Abnormal privilege lifting detection method, device and equipment and medium
Through regular matching of file modification behavior and mapping of detection methods, the problem of difficult to distinguish between malicious and normal file modification behavior in the prior art is solved, and the detection rate and accuracy of power-raising behavior are improved.
Patent Information
- Application Number
- CN202411753384.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-02
- Publication Date
- 2025-04-22
AI Technical Summary
When detecting file modification behaviors, it is difficult to accurately distinguish between malicious power raising behaviors and normal business needs, resulting in a large number of false positives and the subsequent operations after file modification behaviors cannot be identified.
By obtaining the change information of the file whose content has changed in the target file list, performing regular matching, determining the detection method based on the matching result and the preset detection method mapping table, and generating the detection result. If the result is a preset detection result, it is judged that the file has undergone abnormal raising of rights.
It increases the detection rate of incidents of violations or malicious power-raising activities, reduces false positives, and can effectively identify subsequent operations after file modification activities.
Smart Images
Figure CN119862559A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of data processing, and in particular to a method, device, equipment and medium for detecting abnormal privilege escalation. Background Art
[0002] At present, the existing technologies for local privilege escalation detection are mainly divided into three directions: establish static rules through known attackers' common methods, perform regular matching on user input commands, and improve local privilege escalation detection capabilities by continuously increasing the rule base data; analyze the currently known privilege escalation vulnerabilities separately, generate detection, alarm or patch solutions for each vulnerability separately, and detect exp / poc in various ways to improve local privilege escalation detection capabilities; monitor the changes in process RUID, EUID, RGID, and EGID permissions under the same process tree (such as the RUID / EUID bit of a child process becomes 0) to improve detection capabilities; and the internal affairs of enterprises are complex, and file modification may be a malicious privilege escalation behavior or a business requirement, and the existing technology will generate a large number of false alarms. And if the file modification behavior generates an alarm, its subsequent operations are still unable to be identified. There is no ability and means to perceive malicious behavior or illegal operations. Summary of the invention
[0003] The purpose of the present invention is to at least provide a detection method, device, equipment and medium for abnormal privilege escalation, which can at least solve the problem that the existing technology may generate a large number of false alarms when modifying files, which may be malicious privilege escalation behavior or business needs. And if the modification of the file generates an alarm, its subsequent operations cannot be identified. The problem of the ability and means to perceive malicious behavior or illegal operations can at least achieve the beneficial effect of increasing the detection rate of illegal or malicious privilege escalation events.
[0004] To solve the above technical problems, at least one embodiment of the present invention provides a method for detecting abnormal privilege escalation, the method comprising:
[0005] Get the change information corresponding to the target files whose contents have been changed in the target file list; the change information is the information changed by non-ROOT users;
[0006] Perform regular expression matching on the change information corresponding to each target file that has been changed, so as to obtain the regular expression matching result corresponding to each change information;
[0007] Determine the detection method corresponding to each change information according to the regular matching result corresponding to each change information and the preset detection method mapping table;
[0008] According to each change information and the corresponding detection method, a detection result corresponding to each change information is obtained;
[0009] If the detection result corresponding to any change information is a preset detection result, it is determined that the target file corresponding to the change information has undergone abnormal privilege escalation.
[0010] At least one embodiment of the present invention further provides a device for detecting abnormal privilege escalation, the device comprising:
[0011] An information acquisition module is used to acquire change information corresponding to target files whose contents have been changed in the target file list; wherein the change information is information changed by a non-ROOT user;
[0012] A matching module is used to perform regular matching on the change information corresponding to each target file that has been changed, so as to obtain a regular matching result corresponding to each change information;
[0013] A detection method determination module, used to determine the detection method corresponding to each change information according to the regular matching result corresponding to each change information and a preset detection method mapping table;
[0014] A detection result generating module, used for obtaining the detection result corresponding to each modification information according to each modification information and the corresponding detection method;
[0015] The abnormal determination module is used to determine that the target file corresponding to any change information has undergone abnormal privilege escalation if the detection result corresponding to the change information is a preset detection result.
[0016] At least one embodiment of the present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned abnormal privilege escalation detection method.
[0017] At least one embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned abnormal privilege escalation detection method when executed by a processor.
[0018] The abnormal privilege escalation detection method provided by the embodiment of the present invention improves the event detection rate of illegal or malicious privilege escalation behavior by monitoring file permissions and status and performing correlation detection with related behaviors. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.
[0020] Figure 1 is a flow chart of a method for detecting abnormal privilege escalation provided by an embodiment of the present invention;
[0021] Figure 2 is a flow chart of a method for detecting abnormal privilege escalation provided by another embodiment of the present invention;
[0022] Figure 3 is a schematic diagram of a detection device for abnormal privilege escalation provided by another embodiment of the present invention;
[0023] Figure 4 It is a schematic structural diagram of an electronic device provided by another embodiment of the present invention. DETAILED DESCRIPTION
[0024] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it can be understood by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present invention can also be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other under the premise of no contradiction.
[0025] In order to facilitate understanding of the embodiments of the present invention, relevant contents about the detection method of abnormal privilege escalation are first introduced here.
[0026] At present, the existing technologies for local privilege escalation detection are mainly divided into three directions: Establishing static rules through common methods of known attackers: This method collects and organizes the common operation methods of known attackers to establish a static rule base. Then, regular expressions are used to match the commands entered by the user. For example, attackers often use some specific format command combinations to try to break through the permission restrictions. These command formats will be organized into rules. When the system detects that the commands entered by the user meet these rules, it is determined that there may be a risk of privilege escalation. With the continuous increase in the amount of data in the rule base, it is expected to gradually improve the ability of local privilege escalation detection. However, this method has obvious limitations. Due to the extremely complex business scenarios within the enterprise, the commands entered by the user may only be for the needs of normal business development, but they meet certain preset rules, resulting in a large number of false positives, which brings great trouble to security management. Separate analysis method for known privilege escalation vulnerabilities: This method focuses on a separate and in-depth analysis of various privilege escalation vulnerabilities that have been discovered. For each individual privilege escalation vulnerability, technicians will carefully generate corresponding detection, warning or patching solutions. For example, for a file permission configuration vulnerability that exists in a specific version of the operating system, a corresponding detection code will be specially developed to determine whether there is a risk of privilege escalation by detecting whether an attack program that exploits this vulnerability (such as a common vulnerability exploit program exp or poc) appears in the system, thereby improving the local privilege escalation detection capability. However, this approach also faces challenges. There are many file operations involved in the business process of an enterprise, and it is difficult to accurately determine whether each operation related to privilege escalation vulnerabilities is a normal business behavior or a malicious privilege escalation behavior that exploits vulnerabilities. Therefore, false alarms are also more serious. Once an alarm is generated for file modification and other behaviors, it is difficult to continue to track and identify subsequent related operations, and there is a lack of perception and judgment capabilities for the entire malicious behavior chain. Method based on process permission change monitoring: This method mainly closely monitors the changes in permission-related indicators such as the actual user ID (RUID), effective user ID (EUID), actual group ID (RGID) and effective group ID (EGID) of the process under the same process tree. For example, when the RUID / EUID bit of a child process is detected to be 0 (in many operating systems, a permission value of 0 usually represents the highest permission similar to that of the root user), it is considered that there may be privilege escalation, thereby enhancing detection capabilities. However, in actual enterprise application environments, the operation of system processes is complex and diverse, and some normal business operations may also cause similar changes in process permissions, which can easily lead to false alarms, and it is also impossible to effectively identify subsequent operations after the alarm is generated, making it difficult to determine whether there is a malicious intent to escalate privileges and possible subsequent illegal operations.
[0027] In general, although these existing local privilege escalation detection technologies can help to detect abnormal privilege escalation behaviors to a certain extent, due to the complexity of internal business of enterprises, when faced with operations such as file modification, it is often difficult to accurately distinguish whether it is for malicious privilege escalation purposes or normal business needs, resulting in a large number of false positives. Moreover, once an action triggers an alarm, it is still impossible to effectively identify its subsequent operations. The lack of the ability and corresponding means to perceive malicious behavior or illegal operations has become a technical problem that needs to be solved urgently.
[0028] In order to solve the above problem that file modification may be a malicious privilege escalation behavior or a business requirement, the existing technology will generate a large number of false alarms. And if the file modification behavior generates an alarm, its subsequent operations are still unable to be identified. There is no technical problem of the ability and means to perceive malicious behavior or illegal operations. The present invention proposes a detection method for abnormal privilege escalation.
[0029] The following is a detailed description of the implementation details of the abnormal privilege escalation detection method of this embodiment. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution. It should be noted that the acquisition or use of data in the embodiment of this application requires the consent of the user, and the relevant data can only be obtained after the user's authorization, and the acquisition or use of the data complies with relevant legal provisions.
[0030] The detection method of abnormal privilege escalation in this embodiment can be applied to electronic devices with communication, computing and data storage capabilities. The specific process can be as follows: Figure 1 As shown, including:
[0031] Step 101, obtaining change information corresponding to the target file whose content has been changed in the target file list; wherein the change information is information changed by a non-ROOT user.
[0032] Specifically, the ROOT user is the user with the highest permissions in the operating system. In Unix (such as Solaris, AIX, BSD) and Unix-like systems (such as Linux, QNX, etc.), as well as Android and iOS mobile device systems, the ROOT user is the only super user. The ROOT user is named because it can read, write and execute operations on the root directory, which is equivalent to the SYSTEM (XP and below) / TrustedInstaller (Vista and above) user in the Windows system.
[0033] It should be noted that, here, change includes replacement and addition, that is, whether the file content is replaced by new content or new content is added on the basis of the original, it is within the scope of obtaining change information.
[0034] Step 102: Perform regular expression matching on the change information corresponding to each target file that has been changed, so as to obtain a regular expression matching result corresponding to each change information.
[0035] Specifically, regular matching is regular expression matching, which is a text processing technology based on pattern matching. Regular expression (Regular Expression, referred to as Regex or RE) is a text processing tool that can be used to perform various complex text processing tasks, such as search, replacement, verification, etc.
[0036] Furthermore, the steps of regular matching are as follows:
[0037] First, clearly match the goals and needs:
[0038] First, we need to clearly identify the object that needs to be matched by regular expressions, that is, the change information corresponding to the target file, and clarify the specific matching requirements based on the detection purpose. For example, in abnormal privilege escalation detection, if we want to determine whether the change information contains specific malicious command patterns or suspicious permission-related strings, etc., to assist in the subsequent determination of whether there is abnormal privilege escalation behavior, we need to determine these specific search requirements and prepare for the subsequent writing of regular expressions.
[0039] Next, write the regular expression:
[0040] According to the determined matching requirements, use the syntax rules of regular expressions to write the corresponding expressions. Regular expressions have a set of special characters and symbols to define matching patterns. The common ones are as follows: Character matching: Ordinary characters directly match themselves. For example, to match the string "abc", the regular expression is "abc". Some special characters have specific meanings. For example, "." can match any single character except the newline character. If you want to match any character followed by "bc", you can write ".bc". Determinator: used to specify the number of times the preceding character or subexpression appears. For example, "" means that the preceding character can appear 0 or more times, "+" means that the preceding character appears at least 1 time, "?" means that the preceding character appears 0 or 1 time, etc. For example, to match a string that starts with "a" and is followed by any number (including 0) of "b", the regular expression can be written as "ab". Character class: Defined by square brackets "[]", which lists the set of characters that can be matched. For example, "[abc]" means that it can match any of the three characters "a", "b" or "c". It can also be expressed as a range, such as "[az]" can match all lowercase English letters. Grouping and capturing: Use brackets "()" to group, which makes it easier to extract and process the matching content. For example, "(ab)+" means that the combination "ab" appears at least once.
[0041] Combining the above rules with actual matching requirements, write a suitable regular expression. For example, if you want to find whether the change information contains a pattern like "sudo" (command-related string commonly used to obtain higher permissions) followed by any characters and then "edit" (indicates editing operations, assuming it is associated with suspicious operations related to file modification), the regular expression can be written as "sudo.*edit".
[0042] After that, choose a regular expression matching tool or programming language library:
[0043] There are many tools and programming languages that support regular expression matching, and you need to choose according to the actual application scenario: Built-in libraries of programming languages: For example, there is a "re" module in the Python language. After introducing it through "import re", you can use functions such as "re.match()" (match from the beginning of the string), "re.search()" (find matches in the entire string), "re.findall()" (find all matching substrings and return a list) to perform regular expression matching operations.
[0044] Then, perform regular matching operations: use the corresponding functions, methods or commands provided by the selected tool or programming language library to apply the written regular expression to the target change information for matching operations. For example, when using the "re.search()" function in Python, it will find the first position that matches the regular expression pattern in the given string (that is, the change information), and return a match object if found, otherwise return None; "re.findall()" will return a list of all matching substrings, etc.
[0045] Finally, process the matching results: perform corresponding processing according to the results returned by the regular matching operation: Determine whether the match is successful: If the return value indicates that the match is successful (such as the return value is not None in Python), it means that there is an expected pattern in the change information. You can further extract the specific content of the match according to the needs (by capturing groups, etc.), and combine the overall detection logic to determine whether there is an abnormal risk of privilege escalation. For example, if a command pattern suspected of being related to malicious privilege escalation is matched, you may need to mark the change information for subsequent focus. Unsuccessful match: If the return value shows that the match failed, it means that the pattern defined by the regular expression does not exist in the current change information. You can continue to analyze other aspects according to the detection process, or use other detection methods or regular expressions to further investigate the change information.
[0046] Step 103: Determine the detection method corresponding to each modification information according to the regular expression matching result corresponding to each modification information and the preset detection method mapping table.
[0047] Specifically, the preset detection method mapping table includes each regular matching result and the detection method corresponding to each regular matching result. In this embodiment, for different regular matching results, no alarm is given first, but the corresponding detection method is matched for them.
[0048] Step 104, obtaining a detection result corresponding to each modification information according to each modification information and a corresponding detection method;
[0049] Step 105: If the detection result corresponding to any change information is a preset detection result, it is determined that the target file corresponding to the change information has undergone abnormal privilege escalation.
[0050] Specifically, if the detection result corresponding to any change information is the preset detection result, it is determined that the target file corresponding to the change information has abnormal privilege escalation. After determining the abnormal privilege escalation, the emergency response process is entered for analysis and judgment to obtain the corresponding processing means.
[0051] In some embodiments, after step 102, the method further includes:
[0052] Step 106, obtaining user information corresponding to each change information.
[0053] Specifically, the above user information includes: user login type, running process type and network connection status.
[0054] Furthermore, user login type refers to the different ways that users access computer systems or network services. It reflects where and through what channels users access system resources. Different login types often differ in terms of security, permission acquisition, and usage scenarios. As an example: including: local login: users log in directly on the physical terminal of the computer device, such as logging in to the Windows operating system directly by entering a user name and password in front of a desktop computer in the office. In this way, the user and the device are in the same physical location, and data transmission is basically carried out between local hardware. It is relatively safe and is often used in scenarios such as personal daily office use. For example, an employee sitting in front of his office computer and logging in directly to the company's internal office system after turning on the computer is a typical local login. Remote login: users remotely connect to the target computer system from other devices through the network to log in and access. Common methods include remote desktop protocol (RDP, commonly used in Windows systems) or SSH (Secure Shell, commonly used in Unix-like systems). For example, the company's network administrator can use the SSH protocol to remotely log in to the server in the company's computer room through the Internet at home to perform maintenance and management operations on the server. This type of login is convenient for users to manage systems in different locations, but because it involves network transmission, it is necessary to pay attention to network security protection to prevent information leakage and illegal access. Domain login: In the enterprise network environment, based on the login method of the Windows domain architecture, users log in on multiple computers joined to the domain through domain accounts, and the domain controller uniformly manages user identity authentication and permission allocation. For example, a large enterprise has set up a Windows domain. Employees can use the domain account assigned by the enterprise to log in on computers in different offices within the company. As long as the computer joins the domain, it can obtain the corresponding permissions to access the company's internal shared resources, etc., which is convenient for centralized management of user and resource access rights.
[0055] The running process type is a classification description of various processes running in the computer system according to their functions, properties, and application fields. Different types of processes have their own characteristics in terms of resource usage, permission requirements, and impact on system security. As an example: including system processes: These processes are the basic components necessary for the operation of the operating system, responsible for managing and coordinating computer hardware resources, providing system services and other key functions. For example, in the Windows operating system, the "System" process is responsible for core tasks such as memory management and process scheduling. It always runs in the background and plays a fundamental role in the stable operation of the entire system. Ordinary users generally cannot directly intervene in its operation and have higher system permissions; in Unix-like systems, the "init" process (in modern Linux systems, it may be the "systemd" process) is the first process after the system is started. It will start and manage many other system service processes and is a key link in the normal operation of the system. Application process: The process corresponding to various software installed and started by the user. They rely on the operating system to provide users with various specific functional services. For example, when a user opens the office software Microsoft Word, the corresponding "WINWORD.EXE" process (under Windows system) will be started to implement document editing and other functions; or when a browser such as Google Chrome is started, the "chrome.exe" process will run to provide web browsing services. The permissions of such processes are usually limited by the operating system and user settings, and their resource usage varies according to the complexity of the software functions. Service process: usually a process that runs continuously in the background to provide specific service support for the system or other applications. They generally do not require frequent user interaction. For example, the service process in the database management system, taking the MySQL database as an example, the "mysqld" process will run continuously on the server, responsible for processing the client's database connection request, data storage and query operations, and ensuring the normal provision of database services; there is also the "Windows Update" service process in the Windows system, which will regularly check system updates and automatically download and install them to ensure the security and functional integrity of the system.
[0056] The network connection status describes the current connection between the computer device and the network, including whether it is connected to the network, the type of network connected, the stability of the network connection, and related network configuration information. It is of great significance for judging whether the system can perform network communication, data transmission, and whether there is abnormal network behavior. As an example: including connected networks: Among them, wired connection: the computer is connected to network devices such as routers and switches through network cables to achieve stable network access. For example, a desktop computer in an office uses a network cable to plug into the port of the company's LAN, so that it can access the company's internal network resources and access the Internet through the company's network exit. This connection method usually has a high network stability and is suitable for application scenarios with high requirements for network bandwidth and stability, such as data transmission and video conferencing within the enterprise. Wireless connection: the device uses a wireless network card to connect to a wireless access point such as a wireless router through the Wi-Fi protocol to access the network. Mobile devices such as laptops and smartphones search and connect to corresponding Wi-Fi hotspots in places such as homes, cafes or offices to achieve Internet access. Wireless connection is convenient for mobile use of devices, but it may be affected by factors such as signal strength and interference. The network stability is slightly weaker than that of wired connection. It is often used in daily office, leisure and entertainment and other Internet scenarios. Not connected to the network: The computer device is not connected to any network and is offline. For example, during the flight, the wireless communication function needs to be turned off according to regulations. At this time, laptops, tablets and other devices are not connected to the network and cannot perform network-related operations, such as browsing the web, sending and receiving emails, etc. However, you can still use the local applications installed on the device to perform some operations that do not rely on the network, such as editing local documents, viewing locally stored pictures, etc. Abnormal network connection: Although the device is displayed as being connected to the network, there are actually network failures and other problems that prevent normal communication. For example, the computer is connected to Wi-Fi, but due to a router failure or a problem with the network of the Internet service provider, it is unable to access the web page, send messages, etc., which manifests as excessive network delay, severe packet loss, or complete inability to connect to specific network services. At this time, it is necessary to troubleshoot problems with network equipment, network settings, and Internet service providers to restore normal network connection.
[0057] Step 107, according to the preset exception list, the corresponding user information with abnormal regular matching results is added to the preset exception list.
[0058] Specifically, the anomaly list is used for subsequent joint detection.
[0059] In some embodiments, the detection result corresponding to each modification information is obtained according to each modification information and the corresponding detection method, including:
[0060] A joint detection is performed based on the detection method corresponding to each change information, the above-mentioned abnormal list and the ROOT IP to obtain the detection result corresponding to each change information.
[0061] Specifically, there are common correlation detection methods for subsequent behavior detection, and correlation detection is performed based on IP and lists.
[0062] Reference below Figure 2 , the above method is described by specific examples:
[0063] First, obtain / etc / sudoers, / root / .ssh / , / root / .bashrc, / root / .bash_profile, / etc / passwd, letc / shadow, system crontab directory, system user $PATH directory and other sensitive directories, and then determine whether they are written by non-ROOT users. If so, perform regular matching on the newly written content (change information): match the sudo permissions newly granted to the root user by the current user, match the newly added keys, match the newly added environment variables, scripts, match the newly added environment variables, scripts, match the newly added and changed users, match the newly added and changed users, match the newly added scheduled tasks, execute operations, match the newly added or modified files PATH in the directory, etc. To the corresponding regular matching results: Get 1. The current execution user, 2. The sudo permission host, 3. The sudo permission command; Get the newly added key; Get 1. The environment variable newly added PATH, 2. The newly added script content; Get 1. The environment variable newly added PATH, 2. The newly added script content; Get 1. The newly added user with uid 0, 2. The root user whose password has been modified; Get 1. The newly added user with uid 0, 2. The modified root user; Get 1. The execution frequency of the scheduled task, 2. The content of the command, 3. (If any) the directory and content of the executed script; Get 1. The file PATH, 2. The file permissions, etc.; Then perform subsequent behavior detection, including: 1. The current user, the host of the sudo permission list, the sudo command execution, the PATH of the subprocess cmd is the cmd of the sudo permission list, and the secondary subprocess is generated. The following satisfies 1: The number of secondary subprocesses generated>mThe connection time of the secondary subprocess>n min; 1. The current user executes the ssh command locally and successfully logs in to the root account without entering a password. 2. The root user who establishes an ssh connection is logged in through the key; 1. The newly added command, file, or script under PATH is executed; 1. The newly added command, file, or script under PATH is executed; 1. The root user logs in with a password; 1. The scheduled task is executed, and the execution frequency is consistent with the preset 2. The command of the scheduled task is detected as malicious behavior by other detection methods 3. The directory of the executed script can be modified by the current work; 1. The cmd / script permission configuration in the path is abnormal, and the command has been executed by the work; Finally, according to subsequent behavior detection, the successfully detected behavior is determined to be a local privilege escalation behavior caused by improper file operation, and enters the emergency response process.
[0064] The abnormal privilege escalation detection method provided in this embodiment improves the event detection rate of illegal or malicious privilege escalation behaviors by monitoring file permissions and status and performing correlation detection with related behaviors.
[0065] Another embodiment of the present invention relates to a detection device for abnormal privilege escalation. The implementation details of the detection of abnormal privilege escalation in this embodiment are specifically described. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution. The schematic diagram of the detection device for abnormal privilege escalation in this embodiment can be as follows: Figure 3 As shown, it includes an information acquisition module 301, a matching module 302, a detection method determination module 303, a detection result generation module 304 and an abnormality determination module 305; wherein,
[0066] The information acquisition module 301 is used to acquire the change information corresponding to the target files whose contents have been changed in the target file list; wherein the change information is the information changed by a non-ROOT user.
[0067] The matching module 302 is used to perform regular expression matching on the change information corresponding to each target file that has been changed, so as to obtain a regular expression matching result corresponding to each change information.
[0068] The detection method determination module 303 is used to determine the detection method corresponding to each modification information according to the regular expression matching result corresponding to each modification information and a preset detection method mapping table.
[0069] The detection result generating module 304 is used to obtain the detection result corresponding to each modification information according to each modification information and the corresponding detection method.
[0070] The abnormality determination module 305 is used to determine that the target file corresponding to any change information has undergone abnormal privilege escalation if the detection result corresponding to the change information is a preset detection result.
[0071] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.
[0072] Another embodiment of the present invention relates to an electronic device, such as Figure 4 As shown, it includes: at least one processor 401; and a memory 402 that is communicatively connected to the at least one processor 401; wherein the memory 402 stores instructions that can be executed by the at least one processor 401, and the instructions are executed by the at least one processor 401, so that the at least one processor 401 can execute the detection method of abnormal privilege escalation in the above-mentioned embodiments.
[0073] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.
[0074] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.
[0075] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.
[0076] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions for a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the above-mentioned method of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as: ROM), random access memory (Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.
[0077] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made in form and detail without departing from the spirit and scope of the present invention.
Claims
1. A method for detecting abnormal privilege escalation, characterized in that: The method comprises: Get the change information corresponding to the target files whose contents have been changed in the target file list; the change information is the information changed by non-ROOT users; Perform regular expression matching on the change information corresponding to each target file that has been changed, so as to obtain the regular expression matching result corresponding to each change information; Determine the detection method corresponding to each change information according to the regular matching result corresponding to each change information and the preset detection method mapping table; According to each change information and the corresponding detection method, a detection result corresponding to each change information is obtained; If the detection result corresponding to any change information is a preset detection result, it is determined that the target file corresponding to the change information has undergone abnormal privilege escalation.
2. The method for detecting abnormal privilege escalation according to claim 1, characterized in that: Changes include substitutions and additions.
3. The method for detecting abnormal privilege escalation according to claim 1, characterized in that: After performing regular expression matching on the change information corresponding to each target file that has been changed to obtain a regular expression matching result corresponding to each change information, the method further includes: Get the user information corresponding to each change information; According to the preset exception list, the corresponding user information with abnormal regular matching results is added to the preset exception list.
4. The method for detecting abnormal privilege escalation according to claim 3, characterized in that: The user information includes: User login type, running process type, and network connection status.
5. The method for detecting abnormal privilege escalation according to claim 1, characterized in that: The preset detection method mapping table includes each regular matching result and the detection method corresponding to each regular matching result.
6. The method for detecting abnormal privilege escalation according to claim 3, characterized in that: The step of obtaining the detection result corresponding to each modification information according to each modification information and the corresponding detection method includes: A joint detection is performed according to the detection method corresponding to each change information, the abnormal list and the ROOT IP to obtain the detection result corresponding to each change information.
7. The method for detecting abnormal privilege escalation according to claim 3, characterized in that: If the detection result corresponding to any of the change information is a preset detection result, after determining that the target file corresponding to the change information has undergone abnormal privilege escalation, the method further includes: Enter the emergency response process.
8. A detection device for abnormal privilege escalation, characterized in that: The device comprises: An information acquisition module is used to acquire change information corresponding to target files whose contents have been changed in the target file list; wherein the change information is information changed by a non-ROOT user; A matching module is used to perform regular matching on the change information corresponding to each target file that has been changed, so as to obtain a regular matching result corresponding to each change information; A detection method determination module, used to determine the detection method corresponding to each change information according to the regular matching result corresponding to each change information and a preset detection method mapping table; A detection result generating module, used for obtaining the detection result corresponding to each modification information according to each modification information and the corresponding detection method; The abnormal determination module is used to determine that the target file corresponding to any change information has undergone abnormal privilege escalation if the detection result corresponding to the change information is a preset detection result.
9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the abnormal privilege escalation detection method as described in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for detecting abnormal privilege escalation according to any one of claims 1 to 7 is implemented.