Operating system security control method and system

Abstract

The invention discloses an operating system security control method and system, and the method comprises the steps: capturing all host behaviors in real time in an operating system kernel layer, carrying out the analysis and learning, and constructing a host behavior model through employing the analysis and learning result of the host behaviors; if a program is started or operated at the current moment, capturing a corresponding host behavior at a kernel layer of an operating system, verifying the host behavior at the current moment by using a host behavior model, if the verification is passed, allowing the host behavior at the current moment, and if the verification is not passed, stopping the host behavior at the current moment so as to realize mandatory access control on the host behavior; and if the blocked host behavior meets the preset judgment condition, updating the host behavior model by using the blocked host behavior. According to the method, the host behavior model is used as the security baseline of the host system, zero-trust mandatory access control is performed on all host behaviors in the kernel layer of the operating system, a zero-trust security kernel of the operating system is formed, and all-around protection is provided for the security of the host system.

Description

Technical Field

[0001] The present invention relates to the technical fields of computers and information security, and particularly to an operating system security control method and system. Background Art

[0002] Currently, the equal protection security protection structure constructed by product systems such as VPN gateways, firewalls, intrusion detection, virus scanning, EDR / XDR, etc. cannot meet the current real - world requirements for data security. It is still powerless against attacks such as data extortion, data theft, supply chain backdoors, zero - day vulnerabilities, unauthorized operations, lateral movement, and social engineering. The market urgently needs innovative security products and technologies centered on "the integrated security of network security, system security, data security, and data applications" to escort the development of the new quality productivity of "data empowerment".

[0003] Zero Trust is a security model that continuously verifies and dynamically authorizes all users based on as many trust elements as possible, such as the identity of the access subject, the network environment, and the terminal status. Therefore, some technical solutions related to security control are based on the Zero Trust concept and perform real - time verification on behaviors such as business data, file access, and application execution. However, these solutions are traditional rule - management technologies that rely on prior experience to formulate a rule library. If the rules are not updated in a timely manner, unsafe behaviors will not be warned and blocked in a timely manner. Summary of the Invention

[0004] The technical problem to be solved by the present invention is: aiming at the technical problems existing in the prior art, the present invention provides an operating system security control method and system. Taking the host behavior model as the security baseline of the host system, in the operating system kernel layer, the compliance of various host behaviors is verified in real - time through the host behavior model, all unsafe behaviors are warned and blocked in a timely manner, and the host behavior model is updated through the obtained various host behaviors to form an operating system Zero Trust security kernel, greatly enhancing the security and robustness of the host system.

[0005] To solve the above - mentioned technical problems, the technical solution proposed by the present invention is:

[0006] An operating system security control method, comprising the following steps:

[0007] Capture all host behaviors in real - time in the operating system kernel layer, analyze and learn them, and then construct a host behavior model;

[0008] If a program starts or runs at the current moment, capture the corresponding host behavior in the operating system kernel layer, and use the host behavior model to verify the host behavior at the current moment. If the verification passes, allow the host behavior at the current moment; if the verification fails, block the host behavior at the current moment to achieve mandatory access control of the host behavior;

[0009] If the blocked host behavior meets the preset determination conditions, the host behavior model is updated using the blocked host behavior.

[0010] Furthermore, the host behavior model includes a program execution model, a data access model, a network communication model, and a user operation model. When continuously capturing all host behaviors and analyzing and learning them to build the host behavior model at the operating system kernel layer, it includes:

[0011] Obtain the paths, names, and feature information of all programs, and calculate the integrity check value for each program using the hash algorithm. By hooking the core calls of the operating system kernel, read the execution entity of the program by obtaining the program execution process information. Recursively associate the parent and child processes through the pid and ppid information of the current process to form a process flow, and list all the process flows involved in the program. Record the program path, name, feature information, integrity check value, execution entity, and process flow into the model rules of the program execution model;

[0012] By hooking the core calls of the operating system kernel, obtain the access program, access method, access path, access operation, and access entity of all data, and perform semantic analysis and generate fuzzy matching rules using regular expressions, and then record them into the model rules of the data access model;

[0013] By hooking the core calls of the operating system kernel, obtain the program to which all network communications belong, communication protocols, port information, communication methods, and communication entities. Analyze through network port monitoring and kernel association information, and record them into the model rules of the network communication model;

[0014] Obtain the operating system's internal history file history. By hooking the core calls of the operating system kernel, obtain the logged-in username, login identity, and operation characteristics of the user operation, and record them into the model rules of the user operation model.

[0015] Furthermore, after building the host behavior model, it also includes the step of adjusting the model rules. Specifically, the model rules are adjusted through the configuration of the security administrator. The adjustments include, but are not limited to: adding rules, deleting rules, modifying rules, backing up rules, restoring rules, or one or more of them.

[0016] Furthermore, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the verification steps when the program starts, including:

[0017] Obtain the path and name of the executing program, as well as the feature information. Calculate the program integrity verification value through the hash algorithm. By hooking the core calls of the operating system kernel, read the execution subject of the program execution process. Through the pid and ppid information of the current executing program process, recursively associate the parent and child processes to obtain the startup process flow;

[0018] Adopt the hash matching method to match the path and name, feature information, execution subject, integrity verification value, and process flow of the started program with the data in the program execution model respectively. If each piece of information matches the same model rule, allow the program to execute; otherwise, alarm and prevent the program from executing.

[0019] Furthermore, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the steps of verifying user operations when the program starts, including:

[0020] Before the user operation is executed, obtain the historical file history in the operating system. By hooking the core calls of the operating system kernel, obtain the logged-in username, login identity, and operation characteristics of the user operation;

[0021] Match the logged-in username, login identity, and operation characteristics of the user operation with the data in the user operation model. If each piece of information matches the same model rule, allow the program to execute; otherwise, alarm in a timely manner and prevent the program from executing.

[0022] Furthermore, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the steps of verification during the program execution process, including:

[0023] By hooking the core calls of the operating system kernel, obtain the process information of other programs called during the program execution process, and obtain the execution subject of the other programs called. Through the pid and ppid information of the process, recursively associate the parent and child processes to form a process flow. Obtain the path and name, feature information of the other programs called during the program execution process. Calculate the program integrity verification value through the hash algorithm. Based on the model rules of the program execution model, successively perform hash matching on the various pieces of information of the other programs called during the program execution process and the various pieces of information of the executing program. If the associated various pieces of information of the other programs called match the same model rule, and the various pieces of information of the executing program match the same model rule, pass the verification and allow execution; if not, alarm and prevent execution;

[0024] By hooking the core calls of the operating system kernel, obtain the access programs, access methods, access paths, access operations, and access subjects of all data. After processing all the data access programs, access methods, access paths, access operations, and access subjects based on semantic analysis and regular expressions, match the model rules of the data access model. If all the information matches the same model rule, verify and allow the data access behavior. If not, alarm and prevent the data access action from being executed;

[0025] By hooking the core calls of the operating system kernel, obtain the programs to which all network communications belong, communication protocols, port information, communication methods, and communication subjects. Based on the model rules of the network communication model, perform hash matching on the information associated with the executed communication program. If all the information matches the same model rule, verify and allow the network communication behavior. If not, alarm and prevent the network communication behavior;

[0026] Obtain the history file history in the operating system. By hooking the core calls of the operating system kernel, obtain the logged-in user name, login identity, and operation characteristics of the user operation. Then compare and match the logged-in user name, login identity, and operation characteristics of the user operation with the model rules of the user operation model. If all the information matches the same model rule, verify and allow the execution. If not, alarm and prevent the execution.

[0027] Furthermore, after blocking the host behavior at the current moment, it further includes: caching the blocked host behavior as a candidate rule and waiting for confirmation by the security administrator; the preset determination conditions include but are not limited to: waiting for confirmation to time out, and the same blocked host behavior occurring regularly during the waiting for confirmation period; when updating the host behavior model with the blocked host behavior, specifically, it includes but is not limited to waiting for a specified duration, and then using the information of the blocked host behavior as new model rules in the corresponding host behavior model, and at the same time recording the host behavior model update event and notifying the security administrator in a timely manner.

[0028] The present invention also proposes an operating system security control system, including:

[0029] A host behavior model analysis and control module, which is used to capture all host behaviors in real time at the operating system kernel layer, analyze and learn them, and construct a host behavior model using the analysis and learning results of the host behaviors;

[0030] If a program starts or runs at the current moment, capture the corresponding host behavior at the operating system kernel layer, and use the host behavior model to verify the host behavior at the current moment. If the verification passes, allow the host behavior at the current moment. If the verification fails, block the host behavior at the current moment to achieve mandatory access control of the host behavior;

[0031] If the blocked host behavior meets the preset determination conditions, the host behavior model is updated using the blocked host behavior.

[0032] Furthermore, it also includes a network boundary protection module. The network boundary protection module forms network boundary protection through network port anti-scanning, anti-brute force cracking, anti-DDOS and random IP DDOS, network firewall, VPN, IPS, and IDS, providing the first layer of network protection for the host system. The host behavior model analysis and control module forms endogenous security protection for network behavior through host behavior analysis and control, providing the second layer of network protection for the host system.

[0033] Furthermore, it also includes a configuration management module, a log management module, a self-system protection module, an emergency response module, and an upgrade management module, where:

[0034] The configuration management module realizes security administrator authentication, host behavior model configuration management, and network boundary protection configuration management;

[0035] The log management module realizes the log collection and management of the entire system;

[0036] The self-system protection module realizes the security protection of the operating system security control system itself;

[0037] The emergency response module realizes emergency alarm processing;

[0038] The upgrade management module realizes system upgrade management.

[0039] Compared with the prior art, the advantages of the present invention are as follows:

[0040] The present invention takes the host behavior model as the security baseline of the host system. At the operating system kernel layer, zero-trust mandatory access control of "never trust, continuously verify, and minimum authorization" is implemented for host behaviors such as program execution, data access, network communication, and user operations. The compliance of all host behaviors is verified in real time according to the host behavior model, and all insecure behaviors are timely warned and blocked. Moreover, for the host behaviors that fail the verification, the host behavior model is updated with them under the condition of meeting the requirements, realizing the dynamic update of the host behavior model, and then forming a zero-trust security kernel of the operating system, greatly enhancing the security and robustness of the host system. At the same time, the present invention also proposes an operating system security control system, which integrates functions such as zero-trust mandatory access control of host behavior based on the host behavior model, network protection function, configuration management function, log management function, self-protection function, emergency response function, and upgrade management function, providing all-round protection for the security of the host system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Flowchart of the operating system security control method according to an embodiment of the present invention.

[0042] Figure 2 Schematic diagram of the program execution model in an embodiment of the present invention.

[0043] Figure 3 Schematic diagram of the method for generating the program execution model in an embodiment of the present invention.

[0044] Figure 4 Schematic diagram of the data access model in an embodiment of the present invention.

[0045] Figure 5 Schematic diagram of the method for generating the data access model in an embodiment of the present invention.

[0046] Figure 6 Schematic diagram of the network communication model in an embodiment of the present invention.

[0047] Figure 7 Schematic diagram of the method for generating the network communication model in an embodiment of the present invention.

[0048] Figure 8 Schematic diagram of the user operation model in an embodiment of the present invention.

[0049] Figure 9 Schematic diagram of the method for generating the user operation model in an embodiment of the present invention.

[0050] Figure 10 Flowchart of the program forced verification and control during startup according to an embodiment of the present invention.

[0051] Figure 11 Flowchart of the user operation forced verification and control during startup according to an embodiment of the present invention.

[0052] Figure 12 Flowchart of the program execution forced behavior analysis and control during runtime according to an embodiment of the present invention.

[0053] Figure 13 Flowchart of the data access forced behavior analysis and control during runtime according to an embodiment of the present invention.

[0054] Figure 14 Flowchart of the network communication forced behavior analysis and control during runtime according to an embodiment of the present invention.

[0055] Figure 15 Flowchart of the user operation forced behavior analysis and control during runtime according to an embodiment of the present invention.

[0056] Figure 16 System architecture diagram of the operating system security control according to an embodiment of the present invention.

[0057] Figure 17This is the startup flowchart of the operating system security control system in the embodiments of the present invention.

[0058] Figure 18 This is the upgrade flowchart of the operating system security control system in the embodiments of the present invention.

[0059] Figure 19 This is the schematic diagram of the network protection solution for the operating system security control system in the embodiments of the present invention. Detailed implementation manners

[0060] The present invention will be further described below in conjunction with the accompanying drawings of the specification and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

[0061] Embodiment 1:

[0062] In this embodiment, an operating system security control method is provided. The host behavior model is used as the security baseline of the host system. At the operating system kernel layer, zero-trust mandatory access control of "never trust, continuously verify, and minimum authorization" is adopted for host behaviors such as program execution, data access, network communication, and user operations.

[0063] As Figure 1 shown, the method of this embodiment includes the following steps:

[0064] S101) Model learning stage: All host behaviors are captured in real time at the operating system kernel layer and analyzed and learned to construct a host behavior model.

[0065] In the model learning stage, the model automatically generates rules according to the learning situation and supplements them into a complete model. Specifically, by hooking the core calls of the operating system kernel, host behaviors are captured at the operating system kernel layer, and the captured behavior information is associated with information such as socket id, fd, pid, ppid, uid, tid, username, and timestamp to establish a host behavior model. The hosts include: cloud platforms, servers and clusters, PCs, embedded computers, single-chip microcomputers, information processing terminals / modules, virtual machines, and containers. The host behaviors include: program execution, data access, network communication, and user operations.

[0066] S102) Model control stage, including:

[0067] If a program starts or runs at the current moment, the corresponding host behavior is captured at the operating system kernel layer, and the host behavior model is used to verify the host behavior at the current moment. Specifically, by hooking the core calls of the operating system kernel, zero-trust mandatory access control is implemented for the host behavior based on the host behavior model at the operating system kernel layer.

[0068] If the verification passes, the host behavior at the current moment is allowed; if the verification fails, the host behavior at the current moment is blocked, so as to implement mandatory access control over the host behavior;

[0069] If the blocked host behavior meets the preset judgment conditions, the blocked host behavior is used to update the host behavior model, so that the host behavior model continuously learns and evolves as the system runs.

[0070] The following specifically describes the relevant content.

[0071] In this embodiment, the host behavior model includes a program execution model, a data access model, a network communication model, and a user operation model.

[0072] The program execution model in this embodiment is as Figure 2 shown, and its model rules include: the path and name of the program, feature information, integrity check value, execution subject, process flow. Among them, the feature information includes: creator, owner, permission, creation time, modification time, size, etc. The process flow specifically refers to the complete associated program process call relationship flow during the startup and execution of the program, including: startup process flow, execution process flow. The execution subject includes: the subject to which it belongs, the user to which it belongs, the group to which it belongs, the network identity to which it belongs. Among them, the subject to which it belongs includes: host, virtual machine, container, etc., and the network identity to which it belongs includes: local user, remote user address and port.

[0073] Based on the model rules of the program execution model, when continuously capturing all host behaviors at the operating system kernel layer and analyzing and learning to build the host behavior model, the specific method for establishing the program execution model is as Figure 3 shown, including the following steps:

[0074] S201) Conduct a comprehensive scan of the host system, and obtain the paths and names, feature information of all programs inside the host system by reading program information, and record them into the corresponding model rules in the program execution model;

[0075] S202) Conduct a comprehensive scan of the host system, and calculate the integrity check value for each program inside the host system using the SM3 algorithm, and record it into the corresponding model rules in the program execution model. It should be noted that the integrity check value can also be obtained by other hash calculations such as SHA1 / SHA256 / SHA384 / SHA512 / MD5;

[0076] S203) By adopting the method of hooking the core calls of the operating system kernel, read the program execution process information to obtain the execution entity of the program. Recursively associate the parent and child processes through the pid and ppid information of the current process to form a process flow. Enumerate all the process flows involved in the program and include them together with the execution entity of the program into the corresponding model rules in the program execution model. In this embodiment, the operating system uses the Linux operating system. Therefore, when establishing the program execution model, hooking the core calls of the operating system kernel specifically adopts the method of hooking the execve core call of the kernel. Forming a process flow specifically means obtaining the execution entity of the program by reading the program execution process information, combining with the extension of the struct task_struct kernel data structure, and recursively associating the parent and child processes through the pid and ppid information of the current process to form a process flow.

[0077] The data access model in this embodiment is as Figure 4 shown, and its model rules include: the access program, access method, access path, access operation, and access entity of the data. Among them, the access method includes: local user operation access, remote user operation access, local program access, and remote program access. The access path includes: complete data path, wildcard data path. The wildcard data path refers to a data path with wildcards for fuzzy matching of regular expressions. The access operation includes: read, write, delete, move, etc. The access entity includes: the belonging entity, belonging user, belonging group, and belonging network identity. Among them, the belonging entity includes: host, virtual machine, container, etc. The belonging network identity includes: local user, remote user address and port.

[0078] Based on the model rules of the data access model, when continuously capturing all host behaviors at the operating system kernel layer and analyzing and learning them to build a host behavior model, the specific method for establishing the data access model is as Figure 5 shown, including:

[0079] By adopting the method of hooking the core calls of the operating system kernel, obtain the access program, access method, access path, access operation, and access entity of all data, and perform semantic analysis and generate fuzzy matching rules for regular expressions, and then include them in the model rules of the data access model.

[0080] In this embodiment, the operating system uses the Linux operating system. Therefore, when establishing the data access model, hooking the core calls of the operating system kernel specifically uses hooking methods for core calls such as open, write, rename, unlink, access, and stat of the Linux operating system kernel to obtain the access programs, access methods, access paths, access operations, and access subjects of all data during program execution. Additionally, it should be noted that how to perform semantic analysis and fuzzy matching of regular expressions based on semantic analysis and fuzzy matching techniques of regular expressions is a method well-known to those skilled in the art, and will not be elaborated in this embodiment.

[0081] In this embodiment, by continuously obtaining the access programs, access methods, access paths, access operations, and access subjects of all data, performing semantic analysis and fuzzy matching of regular expressions, and then incorporating them into the model rules of the data access model, continuous analysis and learning of data access behaviors within the host system are achieved.

[0082] The network communication model of this embodiment is as Figure 6 shown, and its model rules include: the program to which the network communication belongs, communication protocols, port information, communication methods, and communication subjects. Among them, the communication protocols include: TCP, UDP, ICMP, IGMP, etc.; the port information includes: source IP, destination IP, source port number, destination port number, etc.; the communication methods include: passive response communication, active access communication; the communication subjects include: the subject to which it belongs, the user to which it belongs, the group to which it belongs, and the network identity to which it belongs. Among them, the subject to which it belongs includes: host, virtual machine, container, etc., and the network identity includes: local user, remote user address and port.

[0083] Based on the model rules of the network communication model, when continuously capturing all host behaviors at the operating system kernel layer and analyzing and learning them to build a host behavior model, the specific method for establishing the network communication model is as Figure 7 shown, and includes:

[0084] By hooking the core calls of the operating system kernel, obtain the program to which all network communications belong, communication protocols, port information, communication methods, and communication subjects, and through network port monitoring and analysis of kernel association information, incorporate them into the model rules of the network communication model.

[0085] In this embodiment, the operating system uses the Linux operating system. Therefore, when establishing the network communication model, hooking the core calls of the operating system kernel specifically adopts the core call methods of hooking the socket, connect, bind, send, recv, etc. of the operating system kernel to obtain the program to which all network communications belong during program execution, communication protocols, port information, communication methods, and communication entities. Additionally, it should be noted that the methods for network port monitoring and kernel association information analysis of the program to which the network communication belongs, communication protocols, port information, communication methods, and communication entities are well-known to those skilled in the art and will not be elaborated in this embodiment.

[0086] In this embodiment, by continuously obtaining the program to which all network communications belong, communication protocols, port information, communication methods, and communication entities for network port monitoring and kernel association information analysis and then incorporating them into the model rules of the network communication model, continuous analysis and learning of the communication behaviors of all programs within the host system are achieved.

[0087] The user operation model of this embodiment is as Figure 8 shown, and its model rules include: the logged-in username of the operation, login identity, and operation characteristics. Among them, the login identity includes: local user, remote user address and port, and the operation characteristics include: operating username, operation time period, and operation command set. The operation time period is segmented by working / idle, morning / afternoon, and / or specific time points.

[0088] Based on the model rules of the user operation model, when continuously capturing all host behaviors at the operating system kernel layer and analyzing and learning them to build the host behavior model, the specific method for establishing the user operation model is as Figure 9 shown, including:

[0089] Obtain the history file history in the operating system. By hooking the core calls of the operating system kernel, obtain the logged-in username, login identity, and operation characteristics of the user operation, and incorporate them into the model rules of the user operation model.

[0090] In this embodiment, the operating system uses the Linux operating system. Therefore, when establishing the user operation model, hooking the core calls of the operating system kernel specifically adopts the hook of the execve core call of the operating system kernel, and by combining the corresponding information in the history file history in the operating system, all user operation behaviors of the host system can be obtained. Through continuous monitoring and analysis of user operations, continuous analysis and learning of user operation behaviors are achieved.

[0091] After the host behavior model is established through the above steps and already includes the automatically generated model rules, considering that the user needs to confirm the model rules, therefore, in step S101, after constructing the host behavior model, it also includes the step of adjusting the model rules. Specifically, the model rules are adjusted through the user's configuration, and the adjustments include one or more of adding rules, deleting rules, modifying rules, backing up rules, and restoring rules.

[0092] In step S102 of this embodiment, when the host behavior model controls the host behavior, similar means are adopted to extract the characteristics of the host behavior and then match them with the model rules. For behaviors that conform to the model rules (that is, all the characteristics of a host behavior match the same model rule), they are allowed to pass. For behaviors that violate the model rules (that is, in all the characteristics of a host behavior, there is a situation where there is no matching result or different characteristics match different model rules), an alarm is given to block them.

[0093] To ensure pre-blocking before the program runs, in step S102 of this embodiment, mandatory access control includes: mandatory verification and control at startup and mandatory behavior analysis and control during runtime.

[0094] Based on the above content, in step S102 of this embodiment, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the step of verification at program startup, as Figure 10 shown, including:

[0095] S301) When the program starts, obtain the path and name, feature information of the executing program. At the same time, calculate the program integrity verification value through the SM3 algorithm. By the way of hooking the core calls of the operating system kernel, specifically, adopt the way of hooking the execve core call of the Linux operating system kernel to read the execution process information of the executing program to obtain the execution subject of the executing program. Through the obtained program information combined with the struct task_struct kernel data structure extension, recursively associate the pid and ppid information of the current executing program process to obtain the startup process flow. It should be noted that the integrity verification value can also be obtained by other hash calculations such as SHA1 / SHA256 / SHA384 / SHA512 / MD5, etc.;

[0096] S302) In the operating system kernel, based on the program execution model, verify each parameter in the executing program. Specifically, adopt the hash matching method to match the path and name, feature information, execution subject, integrity verification value, and process flow of the started program with the data in the program execution model respectively. If all the information matches the same model rule, the program execution is allowed to pass. Otherwise, an alarm is given in time and the program execution is blocked.

[0097] In step S102 of this embodiment, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the steps of verifying user operations when the program starts, such as Figure 11 shown, including:

[0098] S401) Before the user operation is executed, by monitoring the change of the history file in the operating system, reading the user operation record, obtaining the operation characteristics of the user operation, and by hooking the core call of the operating system kernel, hooking the execve core call of the operating system kernel, obtaining the logged-in username and login identity of the user operation;

[0099] S402) Based on the user operation model, verify the user operation behavior. Specifically, match and verify the logged-in username, login identity, and operation characteristics of the user operation with the data in the user operation model. For example, compare the operating username of the user operation, the operation time period, and whether it is within the operation command set. If all information matches the same model rule, release the program for execution, otherwise, alarm in time and prevent the program from executing.

[0100] For the analysis and control of forced behaviors during runtime, in step S102 of this embodiment, when capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, it includes the steps of verification during the program execution process, including:

[0101] Analysis and control of forced behaviors during program execution at runtime: such as Figure 12 shown, by hooking the core call of the operating system kernel, specifically by using the method of hooking the execve core call of the Linux operating system kernel to obtain the process information of the program called during the program execution process, and obtaining the execution subject of the other program called. Recursively associate the parent and child processes through the pid and ppid information of the process to form a process flow, obtain the path, name, and characteristic information of the other program called, calculate the program integrity verification value through the hash algorithm, and based on the model rules of the program execution model, successively perform hash matching on the information of the other program called during the program execution process and the information of the executing program. If the associated information of the other program called matches the same model rule, and the information of the executing program matches the same model rule, it passes the verification and is released for execution. If not, alarm and prevent the execution; in this embodiment, the SM3 algorithm is used for hash matching of the information associated during the program execution process. It should be noted that other hash calculations such as SHA1 / SHA256 / SHA384 / SHA512 / MD5 can also be used for hash matching;

[0102] Analysis and control of forced behaviors in runtime data access: As Figure 13 shown, by hooking the core calls of the operating system kernel, specifically by hooking the core calls such as open, write, rename, unlink, access, stat, etc. of the Linux operating system kernel, the access programs, access methods, access paths, access operations, and access subjects of all data are obtained. After semantic analysis and regular expression processing of all data access programs, access methods, access paths, access operations, and access subjects, the model rules of the data access model are matched. If all information matches the same model rule, the data access behavior is verified and allowed. If not, an alarm is issued and the data access action is blocked;

[0103] Analysis and control of forced behaviors in runtime network communication: As Figure 14 shown, by hooking the core calls of the operating system kernel, specifically by hooking the core calls such as socket, connect, bind, send, recv, etc. of the Linux operating system kernel, the programs to which all network communications belong, communication protocols, port information, communication methods, and communication subjects are obtained. Based on the model rules of the network communication model, hash matching is performed on the information associated with the executed communication program. If all information matches the same model rule, the network communication behavior is verified and allowed. If not, an alarm is issued and the network communication behavior is blocked; In this embodiment, hash matching is performed on the information associated with the executed communication program using the SM3 algorithm. It should be noted that other hash calculations such as SHA1 / SHA256 / SHA384 / SHA512 / MD5 can also be used for hash matching.

[0104] Analysis and control of forced behaviors in runtime user operations: As Figure 15 shown, the historical file history in the operating system is obtained. By hooking the core calls of the operating system kernel, specifically by hooking the core call execve of the operating system kernel, the logged-in user name, login identity, and operation characteristics of the user operation are obtained. Then, the logged-in user name, login identity, and operation characteristics of the user operation are compared and matched with the model rules of the user operation model. If all information matches the same model rule, the execution is verified and allowed. If not, an alarm is issued and the execution is blocked.

[0105] In step S102 of this embodiment, after blocking the host behavior at the current moment, it further includes: caching the blocked host behavior as a candidate rule and waiting for user confirmation; the preset determination condition includes: timing out waiting for user confirmation, and the same blocked host behavior occurring regularly during the waiting for user confirmation; when updating the host behavior model with the blocked host behavior, specifically, after waiting for a specified duration, each piece of information of the blocked host behavior is used as a new model rule in the corresponding host behavior model, and at the same time, the host behavior model update event is recorded and the security administrator is notified in a timely manner.

[0106] Through the above steps, in the model management and control stage, while alarming and blocking the host behavior that violates the model, this behavior will be added to the model candidate rules and wait for user confirmation. If the user does not confirm for a long time, and at the same time this host behavior event that violates the model occurs regularly (this generally has a relatively low risk, and there are other determination conditions), therefore, the method of this embodiment will automatically add it to the model as a new model rule after a period of time (which can be configured by the security administrator), achieving the purpose of automatic model evolution.

[0107] Embodiment 2:

[0108] This embodiment specifically proposes an operating system security management and control system in combination with the Linux kernel operating system. It should be noted that it can also be implemented in combination with other types of operating systems such as Windows and MacOS.

[0109] As Figure 16 shown, the system of this embodiment integrates a host behavior model analysis and control module, a network boundary protection module, a configuration management module, a log management module, a self-system protection module, an emergency response module, and an upgrade management module. Among them:

[0110] The host behavior model analysis and control module realizes the establishment of the host behavior model, zero-trust mandatory access control for host behavior, records the host behavior analysis and control log, and is implemented at the operating system kernel layer by using the method of hooking the core calls of the Linux operating system kernel. The core calls include but are not limited to open, write, rename, unlink, access, stat, socket, connect, bind, send, recv, execve, kill, get_dents, get_sock_name, etc.;

[0111] The network boundary protection module implements network boundary protection for the host system, and cooperates with the host behavior model analysis and control module to enhance the network security of the host system. Specifically, it includes: implementing network port anti-scanning, anti-DDOS and random IP DDOS based on netfilter and netlink, implementing anti-brute force cracking and network firewall based on iptables, implementing VPN based on wireguard, iptables and netlink, implementing IPS and IDS based on suricata, and recording network boundary protection logs;

[0112] The configuration management module implements security administrator authentication, host behavior model configuration management, network boundary protection configuration management, and records configuration management logs. The security administrator authentication adopts the password authentication method. The host behavior model configuration management includes adding, deleting, modifying, backing up, and restoring model rules. The network boundary protection configuration management includes black and white list configuration, enabling / disabling protection function items, configuration backup, and restoration;

[0113] The log management module implements the log collection and management of the entire system. Specifically, it includes: log collection and management of the host behavior model analysis and control module, log collection and management of the network boundary protection module, log collection and management of the configuration management module, log collection and management of the self-system protection module, log collection and management of the emergency response module, and log collection and management of the upgrade management module;

[0114] The self-system protection module implements the security protection of the operating system security control system itself. Specifically, it includes: encrypted storage and expansion of the host behavior model analysis and control module, encrypted storage and expansion of the network boundary protection module, encrypted storage and expansion of the configuration management module, encrypted storage and expansion of the upgrade management module, and records self-system protection logs. The encrypted storage and expansion adopt the SM4 algorithm and are bound based on the host physical information. In this embodiment, the binding based on the host physical information means that storage physical address, disk information, host MAC and other host physical information amounts are introduced to participate in the calculation during the encrypted storage and expansion process to achieve host binding. It should be noted that other cryptographic algorithms such as DES / AES can also be used for encrypted storage and expansion. Any information that can uniquely confirm the host identity belongs to the host physical information;

[0115] The emergency response module implements emergency alarm processing. The emergency alarm includes: recording logs, pushing text messages, pushing emails, and / or sending system messages, and supports setting different warning levels, warning configurations, and warning methods;

[0116] The upgrade management module implements system upgrade management and records system upgrade logs.

[0117] Among them, the steps for the host behavior model analysis and control module to establish the host behavior model and enforce zero-trust access control on host behavior include:

[0118] The host behavior model analysis and control module is used to capture all host behaviors in real time at the operating system kernel layer, analyze and learn them, and construct a host behavior model using the analysis and learning results of the host behaviors;

[0119] If a program starts or runs at the current moment, capture the corresponding host behavior at the operating system kernel layer, verify the host behavior at the current moment using the host behavior model. If the verification passes, allow the host behavior at the current moment; if the verification fails, block the host behavior at the current moment to enforce access control on host behavior;

[0120] If the blocked host behavior meets the preset determination conditions, update the host behavior model using the blocked host behavior.

[0121] As Figure 17 shown, the startup process of the operating system security control system in this embodiment includes the following steps:

[0122] When the operating system starts, the log management module, the emergency response module, and the self-system protection module are started in sequence;

[0123] The self-system protection module decrypts and starts the host behavior model analysis and control module, the network boundary protection module, the configuration management module, and the upgrade management module in sequence using the SM4 algorithm. It should be noted that other cryptographic algorithms such as DES / AES can also be used for decryption by the self-system protection module.

[0124] As Figure 18 shown, the operating system security control system in this embodiment is upgraded using the SM4 algorithm encryption method. It should be noted that other cryptographic algorithms such as DES / AES can also be used. The specific upgrade process includes the following steps:

[0125] The service provider of the operating system security control system prepares the upgrade package content, which includes: upgrade package integrity verification, upgrade backup, and function upgrade content. The function upgrade content includes: new functions, replacing original functions, and deleting functions;

[0126] Generate an encrypted system upgrade package using the SM4 algorithm and the upgrade key of the recorded upgrade management module and distribute it;

[0127] The upgrade management module decrypts the upgrade package using the SM4 algorithm according to the upgrade key and verifies the integrity of the upgrade package. If it passes, the upgrade is carried out; if it fails, the upgrade stops. The upgrade key is pre-placed in the upgrade management module and is encrypted and stored together with the upgrade management module when stored. The upgrade key is updated after each upgrade;

[0128] The upgrade adopts a backup upgrade method, specifically: first, back up the upgrade to the local and record the upgrade mark, then perform the function upgrade. If special situations such as power failure occur during the upgrade process, after the system restarts, check the upgrade mark and automatically continue the upgrade using the backup content.

[0129] As Figure 19 As shown, the operating system security control system of this embodiment combines the network boundary protection module and the host behavior model analysis and control module to comprehensively enhance the network security of the host system from two aspects of boundary security and endogenous security. The specific working mode is as follows:

[0130] The network boundary protection module forms a network boundary protection through network port anti-scanning, anti-brute force cracking, anti-DDOS and random IP DDOS, network firewall, VPN, IPS, and IDS, providing the first layer of network protection for the host system;

[0131] The host behavior model analysis and control module forms an endogenous security protection of network behavior through host behavior analysis and control, providing the second layer of network protection for the host system.

[0132] In summary, the present invention takes the host behavior model as the security baseline of the host system. At the operating system kernel layer, it adopts zero-trust mandatory access control of "never trust, continuously verify, and minimum authorization" for host behaviors such as program execution, data access, network communication, and user operations. It verifies the compliance of all host behaviors in real time according to the host behavior model, warns and blocks all unsafe behaviors in a timely manner, greatly enhancing the security and robustness of the host system. At the same time, the operating system security control system integrates functions such as zero-trust mandatory access control of host behaviors based on the host behavior model, network protection function, configuration management function, log management function, self-protection function, emergency response function, and upgrade management function, providing all-round protection for the host system security.

[0133] The above is only a preferred embodiment of the present invention and does not impose any form of limitation on the present invention. Although the present invention has been disclosed above with the preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change, and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for operating system security management and control, characterized in that: The following steps are involved: Capture all host behaviors in real time at the operating system kernel layer and build a host behavior model after analyzing and learning; If a program is started or running at the current moment, the corresponding host behavior is captured at the operating system kernel layer, and the host behavior model is used to verify the host behavior at the current moment. If the verification passes, the host behavior at the current moment is allowed. If the verification fails, the host behavior at the current moment is blocked, so as to implement mandatory access control on the host behavior; If the blocked host behavior meets the preset determination condition, the blocked host behavior is used to update the host behavior model.

2. The operating system security management and control method according to claim 1, characterized in that: The host behavior model includes a program execution model, a data access model, a network communication model, and a user operation model. When the host behavior model is constructed after continuously capturing all host behaviors and analyzing and learning at the operating system kernel layer, it includes: Obtain the paths, names, and feature information of all programs, and use a hash algorithm to calculate the integrity check value for each program. By hooking the core call of the operating system kernel, read the program execution process information to obtain the program execution subject. Recursively associate the parent and child processes through the pid and ppid information of the current process to form a process flow, and list all process flows involved in the program. The program's path, name, feature information, integrity check value, execution subject, and process flow are included in the model rules of the program execution model. By hooking the core call of the operating system kernel, the access program, access method, access path, access operation, and access subject of all data are obtained, and semantic analysis and regular expression fuzzy matching rule generation are performed, and then included in the model rules of the data access model; By hooking the kernel call of the operating system, the programs, communication protocols, port information, communication methods, and communication subjects of all network communications are obtained. Through network port monitoring and kernel related information analysis, the information is included in the model rules of the network communication model. Get the history file history in the operating system, and obtain the login user name, login identity, and operation characteristics of the user operation by hooking the core call of the operating system kernel, and include them in the model rules of the user operation model.

3. The operating system security management and control method according to claim 2, characterized in that: After building the host behavior model, the step of adjusting the model rules is also included. Specifically, the model rules are adjusted through configuration by the security administrator. The adjustment includes: adding rules, deleting rules, modifying rules, backing up rules, and restoring rules. One or more of the following.

4. The operating system security management and control method according to claim 2, characterized in that: Capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, including the verification steps when the program is started, includes: Obtain the path, name, and feature information of the execution program, calculate the program integrity check value through the hash algorithm, read the program execution process information by hooking the core call of the operating system kernel, and obtain the execution subject of the execution program. Through the pid and ppid information of the current execution program process, recursively associate the parent and child processes to obtain the startup process flow; Using hash matching, the path and name of the started program, feature information, execution subject, integrity check value, and process flow are matched with the data in the program execution model. If all the information matches the same model rule, the program execution is released; otherwise, an alarm is issued and the program execution is blocked.

5. The operating system security management and control method according to claim 4, characterized in that: Capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, including the steps of user operation verification when the program is started, includes: Before the user operation is performed, the history file history in the operating system is obtained, and the login user name, login identity, and operation characteristics of the user operation are obtained by hooking the core call of the operating system kernel; Match the user's login username, login identity, and operation characteristics with the data in the user operation model. If all the information matches the same model rules, the program will be allowed to execute. Otherwise, an alarm will be issued in time and the program execution will be blocked.

6. The operating system security management and control method according to claim 2, characterized in that: When capturing the corresponding host behavior at the operating system kernel layer and using the host behavior model to verify the host behavior at the current moment, the verification steps during program execution include: By hooking the core call of the operating system kernel, the process information of calling other programs during the program execution is obtained, and the execution subject of other called programs is obtained. The parent and child processes are recursively associated through the pid and ppid information of the process to form a process flow, and the path, name and feature information of other called programs are obtained. The program integrity check value is calculated through the hash algorithm. Based on the model rules of the program execution model, the various information of other programs called during the program execution and the various information of the executed program are hash matched in turn. If the associated various information of other called programs matches the same model rule, and the various information of the executed program matches the same model rule, it passes the verification and is released for execution. If it does not match, an alarm is issued and the execution is blocked; By hooking the core call of the operating system kernel, the access programs, access methods, access paths, access operations, and access subjects of all data are obtained. After semantic analysis and regular expression processing are performed on all data access programs, access methods, access paths, access operations, and access subjects, the model rules of the data access model are matched. If all information matches the same model rule, the data access behavior is released after verification. If it does not match, an alarm is issued and the data access action is blocked; By hooking the core call of the operating system kernel, the programs, communication protocols, port information, communication methods, and communication subjects of all network communications are obtained. Based on the model rules of the network communication model, hash matching is performed on various information associated with the executed communication program. If various information matches the same model rule, the network communication behavior is verified and released. If it does not match, an alarm is issued and the network communication behavior is blocked; Get the history file history in the operating system, and obtain the login username, login identity, and operation characteristics of the user operation by hooking the core call of the operating system kernel. Then compare the login username, login identity, and operation characteristics of the user operation with the model rules of the user operation model. If all the information matches the same model rule, it passes the verification and is released for execution. If it does not match, an alarm will be issued and the execution will be blocked.

7. The operating system security management and control method according to claim 1, characterized in that: After blocking the host behavior at the current moment, it also includes: caching the blocked host behavior as a candidate rule and waiting for confirmation by the security administrator; the preset judgment conditions include: waiting for confirmation timeout, and the same blocked host behavior occurs regularly during the waiting period for confirmation; when using the blocked host behavior to update the host behavior model, specifically after waiting for a specified period of time, the various information of the blocked host behavior is used as the new model rule in the corresponding host behavior model, and the host behavior model update event is recorded and the security administrator is notified in a timely manner.

8. An operating system security management and control system, characterized in that: include: The host behavior model analysis and control module is used to capture all host behaviors in real time at the operating system kernel layer and analyze and learn them, and use the analysis and learning results of the host behaviors to build a host behavior model; If a program is started or running at the current moment, the corresponding host behavior is captured at the operating system kernel layer, and the host behavior model is used to verify the host behavior at the current moment. If the verification passes, the host behavior at the current moment is allowed. If the verification fails, the host behavior at the current moment is blocked, so as to implement mandatory access control on the host behavior; If the blocked host behavior meets the preset determination condition, the blocked host behavior is used to update the host behavior model.

9. The operating system security management and control system according to claim 8, characterized in that: It also includes a network boundary protection module, which forms network boundary protection through network port anti-scanning, anti-brute force cracking, anti-DDOS and random IP DDOS, network firewall, VPN, IPS, IDS, and provides a first layer of network protection for the host system. The host behavior model analysis and control module forms an intrinsic security protection of network behavior through host behavior analysis and control, and provides a second layer of network protection for the host system.

10. The operating system security management and control system according to claim 8, characterized in that: It also includes configuration management module, log management module, self-system protection module, emergency response module, and upgrade management module, among which: The configuration management module implements security administrator authentication, host behavior model configuration management, and network boundary protection configuration management; The log management module realizes log collection and management of the entire system; The self-system protection module realizes the self-security protection of the operating system security management and control system; The emergency response module implements emergency alarm processing; The upgrade management module implements system upgrade management.

Images