Local privilege lifting identification method and related equipment

Abstract

The invention discloses a local privilege lifting identification method and device, a server, a computer readable storage medium and a computer program product. According to the method, starting permission and execution permission monitoring is carried out on the target process, if it is monitored that the starting permission and the execution permission conform to an abnormal combination, a detection mode of process secondary analysis after list matching is adopted, the problems of too large performance overhead and too many false alarms are avoided while the accuracy and the real-time performance of permission extraction detection are improved, and the detection efficiency is improved. By combining static and dynamic analysis methods, not only can known malicious programs be efficiently identified, but also process behaviors in operation can be deeply detected, and potential suid privilege lifting and setuid privilege lifting attacks of capabilites can be timely found, so that effective security protection is realized.

Description

Technical Field

[0001] The present disclosure generally relates to the field of electronic technology, and in particular to a method, device, server, computer-readable storage medium, and computer program product for identifying local privilege escalation. Background Art

[0002] Privilege escalation refers to the attacker elevating the original lower user privileges to a higher privilege level, usually administrator privileges or system privileges, through some means. Privilege escalation may lead to higher privileges for ordinary user accounts, allowing attackers to gain broader control over the system and carry out further malicious activities. Privilege escalation detection is an important part of system security management. By regularly performing privilege escalation detection, you can effectively prevent unauthorized access, reduce security threats, meet compliance requirements, improve system security, reduce internal threats, optimize system configuration, and support incident response.

[0003] Current methods for detecting privilege escalation include monitoring whether the bits marking permissions change during command execution. However, the running states of various processes are complex, and the overall detection rate of existing methods is low and the false alarm rate is high. There is a lack of accurate and effective detection methods for privilege escalation. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, it is desired to provide a method, device, server, computer-readable storage medium and computer program product for identifying local privilege escalation, which can realize accurate identification of suid privilege escalation and setuid privilege escalation of capabilities.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying local privilege escalation, including:

[0006] Monitor the launch and execution permissions of the target process;

[0007] If it is detected that the startup permission and execution permission meet the abnormal combination, the corresponding blacklist is called according to the abnormal type for matching detection; wherein the abnormal type includes: suid privilege escalation, setuid privilege escalation of capabilities;

[0008] If the blacklist match is successful, extract the information of the specified field in the target process and all subsequent processes within the specified time range according to the exception type, and match and identify the extracted information;

[0009] If the match is successful, an exception privilege escalation decision is made based on the exception type.

[0010] In one embodiment, after detecting that the launch permission and the execution permission match an abnormal combination, the method further includes:

[0011] Call the corresponding whitelist according to the exception type for matching detection;

[0012] If the whitelist is not matched successfully, the step of extracting information of the specified field in the target process and all subsequent processes within the specified time range is executed;

[0013] If the whitelist match is successful, it is determined that it is not an abnormal privilege escalation.

[0014] In one embodiment, before determining that the privilege escalation is not abnormal, the method further includes:

[0015] Perform abnormal behavior detection on the process whose abnormal type is suid privilege escalation;

[0016] If there is abnormal behavior, executing the step of extracting information of the specified field in the target process and all subsequent processes within the specified time range;

[0017] If there is no abnormal behavior, the step of determining non-abnormal privilege escalation is performed.

[0018] In one embodiment, before calling the corresponding whitelist according to the exception type to perform a match detection, the method further includes:

[0019] Perform fuzzy matching of target command execution on the setuid privilege escalation process whose exception type is capabilities, and obtain the matched target information;

[0020] Accordingly, calling the corresponding whitelist for matching detection according to the exception type includes: calling the setuid privilege escalation whitelist of capabilities for matching detection on the target information.

[0021] In one embodiment, if it is detected that the launch permission and the execution permission meet an abnormal combination, the corresponding blacklist is called according to the abnormal type for matching detection, including:

[0022] If it is detected that the process is started with ordinary user privileges and executed with super user privileges, it is determined to meet the abnormal combination of suid privilege escalation, and the suid privilege escalation blacklist is called for matching detection;

[0023] If it is detected that the process is started with ordinary user permissions and executed with ordinary user permissions, it is determined that the setuid privilege escalation exception combination meets the capabilities, and the setuid privilege escalation blacklist of capabilities is called for matching detection.

[0024] In one embodiment, extracting information of a specified field in a target process and all subsequent processes within a specified time range according to the exception type, and matching and identifying the extracted information includes:

[0025] If the exception type is suid privilege escalation, extract the process name, parent process name, process control symbol, parent process control symbol, user identifier, group identifier, parent process user identifier, and effective user identifier of the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose parent process user identifier is the user identifier of the target process, whose effective user identifier is the effective user identifier of the target process, whose parent process name is the process name of the target process, and whose user identifier and group identifier are the user identifier and group identifier of the target process among all the processes; if all of them are satisfied, determine that the matching identification is successful;

[0026] If the exception type is setuid privilege escalation of capabilities, extract the parent process control symbol, process control symbol, user identifier, effective user identifier, parent process user identifier, group identifier, parent process name, process name, parent process user name, and user name in the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose user identifier and effective user identifier are 0 or are not the user identifier and effective user identifier of the target process, whose parent process user identifier is consistent with the user identifier but whose group identifier is consistent with the target process, whose parent process name is the process name of the target process, and whose parent process user name is the user name of the target process; if all of them are met, determine that the match and identification are successful.

[0027] In a second aspect, an embodiment of the present application provides a local privilege escalation identification device, including:

[0028] The process monitoring unit is used to monitor the launch permission and execution permission of the target process; if the launch permission and execution permission are detected to meet the abnormal combination, the blacklist detection unit is triggered;

[0029] The blacklist detection unit is used to call the corresponding blacklist for matching detection according to the exception type; if the blacklist matches successfully, the field monitoring unit is triggered; wherein the exception types include: suid privilege escalation, setuid privilege escalation of capabilities;

[0030] The field monitoring unit is used to extract information of specified fields in the target process and all subsequent processes within a specified time range according to the exception type, and match and identify the extracted information; if the match and identification is successful, the privilege escalation determination unit is triggered;

[0031] The privilege escalation determination unit is used to perform abnormal privilege escalation determination according to the abnormality type.

[0032] In a third aspect, an embodiment of the present application provides a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in the embodiment of the present application when executing the program.

[0033] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the embodiment of the present application.

[0034] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in the embodiment of the present application.

[0035] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0037] Figure 1 A schematic diagram of the process of identifying a method for local privilege escalation provided in an embodiment of the present application is shown;

[0038] Figure 2 A schematic diagram of a SUID privilege escalation detection method provided in an embodiment of the present application is shown;

[0039] Figure 3 A schematic diagram of a setuid privilege escalation detection method for capabilities provided in an embodiment of the present application is shown;

[0040] Figure 4 An exemplary structural block diagram of a local privilege escalation identification device provided in an embodiment of the present application is shown;

[0041] Figure 5 A schematic diagram of the structure of a computer system suitable for implementing a server of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0042] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0043] It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the drawings and in combination with the embodiments. Although the embodiments of the present application provide the method operation instruction steps shown in the following embodiments or drawings, more or fewer operation instruction steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of the present application. The method may be executed in the order of the methods shown in the embodiments or drawings or in parallel during the actual processing process or when the device is executed.

[0044] In Unix-like systems (such as Linux and macOS), file permissions are divided into three parts: user, group, and others. Each part has read (r), write (w), and execute (x) permissions. The suid (Set User ID) bit is a special permission bit, usually represented as s or S, located in the position of the user's execute permission bit. The suid bit can be set or canceled using the chmod command. For example, chmod u+s / path / to / file will set the suid bit, while chmod us / path / to / file will cancel the suid bit. After the suid bit is set, the file permissions will be displayed as rwsr-xr-x, where s indicates that the suid bit is set.

[0045] suid privilege escalation is a common local privilege escalation technique, especially in Unix-like systems. The suid mechanism allows a program to temporarily obtain the permissions of the program owner when it is executed, rather than the permissions of the user who executed the program. This mechanism is often used for programs that require specific permissions to perform certain operations, such as changing file owners or modifying system settings.

[0046] For suid / sgid privilege escalation, the existing detection method is to detect whether the euid (effective user ID) is 0 when the ordinary user binary command is executed, and whether the euid is still 0 after entering a new shell (command line interface) to identify the privilege escalation behavior. In this way, the system has default suid permission commands, the false alarm rate is high, and the detection ability is lost after entering a new shell, and the overall event detection rate is low.

[0047] Capabilities is a permission model that breaks down traditional superuser permissions into multiple independent permission units. Each capability represents a specific privileged operation, such as changing the file owner, binding a port, adjusting the process priority, etc. A file can set capabilities so that the process executing the file obtains specific privileges at runtime. For example, the / bin / ping file is usually set with CAP_NET_RAW capability, so that non-root users can also send ICMP (Internet Control Message Protocol) requests. A process can also dynamically increase or decrease its capabilities during execution, which is flexible to use.

[0048] Among them, the use of setuid (set user ID) capabilities in Capabilities to elevate privileges is an advanced privilege escalation technique, which is mainly achieved by using special permissions of files or processes. In the Linux system, the setuid capability allows a program to temporarily obtain the permissions of the program owner when it is executed, rather than the permissions of the user who executes the program. Combined with Capabilities, this privilege escalation technology through setuid capabilities can be more flexible and covert. Accordingly, the malicious privilege escalation behavior of attackers is more difficult to detect. For example, attackers can elevate their privileges to the super user (root) level by using files with setuid capabilities and Capabilities. This allows attackers to perform any operation, including modifying system files, installing malware, stealing sensitive information, etc. In addition, even if the attacker cannot fully elevate to root privileges, they can also use some Capabilities to abuse privileges, such as CAP_NET_ADMIN can be used to configure network interfaces, CAP_SYS_ADMIN can be used to mount file systems, etc., which poses a serious threat to system security. As for the privilege escalation of Capabilities, there is currently no effective detection method.

[0049] To address this, this application proposes a method for detecting suid privilege escalation and detecting privilege escalation using setuid capabilities in Capabilities. Please refer to Figure 1 , Figure 1 The flowchart of the method for identifying local privilege escalation provided by an embodiment of the present application is shown. Figure 1 As shown, the method includes:

[0050] S101, monitor the launch permission and execution permission of the target process; if the launch permission and execution permission are detected to be an abnormal combination, execute step S102;

[0051] First, the specified fields of the current process are captured and the first pan-match is performed to initially screen the fuzzy features of privilege escalation, including process startup permission monitoring + cmd execution permission monitoring. If the startup permission and execution permission are monitored to belong to the pre-configured abnormal combination, specifically including the abnormal combination of suid privilege escalation and the abnormal combination of setuid privilege escalation of capabilities, if one of the two combinations is met, step S102 is executed to perform blacklist detection.

[0052] In this embodiment, there is no limitation on the abnormal combination of startup permission and execution permission respectively set for suid privilege escalation and setuid privilege escalation of capabilities. In one embodiment, the combination is as follows: if it is monitored that the process is started with ordinary user permissions and is started by an ordinary user (UID is not 0), but is executed with super user permissions, that is, the execution permission of the process is root (EUID=0), it is determined that it meets the abnormal combination of suid privilege escalation, then step S102 calls the suid privilege escalation blacklist for matching detection;

[0053] If it is monitored that the process is started with ordinary user permissions, started by an ordinary user (UID is not 0), and executed with ordinary user permissions, and the execution permissions of the process are root (EUID is not 0), it is determined that it meets the setuid privilege escalation exception combination of capabilities, then step S102 calls the setuid privilege escalation blacklist of capabilities for matching detection.

[0054] It should be noted that in this embodiment, the highest user authority is taken as super user authority (ROOT) as an example. Other system types may have different highest authority naming methods, which are not limited here. Please refer to the introduction of this embodiment and will not be repeated here.

[0055] S102, calling the corresponding blacklist for matching detection according to the exception type; if the blacklist matches successfully, executing S103; wherein the exception types include: suid privilege escalation, setuid privilege escalation of capabilities;

[0056] For the exception type of suid privilege escalation, a pname blacklist corresponding to suid privilege escalation is established for comparison, where pname (Process Name) refers to the name, file name or identifier of a process. In the blacklist, pname is used to identify the object that needs to be blocked or monitored.

[0057] For setuid privilege escalation of capabilities, a pname blacklist corresponding to setuid privilege escalation is established for comparison. The pnames in the pname blacklist corresponding to setuid privilege escalation are mainly mainstream programming languages ​​PHP, Python, Java, Golang, etc. Due to different versions, fuzzy matching can be used for pname.

[0058] There is no limitation on the specific pname objects included in the blacklists corresponding to the two exception types, and blacklist objects can be added and supplemented according to actual usage requirements and expert experience.

[0059] S103, extracting information of specified fields in the target process and all subsequent processes within a specified time range according to the exception type, and matching and identifying the extracted information; if the matching and identification is successful, executing S104;

[0060] S104: Perform abnormal privilege escalation determination based on the abnormality type.

[0061] Here, step S103 and step S104 are combined for introduction.

[0062] If the blacklist match is successful, the target process that meets the conditions is used as the first data, and the specified field is extracted. All processes within the specified time range (for example, within 24 hours) after the match is successful are monitored, and the specified field information extracted from all monitored processes and the content of the specified field information in the first data are matched and identified. If the matching requirements are met, S104 is executed and it is determined to be suid privilege escalation or setuid privilege escalation.

[0063] In this embodiment, the specific field type of the extracted specified field is not limited and can be set according to the needs of the actual application scenario. In addition, when matching and identifying information, the specific matching and identification method needs to be set in accordance with the extracted specified field, so it is not limited either.

[0064] The processing method after the abnormal privilege escalation is determined according to the abnormal type is not limited in this embodiment, and an alarm can be issued and an emergency response process can be entered.

[0065] It should be noted that although the operations of the method of the present invention are described in a particular order in the drawings, this does not require or imply that the operations must be performed in this particular order or that all illustrated operations must be performed to achieve desired results.

[0066] Based on the above introduction, the method provided in this embodiment monitors the startup permissions and execution permissions of the target process, monitors the running process and its permission changes, so as to timely discover any unexpected or unauthorized privilege escalation operations. If the startup permissions and execution permissions are monitored to meet the abnormal combination, a blacklist matching detection is performed; the potential risk processes are screened out through the list matching, and the risky processes are quickly identified to achieve the initial screening of abnormal privilege escalation. It can also avoid comprehensive behavioral analysis of all processes and reduce performance overhead; if the blacklist matching is successful, the information of the specified fields in the target process and all processes within the subsequent specified time range is extracted according to the abnormal type, and the extracted information is matched and identified; after the list matching, a deeper execution check is performed on the running process to ensure that the subsequent process is executed as expected. If the behavior is abnormal, the matching identification is successful, and the abnormal privilege escalation is determined according to the abnormal type. This method adopts a detection method of secondary analysis of the process after the list matching, which improves the accuracy and real-time performance of privilege escalation detection while avoiding the problems of excessive performance overhead and too many false positives. Combining static and dynamic analysis methods, it can not only efficiently identify known malicious programs, but also deeply detect the behavior of running processes, timely discover potential suid privilege escalation and capabilities setuid privilege escalation attacks, and achieve effective security protection.

[0067] In one embodiment, after detecting that the startup permission and execution permission match an abnormal combination, in addition to performing blacklist detection, a paname whitelist may be established for comparison, specifically including:

[0068] Step S105, calling the corresponding whitelist for matching detection according to the exception type; if the whitelist does not match successfully, executing step S103; if the whitelist matches successfully, executing step S106;

[0069] Step S106: Determine whether the privilege escalation is not abnormal.

[0070] Since pname may be modified or customized, a whitelist detection method is added. The pname of the whitelist corresponding to suid privilege escalation includes existing business requirements and pnames with suid permissions by default, which are used to identify objects that are allowed to be accessed, run, or operated; the pname of the whitelist corresponding to capabilities setuid privilege escalation includes existing business requirements and pnames with capabilities setuid permissions by default. If the whitelist fails to match, it means that the behavior of the process is not a known legal item defined in the whitelist, and it is considered to be a potential suspicious or malicious activity that needs further processing; if the whitelist matches successfully, it is determined that the existence and behavior of the process are considered to be in line with expectations, and it can be directly determined as non-abnormal privilege escalation.

[0071] The method provided in this embodiment performs whitelist matching in addition to blacklist matching, which helps to exclude processes or behaviors that frequently appear and are considered to have no security risks, thereby reducing the possibility of false positives.

[0072] In one embodiment, between step S105 and step S106, if the whitelist match is successful, the following steps may be further performed:

[0073] Step S107, perform abnormal behavior detection on the process with the exception type of suid privilege escalation; if abnormal behavior exists, execute step S103; if no abnormal behavior exists, execute step S106.

[0074] For processes with suid privilege escalation as the exception type, further abnormal behavior detection is performed on the processes on the whitelist to prevent attackers from maliciously escalating privileges through legitimate processes (such as system services, known applications, etc.), thereby enhancing the depth of overall privilege escalation defense. Among them, abnormal behaviors such as no external connection (connection to the public network) and no suspicious login or registration of the current uname (User Name) are not limited here.

[0075] In one embodiment, before step S105, the following steps may be further performed:

[0076] Perform fuzzy matching of target command execution on setuid privilege escalation processes with exception type capabilities to obtain the matched target information;

[0077] Accordingly, in step S105, matching detection is performed on the whitelist corresponding to the call under the setuid privilege escalation of capabilities of the exception type, specifically: matching detection is performed on the target information and the setuid privilege escalation whitelist of capabilities is called.

[0078] Since attackers may try to perform malicious operations in different ways or by deforming commands, fuzzy matching helps capture commands or parameters that have undergone certain changes. Through flexible pattern recognition technology, dangerous commands that do not fully match can be identified, thereby enhancing the flexibility of whitelist detection when the number of setuid privilege escalation whitelists in capabilities is limited.

[0079] In the above embodiment, the fields specifically included in the specified field extracted in step S103 and the corresponding matching identification method are not limited. To deepen understanding, this embodiment introduces a specified field and matching method under the CentOS7 system. Figure 2 The figure shows a schematic diagram of a suid privilege escalation detection method. Figure 3The figure shows a schematic diagram of a setuid privilege escalation detection method of capabilities. Step S103 can be performed according to the following sub-steps:

[0080] S31. If the exception type is suid privilege escalation, extract the process name, parent process name, process control symbol, parent process control symbol, user identifier, group identifier, parent process user identifier, and effective user identifier of the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose parent process user identifier is the user identifier of the target process, whose effective user identifier is the effective user identifier of the target process, whose parent process name is the process name of the target process, and whose user identifier and group identifier are the user identifier and group identifier of the target process among all the processes; if all of them are satisfied, determine that the matching identification is successful;

[0081] S32. If the exception type is setuid privilege escalation of capabilities, extract the parent process control symbol, process control symbol, user identifier, effective user identifier, parent process user identifier, group identifier, parent process name, process name, parent process user name, and user name in the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose user identifier and effective user identifier are 0 or are not the user identifier and effective user identifier of the target process, whose parent process user identifier is consistent with the user identifier but whose group identifier is consistent with the target process, whose parent process name is the process name of the target process, and whose parent process user name is the user name of the target process; if all of them are satisfied, determine that the match and identification are successful.

[0082] It should be noted that, in this embodiment, the default ROOT as the super administrator under the CentOS7 system is taken as an example, and a specific directory and user name are provided. The directories and names may be inconsistent under different systems. The processing methods under other systems can refer to the introduction of this embodiment and will not be repeated here.

[0083] Further references Figure 4 , which shows an exemplary structural block diagram of a local privilege escalation identification device according to an embodiment of the present application, which mainly includes:

[0084] The process monitoring unit 101 is used to monitor the launch permission and execution permission of the target process; if the launch permission and execution permission are detected to meet the abnormal combination, the blacklist detection unit 102 is triggered;

[0085] The blacklist detection unit 102 is used to call the corresponding blacklist for matching detection according to the exception type; if the blacklist matches successfully, the field monitoring unit 103 is triggered; wherein the exception types include: suid privilege escalation, setuid privilege escalation of capabilities;

[0086] The field monitoring unit 103 is used to extract information of a specified field in the target process and all subsequent processes within a specified time range according to the exception type, and match and identify the extracted information; if the match and identification is successful, the privilege escalation determination unit 104 is triggered;

[0087] The privilege escalation determination unit 104 is used to perform abnormal privilege escalation determination according to the abnormality type.

[0088] It should be understood that the units described in the above device are similar to those in the reference Figure 1 The steps in the method described above correspond to each other. Therefore, the operations and features described above for the method are also applicable to the device and the units contained therein, and will not be repeated here. The device can be pre-implemented in the browser or other security application of the server, or loaded into the browser or its security application of the server by downloading or the like. The corresponding units in the device can cooperate with the units in the server to implement the solution of the embodiment of the present application.

[0089] For the several units mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units described above can be embodied in one unit. On the contrary, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0090] It should be noted that for details not disclosed in the local privilege escalation identification device in the embodiment of the present application, please refer to the details disclosed in the above embodiments of the present application, which will not be repeated here.

[0091] Reference below Figure 5 , Figure 5 A schematic diagram of the structure of a computer system suitable for implementing a server of an embodiment of the present application is shown.

[0092] like Figure 5 As shown, the computer system includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 to the random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation instructions of the system are also stored. The CPU 501, the ROM 502 and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0093] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0094] In particular, according to an embodiment of the present application, the above reference flow chart Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flow chart. In such an embodiment, the computer program includes a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present application are executed.

[0095] It should be noted that the computer-readable medium shown in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium such as a computer-readable storage medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0096] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operating instructions of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operating instruction, or can be implemented with a combination of dedicated hardware and computer instructions.

[0097] The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be arranged in a processor. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0098] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the server described in the above embodiment, or may exist independently without being installed in the server. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the local privilege escalation identification method described in the present application.

[0099] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for identifying local privilege escalation, characterized in that: include: Monitor the launch and execution permissions of the target process; If it is detected that the startup permission and execution permission meet the abnormal combination, the corresponding blacklist is called according to the abnormal type for matching detection; wherein the abnormal type includes: suid privilege escalation, setuid privilege escalation of capabilities; If the blacklist match is successful, extract the information of the specified field in the target process and all subsequent processes within the specified time range according to the exception type, and match and identify the extracted information; If the match is successful, an exception privilege escalation decision is made based on the exception type.

2. The method according to claim 1, characterized in that If the launch permission and execution permission are detected to match an abnormal combination, the following are also included: Call the corresponding whitelist according to the exception type for matching detection; If the whitelist is not matched successfully, the step of extracting information of the specified field in the target process and all subsequent processes within the specified time range is performed; If the whitelist match is successful, it is determined that this is not an abnormal privilege escalation.

3. The method according to claim 2, characterized in that Before determining that the privilege escalation is not abnormal, the method further includes: Perform abnormal behavior detection on the process whose abnormal type is suid privilege escalation; If there is abnormal behavior, executing the step of extracting information of the specified field in the target process and all subsequent processes within the specified time range; If there is no abnormal behavior, the step of determining non-abnormal privilege escalation is performed.

4. The method according to claim 2, characterized in that Before calling the corresponding whitelist according to the exception type for matching detection, it also includes: Perform fuzzy matching of target command execution on the setuid privilege escalation process whose exception type is capabilities, and obtain the matched target information; Accordingly, calling the corresponding whitelist for matching detection according to the exception type includes: calling the setuid privilege escalation whitelist of capabilities for matching detection on the target information.

5. The method according to claim 1, characterized in that If the startup permission and execution permission are detected to match an abnormal combination, the corresponding blacklist is called according to the abnormal type for matching detection, including: If it is detected that the process is started with ordinary user privileges and executed with super user privileges, it is determined to meet the abnormal combination of suid privilege escalation, and the suid privilege escalation blacklist is called for matching detection; If it is detected that the process is started with ordinary user permissions and executed with ordinary user permissions, it is determined that the setuid privilege escalation exception combination meets the capabilities, and the setuid privilege escalation blacklist of capabilities is called for matching detection.

6. The method according to claim 1, characterized in that Extract information of specified fields in the target process and all subsequent processes within a specified time range according to the exception type, and perform matching and identification on the extracted information, including: If the exception type is suid privilege escalation, extract the process name, parent process name, process control symbol, parent process control symbol, user identifier, group identifier, parent process user identifier, and effective user identifier of the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose parent process user identifier is the user identifier of the target process, whose effective user identifier is the effective user identifier of the target process, whose parent process name is the process name of the target process, and whose user identifier and group identifier are the user identifier and group identifier of the target process among all the processes; if all of them are satisfied, determine that the matching identification is successful; If the exception type is setuid privilege escalation of capabilities, extract the parent process control symbol, process control symbol, user identifier, effective user identifier, parent process user identifier, group identifier, parent process name, process name, parent process user name, and user name in the target process and all processes within the subsequent specified time range; determine whether there is a process control symbol whose parent process control symbol is the process control symbol of the target process, whose user identifier and effective user identifier are 0 or are not the user identifier and effective user identifier of the target process, whose parent process user identifier is consistent with the user identifier but whose group identifier is consistent with the target process, whose parent process name is the process name of the target process, and whose parent process user name is the user name of the target process; if all of them are met, determine that the match and identification are successful.

7. A local privilege escalation identification device, characterized in that: include: A process monitoring unit is used to monitor the launch permission and execution permission of the target process; If the startup permission and execution permission are detected to match an abnormal combination, the blacklist detection unit is triggered; The blacklist detection unit is used to call the corresponding blacklist for matching detection according to the abnormal type; If the blacklist matches successfully, the field monitoring unit is triggered; wherein the exception types include: suid privilege escalation, setuid privilege escalation of capabilities; The field monitoring unit is used to extract information of specified fields in the target process and all subsequent processes within a specified time range according to the exception type, and match and identify the extracted information; if the match and identification is successful, the privilege escalation determination unit is triggered; The privilege escalation determination unit is used to perform abnormal privilege escalation determination according to the abnormality type.

8. A server comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images