Port detection method and apparatus, and computing device

Abstract

The embodiment of the invention provides a port detection method and device and computing equipment, and is applied to the technical field of servers. Specifically, if a to-be-detected program runs, the computing device triggers an ebpf virtual machine collection port through a hook point in a kernel protocol stack of an operating system, and determines whether the to-be-detected program uses the port or not according to port information. Therefore, the computing device can utilize the low delay characteristic of the kernel space to trigger the ebpf virtual machine to accurately collect the port information in real time through the hook point when the to-be-detected program runs. Compared with an external detection tool or internal detection, the method has the advantages that the port information can be accurately acquired in real time, so that the leakage detection risk of the port can be reduced.

Description

Technical Field

[0001] This application relates to the field of computing devices, and in particular, to a port detection method, apparatus, and computing device. Background Art

[0002] Port detection is an important task in network security work and plays a crucial role in ensuring the secure operation of the operating system. Port detection aims to detect the ports of the operating system to determine whether the ports are in a listening state. Among them, the ports in the listening state are called open ports, and open ports can receive connection requests or data packets from the network.

[0003] Currently, port detection is often performed using detection tools. Detection tools include external detection tools and internal detection tools. External detection tools refer to detecting open ports by sending port scan messages to the computing device from outside the computing device. For example, the external detection tool is Network Mapper (nmap). Internal detection tools refer to detecting ports by outputting the currently open ports by reading the system list inside the computing device. For example, the internal detection tool is netsat. However, whether port detection is performed using an external detection tool or an internal detection tool, there will be a problem of missed detection. Summary of the Invention

[0004] Embodiments of this application provide a port detection method, apparatus, and computing device, which can reduce the risk of missed detection.

[0005] In a first aspect, an embodiment of this application provides a port detection method, which is applied to a computing device. The computing device can be a server or other electronic devices with computing functions.

[0006] Specifically, when the program to be detected is running, the computing device triggers an Extended Berkeley Packet Filter (ebpf) virtual machine to collect port information through a hook point; the hook point is located in the kernel protocol stack of the operating system. Then, the computing device determines whether the program to be detected uses the port according to the port information. That is, the computing device can utilize the low-latency characteristic of the kernel space to trigger the ebpf virtual machine to accurately and real-time collect port information through the hook point when the program to be detected is running. This method can obtain the port information of the port accurately and real-time compared with external detection tools or internal detection, thereby reducing the risk of port missed detection.

[0007] Among them, the port information may include at least one of port time information for describing the open time period of the port and port process information for describing the process corresponding to the open port.

[0008] In a specific implementation, before the computing device triggers the target program to collect port information through the hook point, it can also perform the operation of mounting the hook point, which specifically includes: loading the pre-compiled target information into the kernel space of the operating system; the target information indicates to mount the hook point at a specified position in the kernel protocol stack of the operating system; according to the target information, mount the hook point at the specified position in the kernel protocol stack. Thus, the computing device can accurately mount the hook point at the specified position in the kernel protocol stack through the pre-compiled target information, and enable the hook point to trigger the eBPF virtual machine to accurately collect port information.

[0009] In another specific implementation, the specified position includes the first function, the second function or the third function. The first function is used to associate the socket with the port. The second function is used to set the socket to the listening state or receive messages through the socket. The third function is used to monitor the closing behavior of the socket. When the program to be inspected runs, the eBPF virtual machine is triggered through the first hook point to collect port process information, the eBPF virtual machine is triggered through the second hook point to collect the port opening time, and the eBPF virtual machine is triggered through the third hook point to collect the port closing time. By setting hook points on the corresponding functions of the kernel protocol stack, port information can be accurately obtained without affecting the normal operation of the entire kernel protocol stack. In addition, since the first function, the second function or the third function must be called every time when the program to be inspected runs, accurate collection of port information can be achieved by setting hook points at these three functions.

[0010] Furthermore, the second function may further include a first sub-function and a second sub-function. The first sub-function is used to set the socket to the listening state, and the second sub-function is used to receive messages through the socket. If the program to be inspected communicates through TCP, mount the second hook point on the first sub-function. If the program to be inspected communicates through UDP, mount the second hook point at the first call of the second sub-function. In the embodiments of the present application, by limiting the association between the second hook point and the first sub-function and / or the first call of the second sub-function, it can be ensured that the collection of port information starts from the first use of the port. That is, this method can avoid missing any important state changes and can also avoid remounting every time a call is made, which may generate redundant data or error information, etc.

[0011] In yet another specific implementation, the operating system includes a user mode and a kernel mode. First, the computing device can compile the target information from a first language to a second language by preloading the Berkeley Packet Filter Compiler Collection (BCC) compiler. The first language is a language that can be recognized by the operating system in the user space but not in the kernel space, and the second language is a language that can be recognized by the operating system in the kernel space. Then, the target information in the second language is loaded into the eBPF virtual machine. By using the BCC compiler to compile the target information into a language that can be recognized by the kernel space, it can ensure that the kernel protocol stack correctly recognizes and obtains the port information of the port.

[0012] In yet another specific implementation, according to the extended Berkeley Packet Filter mapping function, the port information is transferred from the kernel space to the user space. In the user space, the open ports are determined based on the port information.

[0013] Second, an embodiment of the present application provides a port detection device. The device includes:

[0014] A collection unit, configured to collect port information by triggering an eBPF program through a hook point when the program to be detected is running; the hook point is located in the kernel protocol stack of the operating system;

[0015] A determination unit, configured to determine the port status according to the port information.

[0016] Third, an embodiment of the present application provides a computing device, including:

[0017] A memory, configured to store programs;

[0018] A processor, configured to execute the programs stored in the memory. When the programs stored in the memory are executed, the processor is configured to execute the method according to any one of the first aspects.

[0019] Fourth, the present application provides a computer storage medium, configured to store a computer program. When the computer program is executed, it is used to implement the method provided by any one of the embodiments in the first aspect of the present application.

[0020] Fifth, the present application provides a computer program product containing instructions. When it runs on at least one computing device, it enables at least one computing device to implement the method provided by any one of the embodiments in the first aspect of the present application.

[0021] Any of the port detection methods provided above, corresponding to a computing device, a computer-readable storage medium, a computer program product, etc., are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods, which will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application;

[0023] Figure 2 A flowchart of a port detection method provided by an embodiment of the present application;

[0024] Figure 3 A logical topology diagram of port detection provided by an embodiment of the present application;

[0025] Figure 4 Another port detection method provided by an embodiment of the present application;

[0026] Figure 5 Another implementation topology diagram of port detection provided by an embodiment of the present application;

[0027] Figure 6 A schematic diagram of the structure of a port detection device provided by an embodiment of the present application;

[0028] Figure 7 A schematic diagram of the structure of a server provided by an embodiment of the present application. Detailed implementation manners

[0029] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0030] First, the professional terms involved in the embodiments of the present application will be introduced.

[0031] Port detection: It refers to detecting the port status of the network ports of the operating system to determine which ports are in the listening state or the open state. Ports in the open state or the listening state are called open ports. If a port is an open port, the port is occupied or used by the program to be detected. The program to be detected refers to a process running in the operating system that can use network ports.

[0032] For example, a web service program is running on a server. After this program is started, it will occupy port 21. When the server performs port detection, if it is found that port 21 is occupied by this program, port 21 is an open port.

[0033] Port detection plays an important role in the fields of network security, cloud computing, virtualization environments, and even the security of Internet of Things devices, big data analysis, and blockchain. For example, in the field of network security, port detection can be used in combination with intrusion detection systems and intrusion prevention systems. By recording port information in real time, abnormal behaviors such as port scanning and brute force cracking can be quickly identified, and alarms can be triggered in a timely manner or defensive measures can be taken automatically. In addition, it can be combined with machine learning algorithms to analyze historical data and establish a model of normal network behavior to improve the ability to predict and identify potential threats. Another example is that in cloud computing and virtualization environments, the network activities of each virtual machine in a multi-tenant environment can be accurately monitored to ensure network isolation and network security between tenants.

[0034] Existing technologies can use external detection tools for port detection. Specifically, the external detection tool sends port scanning packets to the computing device. The computing device detects the open ports based on the port scanning packets and generates a response packet. The response packet includes which ports are open ports and the events running on the open ports. The computing device returns the response packet to the external detection tool. The external detection tool determines which ports are open ports based on the response packet. However, this method has the following problems: First, the port scanning packets may be intercepted by the firewall, resulting in missed detections by the external detection tool; Second, by obtaining the running events on the open ports through interactive packets, if some ports are not yet open or have been closed, the external detection tool cannot obtain them, resulting in missed detections.

[0035] Existing technologies can also use internal detection tools for port detection. However, currently, internal detection tools often obtain the currently open ports by reading the system list. The system list includes the currently open ports and the events running on the open ports. Similarly, when some ports are not yet open or have been closed, the internal detection tool cannot identify them, resulting in missed detections.

[0036] In view of this, the embodiments of the present application provide a port detection method. By setting a hook point at a specified position in the kernel protocol stack of the operating system, the ebpf virtual machine in the kernel space is triggered by the hook point to collect port information, that is, the collection operation is performed in the kernel space. This method can avoid the problem that the firewall intercepts the packets when using an external detection tool for port detection, resulting in the inability to accurately obtain the port status information, and can also avoid the problem of missed detections when some ports are not yet open or closed. In addition, the program in the kernel space also has the characteristics of low latency, etc., so it can accurately obtain port information in real time and reduce the risk of missed detections.

[0037] The port detection method provided by the embodiments of the present application will be described below with reference to the accompanying drawings.

[0038] Exemplarily, the attachedFigure 1 A schematic diagram of an application scenario provided by an embodiment of the present application, which relates to a computing device 10 for performing network port detection of an operating system in the computing device 10.

[0039] As Figure 1 shown, the operating system deployed on the computing device 10 includes a kernel space and a user space.

[0040] The kernel space is the area where the operating system kernel runs. The kernel space can directly access all hardware resources and memory areas in the computing device 10, so the execution efficiency is high. And the programs in the kernel space can process the events of the operating system in real time without frequent interaction with the user space through system calls, so it helps to reduce the overhead of context switching and further improve the execution efficiency. In the embodiment of the present application, the kernel protocol stack, virtual machines, etc. are all located in the kernel space.

[0041] The user space is the area where ordinary application programs run and cannot directly access the hardware resources in the computing device 10 and perform specific operations. That is, the programs in the user space need to request the kernel space to assist in accessing hardware resources and performing specific operations through system calls. Therefore, compared with the programs in the kernel space, the programs in the user space have the characteristics of high latency and low execution efficiency. However, the user space has the characteristics of flexibility and platform compatibility relative to the user space. In the embodiment of the present application, the program to be detected, the detection program, etc. are all located in the user space. Among them, the detection program indicates an application program for performing port detection.

[0042] In the embodiment of the present application, when the program to be detected is running, the computing device triggers the ebpf virtual machine located in the kernel space to collect port information through the hook point mounted in the kernel protocol stack of the operating system. Then, the computing device determines whether the program to be detected uses the port according to the port information. Among them, the kernel protocol stack runs in the kernel space. Therefore, the computing device can utilize the low-latency characteristic of the kernel space to accurately and real-time collect port information through the hook point to trigger the ebpf virtual machine in the kernel space when the program to be detected is running. This method can obtain port information accurately and in real time compared with external detection tools or internal detection. Therefore, it can reduce the risk of port undetected.

[0043] Furthermore, after the detection program is started, the detection program in the user space first obtains the pre-compiled target information. For example, the detection program in the user space can load the Berkeley Packet Filter Compiler Collection (BCC) compiler. The user can compile the target information through the BCC compiler.

[0044] Next, the detection program loads the target information into the kernel space of the operating system. According to the target information, the program in the kernel space sets a hook point at a specified position in the kernel protocol stack and associates it with the target program. Thus, when the program to be detected runs, the target program will be triggered through the hook point to collect port information.

[0045] Exemplary illustration: If the data packet enters the associated address stage, the program to be detected will call the associated function to associate the created socket with the network port. A hook point is mounted at the position where the associated function is called, and this hook point is associated with the target program of the eBPF program. When the associated function is called, the computing device 10 obtains the target program through the hook point and uses the target program to collect port information. For example, it records the port number, process ID, and / or process path, etc. Furthermore, the computing device 10 uses the port information in the kernel space to perform port detection and determine the open ports. Thus, the computing device can, through the pre-compiled setting information and program information, accurately mount a hook point at a specified position in the kernel protocol stack and enable the hook point to accurately collect port information.

[0046] It should be noted that the computing device 10 provided in the embodiments of the present application may be a server, specifically an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), as well as large databases and artificial intelligence platforms. When the above server is a server cluster or distributed system composed of multiple physical servers, the multiple physical servers can form a blockchain, and each physical server is a node on the blockchain. The physical type of the server area can be a rack server, a high-density server, a GPU server, a tower server, or a blade server, a whole cabinet server, etc., and the present application does not specifically limit it.

[0047] The following will provide a detailed and complete description of the port detection method provided in the embodiments of the present application with reference to the accompanying drawings.

[0048] Embodiment 1

[0049] Att Figure 2 is a flowchart of a port detection method provided in the embodiments of the present application. This method is applied to Figure 1 the computing device shown, and this method includes the following:

[0050] S10. The computing device obtains target information.

[0051] The target information is used to trigger the eBPF virtual machine to execute the operation of collecting port information by setting hook points. In the embodiments of the present application, the target information is located in the user space of the operating system.

[0052] The target information indicates to mount a hook point at a specified position in the kernel protocol stack. Among them, the specified position is a position that is necessarily passed through during the data packet processing process. Thus, when the program under test runs, it can access the specified position, thereby triggering the mounted hook point. For example, the specified position is the position of calling the bind address function (i.e., bind()), the position of calling the listen connection function (listen()), etc.

[0053] The hook point is used to associate with the eBPF virtual machine, specifically associate with the target program in the eBPF virtual machine. When the program under test accesses the specified position, the target program can be called through the hook point to execute the operation of collecting port information. For example, a hook point is set in the listen connection or connection establishment stage when the data packet enters the kernel protocol stack. After the data packet enters the listen connection or connection establishment stage, the target program will be triggered to execute the port information collection operation through the hook point.

[0054] To accurately and comprehensively collect port information, the specified position includes a first function, a second function, and a third function. Among them, the first function is used to associate the socket with the port, the second function is used to set the socket to the listening state or receive messages through the socket, and the third function is used to monitor the closing behavior of the socket. Thus, when the data packet of the program under test enters the first function of the kernel protocol stack, port information collection will be executed; when it enters the second function of the kernel protocol stack, port information collection will be executed; when it enters the third function of the kernel protocol stack, port information collection will be executed.

[0055] It can be understood that the first function belongs to the starting stage of the port life cycle, the second function belongs to the usage stage of the port life cycle, and the third function belongs to the ending stage of the port life cycle. That is, these three positions cover the entire life cycle of port creation, use, and destruction. Therefore, by collecting port information through these three positions, comprehensive and accurate monitoring of the port can be achieved, and the collected port information can be comprehensive and accurate.

[0056] In a specific implementation, the first function is the bind function (i.e., bind()). The second function is the listen connection function (Listen()), or the call information sending and receiving function (recvmsg()). The third function is the port closing function (shutdown()). Thus, port information collection is executed when the system calls bind(), port information collection is performed when calling Listen() or recvmsg(), and port information collection is performed when calling shutdown().

[0057] In an embodiment of the present application, the target information further includes target program code, and the computing device 10 executes a target program based on the target program code, where the target program is used for port information collection. In an embodiment of the present application, the target program may be an Extended Berkeley Packet Filter (ebpf) program or other kernel programs, and the embodiments of the present application do not specifically limit this.

[0058] It should be noted that the target information may further include, but is not limited to, the protocol family used by the hook point and the network device information related to the hook point.

[0059] In an embodiment of the present application, when the computing device wants to perform network port detection on the operating system, it first starts the detection program.

[0060] The detection program refers to an application program for port detection and is located in the user space of the operating system. The detection program can be displayed on the visualization interface of the computing device. That is, the user can start or open the detection program by interacting with the detection program displayed on the visualization interface.

[0061] After the detection program is started, it will trigger the computing device to obtain the target information.

[0062] For example, after the program to be detected is started, the visualization interface of the computing device enters the compilation interface. The user can compile the target information through the compilation interface. For another example, the user can write the target information using a preset language. The computing device caches the target information, and when the program to be detected is started, the computing device will load a preset compiler and use the compiler to load the target information. For example, the computing device runs a preset script, loads the BCC compiler, and uses the BCC compiler to load the target information.

[0063] It should be noted that the computing device can also obtain the target information through other means, and the embodiments of the present application do not specifically limit this.

[0064] S20. The computing device loads the target information into the ebpf virtual machine of the operating system.

[0065] Since the kernel space can directly access hardware resources and the system bottom layer, the execution efficiency is higher. It can be understood that if the target program runs in the kernel space, the high execution efficiency and low latency characteristics of the kernel space can be fully utilized to achieve real-time and accurate acquisition of port information. Therefore, after the computing device obtains the target information, it first loads the target information in the user space into the kernel space of the operating system.

[0066] In an embodiment of the present application, the computing device can load the target information into the kernel space of the operating system through a system call. For example, if the target information includes an eBPF program, the computing device can call the Berkeley Packet Filter function (i.e., bpf()) to load the eBPF program onto the eBPF virtual machine for execution.

[0067] The embodiment of the present application can also load the target information into the kernel space in other ways. For example, the target information is loaded through a kernel module, where the kernel module provides direct kernel access functionality. The embodiment of the present application does not specifically limit this.

[0068] S30. The computing device mounts a hook point at a specified position in the kernel protocol stack according to the target information.

[0069] The hook point can also be referred to as an insertion point or an interception point, which is a predefined location or interface that allows developers or computing devices to insert custom code to perform specific operations when a specific event occurs. In an embodiment of the present application, the hook point refers to the location or interface where the eBPF virtual machine is allowed to be inserted. When the hook point is triggered, it can trigger the target program in the eBPF virtual machine to perform port information collection operations.

[0070] In an embodiment of the present application, after the kernel space obtains the target information, the computing device inserts a hook point at a specified position in the kernel protocol stack. Thus, when a data packet enters the specified position in the kernel protocol stack, the hook point is triggered to call the target program to perform port information collection operations.

[0071] In one example, when the virtual machine in the kernel space is running, the virtual machine will trigger the computing device to mount a hook point at a specified position in the kernel protocol stack. Specifically, a first hook point is mounted at the first function in the kernel protocol stack, a second hook point is mounted at the second function in the kernel protocol stack, and a third hook point is mounted at the third function in the kernel protocol stack. See specifically Figure 3 shown. Attached Figure 3 is a logical topology diagram of port detection provided by an embodiment of the present application.

[0072] In another example, if the first function is the position where bind() is called, the second function is the position where listen() is called, or the position where recvmsg() is called, and the third function is the position where shutdown() is called. The computing device associates the first hook point at the position where bind() is called, associates the second hook point at the position where listen() or recvmsg() is called, and associates the third hook point at the position where shutdown() is called.

[0073] The embodiment of the present application can also mount hook points at other specified positions, and the embodiment of the present application does not specifically limit this.

[0074] It should be noted that, in actual use, any one or two of the first function, the second function, and the third function can be selected to mount hook points.

[0075] S40. When the program to be tested runs, the computing device triggers the eBPF virtual machine to collect port information through the hook point.

[0076] The port information is used to describe the port status. For example, the port is in an open state, and the port is an open port.

[0077] In the embodiment of the present application, the port information includes at least one of port time information and port process information in the program. Among them, the port time information is used to describe the open time period of the port, and the port process information is used for the process corresponding to the open port.

[0078] In a specific application, the port time information specifically includes the port number, the Internet Protocol (IP) corresponding to the port number, the port opening time, and the port closing time. The port process information includes the IP, process name, and process path of the program to be tested corresponding to the open port.

[0079] Among them, the port number is used to uniquely identify the network port of the operating system.

[0080] The IP corresponding to the port number refers to the IP address associated with the port and is used to distinguish network interfaces.

[0081] The port opening time refers to the timestamp when the port is opened.

[0082] The port closing time refers to the timestamp when the port is closed.

[0083] The IP of the program to be tested corresponding to the open port refers to the IP address of the computing device that runs the program to be tested when the program to be tested starts.

[0084] The process name is used to uniquely identify the program to be tested.

[0085] The process path refers to the file path where the program to be tested can be executed.

[0086] It should be noted that the port information may also include other information, which is not specifically limited in the embodiment of the present application.

[0087] In the embodiment of the present application, when the program to be tested runs, when the data packet passes through the specified position of the kernel protocol stack, it will trigger the hook point and call the eBPF virtual machine to perform the port information collection operation.

[0088] In an example, continue to refer to Figure 3, when the program under test runs, if the data packet of the program under test passes through the first function, the first hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port process information, port numbers, and IP addresses corresponding to port numbers. If the data packet of the program under test passes through the second function, the second hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port closing time. If the data packet of the program under test passes through the third function, the third hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port closing time.

[0089] In specific applications, when the program under test calls bind(), the first hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port process information, port numbers, and IP addresses corresponding to port numbers. When the program under test calls listen() or recvmsg(), the second hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port closing time. When the program under test calls shutdown(), the third hook point will be triggered, and the eBPF virtual machine will be called to collect information such as port closing time.

[0090] Embodiments of the present application can also collect port information through other specified locations, which are not specifically limited in the embodiments of the present application.

[0091] S50. The computing device determines whether the program under test uses the port according to the port information.

[0092] Among them, determining whether the program under test uses the port is also used to determine the port status of the port. The port status is used to describe whether the port is in an open state, that is, whether the port is an open port or a closed port.

[0093] Exemplarily, if the port information includes port time information, the computing device can determine whether the current time is within the port open time period according to the port time information. If so, it is determined that the port is an open port; otherwise, it is determined that the port is a closed port.

[0094] Furthermore, the port status also includes that the port is in an open state and is occupied by an authorized program; the port is in an open state but is occupied by an unauthorized program; the port is in a closed state and no abnormal behavior is found; the port is in a closed state but was once occupied by an unauthorized program.

[0095] The computing device can also determine whether the port is occupied by a legitimate program according to the port process information. Among them, a legitimate program is also called an authorized program. For example, through the process name, process path, and / or the IP address of the program under test corresponding to the open port, it can be determined whether the program under test of the port is an authorized application service or system service.

[0096] In the embodiments of the present application, the port information collected by the computing device is located in the kernel space, and the operation of determining the port status can be performed in the kernel space. Performing port judgment according to the port information in the kernel space does not require frequent interaction between the kernel space and the user space, avoiding additional performance overhead and helping to improve the judgment efficiency. Moreover, it helps to reduce the overhead of data copying and transmission and avoid delays caused by data transmission.

[0097] Furthermore, the port information in the kernel space can be passed to the user space, and the operation of determining the port status according to the port information is performed in the user space. Considering that errors in the kernel space execution may lead to system crashes or security vulnerabilities, the port information is passed to the user space for execution in the user space to reduce the risks in the kernel space.

[0098] In a specific application, the computing device can pass the port information or the determined port status to the user space by calling the extended Berkeley packet filter mapping function (i.e., ebpf maps()), and output the detection result in the user space.

[0099] It should be noted that the computing device can also pass information from the kernel space to the user space through other means, such as passing information using a preset socket or using shared memory, etc. The embodiments of the present application do not specifically limit this.

[0100] It should be noted that during actual execution, the computing device can set a hook point at a specified location only when starting for the first time or using for the first time, and directly use the pre-set hook point to collect port information in other cases. The embodiments of the present application do not specifically limit this.

[0101] Thus, by loading the target program into the kernel space and setting a hook point at a specified location in the kernel protocol stack, the computing device utilizes the low-latency characteristics of the kernel space to achieve precise and real-time collection of port information by the ebpf virtual machine triggered by the hook point when the program to be detected is running. This method can obtain port information precisely and in real time compared with external detection tools or internal detection. Therefore, it can reduce the risk of port undetected.

[0102] Embodiment 2

[0103] Next, another port detection method is introduced. This detection method is implemented based on the ebpf technology. Among them, ebpf is a powerful kernel technology that runs in the Linux kernel, dynamically loads and executes user-defined code without recompiling the kernel or loading a new kernel. In the embodiments of the present application, the target information is specifically an ebpf program.

[0104] Exemplarily, attached Figure 4Another port detection method is provided for the embodiments of this application. Among them, S10 can be refined into S400 to S420, S20 is specifically refined into S430, S30 is specifically refined into S440, S40 is refined into S450, and S50 is refined into S460 to S470. The method includes the following steps:

[0105] S400. The computing device obtains the eBPF program.

[0106] Among them, the eBPF program includes hook instructions and corresponding code for implementing port information collection. A hook instruction refers to a code segment in the eBPF program used to associate with key positions in the kernel protocol stack.

[0107] S410. The computing device loads the language compiler.

[0108] The language compiler refers to a compiler pre-set on the computing device for performing programming language conversion. In the embodiments of this application, the language encoder is used to convert the eBPF program into a language recognizable by the kernel. In one example, the language compiler can be the BCC compiler.

[0109] After the detection program is started, the computing device can load the language compiler through a monitoring tool or script in the user space. For example, a monitoring tool or script in the user space loads the BCC compiler by calling the BCC library. In addition, the computing device can also load the BCC compiler through other means, which is not specifically limited in the embodiments of this application.

[0110] S420. The computing device converts the eBPF program into target bytecode through the language compiler.

[0111] In the embodiments of this application, the eBPF program is a program written by a developer in the user space using a specific programming language (such as C language or other programming languages that support eBPF). Since the programming language used in the user space may not be recognizable and executable by the kernel, in the embodiments of this application, the trigger instruction is converted into target bytecode through the language compiler.

[0112] Among them, the target bytecode refers to information recognizable and loadable by the kernel, also known as eBPF bytecode. In the embodiments of this application, the computing device compiles the eBPF program in the first language into the target bytecode in the second language. The first language is the language recognizable by the program in the user space but not recognizable by the kernel, that is, C language or other specific programming languages. The second language is the language recognizable by the kernel.

[0113] S430. The computing device loads the target bytecode onto the eBPF virtual machine.

[0114] The eBPF virtual machine is located in the kernel space of the operating system and is used to securely execute eBPF programs to ensure that the execution of eBPF programs will not affect the kernel protocol stack, etc.

[0115] In the embodiment of the present application, after the computing device obtains the target bytecode, it is necessary to load the target bytecode onto the eBPF virtual machine so that the target bytecode runs on the eBPF virtual machine. Specifically, the computing device can call bpf() to load the target bytecode onto the eBPF virtual machine. Once the loading is completed, the eBPF virtual machine starts to run the target bytecode.

[0116] S440. The computing device mounts a hook point on the kernel protocol stack.

[0117] When the eBPF virtual machine runs the target bytecode, it will mount hook points at key positions of the kernel protocol stack. These hook points are implemented through the hook instructions defined in the eBPF program. When a system call occurs, the hook point will trigger the execution of the target bytecode.

[0118] Exemplarily, when the eBPF virtual machine runs the target bytecode, it will sequentially associate bind() through the first hook point, associate listen() or recvmsg() through the second hook point, and shutdown() through the third hook point.

[0119] Specifically, if the program to be inspected communicates through the Transmission Control Protocol (TCP), a second hook point is set at the first sub-function (i.e., listen()). If the program to be inspected communicates through the User Datagram Protocol (UDP), a second hook point is set at the first call to the second sub-function (i.e., recvmsg()). In the embodiment of the present application, by limiting the association of the second hook point with listen() and / or the first call to recvmsg(), it can be ensured that the collection of port information starts from the first use of the port. That is, this method can avoid missing any important state changes and can also avoid remounting every time a call is made, which may generate redundant data or error information, etc.

[0120] S450. When the program to be inspected runs, the computing device collects port time information and port process information through the hook point.

[0121] In the embodiments of the present application, the program to be detected interacts with the kernel space through system calls, triggering functions of the kernel protocol stack. Specifically, when the program to be detected is running, if the operating system calls bind(), the first hook point will be triggered, and the target bytecode will be called to collect process information, port numbers, IPs corresponding to port numbers, and other information. If the operating system calls listen() or recvmsg(), the second hook point will be triggered, and the target bytecode will be called to collect information such as port closing time. If the operating system calls shutdown(), the third hook point will be triggered, and the target bytecode will be called to collect information such as port closing time.

[0122] S460. The computing device returns the collected information from the kernel space to the user space.

[0123] Specifically, the computing device returns the collected information from the kernel space to the user space by calling ebpf maps(). Among them, ebpf maps is a mechanism for users to transfer data between the kernel space and the user space.

[0124] S470. The computing device outputs the detection result in the user space.

[0125] Appendix Figure 5 is another implementation topology diagram of port detection provided by the embodiments of the present application. This implementation topology diagram corresponds to Figure 4 the flowchart of. This port detection includes:

[0126] Start a detection program for detecting open ports. First, hook points need to be mounted on the kernel protocol stack. The specific mounting methods include: the server loads the BCC compiler. Then in the user space, the BCC compiler is used to compile the ebpf program into bytecode that can be recognized by the ebpf virtual machine at runtime. The bytecode is loaded onto the ebpf virtual machine through bpf(). When the bytecode is running on the ebpf virtual machine, hook points can be mounted on the kernel protocol stack. Specifically, bind() of the kernel protocol stack is connected to the ebpf virtual machine through the first hook point, listen() or recvmsg() is connected to the ebpf virtual machine through the second hook point, and shutdown() etc. are connected to the ebpf virtual machine through the third hook point.

[0127] Thus, when the program to be detected in the user space is running, a system call is triggered, and "functions such as bind(), listen(), recvmsg(), shutdown()" are called from the kernel protocol stack to perform port connection operations. When the program to be detected calls the functions of the kernel protocol stack, the ebpf virtual machine will be triggered to perform information collection operations.

[0128] In the embodiment of the present application, when the program to be inspected calls bind() from the kernel protocol stack, the first hook point will be triggered to call the eBPF virtual machine to record information such as the IP, process ID, path name, and port of the program to be inspected. When the program to be inspected calls listen() or recvmsg() from the kernel protocol stack, the second hook point will be triggered to call the eBPF virtual machine to record the port opening time. When the program to be inspected calls shutdown() from the kernel protocol stack, the third hook point will be triggered to call the eBPF virtual machine to record the port closing time.

[0129] It should be noted that if the port is a TCP open port, listen() will be called to associate with the second hook point, and listen is used to determine the port opening event. If the port is a UDP open port, the first call of recvmsg() will be associated with the second hook point, and the port opening usage will be determined at the first call of recvmsg().

[0130] Since the eBPF virtual machine is located in the kernel space, the information collected by the eBPF virtual machine is also in the kernel space. For ease of use, it is also necessary to transfer the information in the kernel space to the user space. In the embodiment of the present application, the eBPF virtual machine can convert the information in the kernel state into the information in the user state through the eBPF maps mapping method. The server outputs the information in the user state or the detection result obtained from the information in the user state.

[0131] Through the above eBPF technology, it is possible to monitor and record ports, record the process information of ports, including process ID, process name, process path, etc., as well as record the port opening time and port closing time. And by using the method of eBPF hooking the corresponding functions in the protocol stack in the kernel, the present invention hardly affects the system performance during the recording process. The eBPF program runs in the kernel, featuring high efficiency and low latency, avoiding the performance overhead caused by frequent user-state and kernel-state switches in traditional methods. In this way, even in a high-load environment, the stability and efficiency of the system operation can be maintained. Further, by directly capturing and processing network events in the kernel, the risk of data loss is reduced. Traditional methods may cause some data to fail to be recorded in time due to problems with the logging system or other user-state programs, while the eBPF technology can ensure that all key events are captured and recorded, improving data integrity and reliability.

[0132] In addition, the embodiment of the present application also provides a port detection device.

[0133] Appendix Figure 6A structural schematic diagram of the port detection device provided by an embodiment of the present application, which is applied to a computing device. The device 600 includes: a collection unit 601, configured to trigger an eBPF virtual machine to collect ports through a hook point in the operating system kernel protocol stack when a program to be detected is running. A determination unit 602, configured to determine whether the program to be detected uses the port according to the port information.

[0134] That is, the port detection device can utilize the low-latency characteristics of the kernel space to achieve accurate and real-time collection of port information by triggering a target program through a hook point when the program to be detected is running. Compared with external detection tools or internal detection, this method can obtain port information accurately and in real time. Therefore, the risk of port undetected can be reduced.

[0135] Among them, the port information may include at least one of port time information for describing the port opening time period and port process information for describing the process corresponding to the open port.

[0136] Further, the device 600 may further include a mounting unit, and the mounting unit is configured to: load pre-compiled target information into the kernel space of the operating system; the target information indicates to mount a hook point at a specified position in the operating system kernel protocol stack; mount a hook point at the specified position in the kernel protocol stack according to the target information, and associate a target program corresponding to the program information at the hook point; the target program is configured to collect port information.

[0137] Optionally, the specified position includes a first function, a second function or a third function. The first function is used to associate a socket with a port, the second function is used to set the socket to a listening state or receive a message through the socket, and the third function is used to monitor the closing behavior of the socket.

[0138] The mounting unit is specifically configured to: mount a first hook point on the first function; mount a second hook point on the second function; mount a third hook point on the third function; when the program to be detected is running, trigger the eBPF virtual machine to collect port process information through the first hook point, trigger the eBPF virtual machine to collect the port opening time through the second hook point, and trigger the eBPF virtual machine to collect the port closing time through the third hook point. By setting hook points on the corresponding functions of the kernel protocol stack, port information can be accurately obtained without affecting the normal operation of the entire kernel protocol stack. In addition, since the first function, the second function and the third function will definitely be called every time when the program to be detected is running, accurate collection of port information can be achieved by setting hook points at these three functions.

[0139] Further, the second function may further include a first sub-function and a second sub-function. The first sub-function is used to set the socket to the listening state, and the second sub-function is used to receive messages through the socket. The mounting unit is further used to: if the program to be inspected communicates through TCP, mount a second hook point on the first sub-function; if the program to be inspected communicates through UDP, mount a second hook point at the first call of the second sub-function. In the embodiments of the present application, by defining that the second hook point is associated with the first sub-function and / or the first call of the second sub-function, it can be ensured that the collection of port information starts from the first use of the port. That is, this method can avoid missing any important state changes and also avoid remounting every time a call is made, which may generate redundant data or error messages, etc.

[0140] Optionally, the recording unit is further used to compile the target information from the first language to the second language by preloading the Berkeley Packet Filter Compiler Collection (BCC) compiler; the first language is a language that can be recognized by the operating system in the user space but cannot be recognized by the operating system in the kernel space; the second language is a language that can be recognized by the operating system in the kernel space. Then, the target information in the second language is loaded into the kernel space. By using the BCC compiler to compile the target information into a language that can be recognized by the kernel space, it can ensure that the kernel protocol stack correctly recognizes and correctly obtains the port status information.

[0141] Optionally, according to the extended Berkeley packet filter mapping function, the port information is transferred from the kernel space to the user space; in the user space, the open ports are determined according to the port information.

[0142] Further, the embodiments of the present application also provide a server.

[0143] Appendix Figure 7 The embodiments of the present application also provide a server 700. The application scenario of the server 700 is not specifically limited. For example, the server 700 is introduced by taking a server as an example. Specifically, the type of the server is not limited either. For example, the server can be a rack server or an edge server. The server can be located in a data center or in other areas, which is not specifically limited in the embodiments of the present application.

[0144] The server 700 includes a processor 701 and a memory 703. The memory 701 is electrically connected to the processor 703 respectively; the memory 703 is used to store program instructions for the port detection methods involved in the above embodiments; the processor 701 is used to call the corresponding parts of the above program instructions so that the server can execute the port detection methods involved in the above embodiments.

[0145] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions in the embodiments of the present application are generated in whole or in part.

[0146] The embodiments of the present application also provide a computer program product containing instructions. The computer program product can be a software or program product containing instructions that can run on a computing device or be stored in any available medium. When the computer program product runs on a computing device, it causes the computing device to execute the above port detection method. The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc. The computer-readable storage medium includes instructions that direct the computing device to execute the above port detection method.

[0147] The descriptions of the processes or structures corresponding to the above respective drawings each have their own focuses. For parts not detailed in a certain process or structure, reference can be made to the relevant descriptions of other processes or structures.

[0148] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A port detection method, characterized in that, The method includes: When the program to be inspected runs, trigger the extended Berkeley packet filter (eBPF) virtual machine through a hook point to collect port information of the port; the hook point is located in the kernel protocol stack of the operating system; Determine whether the program to be inspected uses the port according to the port information.

2. The detection method according to claim 1, wherein The port information includes at least one of port process information and port time information. The port time information is used to describe the open time period of the port, and the port process information is used to describe the process using the port.

3. The detection method according to claim 1, wherein Before triggering the target program to collect port information of the port through the hook point, the method further includes: Load pre-compiled target information into the eBPF virtual machine; the target information indicates to mount the hook point at a specified position in the kernel protocol stack; Mount the hook point at the specified position in the kernel protocol stack according to the target information.

4. The detection method according to claim 3, characterized in that If the setting position of the hook point includes a first function, a second function, or a third function, the first function is used to bind a socket to a port, the second function is used to set the socket to a listening state or receive a message through the socket, and the third function is used to monitor the closing behavior of the socket; When the program to be inspected runs, triggering the eBPF virtual machine to collect port information through the hook point includes: When the program to be inspected runs, trigger the eBPF virtual machine to collect the port process information through the first hook point, trigger the eBPF virtual machine to collect the port opening time through the second hook point, and trigger the eBPF virtual machine to collect the port closing time through the third hook point.

5. The detection method according to claim 3, wherein The second function includes a first sub-function and a second sub-function. Mounting the second hook point on the second function includes: If the program to be inspected communicates through the Transmission Control Protocol (TCP), mount the second hook point on the first sub-function, and the first sub-function is used to set the socket to a listening state; If the program to be inspected communicates through the User Datagram Protocol (UDP), mount the second hook point at the first call of the second sub-function, and the second sub-function is used to receive a message through the socket.

6. The detection method according to any one of claims 3-5, characterized in that, The method further includes: Compile the target information into a second language by pre-loading the Berkeley Packet Filter Compiler Collection (BCC) compiler; the second language is a language recognizable by the operating system; ​ 7. The detection method according to claim 3, characterized in that, ​ ​ 8. A port detection device, characterized in that, ​ ​ ​ 9. A computing device, characterized in that, ​ ​ The processor is configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method according to any one of claims 1-7.

10. A computer storage medium, characterized in that, For storing a computer program, which when executed is configured to implement the method according to any one of claims 1-7.

Images