A process monitoring improvement method and device for system dynamic measurement function

Abstract

The present invention proposes an improved process monitoring method and device for a system with dynamic measurement functions, comprising: constructing a kernel-state dynamic measurement function component, the kernel-state dynamic measurement function component including a policy library and a benchmark library; when a measurement task is initiated, traversing all process lists in the system through the kernel-state dynamic measurement function component to detect whether the main executable file corresponding to the current process is in the measurement policy list; traversing the virtual machine (VM) list of the current process, checking whether each VM has a benchmark value stored in the benchmark library, measuring the VM hash value and comparing it with the benchmark value; if a match is found, traversing the next VM; if a match is found, making a decision based on the measurement policy; traversing the next process in the process list until the process list is completely traversed. The present invention issues policies to the process subject and uses the entire process as the measurement target, solving the problems of missed measurements and the inability to prove the actual credibility of the monitored process.

Description

Technical Field

[0001] The present invention belongs to the field of computer information technology, and in particular relates to a process monitoring improvement method and device for a system dynamic measurement function. Background Art

[0002] With the rapid advancement of technology, hacking techniques are constantly evolving and upgrading. Today, more and more hackers are no longer relying on traditional file replacement methods to carry out attacks. Instead, they are focusing on exploiting system vulnerabilities and invading systems by directly modifying data in memory. This attack method is more covert and efficient, posing unprecedented challenges to system security. To address this new threat, host protection technology must be continuously improved to effectively deal with complex and diverse attack methods and ensure system security and stability. With the rapid advancement of technology, hacking techniques are constantly evolving and upgrading. Today, more and more hackers are no longer relying on traditional file replacement methods to carry out attacks. Instead, they are focusing on exploiting system vulnerabilities and invading systems by directly modifying data in memory. This attack method is more covert and efficient, posing unprecedented challenges to system security. To address this new threat, host protection technology must be continuously improved to effectively deal with complex and diverse attack methods and ensure system security and stability.

[0003] Dynamic measurement is a method that periodically performs hash checks on read-only data and code segments of running processes. This strengthens monitoring of critical software processes in the system and can shut down maliciously tampered processes based on policy configuration, thereby improving overall system security and mitigating the threat of hacker attacks.

[0004] Currently, dynamic metrics primarily check the VMA (virtual memory address) mappings of the code and read-only data segments of the ELF file specified in the policy configuration to determine whether a process has been compromised. If a change in the metric value of the mapped memory segment is detected, an alarm is generated or the abnormal process is terminated.

[0005] However, existing dynamic measurement schemes have logical contradictions that need to be resolved:

[0006] Because process operation relies on executable files and dynamic libraries, the corresponding segments of each dynamic library and executable file are maintained separately in the process, and the dynamic libraries used by the program are not all loaded at once. This results in the absence of an exact node to guarantee that no new dynamic library code segments or read-only data segments will be added to the process later. In some existing dynamic measurement designs, all measurement baseline values ​​are calculated at a specific time node and used as the measurement baseline for the subsequent process. This method has a logical fallacy in time, which makes it impossible for the dynamic measurement task to monitor the tampering of dynamic library code segments and read-only data segments after the process baseline value is captured, resulting in measurement omissions.

[0007] To address this issue, existing designs measure ELF segments. This approach only measures the VMAs of dynamic libraries or executable files added to the measurement policy, rather than measuring all critical segments of the entire process. This still leaves room for missed detections. For example, if the VMAs of dynamic library X in process A are tampered with, the VMAs of dynamic library X in process B remain unchanged due to the copy-on-write mechanism between processes. This demonstrates that tampering with the VMAs of dynamic library X in process A does not necessarily mean that all VMAs corresponding to dynamic library X have been modified.

[0008] In summary, under the existing dynamic measurement design state, the failure to detect tampering anomalies cannot prove that the monitored object has not actually been tampered with in its memory state, that is, it cannot prove the actual credibility of the monitored process. Summary of the Invention

[0009] The purpose of the present invention is to provide an improved process monitoring method and device for the dynamic measurement function of the system, which issues policies to the process subject and takes the entire process as the measurement target, thereby solving the problems of measurement omissions and inability to prove the actual credibility of the monitored process in the existing dynamic measurement function.

[0010] In order to achieve the above object, the technical solution of the present invention is as follows:

[0011] A method for improving process monitoring of a system's dynamic measurement function, comprising:

[0012] S1. Construct a kernel-state dynamic measurement function component, wherein the kernel-state dynamic measurement function component includes a policy library and a benchmark library; the benchmark library is used to store benchmark values ​​of memory vma mappings related to code segments of executable program files and dynamic libraries; the policy library is used to store measurement policies, which include unique identification information of the main executable file of the process;

[0013] S2. When the measurement task is started, the kernel state dynamic measurement function component traverses the entire process list in the system to detect whether the main execution file corresponding to the current process is in the list of the measurement policy. If so, step S3 is executed; otherwise, step S4 is executed.

[0014] S3. Traverse the vma list of the current process and check whether each vma has a baseline value saved in the baseline library. If not, calculate the vma hash value and save it as the baseline value in the baseline library. If it is saved, measure the vma hash value and compare it with the baseline value. If they match, continue to traverse the next vma. If not, decide whether to kill the process to which the vma belongs based on the measurement strategy.

[0015] S4. Traverse the next process in the process list until the process list is traversed.

[0016] Furthermore, the method for constructing the kernel state dynamic measurement function component in step S1 includes:

[0017] Build a file system interface for the user layer to write configuration information and measurement policy information to the kernel layer;

[0018] Build the initialization component, which is responsible for initializing the policy library, benchmark library, and starting the scheduled task maintenance thread;

[0019] Build a scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the period policy configuration in the measurement policy;

[0020] Build a process measurement component: As the core component of the dynamic measurement function, it scans all kernel processes and compares policies when called. When the policy matches, it performs measurement actions. If the vma information is found to be tampered with during measurement, a log is generated through the standard syslog interface and passed to the upper-level auditd service. The decision on whether to kill the process to which the vma belongs is made based on the measurement policy.

[0021] Furthermore, the collection of the benchmark values ​​in the benchmark library in steps S1 and S3 includes:

[0022] S101, local loading, after the kernel state dynamic measurement function component is started for the first time, reads the localized benchmark database and writes it into the benchmark library through the file system interface;

[0023] S102, when loading the elf file, the benchmark values ​​are collected by the dynamic metric benchmark library collection function mounted on the lsm hook and written into the benchmark library;

[0024] S103. Completing missing reference values ​​in the measurement action.

[0025] Furthermore, the dynamic metric benchmark library collection function includes:

[0026] Confirm whether it is an executable mapping. If so, check whether the current mapping object already has a benchmark value. If not, calculate the benchmark value and write it to the kernel-mode benchmark library.

[0027] Furthermore, the initiation of the measurement task in step S2 includes: measurement event triggering and measurement strategy updating.

[0028] Another aspect of the present invention provides a process monitoring improvement device for a system dynamic measurement function, comprising:

[0029] Kernel-state dynamic measurement functional component: The kernel-state dynamic measurement functional component includes a policy library and a benchmark library; the benchmark library is used to store benchmark values ​​of code segments of executable program files and dynamic libraries; the policy library is used to store measurement policies, which contain unique identification information of the main executable file of the process;

[0030] Process detection module: traverses all process lists in the system through the kernel state dynamic measurement function component, and detects whether the main execution file corresponding to the current process is in the measurement policy list. If so, it jumps to the Vma traversal module; otherwise, it jumps to the process traversal module;

[0031] VMA traversal module: traverses the vma list of the current process, checks whether each vma has a baseline value saved in the benchmark library, and calculates the vma hash value if not saved, and saves it as the baseline value in the benchmark library; measures the vma hash value and compares it with the benchmark value, and if they match, continues to traverse the next vma; if they do not match, decides whether to kill the process to which the vma belongs based on the measurement strategy;

[0032] Process traversal module: traverses the next process in the process list until the process list is traversed.

[0033] Furthermore, the kernel state dynamic measurement functional components include:

[0034] The file system interface is used by the user layer to write configuration information and measurement policy information to the kernel layer;

[0035] Initialization component, responsible for initializing the policy library, benchmark library, and starting the scheduled task maintenance thread;

[0036] Scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the period policy configuration in the measurement policy;

[0037] Process measurement component: As the core component of the dynamic measurement function, it scans all kernel processes and compares policies when called. When the policy matches, it performs measurement actions. If the vma information is found to be tampered with during measurement, a log is generated through the standard syslog interface and passed to the upper-level auditd service. The system then decides whether to kill the process to which the vma belongs based on the measurement policy.

[0038] Furthermore, the collection of benchmark values ​​in the benchmark library in the kernel state dynamic measurement function component and the Vma traversal module includes:

[0039] Local loading unit: After the kernel-mode dynamic measurement function component is started for the first time, it reads the localized benchmark database and writes it to the benchmark library through the file system interface;

[0040] File loading unit: when loading the elf file, the benchmark values ​​are collected by the dynamic metric benchmark library collection function mounted in the lsm hook and written into the benchmark library;

[0041] Missing completion unit: Completes missing reference values ​​in measurement actions.

[0042] Furthermore, the dynamic metric benchmark library collection functions of the file loading unit include:

[0043] Confirm whether it is an executable mapping. If so, check whether the current mapping object already has a benchmark value. If not, calculate the benchmark value and write it to the kernel-mode benchmark library.

[0044] Furthermore, the initiation of the measurement task in the process detection module includes: measurement event triggering and measurement strategy updating.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] (1) The present invention separates the policy library of dynamic measurement from the benchmark library. The benchmark library is responsible for collecting and maintaining the benchmark values ​​of each segment, while the policy library is responsible for the supervision logic of the measurement strategy. There is no need to pay attention to the number of specific measurement segments and specific objects. Logically, the benchmark library and the policy library are decoupled, and the measurement strategy focuses on specific measurement objects, ensuring that each dynamic measurement can fully measure the process, avoiding the problem of missing measurement segments in other existing solutions.

[0047] (2) The measurement strategy of the present invention is based on the complete execution program or process, rather than a separate ELF, to ensure that there is no contradiction between the strategy and the logical corresponding properties of the measured entity program or process.

[0048] (3) The dynamic measurement range of the present invention always remains the entire code segment of the complete process, rather than the corresponding segment of a specific file or a portion of the corresponding segment locked at a specific moment. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a schematic diagram of the kernel-state dynamic measurement function components of Example 1 of the present invention;

[0050] Figure 2 This is a functional diagram of a process measurement component in a kernel-mode dynamic measurement function component according to Example 1 of the present invention;

[0051] Figure 3 This is a schematic diagram of the dynamic measurement process of Example 1 of the present invention;

[0052] Figure 4 This is a schematic diagram of the benchmark value collection process of the benchmark library in Example 1 of the present invention. DETAILED DESCRIPTION

[0053] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0054] The design idea of ​​the present invention is to no longer use a single elf file as the policy configuration target, but to issue policies to the process body (Zhu execution file) and use the entire process as the measurement target. The policy library and the benchmark library independently ensure that the monitoring object is all the code segments and read-only data segments of the current process, which solves the problem of missing measurement process segments and unclear monitoring protection objects in the existing dynamic measurement function.

[0055] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0056] Example 1:

[0057] In this embodiment, a kernel-state dynamic measurement function component is first constructed.

[0058] like Figure 1 As shown in the figure, the kernel state dynamic measurement functional components include:

[0059] 1. File system interface: The securityfs file system interface is used by the user layer to write configuration information and measurement policy information to the kernel layer. Users configure policies and related functions through standard file operations.

[0060] 2. Initialization component: responsible for initializing the strategy library and benchmark library;

[0061] The benchmark library implements the preservation of benchmark values ​​of the memory vma mapping related to the execution program file and the dynamic library code segment through the benchmark value cache structure;

[0062] The policy library stores the measurement policy through a policy cache structure. The measurement policy contains the unique identification information of the main execution file of the process. The unique identification information can be the real path of the main execution file of the process, or unique information such as "partition information + iNode number". In this embodiment, the real path of the main execution file of the process is used as its unique identification information and included in the measurement policy.

[0063] The initialization component initializes the policy library and benchmark library so that it can normally receive the configuration and measurement policies issued by the user layer. After initialization, it starts the scheduled task maintenance thread.

[0064] 3. Scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the periodic policy configuration in the measurement policy.

[0065] 4. Process Measurement Component: This component is the core component of the kernel's measurement functionality. When called, it scans all kernel processes and compares them against measurement policies. Measurement is performed when a policy matches. If key information is tampered with during measurement, a log is generated through the standard syslog interface and transmitted to the upper-layer auditd service. The service then decides whether to terminate the vma process based on the measurement policy.

[0066] The basic algorithm flow of the process measurement component as the core component is as follows Figure 2 As shown, including:

[0067] (1) Traverse all processes of the system kernel:

[0068] In the system kernel, the system global task list can be obtained through the current process task. All processes can be traversed by traversing each node of the system global task list one by one.

[0069] (2) When traversing a process task structure, first obtain the real path of the main execution file of the process as the key index policy library (policy cache).

[0070] If the measurement policy for the path exists in the policy library, the vma list of the process task is further obtained. If the measurement policy for the path does not exist in the policy library, the next task node is traversed.

[0071] The description of the vma list is as follows: Each process has an independent read-only executable vma list, which is used to maintain all executable files mapped in the current process, including the main executable file and dynamic library files.

[0072] (3) After obtaining the vma list, traverse the vma nodes of the currently checked process one by one and obtain the mapping file information of the vma node.

[0073] If the file information exists, the current vma node may contain a code segment or a data segment, and further verification and matching are performed. Otherwise, the next vma is traversed.

[0074] vma checks the segment flags. If the segment flag is read-only, it determines that the segment contains read-only data and performs read-only data segment metric calculation. If the segment flag is executable but not writable, it determines that the segment contains executable data.

[0075] Perform hash calculation for the corresponding area.

[0076] (4) Query the benchmark library using the mapping file path of the vma segment as the key. If a match is found, the current hash value is matched with the benchmark value stored in the benchmark library. Otherwise, the current hash value is saved as the benchmark value in the benchmark library and the next vma is traversed.

[0077] If the current hash value is the same as that in the benchmark cache, the check passes. Otherwise, a log is generated and sent to the log system to record the tampering information of the process, and a decision is made based on the measurement strategy whether to kill the process to which vma belongs.

[0078] In the above process, the measurement strategy is always only related to the real path of the main executable file of the process and has nothing to do with the dynamic library.

[0079] During the running of each process, there will be multiple vma mappings corresponding to multiple files (including executable programs and dynamic libraries). The specific code segment benchmark values ​​of each executable program file and dynamic library are maintained in the benchmark library.

[0080] At the same time, the benchmark value library can be persistently stored and configured by upper-level software components through the file system interface.

[0081] After building the kernel-mode dynamic measurement functional component, the dynamic measurement process can be executed.

[0082] Dynamic measurement process execution Figure 3 As shown, including:

[0083] a. The measurement policy is delivered to the kernel through the file system interface of the kernel-mode dynamic measurement component. The measurement policy includes a policy list that contains the real path of the process's main executable file as unique identification information, as well as auxiliary policies for the process's main executable file.

[0084] b. The kernel-mode dynamic measurement function component saves the issued measurement policy to the policy library.

[0085] c. When the system encounters a measurement event trigger, measurement policy update, or other status, the process measurement component is started to perform the measurement task.

[0086] d. The process measurement component traverses all process lists in the system and checks whether the current process is in the policy list of the policy library. If so, it executes the next step; otherwise, it executes step j to traverse the next process.

[0087] e. Expand and traverse the vma list of the currently traversed process (that is, the independent read-only executable vma list that exists in each process).

[0088] f. Check whether the currently traversed vma already has a benchmark value in the benchmark library. If so, proceed to step g; otherwise, proceed to step h.

[0089] g. Measure the current vma hash value and compare it to the baseline value stored in the baseline database. If the baseline value does not match, an alarm log is generated (generated through the standard syslog interface and transmitted to the upper-layer auditd service). Based on the measurement policy, a decision is made whether to kill the process to which vma belongs. Then, proceed to step i.

[0090] h. Calculate the current vma hash value and save it as the benchmark value in the benchmark library. Then execute step i.

[0091] i. If the vma list of the current process is traversed, execute step j, otherwise traverse the next vma in the vma list and execute step f.

[0092] j. If the process list is traversed, end this round of measurement. Otherwise, traverse the next process in the process list and execute step e.

[0093] The difference between the above process and traditional dynamic measurement is that the measured process segment is not fixed immediately. Instead, the measurement value is compared with the baseline value through the vma list when any measurement event is triggered (manual trigger, periodic task trigger, etc.). All key segments of the current process are fully scanned. This ensures that dynamic measurement always measures the current complete state of the process, avoids missing measurement segments, and thus ensures the availability of the current dynamic measurement results.

[0094] The acquisition and update of benchmark values ​​in the benchmark library come from three scenarios.

[0095] like Figure 4 As shown in Figure 1, the three scenarios include local persistent benchmark configuration, ELF file loading caused by arbitrary program running, and triggering the non-existence of benchmark values ​​during dynamic measurement.

[0096] 1. Local persistence benchmark value configuration:

[0097] The configuration file loading process is as follows:

[0098] a. When the dynamic measurement service is started for the first time after booting, the initialization component of the kernel state dynamic measurement function component initializes the benchmark library of the system kernel;

[0099] b. Read the localized benchmark library;

[0100] c. Write the benchmark value of the localized benchmark library into the benchmark library of the system kernel through the file system interface.

[0101] 2. The program runs and loads the elf file:

[0102] a. Any program starts;

[0103] b. Trigger the elf loading system call (including execution program loading and dynamic library loading);

[0104] c. Triggering the LSM Hook; the LSM Hook is a core mechanism in the Linux Security Module (LSM) framework that implements access control to system resources by inserting hook functions into kernel critical paths;

[0105] d. Trigger the dynamic metric benchmark library collection function mounted on the lsm hook;

[0106] e. The dynamic metric benchmark library collection function confirms whether the loaded elf is an executable vma mapping. If so, it executes the next step, otherwise it returns;

[0107] f. Check whether the current vma mapping object already has a baseline value. If not, proceed to the next step, otherwise return;

[0108] g. Calculate the current vma baseline value;

[0109] h. Write to the kernel-mode benchmark library.

[0110] 3. Triggering the absence of a baseline value during dynamic measurement:

[0111] a. Trigger the measurement action of a vma of a process;

[0112] b. Check whether the benchmark value exists. If so, perform the measurement. Otherwise, proceed to the next step.

[0113] c. Calculate the vma benchmark value and save it to the kernel benchmark library.

[0114] Since the measurement segment baseline value is separated from the strategy in the present invention, the strategy is used to maintain which programs or processes are measured without paying attention to the number of specific measurement segments and specific objects, ensuring that each dynamic measurement can fully measure the process, avoiding the problem of measurement segment omission in other existing solutions.

[0115] In actual project requirements, the user's actual demand for dynamic measurement is to monitor the entire business software. When any tampering is detected in the business software, the program will be terminated or a warning will be issued according to the measurement strategy.

[0116] Logically, the benchmark library and the policy library are independent of each other, so the benchmark value is decoupled from the policy, and the measurement policy focuses on the specific measurement object, avoiding the problem of measurement policy not meeting the actual needs of users in other existing dynamic measurement solutions.

[0117] Example 2:

[0118] The present invention proposes a process monitoring improvement device for a system dynamic measurement function, comprising:

[0119] Kernel-state dynamic measurement functional component: The kernel-state dynamic measurement functional component includes a policy library and a benchmark library; the benchmark library is used to store benchmark values ​​of code segments of executable program files and dynamic libraries; the policy library is used to store measurement policies, which contain unique identification information of the main executable file of the process;

[0120] Process detection module: traverses all process lists in the system through the kernel state dynamic measurement function component, and detects whether the main execution file corresponding to the current process is in the measurement policy list. If so, it jumps to the Vma traversal module; otherwise, it jumps to the process traversal module;

[0121] VMA traversal module: traverses the vma list of the current process, checks whether each vma has a baseline value saved in the benchmark library, and calculates the vma hash value if not saved, and saves it as the baseline value in the benchmark library; measures the vma hash value and compares it with the benchmark value, and if they match, continues to traverse the next vma; if they do not match, decides whether to kill the process to which the vma belongs based on the measurement strategy;

[0122] Process traversal module: traverses the next process in the process list until the process list is traversed.

[0123] The kernel state dynamic measurement functional components include:

[0124] The file system interface is used by the user layer to write configuration information and measurement policy information to the kernel layer;

[0125] Initialization component, responsible for initializing the policy library, benchmark library, and starting the scheduled task maintenance thread;

[0126] Scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the period policy configuration in the measurement policy;

[0127] Process measurement component: As the core component of the dynamic measurement function, it scans all kernel processes and compares policies when called. When the policy matches, it performs measurement actions. If the vma information is found to be tampered with during measurement, a log is generated through the standard syslog interface and passed to the upper-level auditd service. The system then decides whether to kill the process to which the vma belongs based on the measurement policy.

[0128] The collection of benchmark values ​​in the benchmark library in the kernel state dynamic measurement function component and the Vma traversal module includes:

[0129] Local loading unit: After the kernel-mode dynamic measurement function component is started for the first time, it reads the localized benchmark database and writes it to the benchmark library through the file system interface;

[0130] File loading unit: when loading the elf file, the benchmark values ​​are collected by the dynamic metric benchmark library collection function mounted in the lsm hook and written into the benchmark library;

[0131] Missing completion unit: Completes missing reference values ​​in measurement actions.

[0132] The dynamic metrics benchmark library collection functions of the file loading unit include:

[0133] Confirm whether it is an executable mapping. If so, check whether the current mapping object already has a benchmark value. If not, calculate the benchmark value and write it to the kernel-mode benchmark library.

[0134] The start of the measurement task in the process detection module includes: measurement event triggering and measurement strategy update.

[0135] The process monitoring improvement device for the system dynamic measurement function proposed in this embodiment can implement the process monitoring improvement method for the system dynamic measurement function proposed in Example 1, and has the same technical effect as the method described in Example 1.

[0136] The above-described embodiments are merely preferred implementations of the present invention and are intended to help understand the method and core concepts of the present application. The scope of protection of the present invention is not limited to the above-described embodiments. All technical solutions within the scope of protection of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for improving process monitoring of system dynamic measurement functions, characterized in that: include: S1. Constructing a kernel-state dynamic measurement function component, wherein the kernel-state dynamic measurement function component includes a policy library and a benchmark library; The benchmark library is used to store benchmark values ​​of code segment-related memory vma mappings of execution program files and dynamic libraries; The policy library is used to store measurement policies, which contain unique identification information of the main execution file of the process; the benchmark library and the policy library are independent of each other, and the benchmark value is decoupled from the policy; S2. When the measurement task is started, the kernel state dynamic measurement function component traverses the entire process list in the system to detect whether the main execution file corresponding to the current process is in the list of the measurement policy. If so, step S3 is executed; otherwise, step S4 is executed. S3. Traverse the vma list of the current process and check whether each vma has a baseline value saved in the baseline library. If not, calculate the vma hash value and save it as the baseline value in the baseline library. Complete the missing baseline value in the measurement action. If it is saved, measure the vma hash value and compare it with the baseline value. If they match, continue to traverse the next vma. If not, decide whether to kill the process to which the vma belongs based on the measurement policy. S4. Traverse the next process in the process list until the process list is traversed; The collection of benchmark values ​​in the benchmark library described in steps S1 and S3 includes: S101, local persistent benchmark value configuration: After the kernel state dynamic measurement function component is started for the first time, it reads the local benchmark database and writes it to the benchmark library through the file system interface; S102, when the program runs and loads the elf file, the benchmark values ​​are collected by the dynamic metric benchmark library collection function mounted on the lsm hook and written into the benchmark library; S103: If a reference value does not exist during the dynamic measurement process, the missing reference value is supplemented in the measurement action.

2. The process monitoring improvement method of the system dynamic measurement function according to claim 1 is characterized in that: The method for constructing the kernel state dynamic measurement function component in step S1 includes: Build a file system interface for the user layer to write configuration information and measurement policy information to the kernel layer; Build the initialization component, which is responsible for initializing the policy library, benchmark library, and starting the scheduled task maintenance thread; Build a scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the period policy configuration in the measurement policy; Build a process measurement component: As the core component of the dynamic measurement function, it scans all kernel processes and compares policies when called. When the policy matches, it performs measurement actions. If the vma information is found to be tampered with during measurement, a log is generated through the standard syslog interface and passed to the upper-level auditd service. The decision on whether to kill the process to which the vma belongs is made based on the measurement policy.

3. The process monitoring improvement method of the system dynamic measurement function according to claim 1 is characterized in that: The dynamic metric benchmark library collection function includes: Confirm whether it is an executable mapping. If so, check whether the current mapping object already has a benchmark value. If not, calculate the benchmark value and write it to the kernel-mode benchmark library.

4. The process monitoring improvement method of the system dynamic measurement function according to claim 1 is characterized in that: The initiation of the measurement task in step S2 includes: measurement event triggering and measurement strategy updating.

5. A process monitoring improvement device for the dynamic measurement function of a system, characterized in that: include: Kernel state dynamic measurement function component: the kernel state dynamic measurement function component includes a policy library and a benchmark library; The benchmark library is used to store benchmark values ​​of code segments of execution program files and dynamic libraries; The policy library is used to store measurement policies, which contain unique identification information of the main execution file of the process; the benchmark library and the policy library are independent of each other, and the benchmark value is decoupled from the policy; Process detection module: traverses all process lists in the system through the kernel state dynamic measurement function component, and detects whether the main execution file corresponding to the current process is in the measurement policy list. If so, it jumps to the Vma traversal module; otherwise, it jumps to the process traversal module; VMA traversal module: traverses the vma list of the current process and checks whether each vma has a baseline value saved in the baseline library. If not, the vma hash value is calculated and saved as the baseline value in the baseline library. The missing baseline value is completed in the measurement action. If it is saved, the vma hash value is measured and compared with the baseline value. If they match, the next vma is traversed. If not, the measurement strategy is used to decide whether to kill the process to which the vma belongs. Process traversal module: traverses the next process in the process list until the process list is traversed; The collection of the benchmark values ​​in the benchmark library in the kernel state dynamic measurement function component and the Vma traversal module includes: Local loading unit: Local persistent benchmark value configuration: After the kernel-mode dynamic measurement function component is started for the first time, it reads the local benchmark database and writes it to the benchmark library through the file system interface; File loading unit: When the program runs and loads the elf file, the benchmark values ​​are collected and written into the benchmark library through the dynamic metric benchmark library collection function mounted in the lsm hook; Missing completion unit: When a baseline value does not exist during dynamic measurement, the missing baseline value is completed in the measurement action.

6. The process monitoring improvement device for the system dynamic measurement function according to claim 5 is characterized in that: Kernel state dynamic measurement functional components include: The file system interface is used by the user layer to write configuration information and measurement policy information to the kernel layer; Initialization component, responsible for initializing the policy library, benchmark library, and starting the scheduled task maintenance thread; Scheduled task maintenance thread: used to schedule measurement tasks with a specific measurement period according to the period policy configuration in the measurement policy; Process measurement component: As the core component of the dynamic measurement function, it scans all kernel processes and compares policies when called. When the policy matches, it performs measurement actions. If the vma information is found to be tampered with during measurement, a log is generated through the standard syslog interface and passed to the upper-level auditd service. The system then decides whether to kill the process to which the vma belongs based on the measurement policy.

7. The process monitoring improvement device for the system dynamic measurement function according to claim 5 is characterized in that: The dynamic metrics benchmark library collection functions of the file loading unit include: Confirm whether it is an executable mapping. If so, check whether the current mapping object already has a benchmark value. If not, calculate the benchmark value and write it to the kernel-mode benchmark library.

8. The process monitoring improvement device for system dynamic measurement function according to claim 5, characterized in that: The start of the measurement task in the process detection module includes: measurement event triggering and measurement strategy update.

Images