps / processes with root permissions. After the relevant information is collected, it will be passed to the rule engine through the information transmission channel.

[0111] In addition, in this embodiment, the user logs in to the terminal to execute instructions such as Figure 6 As shown in the figure, the user logs in to the terminal. The user executes instructions on the terminal, triggering the collection of process file behavior information and process permission information. A normal user with ordinary permissions starts an ordinary process. The user process is not a suid process or a process with setuid cap, which is a normal user state privilege escalation behavior (normal behavior). A normal user with ordinary permissions starts a suid process or a process with setuid cap. The user process is a suid process or a process with setuid cap, but the created child process does not have root permission, which is a normal user state privilege escalation behavior. A normal user with ordinary permissions starts a suid process or a process with setuid cap and switches the current permission to root. The user process is a suid process or a process with setuid cap, and the created child process has root permission. The user process has a call to the getspnam function, which means that there is a password verification, so it is a normal user state privilege escalation behavior. The attacker starts a suid process or a process with setuid cap and switches the current permission to root. The user process is a suid process or a process with setuid cap, and the created child process has root permission. Continuous detection of getspnam function call behavior: If the user process does not call the getspnam function, the rule engine considers it as abnormal privilege escalation behavior. If the rule engine determines that the current behavior is an attack behavior, it will synchronize the attack information to the EDR. The EDR will convey this alarm to the system administrator.

[0112] Optionally, in this embodiment, the basic principle of this embodiment includes the selection of dynamic library hook target, the principle of process information collection, and the design of rule engine, which are as follows: the hook target based on the dynamic library hook mechanism is the getspnam function. When the process performs password verification, the getspnam function will be called. This embodiment marks the current process as having password verification behavior when the getspnam function is called. Linux provides an audit mechanism for user-mode programs to count process information. When the auditd system service is enabled, users can use audit_ctl to filter irrelevant data and only collect valid information. For example, in this embodiment, the information collection target is limited to suid processes / processes with setuid caps / processes with root permissions.

[0113] In addition, this embodiment also sets a rule engine to perform behavioral detection of user-mode privilege escalation attacks on processes, wherein the rule engine mainly covers three rules: whether the user process is a suid process or a process with setuid cap, whether the user process creates a root process, and whether the user process does not call the getspnam function. The above three rules ensure that when an attacker implements a user-mode privilege escalation attack, it can be captured in time and no false alarms are generated.

[0114] The embodiments provided in this application are implemented using dynamic library hook and audit mechanism, which has universal system version. When threatening behavior occurs, real-time feedback is given to EDR, and visual threatening behavior alerts are provided to users. The general rule protection for user-state privilege escalation attacks can accurately detect related threats without generating false positives.

[0115] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0116] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0117] According to another aspect of the embodiment of the present application, a detection device for a user-mode privilege escalation attack for implementing the above-mentioned detection method for a user-mode privilege escalation attack is also provided. Figure 7As shown, the device comprises:

[0118] The first acquisition unit 702 is used to acquire a process behavior identification request, wherein the process behavior identification request is used to request to detect whether the privilege escalation behavior executed by the user process in the user state belongs to the normal privilege escalation behavior in the user state or the privilege escalation attack behavior in the user state, and the privilege escalation behavior includes the process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in the user state;

[0119] The second acquisition unit 704 is used to respond to the process behavior identification request and acquire the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation sub-process, and the verification function is used to verify the legitimacy of creating the privilege escalation sub-process;

[0120] The first determination unit 706 is used to call the rule engine to judge the behavior attribute of the call behavior of the verification function and obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the call behavior of the verification function complies with the judgment rule;

[0121] The second determining unit 708 is used to determine whether the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode based on the judgment result.

[0122] For a specific embodiment, reference may be made to the example shown in the above-mentioned detection device for user-mode privilege escalation attack, which will not be described in detail in this example.

[0123] As an optional solution, the second obtaining unit 704 includes:

[0124] The detection module 802 is used to continuously detect all behaviors of calling the verification function in the user process to obtain the detection result, wherein the detection result is used to indicate the calling behavior of the user process to the verification function, and the function history calling information includes the detection result.

[0125] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0126] As an alternative, Figure 8 As shown, the detection module 802 includes at least one of the following:

[0127] The first detection submodule is used to continuously detect the calling behavior of the verification function by using the hook function in the dynamic library loaded into the user process, wherein the hook function has the same name as the verification function, and the dynamic library is provided with a continuous detection function, the continuous detection function is used to record the calling behavior of the user process to the hook function, the hook function replaces the calling behavior executed on the verification function, the hook function is configured with a function pointer of the verification function, and the function pointer is used to call the verification function when the hook function is called;

[0128] The second detection submodule is used to continuously detect the calling behavior of the verification function by using the detection rules set by the continuous detection service when the user process is configured with a continuous detection service. The continuous detection service is used to continuously detect various operation behaviors in the system where the user process is located, and the various operation behaviors include the calling behavior of the verification function.

[0129] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0130] As an optional solution, the device also includes:

[0131] A first request unit is configured to trigger a process behavior identification request before obtaining a process behavior identification request, when a user process has created a privileged child process; or

[0132] The second request unit is used to trigger a process behavior identification request before obtaining the process behavior identification request when a user process requests to create a privileged sub-process.

[0133] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0134] As an optional solution, the device also includes:

[0135] a deleting unit, configured to, after determining based on the judgment result that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, delete the created privilege escalation subprocess if the privilege escalation behavior is a privilege escalation attack behavior in user mode and the user process has created a privilege escalation subprocess; or,

[0136] The blocking unit is used to block the request response for creating a privilege escalation sub-process after determining based on the judgment result that the privilege escalation behavior belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, if the privilege escalation behavior belongs to privilege escalation attack behavior in user mode and the user process requests to create a privilege escalation sub-process.

[0137] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0138] As an optional solution, the device also includes:

[0139] A third determination unit is used to determine the first process as a user process before obtaining the process behavior identification request, when the first process is a target permission process that allows the execution permission to be elevated, wherein the target permission process is set to call a verification function before creating an elevated permission child process;

[0140] The fourth determination unit is used to determine the second process as a user process before obtaining a process behavior identification request, if the second process is a process with a target permission function, wherein the target permission function is a function that allows the execution permission to be elevated, and the process with the target permission function is set to call a verification function before creating a privilege-elevated sub-process.

[0141] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0142] As an optional solution, the device also includes:

[0143] The security unit is used to send the abnormal information associated with the process behavior to the process security center after determining based on the judgment result whether the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, and the process security center performs abnormal repair processing on the user process.

[0144] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0145] As an alternative, Fig. 9 As shown, the second determining unit 708 includes:

[0146] Determination module 902 is used to determine that the privilege escalation behavior is a normal privilege escalation behavior in user mode when the judgment result indicates that the calling behavior of the verification function meets the judgment rule, wherein the judgment rule is used to stipulate that the verification function must be called before creating the privilege escalation sub-process and pass the legitimacy check of the verification function.

[0147] As an optional solution, the determination module 902 includes:

[0148] A determination submodule is used to determine whether the process behavior is a normal privilege escalation behavior in user mode when the function history call information indicates that the user process has called the verification function and passed the password information verification under preset conditions. The password information is the information displayed when the verification function is called and is used to verify the legitimacy of creating the privilege escalation subprocess.

[0149] For a specific implementation example, reference may be made to the example shown in the above-mentioned method for detecting user-mode privilege escalation attacks, which will not be described in detail in this example.

[0150] According to another aspect of the embodiment of the present application, an electronic device for implementing the above-mentioned user state privilege escalation attack detection method is also provided. The electronic device can be but is not limited to Figure 1 The user device 102 or the server 112 shown in FIG. 1 is used as an example to illustrate the electronic device as the user device 102. Fig.10 As shown, the electronic device includes a memory 1002 and a processor 1004. The memory 1002 stores a computer program, and the processor 1004 is configured to execute the steps in any of the above method embodiments through the computer program.

[0151] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0152] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0153] S1, obtaining a process behavior identification request, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior performed by a user process in user mode belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, and the privilege escalation behavior includes the process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in user mode;

[0154] S2, responding to the process behavior identification request, obtaining the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation sub-process, and the verification function is used to verify the legitimacy of creating the privilege escalation sub-process;

[0155] S3, calling the rule engine to judge the behavior attribute of the calling behavior of the verification function, and obtaining a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule;

[0156] S4, based on the judgment result, determining whether the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode.

[0157] Alternatively, a person skilled in the art may understand that: Fig.10 The structure shown is for illustration only. Fig.10 The structure of the electronic device is not limited. Fig.10 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig.10Different configurations are shown.

[0158] Among them, the memory 1002 can be used to store software programs and modules, such as the program instructions / modules corresponding to the method and device for detecting user-mode privilege escalation attacks in the embodiments of the present application. The processor 1004 executes various functional applications and data processing by running the software programs and modules stored in the memory 1002, that is, to implement the above-mentioned method for detecting user-mode privilege escalation attacks. The memory 1002 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1002 may further include a memory remotely located relative to the processor 1004, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1002 may be specifically, but not limited to, used to store information such as process behavior identification requests, function history call information, and verification functions. As an example, Fig.10 As shown, the memory 1002 may include, but is not limited to, the first acquisition unit 702, the second acquisition unit 704, the first determination unit 706, and the second determination unit 708 in the detection device for the user-state privilege escalation attack. In addition, other module units in the detection device for the user-state privilege escalation attack may also be included but are not limited to, which will not be repeated in this example.

[0159] Optionally, the transmission device 1006 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 1006 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1006 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0160] In addition, the electronic device further includes: a display 1008 for displaying the process behavior identification request, function history call information, verification function and other information; and a connection bus 1010 for connecting the various module components in the electronic device.

[0161] In other embodiments, the user device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, a peer-to-peer network may be formed between the nodes, and any form of computing device, such as a server, user device, or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0162] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program / instruction, the computer program / instruction comprising a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit, various functions provided by the embodiments of the present application are executed.

[0163] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0164] It should be noted that the computer system of the electronic device is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0165] The computer system includes a central processing unit (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) or the program loaded from the storage part to the random access memory (RAM). In the random access memory, various programs and data required for system operation are also stored. The central processing unit, the read-only memory and the random access memory are connected to each other through a bus. The input / output interface (I / O interface) is also connected to the bus.

[0166] The following components are connected to the input / output interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a local area network card, a modem, etc. The communication part performs communication processing via a network such as the Internet. A drive is also connected to the input / output interface as needed. Removable media, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., are installed on the drive as needed so that the computer program read therefrom is installed into the storage part as needed.

[0167] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit, various functions defined in the system of the present application are executed.

[0168] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the above-mentioned various optional implementations.

[0169] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0170] S1, obtaining a process behavior identification request, wherein the process behavior identification request is used to request detection of whether the privilege escalation behavior performed by a user process in user mode belongs to normal privilege escalation behavior in user mode or privilege escalation attack behavior in user mode, and the privilege escalation behavior includes the process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in user mode;

[0171] S2, responding to the process behavior identification request, obtaining the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation sub-process, and the verification function is used to verify the legitimacy of creating the privilege escalation sub-process;

[0172] S3, calling the rule engine to judge the behavior attribute of the calling behavior of the verification function, and obtaining a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule;

[0173] S4, based on the judgment result, determining whether the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode.

[0174] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the electronic device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0175] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0176] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the methods of each embodiment of the present application.

[0177] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0178] In the several embodiments provided in the present application, it should be understood that the disclosed user equipment can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0179] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0180] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0181] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting a user-mode privilege escalation attack, characterized in that: include: Obtain a process behavior identification request, wherein the process behavior identification request is used to request detection of whether a privilege escalation behavior performed by a user process in user mode belongs to a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, wherein the privilege escalation behavior includes a process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in the user mode; In response to the process behavior identification request, obtaining the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation subprocess, and the verification function is used to verify the legitimacy of creating the privilege escalation subprocess; Calling a rule engine to judge the behavior attribute of the calling behavior of the verification function to obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule; Based on the judgment result, it is determined that the privilege escalation behavior belongs to the normal privilege escalation behavior in the user state or the privilege escalation attack behavior in the user state.

2. The method according to claim 1, characterized in that The obtaining of the historical function call information of the user process includes: Continuously detect all behaviors of calling the verification function in the user process to obtain a detection result, wherein the detection result is used to indicate the calling behavior of the user process on the verification function, and the function history calling information includes the detection result.

3. The method according to claim 2, characterized in that The continuously detecting all the behaviors of calling the verification function in the user process to obtain the detection result includes at least one of the following: Utilizing a hook function in a dynamic library loaded into the user process to continuously detect the calling behavior of the verification function, wherein the hook function has the same name as the verification function, the dynamic library is provided with a continuous detection function, the continuous detection function is used to record the calling behavior of the user process to the hook function, the hook function replaces the calling behavior executed on the verification function, the hook function is configured with a function pointer of the verification function, and the function pointer is used to call the verification function when the hook function is called; In the case where the user process is configured with a continuous detection service, the calling behavior of the verification function is continuously detected using the detection rules set by the continuous detection service, wherein the continuous detection service is used to continuously detect various operation behaviors in the system where the user process is located, and the various operation behaviors include the calling behavior of the verification function.

4. The method according to claim 1, characterized in that Before obtaining the process behavior identification request, the method further includes: In the case where the user process has created the privilege escalation subprocess, triggering the process behavior identification request; or, In the case where the user process requests to create the privilege escalation sub-process, the process behavior identification request is triggered.

5. The method according to claim 4, characterized in that After determining, based on the judgment result, that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, the method further includes: If the privilege escalation behavior belongs to the user state privilege escalation attack behavior and the user process has created the privilege escalation subprocess, deleting the created privilege escalation subprocess; or When the privilege escalation behavior belongs to the user-mode privilege escalation attack behavior and the user process requests to create the privilege escalation sub-process, the request response to create the privilege escalation sub-process is blocked.

6. The method according to claim 1, characterized in that The determining, based on the judgment result, that the privilege escalation behavior is a normal privilege escalation behavior in the user state or a privilege escalation attack behavior in the user state includes: When the judgment result indicates that the calling behavior of the verification function complies with the judgment rule, it is determined that the privilege escalation behavior belongs to the normal privilege escalation behavior in the user state, wherein the judgment rule is used to stipulate that the verification function must be called before creating the privilege escalation sub-process and pass the legitimacy check of the verification function.

7. The method according to claim 6, characterized in that Determining that the privilege escalation behavior belongs to the normal privilege escalation behavior in user mode includes: When the function call history information indicates that the user process has called the verification function and passed the verification of the password information under preset conditions, it is determined that the process behavior belongs to the normal privilege escalation behavior in the user state, wherein the password information is the information displayed when the verification function is called and is used to verify the legality of creating the privilege escalation sub-process.

8. The method according to any one of claims 1 to 7, characterized in that Before obtaining the process behavior identification request, the method further includes: In the case where the first process is a target permission process that allows the execution permission to be elevated, determining the first process as the user process, wherein the target permission process is set to call the verification function before creating the elevated permission subprocess; In the case where the second process is a process with the target permission function, the second process is determined as the user process, wherein the target permission function is a function that allows the execution permission to be elevated, and the process with the target permission function is set to call the verification function before creating the elevated sub-process.

9. The method according to any one of claims 1 to 7, characterized in that After determining, based on the judgment result, that the privilege escalation behavior is a normal privilege escalation behavior in user mode or a privilege escalation attack behavior in user mode, the method further includes: In the case where the privilege escalation behavior belongs to the user-mode privilege escalation attack behavior, the abnormal information associated with the process behavior is sent to the process security center, and the process security center performs abnormal repair processing on the user process.

10. A detection device for user-mode privilege escalation attack, characterized in that: include: A first acquisition unit is used to acquire a process behavior identification request, wherein the process behavior identification request is used to request to detect whether the privilege escalation behavior performed by the user process in the user state belongs to the normal privilege escalation behavior in the user state or the privilege escalation attack behavior in the user state, and the privilege escalation behavior includes the process behavior of creating a privilege escalation subprocess, and the privilege escalation subprocess is used to enhance the execution permission of the user process in the user state; a second acquisition unit, configured to respond to the process behavior identification request and acquire the function history call information of the user process, wherein the function history call information is used to indicate the calling behavior of the user process to the verification function before creating the privilege escalation subprocess, and the verification function is used to verify the legitimacy of creating the privilege escalation subprocess; A first determination unit is used to call a rule engine to judge the behavior attribute of the calling behavior of the verification function and obtain a judgment result, wherein the judgment rule has been pre-defined in the rule engine, and the judgment result is used to indicate whether the calling behavior of the verification function complies with the judgment rule; The second determining unit is used to determine, based on the judgment result, whether the privilege escalation behavior belongs to the normal privilege escalation behavior in the user state or the privilege escalation attack behavior in the user state.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 9 when executed by an electronic device.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 9 are implemented.

13. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 9 through the computer program.

Images