Data acquisition method, electronic equipment, storage medium and program product
By mounting packet filters and kprobe technology in the kernel, fileless attack behavior can be monitored and recorded in real time, solving the problem of missed detection in traditional detection methods and improving the accuracy of fileless attack identification and system performance.
Patent Information
- Application Number
- CN202511334492.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-18
- Publication Date
- 2026-02-06
AI Technical Summary
Traditional host security detection methods cannot record malicious code in fileless attack scenarios. Memory scanning has high performance overhead and detection window limitations, leading to missed detections.
By pre-loading packet filters into the kernel's pipe write and read functions, and utilizing ebpf and kprobe techniques, process information in memory space is monitored to obtain real-time information on processes writing and reading data, determine their relationships, and record fileless attack behaviors.
It enables real-time recording of fileless attack behaviors, avoids attack blind spots during the detection window interval, improves detection accuracy and performance stability, and avoids delays to critical services.
Smart Images
Figure CN121479768A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of cloud security technology, and in particular to a data acquisition method, electronic device, storage medium, and program product. Background Technology
[0002] In the field of host security detection, accurately recording the content of malicious scripts executed on a host is crucial for security detection. Traditional host security detection methods monitor file behavior on the disk, recording file content and performing detection when files are added or modified. However, in fileless attack scenarios, malicious code executes directly in memory without being written to disk. Therefore, traditional host security detection methods cannot record malicious code in fileless attack scenarios.
[0003] In related technologies, security detection is performed through memory scanning. However, memory scanning has significant performance overhead, which may cause significant delays to critical services and may pose stability risks. In addition, memory scanning has a detection window limitation, which may miss momentary attacks and create attack blind spots during the detection window interval, leading to missed detection problems. Summary of the Invention
[0004] This application provides a data acquisition method, electronic device, storage medium, and program product to solve at least one of the above-mentioned technical problems.
[0005] In a first aspect, embodiments of this application provide a data acquisition method, comprising: if a pipe write request is detected, then using a packet filter to obtain the first process information of a first process writing data in the memory space of the pipe, and the first parent process information of the parent process of the first process; the packet filter is pre-loaded into the pipe write function and the pipe read function in the kernel; using the packet filter to parse the pipe write function to obtain the first pipe information and the written data; if a pipe read request is detected, then using the packet filter to obtain the second process information of a second process reading data in the memory space of the pipe, and the second parent process information of the parent process of the second process; using the packet filter to parse the pipe read function to obtain the second pipe information; if the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, then reporting the first process information, the written data, and the second process information to the user space.
[0006] Secondly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor implements any of the methods described above when executing the computer program.
[0007] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the methods described above.
[0008] Fourthly, embodiments of this application provide a computer program product, which includes a computer program that, when executed by a processor, implements any of the methods described above.
[0009] Compared with the prior art, this application has the following advantages:
[0010] This application provides a data acquisition method, electronic device, storage medium, and program product. If a pipe write request is detected, a packet filter is used to obtain the first process information of the first process writing data in the pipe's memory space, as well as the first parent process information of the first process's parent process. The packet filter is pre-loaded into the pipe write and pipe read functions in the kernel. The packet filter is used to parse the pipe write function to obtain the first pipe information and the written data. If a pipe read request is detected, the packet filter is used to obtain the second process information of the second process reading data in the pipe's memory space, as well as the second parent process information of the second process's parent process. The packet filter is used to parse the pipe read function to obtain the second pipe information. If the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, the first process information, the written data, and the second process information are reported to user space. In this embodiment, a packet filter is pre-mounted into the pipe write and pipe read functions in the kernel. If the pipe information and parent process information corresponding to the written and read data match, meaning the data is written and read within the pipe's memory space without being written to disk, it may indicate a fileless attack. In this case, the relevant process information and the written data are reported to user space, thus recording the fileless attack. By mounting the packet filter, data acquisition can be triggered in real time, avoiding attack blind spots caused by the detection window interval in memory scanning. Moreover, it does not cause delays to critical services, resulting in better performance and stability. Furthermore, by determining whether the parent process information corresponding to the written and read data matches, a kinship verification is performed, which improves the correlation accuracy between the written and read data, thereby improving the accuracy of fileless attack identification.
[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application, it can be implemented according to the contents of the specification. In order to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description
[0012] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments according to this application and should not be construed as limiting the scope of this application.
[0013] Figure 1 This is a schematic diagram illustrating an application scenario of a data acquisition method according to an embodiment of this application.
[0014] Figure 2 This is a flowchart of a data acquisition method according to an embodiment of this application.
[0015] Figure 3 This is a flowchart of a data acquisition method according to an embodiment of this application.
[0016] Figure 4 This is a structural block diagram of a data acquisition device according to an embodiment of this application.
[0017] Figure 5 This is a block diagram of an electronic device used to implement embodiments of this application. Detailed Implementation
[0018] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the concept or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.
[0019] To facilitate understanding of the technical solutions of the embodiments of this application, the relevant technologies of the embodiments of this application are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this application in any way, and all of them fall within the protection scope of the embodiments of this application.
[0020] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.
[0021] The following is a description of the technical terms used in this application:
[0022] ebpf (Extended Berkeley Packet Filter) allows for the efficient and safe execution of specific code based on system or program events without recompiling the kernel.
[0023] Fileless attack: A covert attack technique that uses legitimate system tools and processes to execute malicious code directly in memory without leaving any trace of malicious files on the disk.
[0024] kprobe: A kernel-mode dynamic instrumentation technique that uses two types of exception instructions, "breakpoint exception" and "single-step exception," to instrument arbitrary addresses.
[0025] Pipe: An inter-process communication mechanism that uses a memory buffer to connect the standard input / output of two processes, allowing the output of one process to be directly used as the input of another process without the need for a temporary file.
[0026] Figure 1 This is a schematic diagram illustrating an application scenario of the data acquisition method provided in this application. The method in this embodiment can be applied to a terminal device, i.e., the host side. A packet filter (e.g., ebpf) is pre-mounted into the pipe write and pipe read functions in the kernel. If the pipe information and parent process information corresponding to the written data and read data match, it may indicate a fileless attack. In this case, the process information related to the attack and the written data are reported to user space, thereby recording the fileless attack.
[0027] The ebpf program is pre-compiled into corresponding ebpf bytecode in user space, and then passed to the kernel via a system call instruction, such as the bpf() instruction. The ebpf bytecode is the packet filter in this embodiment. The kernel verifies the security and compliance of the ebpf bytecode. If the verification passes, the ebpf bytecode is dynamically compiled into the native code of the underlying hardware platform using Just-In-Time (JIT) compilation. JIT compilation occurs during program execution and can be optimized by incorporating runtime information, thereby improving execution efficiency. Then, the native code is pre-mounted into the pipe write and read functions. The kprobe technique is combined with ebpf to monitor the pipe write and read functions. If a data write request is detected in the pipe's memory space, ebpf is used to obtain the first process information of the first process writing data, as well as the first parent process information of the first process's parent process. The pipe write function is then parsed using ebpf to obtain the first pipe information and the data to be written. Then, a hash map is constructed, which consists of key-value pairs. The key in the key-value pair is the first pipeline information, and the value in the key-value pair includes the first process information, the first parent process information, and the data to be written.
[0028] If a data read request is detected in the pipe's memory space, the second process information of the second process reading the data, as well as the second parent process information of the second process's parent process, are obtained using EBPF. The pipe read function is then parsed using EBPF to obtain the second pipe information. The hash map is then queried using the second pipe information. If no matching first pipe information is found, the process exits. If a matching first pipe information is found, the first parent process information associated with the first pipe information is compared with the second parent process information. If they match, it indicates a kinship between the process writing data and the process reading data, which is highly likely a fileless attack. In this case, data is reported: the first process information, the written data, and the second process information are written to an event array (EVENT_ARRAY), and the event array is reported to user space. The first process information includes the first process name and first process identifier, and the second process information includes the second process name and second process identifier. If the information of the first parent process does not match the information of the second parent process, it indicates that the process writing data and the process reading data are not related. Therefore, data does not need to be reported, thus avoiding invalid reporting and improving the accuracy of data reporting.
[0029] When it is necessary to read relevant data about a fileless attack event, the data in the buffer can be read in user space through the event callback (event_cb) process. It is also possible to determine whether data has been lost and which data has been lost in user space through the loss callback (lost_cb) process.
[0030] This application provides a data acquisition method, which can be applied to terminal devices with computing and processing capabilities. Figure 2 The diagram shown is a flowchart of a data acquisition method according to an embodiment of this application, including:
[0031] Step S201: If a pipe write request is detected, the packet filter obtains the first process information of the first process that writes data in the memory space of the pipe, and the first parent process information of the parent process of the first process.
[0032] The packet filter is pre-loaded into the kernel's pipe write and pipe read functions. The packet filter can be an ebpf.
[0033] In the Linux kernel, the pipe_write function is used to write data to the pipe's memory space. A probe point (hook) is inserted at the entry point of the pipe_write function using the kprobe mechanism. This probe point is triggered when a process calls pipe_write. The ebpf program is executed to obtain information about the process currently executing pipe_write (i.e., the first process information), including the process ID (writer_pid), process name (writer_name), and parent process ID (writer_ppid).
[0034] The kprobe mechanism allows users to insert probe points at the entry, return, or instruction points of kernel functions without modifying the kernel code or restarting the system. This allows developers to collect real-time information about kernel operations for performance analysis, troubleshooting, or studying kernel behavior.
[0035] Step S202: Use a packet filter to parse the pipe writing function to obtain the first pipe information and the written data.
[0036] The `pipe_write` function has multiple parameters. When an EBPF program executes, the parameters of the `pipe_write` function are parsed to obtain information about the pipe through which data is being written, such as the pipe identifier, thus indicating which pipe the data was written to. Additionally, it can also determine exactly what data was written to the memory space of that pipe.
[0037] Step S203: If a pipe read request is detected, the second process information of the second process that reads data in the memory space of the pipe and the second parent process information of the parent process of the second process are obtained by using a packet filter.
[0038] At the entry point of the pipe read function `pipe_read`, EBPF's kprobe mechanism is also used to insert a probe point (hook). When a process calls `pipe_read`, this probe point is triggered. The EBPF program is executed to obtain information about the process currently executing `pipe_read` (i.e., the second process information), including the process ID (`reader_pid`), process name (`reader_name`), and parent process ID (`reader_ppid`).
[0039] By combining kprobe technology with packet filtering, the packet filter is pre-loaded into the pipe write and pipe read functions in the kernel. Monitoring is performed by triggering probe points, and data is acquired in real time, avoiding the attack blind spots caused by the detection window interval of memory scanning methods in related technologies.
[0040] Step S204: Use a data packet filter to parse the pipe reading function to obtain the second pipe information.
[0041] The pipe_read function has multiple parameters. When the ebpf program is executed, the parameters of the pipe_read function are parsed to obtain the pipe information for reading data, such as the pipe identifier, so as to know which pipe to read data from.
[0042] Step S205: If the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, then the first process information, the written data, and the second process information are reported to the user space.
[0043] If the second pipe information matches the first pipe information, it indicates that the pipes for writing and reading data are the same. If the second parent process information matches the first parent process information, it indicates that the processes for writing and reading data are related, meaning that data is written and read in memory space without being written to disk, which matches the characteristics of a fileless attack. Therefore, it is likely a fileless attack, and the process information for reading data, the process information for writing data, and the specific data written are reported to the user space, recording the fileless attack behavior in the user space.
[0044] The data acquisition method provided in this application embodiment, if a pipe write request is detected, then a packet filter is used to obtain the first process information of the first process writing data in the memory space of the pipe, and the first parent process information of the parent process of the first process; the packet filter is pre-mounted in the pipe write function and the pipe read function in the kernel; the packet filter is used to parse the pipe write function to obtain the first pipe information and the written data; if a pipe read request is detected, then a packet filter is used to obtain the second process information of the second process reading data in the memory space of the pipe, and the second parent process information of the parent process of the second process; the packet filter is used to parse the pipe read function to obtain the second pipe information; if the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, then the first process information, the written data, and the second process information are reported to the user space. In this embodiment, a packet filter is pre-mounted into the pipe write and pipe read functions in the kernel. If the pipe information and parent process information corresponding to the written and read data match, meaning the data is written and read within the pipe's memory space without being written to disk, it may indicate a fileless attack. In this case, the relevant process information and the written data are reported to user space, thus recording the fileless attack. By mounting the packet filter, data acquisition can be triggered in real time, avoiding attack blind spots caused by the detection window interval in memory scanning. Moreover, it does not cause delays to critical services, resulting in better performance and stability. Furthermore, by determining whether the parent process information corresponding to the written and read data matches, a kinship verification is performed, which improves the correlation accuracy between the written and read data, thereby improving the accuracy of fileless attack identification.
[0045] The following describes the specific implementation process of each step above through various implementation methods:
[0046] In one implementation, a packet filter is used to parse the pipe write function to obtain first pipe information and write data, including: parsing the first part of the parameters of the pipe write function using a packet filter to obtain first pipe information; and parsing the second part of the parameters of the pipe write function using a packet filter to obtain write data.
[0047] The packet filter is ebpf. Executing the ebpf program, for the pipe write function `pipe_write(struct kiocb*iocb, struct iov_iter*from)`, parses the first parameter `struct kiocb*iocb` to obtain `struct file*filp`. From `struct file*filp`, the pipe information for the write operation can be further extracted, such as the unique identifier of the pipe to be written, `struct pipe_inode_info*pipe`. Parsing the second parameter `struct iov_iter*from` yields the data to be written to the pipe.
[0048] In this embodiment, the pipeline writing function is parsed using a packet filter to obtain the pipeline information and the specific writing data, thereby obtaining the specific information of the writing operation, which is convenient for comparison with subsequent reading operations to determine whether data should be reported.
[0049] In one implementation, a packet filter is used to parse the pipe reading function to obtain the second pipe information, including: using a packet filter to parse the first part of the parameters of the pipe reading function to obtain the second pipe information.
[0050] When executing the ebpf program, for the pipe read function pipe_read(struct kiocb*iocb,struct iov_iter*to), the first part of the parameter struct kiocb*iocb is parsed to obtain struct file*filp. From struct file*filp, the pipe information for the read operation can be further extracted, such as the unique identifier of the read pipe struct pipe_inode_info*pipe.
[0051] In this embodiment, the pipeline read function is parsed using a packet filter to obtain the pipeline information of the read operation, which is convenient for comparison with the write operation to determine whether data should be reported.
[0052] In one implementation, after parsing the pipe write function using a packet filter to obtain the first pipe information and the written data, the method further includes: constructing a hash map, where the hash map is a key-value pair, the key in the key-value pair is the first pipe information, and the value in the key-value pair includes the first process information, the first parent process information, and the written data; the matching of the second pipe information and the first pipe information is determined by: using the second pipe information, querying in the hash map, and determining whether the second pipe information and the first pipe information match based on the query result.
[0053] Specifically, after parsing the pipe writing function using a packet filter to obtain the first pipe information and the written data, a hash map is constructed and stored using the first pipe information, the first process information, the first parent process information, and the written data.
[0054] When determining whether to report data, the process uses the pipe information of the read operation (e.g., the unique identifier of the pipe) to query the hash map. If a matching pipe information for a write operation is found, it may indicate a fileless attack, and the relationship between the write and read processes will be verified subsequently. If no matching pipe information for the written data is found, the process exits without reporting data.
[0055] In this embodiment, a hash mapping with pipe information as the key and related process context (process information, parent process information) and written data as the value is used to realize the correlation tracking and cross-context matching analysis of inter-process communication behavior, thereby realizing the tracking and auditing of pipe communication.
[0056] In one implementation, the matching of the second parent process information with the first parent process information is determined as follows: if the first pipe information that matches the second pipe information is found in the hash map, the first parent process information associated with the first pipe information is compared with the second parent process information, and the matching result is used to determine whether the second parent process information matches the first parent process information.
[0057] If the hash map finds a first pipe information that matches the second pipe information, it indicates that the read and write operations are in the same pipe. Then, it further compares whether the parent processes of the write and read operations match. For example, it checks whether the parent process identifiers of the write and read operations are the same. If they match, it indicates that the write and read operations are related, which may be a fileless attack. The data related to the write and read operations is then reported to the user space for recording.
[0058] In this embodiment, by verifying the affinity between the processes of write operations and read operations, the correlation accuracy between data writing and data reading can be improved, erroneous reporting can be avoided, and the accuracy of data reporting can be improved.
[0059] In one implementation, the first process information includes a first process name and a first process identifier, and the second process information includes a second process name and a second process identifier. Reporting the first process information, the written data, and the second process information to the user space includes: if the first process name and the second process name are in a preset list of fileless attack processes, then reporting the first process information, the written data, and the second process information to the user space. The list of fileless attack processes includes the process name of at least one process that reads data in the memory space of the pipe, and the process name of at least one process that writes data in the memory space of the pipe.
[0060] In practical applications, a list of processes for common fileless attacks can be pre-set based on expert experience. This list includes the process names of read and write operations during the execution of a fileless attack. If, after kinship verification, the process names of the read and write operations are found in the fileless attack process list, it indicates a fileless attack, and data is reported. Otherwise, it indicates that the attack is not of interest, and no data is reported.
[0061] In this embodiment, by pre-setting a list of fileless attack processes and using the list to filter process names, the amount of reported data can be effectively reduced, thereby reducing the performance impact.
[0062] In one implementation, reporting the first process information, the written data, and the second process information to the user space includes: writing the first process information, the written data, and the second process information into an event array, and reporting the event array to the user space.
[0063] In practical applications, relevant data (e.g., the process identifier `writer_pid` for writing data, the process name `writer_name` for writing data, the data `writer_data` for writing data, the process identifier `reader_pid` for reading data, and the process name `reader_name` for reading data) can be reported to user space. This can be achieved through the event mechanism provided by EBPF. For example, the relevant data can be written to an event array (`EVENT_ARRAY`), which can then be read and processed by the user-space program, thus enabling the recording of file-free attack behavior.
[0064] In this embodiment, secure and efficient data transfer from the kernel to user space can be achieved by reporting through an event array.
[0065] This application provides a data acquisition method, which can be applied to terminal devices with computing and processing capabilities.
[0066] like Figure 3The diagram shown is a flowchart of a data acquisition method according to an embodiment of this application, including:
[0067] Step S301: If a pipe write request is detected, the first process information of the first process that writes data in the memory space of the pipe and the first parent process information of the parent process of the first process are obtained by using a packet filter.
[0068] The packet filter is pre-loaded into the pipe write and pipe read functions in the kernel.
[0069] Step S302: Use a data packet filter to parse the first part of the parameters of the pipe writing function to obtain the first pipe information.
[0070] Step S303: Construct a hash map. The hash map is a key-value pair. The key in the key-value pair is the first pipe information, and the value in the key-value pair includes the first process information, the first parent process information, and the data to be written.
[0071] Step S304: Use a packet filter to parse the second part of the parameters of the pipe write function to obtain the write data.
[0072] Step S305: If a pipe read request is detected, the second process information of the second process that reads data in the memory space of the pipe and the second parent process information of the parent process of the second process are obtained by using a packet filter.
[0073] Step S306: Use a data packet filter to parse the first part of the parameters of the pipe reading function to obtain the second pipe information.
[0074] Step S307: Using the second pipeline information, perform a query in the hash map, and determine whether the second pipeline information and the first pipeline information match based on the query result.
[0075] Step S308: If the second pipe information matches the first pipe information, then compare the first parent process information associated with the first pipe information with the second parent process information.
[0076] Step S309: If the information of the second parent process matches the information of the first parent process, then the information of the first process, the data to be written, and the information of the second process are reported to the user space.
[0077] Corresponding to the application scenarios and methods provided in the embodiments of this application, the embodiments of this application also provide a data acquisition device. For example... Figure 4 The diagram shown is a structural block diagram of a data acquisition device according to an embodiment of this application. The device includes:
[0078] The first acquisition module 401 is used to obtain, if a pipe write request is detected, the first process information of the first process writing data in the pipe's memory space, and the first parent process information of the first process's parent process, using a packet filter. The packet filter is pre-loaded into the pipe write and pipe read functions in the kernel.
[0079] The first parsing module 402 is used to parse the pipe writing function using a data packet filter to obtain the first pipe information and the written data.
[0080] The second acquisition module 403 is used to acquire, by means of a packet filter, the second process information of the second process reading data in the memory space of the pipe, and the second parent process information of the parent process of the second process if a pipe read request is detected.
[0081] The second parsing module 404 is used to parse the pipe reading function using a data packet filter to obtain the second pipe information.
[0082] The data reporting module 405 is used to report the first process information, the written data, and the second process information to the user space when the second pipeline information matches the first pipeline information and the second parent process information matches the first parent process information.
[0083] The data acquisition device provided in this application embodiment, if a pipe write request is detected, uses a packet filter to obtain the first process information of the first process writing data in the memory space of the pipe, and the first parent process information of the parent process of the first process; the packet filter is pre-loaded into the pipe write function and the pipe read function in the kernel; the packet filter is used to parse the pipe write function to obtain the first pipe information and the written data; if a pipe read request is detected, the packet filter is used to obtain the second process information of the second process reading data in the memory space of the pipe, and the second parent process information of the parent process of the second process; the packet filter is used to parse the pipe read function to obtain the second pipe information; if the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, the first process information, the written data, and the second process information are reported to the user space. In this embodiment, a packet filter is pre-mounted into the pipe write and pipe read functions in the kernel. If the pipe information and parent process information corresponding to the written and read data match, meaning the data is written and read within the pipe's memory space without being written to disk, it may indicate a fileless attack. In this case, the relevant process information and the written data are reported to user space, thus recording the fileless attack. By mounting the packet filter, data acquisition can be triggered in real time, avoiding attack blind spots caused by the detection window interval in memory scanning. Moreover, it does not cause delays to critical services, resulting in better performance and stability. Furthermore, by determining whether the parent process information corresponding to the written and read data matches, a kinship verification is performed, which improves the correlation accuracy between the written and read data, thereby improving the accuracy of fileless attack identification.
[0084] In one implementation, the first parsing module 402 is used for:
[0085] The first part of the parameters of the pipe writing function is parsed using a packet filter to obtain the first pipe information;
[0086] The second part of the parameters of the pipe write function is parsed using a packet filter to obtain the write data.
[0087] In one implementation, the second parsing module 404 is used for:
[0088] The first part of the parameters of the pipe reading function is parsed using a packet filter to obtain the second pipe information.
[0089] In one implementation, the apparatus is further configured to: after parsing the pipe write function using a packet filter to obtain the first pipe information and the write data, construct a hash map, wherein the hash map is a key-value pair, the key in the key-value pair is the first pipe information, and the value in the key-value pair includes the first process information, the first parent process information, and the write data;
[0090] The matching of the second pipeline information and the first pipeline information is determined in the following way: using the second pipeline information, a query is performed in the hash map, and the matching of the second pipeline information and the first pipeline information is determined based on the query results.
[0091] In one implementation, the matching of the second parent process information with the first parent process information is determined in the following way:
[0092] If a first pipe information matching the second pipe information is found in the hash map, the first parent process information associated with the first pipe information is compared with the second parent process information, and the comparison result determines whether the second parent process information matches the first parent process information.
[0093] In one implementation, the first process information includes a first process name and a first process identifier, the second process information includes a second process name and a second process identifier, and the data reporting module 405 is used for:
[0094] If the first process name and the second process name are in the preset list of fileless attack processes, the information of the first process, the written data, and the information of the second process are reported to the user space. The list of fileless attack processes includes the process name of at least one process that reads data in the memory space of the pipe, and the process name of at least one process that writes data in the memory space of the pipe.
[0095] In one implementation, the data reporting module 405 is used to: write the first process information, the written data, and the second process information into an event array, and report the event array to the user space.
[0096] The functions of each module in the embodiments of this application can be found in the corresponding descriptions in the above methods, and they have corresponding beneficial effects, which will not be repeated here.
[0097] Figure 5 This is a block diagram of an electronic device used to implement embodiments of this application. For example... Figure 5 As shown, the electronic device includes a memory 510 and a processor 520. The memory 510 stores a computer program that can run on the processor 520. When the processor 520 executes the computer program, it implements the method described in the above embodiments. The number of memories 510 and processors 520 can be one or more.
[0098] The electronic device also includes:
[0099] The communication interface 530 is used to communicate with external devices and exchange and transmit data.
[0100] If the memory 510, processor 520, and communication interface 530 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0101] Optionally, in a specific implementation, if the memory 510, processor 520, and communication interface 530 are integrated on a single chip, then the memory 510, processor 520, and communication interface 530 can communicate with each other through an internal interface.
[0102] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method provided in this application.
[0103] This application provides a computer program product, which includes a computer program that, when executed by a processor, implements the method provided in this application.
[0104] This application also provides a chip including a processor for calling and executing instructions stored in a memory, causing a communication device with the chip installed to perform the method provided in this application.
[0105] This application also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.
[0106] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Machines (ARM) architecture.
[0107] Further, optionally, the aforementioned memory may include read-only memory and random access memory. The memory may be volatile memory or non-volatile memory, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available. Examples include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).
[0108] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.
[0109] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.
[0110] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.
[0111] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.
[0112] The logic and / or steps described in the flowchart or otherwise herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).
[0113] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.
[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.
[0115] The above description is merely an exemplary embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope described in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A data acquisition method, characterized in that, include: If a pipe write request is detected, the packet filter is used to obtain the first process information of the first process that writes data to the memory space of the pipe, as well as the first parent process information of the parent process of the first process; the packet filter is pre-loaded into the pipe write function and pipe read function in the kernel; The packet filter is used to parse the pipe writing function to obtain the first pipe information and the written data; If a pipe read request is detected, the packet filter is used to obtain the second process information of the second process that reads data in the pipe's memory space, as well as the second parent process information of the parent process of the second process. The second pipeline information is obtained by parsing the pipeline reading function using the packet filter. If the second pipe information matches the first pipe information, and the second parent process information matches the first parent process information, then the first process information, the written data, and the second process information are reported to the user space.
2. The method according to claim 1, characterized in that, The step of parsing the pipe write function using the packet filter to obtain the first pipe information and the write data includes: The first part of the parameters of the pipe writing function is parsed using the packet filter to obtain the first pipe information; The second part of the parameters of the pipe write function is parsed using the packet filter to obtain the write data.
3. The method according to claim 1, characterized in that, The step of parsing the pipeline reading function using the data packet filter to obtain the second pipeline information includes: The first part of the parameters of the pipeline reading function is parsed using the data packet filter to obtain the second pipeline information.
4. The method according to claim 1, characterized in that, After parsing the pipe write function using the packet filter to obtain the first pipe information and the write data, the method further includes: Construct a hash map, wherein the hash map is a key-value pair, the key in the key-value pair is the first pipe information, and the value in the key-value pair includes the first process information, the first parent process information, and the written data; The matching of the second pipeline information and the first pipeline information is determined in the following way: Using the second pipeline information, a query is performed in the hash map, and the query result determines whether the second pipeline information and the first pipeline information match.
5. The method according to claim 4, characterized in that, The matching of the second parent process information with the first parent process information is determined in the following way: If the hash map finds first pipe information that matches the second pipe information, then the first parent process information associated with the first pipe information is compared with the second parent process information, and the comparison result determines whether the second parent process information matches the first parent process information.
6. The method according to any one of claims 1-5, characterized in that, The first process information includes a first process name and a first process identifier, and the second process information includes a second process name and a second process identifier. Reporting the first process information, the written data, and the second process information to user space includes: If the first process name and the second process name are in a preset list of fileless attack processes, then the first process information, the written data, and the second process information are reported to the user space. The list of fileless attack processes includes the process name of at least one process that reads data in the memory space of the pipe, and the process name of at least one process that writes data in the memory space of the pipe.
7. The method according to any one of claims 1-5, characterized in that, The step of reporting the first process information, the written data, and the second process information to the user space includes: The first process information, the written data, and the second process information are written into an event array, and the event array is reported to the user space.
8. An electronic device, characterized in that, The electronic device includes a memory, a processor, and a computer program stored in the memory, wherein the processor, when executing the computer program, implements the method of any one of claims 1-7.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-7.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1-7.