Method for monitoring integrity of multiple elements of host system

Abstract

The invention discloses a host system multi-element integrity monitoring method, which is based on a TPM / TCM chip, a user-defined kernel module, a cryptographic algorithm and an eBPF dynamic instrumentation technology to realize identity binding of a host system TPM / TCM and integrity monitoring of kernel invariants, user mode sensitive files and system kernel security events. According to the invention, multi-node concurrent management is supported, and security protection in a distributed environment can be realized; the server side can formulate a personalized credible protection strategy for the host nodes, and the data security protection capability of the host system is enhanced. And the authenticability and the integrity of the integrity monitoring report are ensured. A periodic integrity monitoring report is realized through the measurement agent, so that a system kernel and a sensitive file can be effectively prevented from being tampered, an operation track of a malicious process can be tracked, and an unauthorized execution behavior of the malicious process can be detected. The risk that system data are illegally stolen can be effectively avoided, and the phenomenon that key resources such as system computing power and storage are used up by malicious processes through resource abuse is eradicated.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of computer system security and trusted computing, and specifically relates to a multi-element integrity monitoring method for a host system. BACKGROUND

[0002] Under the background of the digital wave sweeping the world, computer systems and networks have become the core support for the operation of modern society, and their influence penetrates into all key infrastructure fields such as finance, medicine, transportation, and energy. Financial institutions completely rely on online transaction systems to handle daily trillions of capital flows, and any system failure or security vulnerability can trigger a chain of financial risks; the medical industry realizes precise diagnosis and treatment through electronic health record systems and intelligent medical devices, and the reliability and security of the system are directly related to the health of patients; the transportation sector relies on intelligent traffic scheduling and automated ticketing systems to ensure smooth and safe urban public transportation, and system security incidents can cause large-scale traffic paralysis. This deep dependence makes the stable operation of digital infrastructure a basic prerequisite for the normal operation of society.

[0003] With the vigorous development of Internet of Things technology and the rapid popularization of 5G networks, a new era of Internet of Everything has arrived. According to authoritative forecasts, by 2025, the number of Internet of Things devices connected globally will exceed 40 billion. These devices include intelligent sensors in industrial control systems, monitoring devices in smart cities, various terminals in smart homes, and increasingly popular Internet of Vehicles devices. They form a huge and complex network ecosystem, realizing the deep integration of the physical and digital worlds. However, this interconnection greatly expands the potential attack surface, with attack vectors extending from traditional servers and personal computers to various edge devices. More seriously, many Internet of Things devices have inherent defects such as limited hardware resources, weak security protection, and difficulty in updating patches in a timely manner, making them ideal targets for attackers. These devices often interact with home networks, enterprise intranets, and even cloud services, and once a weak link is breached, attackers can use it as a stepping stone to cause chain damage to the entire network ecosystem.

[0004] In today's digital era, computer systems and networks have become a core component of social infrastructure, and it is essential to ensure their safe and reliable operation. In the face of increasingly complex security threats, traditional security protection mechanisms have shown many essential defects. As the first line of defense for network security, firewalls mainly filter network traffic based on IP addresses, ports, and protocols through predefined access control policies. However, in the face of modern advanced persistent threats, this approach based on border protection has proven to be inadequate. Attackers can easily bypass traditional firewall detection by disguising malicious traffic as legitimate communication through techniques such as SSL encryption tunnels and domain name generation algorithms. In particular, in today's zero-trust architecture, simple border protection cannot meet the needs of internal threat protection.

[0005] Intrusion detection systems play an important role in network security monitoring, but their detection mechanisms mainly rely on feature matching of known attack patterns and statistical analysis-based anomaly detection. This method significantly reduces detection effectiveness when facing zero-day attacks, advanced persistent threats, or carefully designed low-frequency attacks. At the same time, IDS systems generally have a high false alarm rate, and security operations personnel have to spend a lot of time verifying alarms, resulting in low security operation efficiency, and even real threats may be ignored due to alarm fatigue.

[0006] Antivirus software, as a traditional means of terminal protection, its core mechanism is based on feature library-based malicious code detection. This mechanism has a natural lag, and the update of the virus feature library will always lag behind the emergence of new malicious code. Especially in the face of modern malicious software with features such as transformation, encryption, and polymorphism, the traditional feature detection method has limited effectiveness. More seriously, security software itself may have vulnerabilities, and in recent years, there have been several cases of attackers exploiting security software vulnerabilities to gain system privileges. For example, some advanced attacks can bypass the protection mechanism of security software, or even directly tamper with the core components of security software, rendering it unable to protect. According to the latest network security threat report, more than 60% of organizations say that traditional security solutions cannot effectively detect and block new attacks. This lack of protection capability directly leads to the frequent occurrence of security incidents, causing serious consequences for various organizations.

[0007] As the final execution unit of data processing, the security state of the host system is affected by multiple important factors, forming a complex security protection system. At the operating system level, the integrity of the kernel is the cornerstone of system security. Once the integrity of kernel critical data structures such as system call tables, interrupt descriptor tables, and memory management unit configurations is compromised, attackers can completely control the system through Rootkit technology and perfectly hide their malicious activities. Traditional security monitoring methods often run in user mode or rely on tampered kernel functions, so it is difficult to detect such underlying tampering. Existing technologies lack effective mechanisms for continuous and lightweight measurement of kernel invariants, and cannot continuously verify the integrity of kernel critical components during system operation.

[0008] At the user level, application programs, configuration files, scripts, and other digital assets face serious security challenges. Tampering with system configuration files can cause service abnormalities or privilege escalation; application programs implanted with malicious code can cause data leakage; and script files modified can provide a persistent channel for attackers. Although traditional file integrity monitoring solutions can detect file changes, they often have large performance overhead, coarse detection granularity, and lack of trusted benchmarks. More importantly, these solutions often lack close integration with hardware trust roots, making it possible for attackers to tamper with the monitoring software itself or its benchmark database.

[0009] At the system runtime behavior level, the ultimate goal of malicious software is to achieve its attack intent by performing specific system operations. These operations include process creation, privilege escalation, file access, network communication, and other behaviors. Existing monitoring tools such as system audit logs can record these events, but their data granularity is coarse, the information volume is large, and the analysis process is severely lagging. Traditional solutions cannot achieve fine-grained, real-time monitoring of kernel events, and lack the ability to block malicious behavior immediately when it occurs. According to statistics, the average time from attack to detection is still more than 100 days, fully exposing the shortcomings of existing monitoring methods.

[0010] At the technical implementation level of the monitoring mechanism, integrity measurement based on cryptography provides basic security assurance. Through hash algorithms and digital signature technology, the integrity and authenticity of monitoring data can be ensured, providing a reliable basis for security decisions. However, pure cryptographic security cannot solve all problems, and needs to be deeply integrated with other technologies to maximize benefits.

[0011] In recent years, the emergence of Extended Berkeley Packet Filter (eBPF) has brought a revolutionary breakthrough to the security monitoring of operating system kernels. EBPF technology originates from traditional BPF technology and was initially designed as a network packet filtering mechanism. Its main goal is to achieve fast packet filtering at the kernel level through an efficient instruction set, avoiding unnecessary data copying and thus improving the performance of network analysis tools. The core innovation of eBPF lies in extending the BPF instruction set, originally limited to the network domain, into a general-purpose kernel virtual machine execution environment. This technology allows developers to write specific eBPF programs, which, after rigorous security verification, are loaded into the kernel for execution without recompiling the kernel or loading additional kernel modules.

[0012] The advantages of eBPF technology lie in its exceptional flexibility and high performance. eBPF programs can bind to various kernel hooks, including kprobe, tracepoint, and XDP, enabling dynamic monitoring of kernel events. Furthermore, the eBPF Maps mechanism facilitates efficient data exchange between kernel and user space. These characteristics make eBPF an ideal tool for achieving high-performance, low-overhead kernel event monitoring, and it is currently widely used in security monitoring, performance analysis, network control, and many other fields.

[0013] At the hardware security level, hardware security chips such as Trusted Platform Modules (TPMs) provide a solid foundation of trust for system security. TPM chips can securely generate and store encryption keys, provide hardware-protected cryptographic operations, and establish a chain of trust through trusted metrics. However, most existing TPM applications are limited to static verification during system startup, and their robust security capabilities fail to extend fully to the entire system lifecycle. This limitation results in insufficient hardware-level security guarantees for dynamic runtime security monitoring.

[0014] The current host security landscape exhibits significant "protection gaps," primarily manifested in the fragmentation across three layers: kernel integrity protection, file security monitoring, and runtime behavior analysis operate independently, lacking a unified protection framework. This fragmentation leads to blind spots, allowing attackers to exploit the gaps between different protection layers. For example, an attacker might tamper with the kernel structure to hide file operations and then use legitimate system processes to execute malicious actions, thereby bypassing each independent protection mechanism.

[0015] A deeper problem lies in the fact that existing solutions lack an overall architecture that organically combines hardware root of trust, deep kernel monitoring, and user-space asset protection. Traditional security monitoring often relies on interfaces and functions provided by the operating system itself; when the system kernel has been compromised, the reliability of these monitoring methods becomes questionable. Furthermore, hardware-based security solutions are often limited to specific use cases and cannot provide comprehensive support for system security during runtime.

[0016] This systemic flaw often renders modern hosts passive and vulnerable to sophisticated, well-designed attacks. Attackers can exploit information asymmetry and time differences between different layers of protection to achieve persistent and covert attacks. Industry analysis reports indicate that over 80% of enterprises believe their existing security architectures are inadequate to cope with increasingly complex cyber threats, urgently requiring new technological paradigms to change this situation.

[0017] In summary, current host system security faces multi-dimensional challenges: at the technical level, traditional protection mechanisms are ineffective against new threats; at the architectural level, there are serious gaps between various security protection components; and at the practical level, the real-time performance and reliability of security monitoring urgently need improvement. While emerging technologies such as eBPF bring new possibilities, their potential in the field of integrity monitoring has not yet been fully explored. Hardware security capabilities such as TPM have also failed to achieve deep integration with dynamic security monitoring. Summary of the Invention

[0018] With the deepening of digital transformation, host systems face increasingly complex and diverse security threats. Traditional security protection mechanisms have inherent shortcomings such as limited detection capabilities, single protection dimensions, and delayed response, making it difficult to effectively cope with new security challenges such as advanced persistent threats and zero-day attacks. The purpose of this invention is to provide a multi-element integrity monitoring method for host systems, which achieves comprehensive perception and dynamic protection of the host system's security status by constructing a protection system covering the entire system stack.

[0019] The objective of this invention is achieved through the following technical solution:

[0020] A method for multi-element integrity monitoring of a host system includes the following steps:

[0021] Step 1) Generate EK, PIK and AIK unique to the host platform based on the TPM / TCM chip to prepare for subsequent integrity monitoring interaction. The binding of the TPM / TCM chip prevents the host report from being tampered with. After the keys are generated, the public keys of EK and AIK are synchronized to the server for subsequent authentication.

[0022] In this step, a unique key pair for the host platform is generated using a Trusted Platform Module (TPM) or Trusted Cryptographic Module (TCM) chip, including an Endorsement Key (EK), a Platform Identity Key (PIK), and an Acknowledgment Key (AIK). The generation and storage of these keys rely on the physical protection capabilities of the hardware security module, ensuring that the keys are difficult to tamper with or steal. The EK uniquely identifies the host platform, and its public key needs to be synchronized to the server as the host's identity credential. The PIK applies for a digital certificate from a Certificate Authority (CA) during the initialization phase to prove the platform's trustworthy identity. The AIK is used for the digital signature of subsequent integrity monitoring reports, providing a trusted credential for status verification. The binding of the TPM / TCM chip effectively prevents tampering with host reports, ensuring the authenticity and integrity of the monitoring data. Furthermore, the key generation process must comply with relevant standards (such as the TPM 2.0 specification) and employ a secure random number generator to enhance the randomness and security of the keys.

[0023] Step 2) Write a custom kernel module to measure and monitor key invariants and memory data structure information of the host system kernel;

[0024] Write a custom kernel module to monitor critical invariants and memory data structures of the host system kernel. Kernel invariants refer to critical data structures and configuration information that are expected to remain unchanged during system operation, such as the Global Descriptor Table (GDT), Interrupt Descriptor Table (IDT), System Call Table (SCT), Process Descriptor Table, and memory page tables. This module can generate metrics (such as hash values ​​and checksums) representing the characteristics of kernel invariants. These metrics uniquely identify the state of kernel invariants and are difficult to tamper with. The module itself has a certain degree of anti-interference capability (such as anti-debugging and anti-memory modification). Specific metrics also include kernel version information, CPU information (such as model and frequency), memory size information, and kernel symbol addresses. The compiled kernel module is directly loaded into the kernel via system calls (such as insmod), thereby achieving real-time monitoring of kernel invariants. The module can be configured with a sampling frequency and uses a circular buffer to store metric data to avoid memory overflow.

[0025] Step 3) Based on cryptographic algorithms, measure sensitive files in user space and monitor file changes;

[0026] Sensitive user-space files are measured using cryptographic hash algorithms (such as SM3, SHA-256, and SHA-512) to monitor file changes. Sensitive user-space files include, but are not limited to, terminal environment variable configuration files for the current user and root user (such as .bashrc and .profile), host startup scripts (such as / etc / rc.local and / etc / init.d), user and group related files (such as / etc / passwd, / etc / group, and / etc / shadow), and other sensitive files in the host file system that need to be monitored (such as application configuration files, log files, and key files). The measurement program for these files can be directly integrated into the measurement agent, periodically calculating the file's hash value and comparing it with a baseline value (such as the initial installation state) to detect whether the file has been tampered with. The measurement process can employ an incremental update mechanism, re-measuring only modified files to improve efficiency. Simultaneously, file paths and hash values ​​can be stored in a security database for subsequent auditing.

[0027] Step 4) Write an eBPF integrity monitoring program to monitor the running status of kernel events in the host system. Use eBPFMaps to transfer the status data of kernel events to user space, thereby realizing the monitoring of kernel event status.

[0028] Write an integrity monitoring program based on eBPF technology to monitor the runtime status of host system kernel events. The eBPF program binds to specific kernel functions through dynamic instrumentation techniques (kprobe, tracepoint). When these functions are called, the eBPF program is activated, captures the function's runtime status data, and passes the data to user space through eBPF Maps (such as hash map, arraymap), thereby realizing the monitoring of kernel event status.

[0029] The compilation process of the eBPF integrity monitoring program is similar to that of a regular eBPF program: first, the program code is written in C language, then compiled into LLVM intermediate representation (IR) by the Clang compiler, and then converted into eBPF bytecode by LLVM. These operations are completed in user space. The eBPF bytecode needs to be loaded into kernel space through interfaces provided by the Linux system kernel (such as the bpf() system call) and undergo security verification by the eBPF Verifier to ensure that it does not compromise kernel stability and security (such as infinite loops or illegal memory access). After verification, the bytecode is bound to a specific kernel event hook for execution. The eBPF bytecode loaded into the kernel undergoes Just-In-Time (JIT) compilation optimization, converting it into native machine code for the corresponding platform, thereby ensuring that the eBPF program can efficiently respond to kernel events and execute in real time. When the corresponding kernel event is triggered, the eBPF monitoring program is activated, capturing the running status of the target function according to the custom monitoring logic, and using eBPFMaps to achieve data interaction between kernel space and user space. eBPF Maps can be accessed by user-space programs (such as metric agents) through the libbpf library to read monitoring data.

[0030] Step 5) The measurement agent periodically obtains measurement information of kernel invariants, user-space sensitive files, and kernel events, generates an integrity monitoring report, and uploads it to the server.

[0031] The metrics agent periodically retrieves metrics information for kernel invariants, user-space sensitive files, and kernel events, forming an integrity monitoring log. Then, it digitally signs the log using the AIK private key, generates an integrity monitoring report, and uploads the report to the server. For kernel invariants, the metrics agent obtains metric data through a custom kernel module (e.g., via the / proc or sysfs interface); for user-space sensitive files, the metric agent directly calls a cryptographic algorithm to calculate the file hash value; for kernel events, the metric agent accesses eBPF Maps through the libbpf library, obtains monitoring data, and organizes it into a log. The metric agent can be configured to upload at regular intervals (e.g., every 5 minutes) to generate reports periodically or triggered by events. The report format can use structured data (e.g., JSON, XML), including timestamps, host identifiers, a list of metrics, and digital signatures.

[0032] Step 6) After receiving the integrity monitoring report, the server verifies the identity information of the report. If the verification is successful, the report data is written to the database. The server then analyzes the data using a security management platform or data analysis tool to formulate a personalized trusted protection policy for the host. Finally, the policy is synchronized with the host, and the host continues to operate according to the new protection policy.

[0033] After receiving the integrity monitoring report, the server first verifies the report's digital signature using the AIK public key synchronized during the initialization phase, ensuring the report's integrity and authenticity. Upon successful verification, the server parses the report content according to a predefined data format and writes the data to a database (such as MySQL, SQLite, or a time-series database). Based on this data, the server can analyze it using a security management platform or data analysis tools (such as ELK Stack or Splunk) to identify abnormal behavior or potential threats (such as statistical anomalies or pattern matching) and formulate personalized trusted protection policies for the host. For example, it can establish a behavioral baseline by analyzing historical data and detect operations that deviate from the baseline; or it can formulate a whitelist policy to allow only trusted processes and operations to run. Finally, the server synchronizes the protection policy to the host (e.g., through a secure channel), and the host continues to run according to the new policy, thus achieving dynamic security protection. Policies may include process blacklists, file access control, and network connection restrictions.

[0034] Furthermore, in step 1), selecting either a TPM or TCM chip can achieve equivalent protection capabilities. Both adhere to trusted computing standards and provide hardware-level security protection. The EK's public key can be used for the host's unique identification. PIK requests an identity certificate from the CA during the initialization phase, while AIK provides trusted credentials for state verification during the subsequent integrity monitoring phase, ensuring the monitoring report is non-repudiable.

[0035] Furthermore, in step 1), regarding key management, this invention adopts a hierarchical key architecture, where the generation, storage, and use of all keys strictly adhere to relevant security standards. Specifically, the use of the AIK private key is subject to strict access control and can only be used for report signing operations under specific authorized environments. To enhance key security, the system also implements a key rotation mechanism, periodically updating the AIK key pair to reduce the risk of key leakage.

[0036] Furthermore, in step 1), in actual deployment, the system supports various security chips that conform to the TPM 2.0 standard or the Chinese TCM standard. For different application scenarios, the appropriate chip type can be flexibly selected. In resource-constrained embedded environments, a simplified version of the TCM chip can be chosen; while in server environments with extremely high security requirements, a TPM chip supporting advanced cryptographic algorithms can be used.

[0037] Furthermore, in step 1), to ensure the security of the key materials throughout their entire lifecycle, this invention also designs a complete key backup and recovery mechanism. Through secure fragmented storage technology, single-point leakage risks are prevented while maintaining availability. In addition, the system establishes a comprehensive certificate management mechanism, including full-process management of certificate application, verification, renewal, and revocation.

[0038] Furthermore, the custom module in step 2) can generate metric data representing the characteristics of kernel invariants. This data uniquely identifies the characteristics of kernel invariants and is difficult to tamper with, possessing a certain degree of anti-interference capability (such as code obfuscation and integrity self-verification). Specific metric data includes, but is not limited to: monitoring of the Global Descriptor Table (GDT), Interrupt Descriptor Table (IDT), and System Call Table (SCT), as well as critical kernel data such as kernel version information, CPU information, and memory size information. The compiled kernel module is directly loaded into the kernel using system calls, and the monitoring scope can be configured through module parameters.

[0039] Furthermore, in step 2), the monitoring module employs a multi-layered measurement strategy in terms of technical implementation. The base layer establishes an integrity benchmark by calculating the cryptographic hash values ​​of key data structures. The runtime layer uses a memory protection mechanism to set write protection for critical memory areas to prevent unauthorized modifications. For dynamically changing kernel data structures, the system adopts an incremental monitoring strategy, recalculating the measurement values ​​only for the changed parts, significantly reducing performance overhead.

[0040] Furthermore, in step 2), to counter advanced attack methods, the monitoring module itself possesses robust self-protection capabilities. Through techniques such as code obfuscation, control flow integrity protection, and anti-debugging, it ensures that the monitoring module is difficult for attackers to bypass or compromise. Simultaneously, the module also implements an integrity self-verification mechanism, periodically verifying the integrity of its own code and data to prevent malicious tampering.

[0041] Furthermore, in step 2), regarding data acquisition, the system employs an intelligent sampling mechanism to dynamically adjust the monitoring frequency based on system load. In scenarios with high security requirements, continuous monitoring mode can be enabled; while in performance-sensitive environments, a periodic sampling strategy can be used. All collected metric data is cached through a secure circular buffer to ensure that critical security events are not lost under high load conditions.

[0042] Furthermore, the sensitive files in user space in step 3) include, but are not limited to: terminal environment variable configuration files for the current user and root user, host startup scripts, user and group related files, and sensitive files in the host file system that need to be monitored. Measurement programs for these files can be directly integrated into the measurement agent to reduce system overhead.

[0043] Furthermore, in step 3), at the technical implementation level, the system adopts a hybrid measurement strategy. For static configuration files, cryptographic hash algorithms such as SHA-256 and SM3 are used to calculate the baseline value, and digital signatures are used to ensure the credibility of the baseline value. For dynamically changing log files, a content-based feature detection method is used to identify abnormal content through regular expression matching and other methods. For large files, the system supports a block measurement mechanism, calculating only the key parts of the file, significantly improving monitoring efficiency.

[0044] Furthermore, in step 3), regarding the real-time nature of file monitoring, the system supports configurable monitoring strategies. For critical system files, a real-time monitoring mode is used, where any modification immediately triggers measurement verification. For ordinary application files, a scheduled scanning mode can be used to perform batch measurement operations when the system load is low. This flexible scheduling strategy ensures that good system performance is maintained while providing strong security guarantees.

[0045] Furthermore, the eBPF integrity monitoring program in step 4) is a custom program based on eBPF technology that monitors kernel events. One example of a monitored event is given here, but the monitored kernel events include, but are not limited to, the listed functions. In actual deployment, it can be flexibly expanded according to security requirements.

[0046] Furthermore, the eBPF integrity monitoring program in step 4) is similar to the compilation process of a regular eBPF program. It is first written in C, then compiled into LLVM IR by Clang, and finally converted into eBPF bytecode by LLVM. These operations occur in user space. The eBPF bytecode needs to be loaded into kernel space to function. It is loaded into the kernel through an interface provided by the Linux system kernel, verified by the eBPF Verifier, and then bound to a kernel event hook for execution. The eBPF bytecode loaded into the kernel undergoes JIT compilation optimization to convert it into native machine code for the corresponding platform, ensuring that the eBPF program can efficiently respond to kernel events and execute in real time. When the corresponding kernel event is triggered, the eBPF monitoring program is activated, capturing the running status of the target function according to the customized integrity monitoring function, and using eBPF Maps to achieve data interaction between kernel space and user space.

[0047] Further, in step 4), the eBPF integrity monitoring program provides some customized examples. The `execve` function: This function must be executed when a new process is created. Through eBPF instrumentation, data such as process ID (PID), parent process ID (PPID), process name, executable path, execution parameters, environment variables, and monitoring time can be captured to determine whether the new process meets expectations (e.g., whitelist verification). The `load_elf_binary` function: Responsible for loading the new ELF executable program. Through eBPF dynamic monitoring, data such as process ID, process name, interpreter path, interpreted file path, file mount point, file inode number, function return value, and monitoring time can be captured. The file mount point and inode number can uniquely identify the parsed ELF file, preventing file overwriting attacks or malicious replacement. The `do_init_module` function: Responsible for loading the initialization work of the kernel module. By dynamically monitoring this function, kernel-level rootkit attacks can be prevented. After instrumentation, data such as process ID, executing process name, kernel module name, user ID of the executing user, username of the executing user, and monitoring time can be obtained to monitor whether the kernel module is initialized correctly. The `open` function: This function is called whenever any process opens a file. Instrumentation monitoring can obtain data such as process ID, process name accessing the file, absolute path of the file, function return value, and monitoring time, thereby monitoring the compliance of process access to the file system (e.g., unauthorized access attempts). The `cap_capable` function: Used to check a process's permission capabilities. Dynamic monitoring can reveal a process's usage of required capabilities, thus preventing malicious processes from illegally using capabilities (e.g., `CAP_SYS_ADMIN`). Instrumentation can obtain data such as process ID, username using the capability, corresponding user ID, capability identifier, capability name, option parameters, and monitoring time. The `setuid` function: Called when a system call escalates process privileges. Instrumentation monitoring can obtain data such as process ID, process name performing the privilege escalation, username performing the privilege escalation, corresponding user ID, name of the privilege escalation function used, parameters of the privilege escalation function, function return value, and monitoring time, thereby identifying the privilege escalation status of various processes and users in the system and preventing malicious processes from illegally escalating privileges. The `tcp_connect` function: Used to establish a TCP connection. Dynamic instrumentation can prevent malicious processes from eavesdropping or illegally controlling networks. Monitoring is performed by acquiring the following data: process ID, process name, source address, source port, destination address, destination port, and monitoring time, thereby detecting abnormal network connections (such as connections to malicious servers). It's important to note that the monitored kernel events are not limited to the functions mentioned above; other kernel functions (such as fork, write, and bind) can be extended according to actual security needs.

[0048] Furthermore, in step 4), a modular architecture is adopted in terms of program structure design, separating functions such as monitoring logic, data processing, and policy execution to improve code maintainability and scalability. Each eBPF program contains a complete state machine and event handlers, capable of adopting appropriate monitoring strategies based on different runtime contexts.

[0049] Furthermore, in step 4), regarding data acquisition, the system implements an intelligent filtering mechanism. This mechanism uses predefined rules to initially filter events, avoiding the collection of large amounts of irrelevant data. Simultaneously, it supports dynamic sampling rate adjustment, automatically adjusting the event acquisition frequency based on system load to minimize performance impact while ensuring monitoring effectiveness.

[0050] Furthermore, in step 4), regarding security policy execution, the eBPF program has a built-in real-time decision engine that can instantly evaluate monitored events based on predefined security policies. When a high-risk operation is detected, the program can intervene directly at the kernel level, blocking malicious behavior by returning error codes.

[0051] Furthermore, in step 4), during the program verification phase, the system employs a multi-layered verification mechanism. First, static analysis is performed using eBPFVerifier to ensure the program does not compromise kernel stability. Then, dynamic testing is conducted in a sandbox environment to verify the program's behavior under various boundary conditions. Finally, a gradual deployment strategy is adopted in the production environment to progressively expand the monitoring scope.

[0052] Furthermore, in step 4), regarding performance optimization, the system fully utilizes the optimization capabilities of the eBPF JIT compiler to compile bytecode into native machine code in real time. Simultaneously, through carefully designed data structures and algorithms, it minimizes the program's memory access overhead and computational complexity. For high-frequency events, a batch processing mechanism is employed to merge multiple related events for processing, significantly improving processing efficiency.

[0053] Furthermore, in step 4), regarding data interaction, the system optimizes the usage strategy of eBPF Maps, selecting the appropriate Map type based on data type and access mode. For frequently read and write data, a perCPU-based HashMap is used; for read-only configuration data, an ArrayMap is used; and for data requiring complex queries, dedicated data structures such as LPM Trie are used.

[0054] Further, in step 5), the measurement agent needs to aggregate measurement information for kernel invariants, user-space sensitive files, and kernel events to form an integrity monitoring log. This log is then signed using the AIK private key to generate an integrity monitoring report, which is periodically sent to the server. For the kernel invariant module, the measurement agent can collect measurement information from custom modules. Measurement of user-space sensitive files can be performed directly using cryptographic algorithms, such as SM3 or SHA. Kernel event monitoring can be implemented using the libbpf library to obtain Map content and compile a complete kernel event integrity monitoring log.

[0055] Furthermore, in step 5), regarding data collection, the agent employs a multi-path parallel acquisition architecture, simultaneously collecting monitoring information from multiple data sources such as kernel modules, eBPF Maps, and the file system. Each data source has an independent acquisition thread, exchanging data through a lock-free queue to ensure that critical security events are not lost under high load conditions.

[0056] Furthermore, in step 5), at the data processing level, the agent implements intelligent data filtering and aggregation mechanisms. Through rule-based content filtering, duplicate and irrelevant monitoring data is removed. Through time window aggregation, multiple related events are merged into more meaningful composite events. In addition, the agent supports streaming data processing, enabling real-time analysis and feature extraction of monitoring data.

[0057] Furthermore, in step 5), regarding report generation, the system employs a structured data format, supporting multiple serialization formats such as JSON and Protocol Buffers. Each monitoring report contains complete metadata information, including data collection time, host identifier, and monitoring component version. To ensure report integrity, the system uses an AIK private key to digitally sign the report and supports multiple signature algorithms to meet different security requirements.

[0058] Furthermore, in step 5), regarding communication security, all data transmission between the proxy and the server is encrypted and authenticated. Modern security protocols such as TLS 1.3 are supported to ensure the confidentiality and integrity of data transmission. Simultaneously, the proxy implements a robust session management mechanism, supporting reliability assurance functions such as reconnection after disconnection and data caching.

[0059] Furthermore, in step 5), regarding resource management, the agent possesses adaptive resource control capabilities. It dynamically adjusts data collection frequency and caching strategies by monitoring system resource usage. When system resources are strained, it automatically reduces monitoring granularity to ensure critical business operations are not affected.

[0060] Furthermore, in step 6), the server uses the AIK public key synchronized during the initialization phase to verify the signature of the report. After verification, the data is parsed according to the data format of each monitoring function and stored in the database line by line. The historical data of the node can be analyzed through analysis tools or by developing a management interface to investigate the relevant operations of malicious processes and make corresponding protection strategies. A trusted runtime library can also be formulated to achieve automated monitoring and prevent unauthorized behavior of malicious processes in real time.

[0061] Furthermore, in step 6), at the data receiving level, the server establishes a complete trust verification chain. First, it verifies the authenticity of the report signature using a pre-configured AIK public key to ensure the data source is trustworthy. Then, it checks the validity of the certificate through the Certificate Revocation List (CRL) and the Online Certificate Status Protocol (OCSP). Finally, it verifies data integrity to ensure that the monitoring data has not been tampered with during transmission.

[0062] Furthermore, in step 6), regarding data parsing, the system supports a scalable parsing framework capable of handling data formats from different versions of monitoring agents. Through data standardization, heterogeneous monitoring data is converted into a unified internal representation, facilitating subsequent analysis.

[0063] Furthermore, in step 6), the rule-based detection engine uses a rule base built from expert experience to quickly identify known attack patterns. The rules support complex logical combinations and temporal relationships, capable of describing attack chains across multiple events.

[0064] Furthermore, in step 6), the behavior-based detection engine establishes a baseline of normal behavior through machine learning algorithms and identifies abnormal behavior using algorithms such as clustering and classification. In particular, the system employs deep learning methods to process complex time-series data, enabling it to detect covert attacks that are difficult to identify using traditional methods.

[0065] Furthermore, in step 6), the threat intelligence-based detection engine integrates multi-source threat intelligence, including malicious IP addresses, malicious file hashes, and malicious domain names. Through real-time matching, it can quickly identify associations with known malicious entities.

[0066] Furthermore, in step 6), for confirmed high-risk events, the system generates immediate blocking policies and rapidly distributes them to the target host via an emergency channel. These policies have the highest priority and can take effect within seconds, effectively curbing the spread of attacks.

[0067] Furthermore, in step 6), for suspected medium-risk events, the system generates enhanced monitoring strategies to increase the granularity of monitoring related events and collect more evidence for subsequent analysis. Simultaneously, an alarm notification is triggered to alert security personnel to intervene in the investigation.

[0068] Furthermore, in step 6), for potential low-risk events, the system generates an observational learning strategy, incorporates these events into the training dataset, and continuously optimizes the detection model.

[0069] Furthermore, in step 6), regarding policy distribution, the system supports multiple deployment modes. For a centralized management environment, proactive policy distribution is used; for a distributed environment, a pull mode is supported, where an agent periodically obtains policy updates. All policy transmissions are encrypted and signed to prevent policy tampering.

[0070] The core innovation of this invention lies in breaking through the limitations of traditional security technologies by organically integrating security capabilities across multiple dimensions, including hardware security modules, operating system kernel monitoring, user-mode asset protection, and runtime behavior analysis. By establishing a complete trust chain based on trusted computing and combining it with the kernel programmability provided by modern operating systems, a novel host security protection system characterized by defense-in-depth, proactive protection, and intelligent self-adaptation is constructed.

[0071] Specifically, this invention achieves innovative breakthroughs through the following technical paths: First, it establishes an immutable foundation of trust using a hardware security chip; second, it achieves comprehensive coverage of key system elements through a multi-layered monitoring mechanism; third, it leverages advanced program analysis technology to achieve real-time insight into system behavior; and finally, it forms a closed-loop control for security protection through an intelligent analysis engine. This method not only significantly enhances the security protection capabilities of the host system but also provides crucial technical support for building next-generation proactive defense systems.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] This invention addresses the vulnerability of hosts to malware intrusion and core data theft in the internet environment by proposing a multi-factor integrity monitoring method. Its beneficial effects are as follows:

[0074] 1. A comprehensive, in-depth defense system has been constructed.

[0075] Traditional security solutions often focus on a single layer of protection, leaving significant security blind spots. This invention, through deep collaboration between kernel modules, cryptographic algorithms, and eBPF technology, achieves, for the first time, comprehensive monitoring of all elements of the host system stack. Specifically: at the underlying kernel level, continuous monitoring of core data structures such as the global descriptor table and system call table effectively defends against low-level attacks such as rootkits; at the intermediate runtime level, real-time tracking of system behaviors such as process creation and permission changes promptly detects abnormal operation patterns; at the upper application level, integrity verification of critical assets such as configuration files and script files prevents backdoor implantation. This comprehensive monitoring, from the hardware layer to the application layer, from static configuration to dynamic behavior, forms a layered protection network, making it difficult for attackers to find opportunities.

[0076] 2. It has achieved active, real-time protection capabilities.

[0077] Unlike traditional security products that passively respond after an attack occurs, this invention utilizes eBPF technology to achieve real-time threat blocking at the kernel level. When the system detects unauthorized privilege escalation, abnormal file access, or suspicious network connections, the eBPF program can intervene immediately at the kernel event trigger point, directly blocking malicious operations by returning error codes and nipping the attack in the bud. More importantly, thanks to the high efficiency of the eBPF virtual machine, this real-time protection has extremely low system overhead, making it particularly suitable for performance-sensitive production environments.

[0078] 3. A trusted assurance mechanism based on a hardware root of trust has been established.

[0079] This invention innovatively integrates TPM / TCM hardware security chips with a software monitoring system, constructing an immutable chain of trust. A unique platform identifier is generated through the chip's built-in cryptographic module, ensuring the authenticity and integrity of monitoring data. All integrity reports are digitally signed using hardware keys, effectively preventing attackers from forging or tampering with monitoring data. This hardware-level security provides a solid foundation of trust for the entire monitoring system, making it particularly suitable for high-security applications such as finance and government.

[0080] 4. It possesses a high degree of flexibility and environmental adaptability.

[0081] The architecture of this invention fully considers the deployment needs of different scales and scenarios. At the monitoring strategy level, it supports flexible definition of the monitoring scope according to business needs, customizing everything from core system files to specific application components. At the deployment mode level, it supports both centralized management, managing tens of thousands of hosts through a unified console, and distributed autonomy, meeting the independent protection needs of offline environments such as IoT devices and edge computing nodes. This flexible architecture enables the invention to smoothly scale from traditional data centers to emerging cloud-native environments, demonstrating excellent technological foresight.

[0082] 5. Achieved intelligent closed-loop security management and control.

[0083] This invention transcends the scope of traditional monitoring tools, constructing a continuously evolving intelligent security system. By analyzing massive amounts of monitoring data through machine learning algorithms, the system can automatically establish a baseline of normal behavior and accurately identify abnormal operations that deviate from expectations. Based on the analysis results, the system can dynamically generate personalized protection policies for hosts with different business attributes, such as least privilege access control and network communication whitelists. After these policies are issued and executed, their effect data is fed back to the analysis end, forming a complete closed loop of "perception-decision-execution-optimization," enabling the system's protection capabilities to continuously improve over time.

[0084] 6. Significantly improved the level of core data security.

[0085] To address the increasingly serious threat of data breaches, this invention constructs a data security protection network through a multi-pronged approach. On the one hand, fine-grained monitoring of file access operations effectively prevents unauthorized processes from reading sensitive data; on the other hand, real-time analysis of network connection behavior promptly detects attempts to leak data. More importantly, the system can implement tiered protection based on the importance and sensitivity of the data, imposing stricter access controls on core data assets and curbing the risk of data leakage at its source.

[0086] This invention achieves significant breakthroughs in multiple aspects, including protection dimensions, response timeliness, reliable assurance, deployment flexibility, intelligence level, and data protection, through technological integration and architectural innovation, providing a complete technical solution for building a new generation of host security protection system. Attached Figure Description

[0087] Figure 1 This is a deployment framework diagram for the server and host in Case 1.

[0088] Figure 2 This is a diagram illustrating the operation of the internal security module of the host in Case 1.

[0089] Figure 3 This is a diagram illustrating the operation of the internal security module of the monitoring host in Case 2. Detailed Implementation

[0090] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0091] Example 1: Distributed deployment scenario.

[0092] Figure 1 This diagram illustrates the deployment framework of the server and host in Case 1. It showcases a typical deployment architecture of the present invention in a distributed environment. Figure 1 The framework comprises multiple monitoring hosts and a central server, connected via a network. Each monitoring host deploys components such as a TPM / TCM chip, a custom kernel module, an eBPF integrity monitoring program, and a metrics agent. The monitoring hosts communicate with the server via a secure communication channel (such as TLS) and periodically upload integrity monitoring reports. The server-side includes a database, analytics tools, and a management platform for storing, analyzing, and responding to monitoring data. This framework supports multi-node management, is suitable for enterprise-level network environments, and can be scaled to a layered architecture (such as regional server data aggregation).

[0093] This implementation case demonstrates a complete enterprise-level distributed security monitoring system deployment solution. The system adopts a layered architecture design, including an endpoint monitoring layer, a data transmission layer, and a service management layer, and is suitable for host security monitoring needs in medium to large enterprise environments.

[0094] The monitoring host uses a standard x86 server equipped with a TPM 2.0 security chip. Specific configuration requirements include: an Intel Xeon E-2300 series processor, 16GB DDR4 memory, and a 512GB NVMe solid-state drive. The operating system is Ubuntu 20.04 LTS, kernel version 5.15 or higher, ensuring full support for eBPF functionality. During kernel compilation, key configuration options such as CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT, and CONFIG_HAVE_EBPF_JIT must be enabled.

[0095] The server-side employs a highly available cluster architecture, comprising three server nodes configured as follows: dual Intel Xeon Silver 4310 processors, 128GB DDR4 ECC memory, a 2TB NVMe system disk, and a 10TB SAS data storage array. The database system uses a MySQL 8.0 cluster configured with Galera-based multi-master replication to ensure high availability and consistency. The web management platform is developed using the Spring Boot framework, with Vue.js as the front-end framework and Nginx for load balancing.

[0096] The network environment adopts a layered design, with the monitoring host and management network connected via Gigabit Ethernet and configured with independent VLANs for logical isolation. All network communications are encrypted using the TLS 1.3 protocol and employ the ECDHE-RSA-AES256-GCM-SHA384 cipher suite to ensure the confidentiality and integrity of data transmission.

[0097] Figure 2 This is a diagram illustrating the operation of the internal security module of the host in Case 1. Figure 2 The interaction flow of various components within the monitoring host is described in detail. The TPM / TCM chip provides hardware-level security protection, generating and storing keys. A custom kernel module monitors kernel invariants, the eBPF program monitors kernel events, and the measurement agent integrates data and generates reports. The diagram illustrates the data flow: from kernel space to user space, kernel event data is passed through eBPF Maps, and the measurement agent collects all data, signs it, and uploads it. Simultaneously, the host receives protection policies from the server and executes these policies through eBPF Maps or kernel modules, forming a closed-loop security control. The diagram also marks key data structures (such as measurement logs and policy libraries) and system call interfaces. Specific implementation steps include:

[0098] 1. TPM / TCM chip initialization and key management system establishment

[0099] Install the TPM 2.0 chip or TCM module on the monitoring host and initialize it according to the manufacturer's guidelines. The initialization process includes generating an Endorsement Key (EK), a Platform Identity Key (PIK), and an Accreditation Key (AIK). The EK is used for host identity identification; its public key needs to be exported and synchronized to the server. The PIK is used to apply for a digital certificate from a Certificate Authority (CA) to verify the platform's identity. The AIK is used for signing subsequent integrity reports. Ensure the keys are securely stored internally within the chip to prevent physical and logical attacks. Initialization tools can be tpm2-tools or the manufacturer's SDK.

[0100] Once the keys are generated, a complete certificate management system is established. PIK certificates are applied for from the enterprise's internal CA authority, and the certificate format follows the X.509v3 standard, including basic constraint extensions and key usage extensions. The certificate application process uses the PKCS#10 format, and certificate issuance is completed through the enterprise's PKI system. AIK certificates are remotely verified through Privacy CA to ensure the trustworthiness of the platform's identity.

[0101] 2. Deployment of the kernel invariant monitoring module

[0102] A custom kernel module is written on the monitoring host to monitor kernel invariants, such as the Global Descriptor Table (GDT), Interrupt Descriptor Table (IDT), and System Call Table (SCT). The module code is written in C and compiled into a .ko file using a Makefile. After compilation, the module is loaded into the kernel using the `insmod` or `modprobe` command. Once loaded, the module begins periodically collecting metric data of kernel invariants (such as calculating hash values ​​using the kernel function `crc32`) and storing the data in a kernel buffer. The module can also expose data to user space via the ` / proc` or `sysfs` interface.

[0103] Module compilation uses the DKMS (Dynamic Kernel Module Support) framework to ensure compatibility during kernel upgrades. The Makefile is configured with strict security compilation options.

[0104] ccflags-y := -Wall -Werror -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2

[0105] Module loading configuration parameters:

[0106] sudo insmod kernel_integrity.ko \

[0107] scan_interval=5 \

[0108] gdt_monitor=1 \

[0109] idt_monitor=1 \

[0110] sct_monitor=1 \

[0111] crc_check=1 \

[0112] hash_algorithm=sha256

[0113] 3. Implementation of User-Mode Sensitive File Monitoring System

[0114] A user-space program is written on the monitoring host to calculate the hash values ​​of sensitive files. Sensitive files include system configuration files (such as ` / etc / passwd`), user configuration files (such as `~ / .bashrc`), and startup scripts (such as ` / etc / rc.local`). This program can implement the SM3 or SHA-256 algorithm using standard cryptographic libraries (such as OpenSS). To enhance security, the program can be stored in a memory area protected by TPM / TCM and have strict access permissions set (such as `mlock` to prevent swapping). The metrics agent can directly invoke this program to periodically scan for file changes.

[0115] The file monitoring system implements a tiered protection strategy, classifying monitored files into three security levels:

[0116] Level 1 protected files (core system files):

[0117] Authentication files: / etc / passwd, / etc / shadow, / etc / group, / etc / gshadow

[0118] System configuration files: / etc / sudoers, / etc / ssh / sshd_config, / etc / pam.d / *

[0119] Startup management files: / etc / rc.local, / etc / systemd / system / , / etc / init.d /

[0120] Level 2 protected files (application service files):

[0121] Web service configuration: / etc / nginx / nginx.conf, / etc / apache2 / apache2.conf

[0122] Database configuration: / etc / mysql / my.cnf, / etc / postgresql / * / postgresql.conf

[0123] System parameter configuration: / etc / sysctl.conf, / etc / security / limits.conf

[0124] Level 3 protected file (business data file):

[0125] Log files: / var / log / secure, / var / log / auth.log, / var / log / audit / audit.log

[0126] Temporary files: privileged scripts in the / tmp / and / var / tmp / directories

[0127] User configuration files: / home / * / .ssh / authorized_keys, / root / .bashrc

[0128] 4. eBPF Monitoring Program Deployment and Configuration

[0129] Write eBPF programs to monitor kernel events such as process creation, file opening, and network connections. The programs are written in C and then compiled into eBPF bytecode using the Clang and LLVM toolchain. The specific command is: `clang -O2 -targetbpf -c program.c -o program.o`. After compilation, the bytecode is loaded into the kernel via a system call (e.g., `bpf(BPF_PROG_LOAD)`). During loading, the eBPF Verifier rigorously verifies the bytecode to ensure it does not compromise kernel stability. Upon successful verification, the kernel returns a file descriptor, indicating successful binding. The program is then bound to a specific kernel function hook (such as `kprobe` or `tracepoint`). When the function is called, the eBPF program executes and captures data. For example, binding the `execve` function can be done using `bpf_attach_kprobe`.

[0130] eBPF programs are compiled using the LLVM toolchain, and the loading process has undergone rigorous verification.

[0131] clang -O2 -target bpf -c program.c -o program.o \

[0132] -I / usr / include / x86_64-linux-gnu \

[0133] -Wall -Werror

[0134] 5. Metrics Agent Configuration and Data Management

[0135] Run a metrics agent (e.g., written in Python or C) on the monitoring host. The agent configuration file sets the report upload period (e.g., every 5 minutes). The metrics agent periodically collects kernel invariant data from kernel modules, sensitive file metrics data from user-space programs, and kernel event data from eBPF Maps. The agent integrates this data into an integrity monitoring log (JSON format), then digitally signs the log using the AIK private key (e.g., using the OpenSSL library), generating an integrity monitoring report. The report, along with the EK public key and AIK certificate, is uploaded to the server via a secure channel (e.g., TLS). The agent also implements a retry mechanism to handle network failures.

[0136] The report format uses a standardized JSON structure:

[0137] {

[0138] "report_id": "integrity_report_20240115_103000",

[0139] "host_info": {

[0140] "hostname": "host-192-168-1-100",

[0141] "platform": "x86_64",

[0142] "kernel_version": "5.15.0-60-generic"

[0143] },

[0144] "timestamp": "2024-01-15T10:30:00Z",

[0145] "tpm_identity": {

[0146] "ek_pubkey": "base64_encoded_ek_public_key",

[0147] "aik_certificate": "base64_encoded_aik_cert"

[0148] },

[0149] "measurements": {

[0150] "kernel_integrity": {

[0151] "gdt_hash": "sha256_hash_value",

[0152] "idt_hash": "sha256_hash_value",

[0153] "sct_hash": "sha256_hash_value",

[0154] "status": "clean"

[0155] },

[0156] "file_integrity": [

[0157] {

[0158] "file_path": " / etc / passwd",

[0159] "hash_algorithm": "sm3",

[0160] "current_hash": "file_hash_value",

[0161] "baseline_hash": "baseline_hash_value",

[0162] "status": "unchanged",

[0163] "last_modified": "2024-01-15T08:00:00Z"

[0164] }

[0165] ],

[0166] "security_events": [

[0167] {

[0168] "event_type": "process_exec",

[0169] "pid": 1234,

[0170] "ppid": 567,

[0171] "executable": " / usr / bin / bash",

[0172] "arguments": ["-c", "echo hello"],

[0173] "timestamp": "2024-01-15T10:29:55Z",

[0174] "user": "root",

[0175] "result": "allowed"

[0176] } ]

[0178] },

[0179] "digital_signature": {

[0180] "algorithm": "rsa-sha256",

[0181] "signature": "base64_encoded_signature",

[0182] "timestamp": "2024-01-15T10:30:00Z"

[0183] }

[0184] }

[0185] 6. Server-side analysis and response mechanism

[0186] Upon receiving the report, the server first verifies the validity of the AIK certificate (e.g., checking the certificate chain and revocation status), and then uses the AIK public key to verify the correctness of the report signature. After successful verification, the server parses the report content and writes the data to the database. Administrators can view the monitoring data and analyze host behavior through a web management interface or data analysis tools (such as the ELK Stack). For example, they can query process creation events within a specific time period to detect abnormal processes; or compare changes in file hash values ​​to identify tampering. Based on the analysis results, the server can formulate personalized protection policies (such as detecting anomalies through machine learning algorithms) and distribute these policies to monitored hosts for execution. Policies can be synchronized via eBPF Maps or configuration files.

[0187] Policy configuration uses a declarative format:

[0188] {

[0189] "policy_id": "security_policy_001",

[0190] "version": "1.0",

[0191] "target_hosts": ["host-192-168-1-100", "host-192-168-1-101"],

[0192] "effective_time": "2024-01-15T11:00:00Z",

[0193] "expiration_time": "2024-12-31T23:59:59Z",

[0194] "rules": [

[0195] {

[0196] "rule_id": "process_restriction_001",

[0197] "rule_type": "process_restriction",

[0198] "action": "block",

[0199] "conditions": {

[0200] "executable_path": " / tmp / *",

[0201] "user_context": "non_privileged",

[0202] "time_range": "00:00-23:59"

[0203] },

[0204] "priority": "high"

[0205] },

[0206] {

[0207] "rule_id": "network_acl_001",

[0208] "rule_type": "network_acl",

[0209] "action": "allow",

[0210] "conditions": {

[0211] "dest_address": "192.168.1.0 / 24",

[0212] "protocol": "tcp",

[0213] "dest_port": [80, 443, 22],

[0214] "process_name": ["ssh", "nginx", "apache2"]

[0215] },

[0216] "priority": "medium"

[0217] } ]

[0219] }

[0220] Furthermore, in multi-node deployment scenarios for large-scale enterprise environments, the monitoring and management server can achieve centralized and unified security management of hundreds or even thousands of monitored hosts. The server-side architecture employs a hierarchical management system, employing a three-tiered management architecture of region-group-host to achieve granular control over distributed hosts. Within this architecture, the server maintains a unified security policy benchmark library, which is continuously updated based on industry security standards, organizational security policies, and threat intelligence derived from machine learning analysis.

[0221] Policy management employs a fully automated lifecycle mechanism. First, the server automatically generates differentiated security policies based on global risk assessment and security status reports from each host. These policies, after being digitally signed to ensure integrity, are distributed to each monitored host via a secure channel. Policy transmission utilizes two-way authentication and encryption to prevent theft or tampering during transmission. Once the policy reaches the target host, it is loaded into the efficient kernel-level data structure eBPF Maps, enabling the security policy to be executed directly at the system call level, achieving "zero-latency" security protection.

[0222] At the policy enforcement level, the system implements a fine-grained access control mechanism. For example, it can restrict read and write permissions for non-privileged users on sensitive system files such as ` / etc / shadow` and ` / etc / passwd`, preventing attackers from accessing critical resources even if they gain certain privileges. At the network level, policies can restrict hosts to connecting only to authenticated and trusted network addresses and ports, effectively preventing data leaks and malicious software backlinks. The system also supports dynamic policy adjustments based on behavior, automatically escalating protection levels and implementing stricter access control when abnormal activity patterns are detected.

[0223] To ensure timely security responses, the server has established an intelligent alerting mechanism. This mechanism employs a multi-level classification system, categorizing security incidents into four levels based on severity: urgent, high-risk, medium-risk, and low-risk. When a serious anomaly is detected, such as a large-scale malware infection, tampering with critical system files, or abnormal operations by privileged accounts, the system will immediately trigger alerts from multiple channels.

[0224] The alert information includes detailed event context, including affected hosts, attack timeline, threat type, potential impact scope, and emergency response recommendations. The system also supports an alert escalation mechanism; if no response is received within a specified time, the alert will automatically be sent to a higher-level administrator, forming a closed-loop security incident management process.

[0225] Meanwhile, the server provides comprehensive auditing and compliance reporting capabilities, generating security posture reports by time, host, threat type, and other dimensions. This helps administrators gain a complete understanding of the system's security status and provides data support for security decisions. This centralized security management model not only significantly reduces operational costs but also ensures the stable operation of the entire system under strictly controlled security policies through unified security strategies and real-time threat response.

[0226] Implementation Case 2: Standalone Integrated Deployment Scenario.

[0227] This implementation case demonstrates a highly integrated host security monitoring and protection solution, specifically designed for network isolation or special environments with extremely high security and real-time requirements. Unlike the distributed architecture of Implementation Case 1, this solution deeply integrates all security components into a single physical device. By constructing a complete localized security decision-making and execution closed loop, it achieves autonomous security protection capabilities independent of external network connections. This architecture is particularly suitable for scenarios with stringent requirements for network security and real-time response, such as military facilities, industrial control systems, and financial trading platforms.

[0228] In terms of system architecture design, a full-stack integrated solution is adopted, with all security monitoring and protection components deployed on the same high-performance server. The equipment uses a security-hardened industrial-grade server platform, with a basic configuration including an Intel Core i7-12700 processor, 64GB DDR4 ECC error-correcting memory, a 1TB NVMe solid-state drive as the system disk, and a 4TB SAS enterprise-grade hard drive for data storage. The operating system used is Ubuntu 24.04LTS Security Edition, optimized for security scenarios, with a kernel version of 6.8 or higher, ensuring full support for modern security features such as eBPF and TPM 2.0, and further enhancing kernel security through the GRSecurity patch.

[0229] The system architecture employs a layered defense design. At the hardware level, a hardware root of trust is established through the TPM 2.0 security chip; at the kernel level, deep monitoring and real-time protection are achieved through customized security modules and eBPF programs; and at the user-space level, security decisions and responses are completed through an integrity measurement agent and a security policy engine. All components communicate via a local high-speed bus, forming a complete security protection closed loop, ensuring enterprise-level security even in a completely offline environment.

[0230] Figure 3 This diagram illustrates the operation of the internal security modules of the monitoring host in Case Study 2. It specifically explains the collaborative working principle and data loop of the various security modules within the host in a single-machine integrated deployment mode. The core of the diagram shows the complete process of local policy execution and proactive defense: the TPM / TCM chip, as the hardware root of trust, provides integrity protection for the locally stored policy benchmark library and logs generated by the measurement agent. In kernel space, a custom kernel module and multiple eBPF integrity monitoring programs (hooked to key functions such as execve, open, and setuid) run in parallel, capturing system status and behavior in real time. The innovation of the eBPF program lies in its execution logic, which directly compares the security policy issued through user space and stored in eBPF Maps in real time. When a policy violation is detected (such as unauthorized privilege escalation or access to sensitive files), the eBPF program immediately returns an error code to the kernel, proactively interrupting the malicious operation, thus achieving real-time blocking. Simultaneously, this violation event is transmitted as an alarm log to the measurement agent through the eBPF Maps. The metric agent periodically collects kernel invariant metrics, user-space file hashes, kernel event logs, and alert logs generated by proactive defenses, forming a comprehensive local integrity report. This report can be signed and stored in the local security log area for audit analysis. This diagram clearly depicts an intrinsic security system that does not rely on external servers and can make autonomous decisions, perform real-time detection, and block attacks. Specific implementation steps include:

[0231] 1. TPM / TCM chip initialization and key management system establishment

[0232] Similar to Implementation Case 1, a security chip compliant with the TPM 2.0 standard is installed on the host machine, and a complete initialization process is performed according to the manufacturer's specifications. The initialization process includes generating core key pairs such as the Endorsement Key (EK), Platform Identity Key (PIK), and Authenticating Identity Key (AIK). Since it is a single-machine deployment environment, all key materials are generated and managed locally, without interaction with external certificate authorities. The AIK public key and corresponding digital certificate are stored in a locally encrypted secure storage area (e.g., / etc / security / tpm / keys), which is protected by TPM's sealed storage function to ensure that key materials are not accessed or tampered with without authorization. A complete local key lifecycle management mechanism is also established, including key rotation, backup, and recovery processes, to ensure the security and reliability of key management.

[0233] 2. Deployment of the kernel invariant monitoring module

[0234] Similar to Implementation Case 1, a dedicated kernel module was developed to monitor the integrity of critical kernel invariants, including core data structures such as the system call table, interrupt descriptor table, and process descriptor table. Considering the resource constraints of a single-machine environment, this module employs an intelligent trigger-based measurement mechanism, performing integrity checks only when critical system events (such as module loading, process creation, and permission changes) are detected, significantly reducing system overhead. The module obtains monitoring data by directly accessing the kernel memory space, calculates the measurement value using the SM3 hash algorithm, and temporarily stores the monitoring results in a kernel circular buffer. The module also implements an adaptive sampling mechanism, which dynamically adjusts the monitoring frequency based on system load, maximizing system performance while ensuring security.

[0235] 3. Implementation of User-Mode Sensitive File Monitoring System

[0236] Similar to Implementation Case 1, a user-space file integrity monitoring program was developed to continuously monitor critical system files. The monitoring scope employs a tiered strategy, dividing system files into three security levels: core files (such as / etc / passwd and / etc / shadow), important configuration files (such as / etc / ssh / sshd_config), and general files. Different levels of monitoring strategies, including real-time monitoring, scheduled scanning, and sampling detection, are used for each level. The monitoring program integrates advanced incremental hash calculation technology, recalculating hash values ​​only for changed parts of the file, significantly improving monitoring efficiency. All baseline hash values ​​are protected by TPM's sealed storage function to prevent malicious tampering. Monitoring results are cached in a protected memory area, supporting rapid comparison and anomaly detection.

[0237] 4. eBPF Monitoring Program Deployment and Configuration

[0238] This case study differs fundamentally from Implementation Case 1, which only focuses on security data collection. It involves developing eBPF programs with deep policy verification and real-time blocking capabilities. These programs not only collect system behavior data but, more importantly, integrate a complete security policy verification engine and malicious process detection logic. After compilation and loading, the eBPF programs establish a real-time connection with the security policy benchmark library pre-installed in eBPF Maps, forming a kernel-level policy decision-making and execution system.

[0239] When the system detects critical kernel events such as process creation, file access, privilege escalation, and network connection, the eBPF program immediately triggers a policy verification process to assess the security of the operation from multiple dimensions: First, it verifies the trustworthiness of the executing entity, including process signature, path whitelist, and hash value verification; second, it analyzes the rationality of the operation behavior, matching it based on predefined security policies and abnormal behavior patterns; finally, it assesses the risk level of the operation and makes a comprehensive decision based on the system context.

[0240] Once a violation of security policies is detected, such as an unauthorized process attempting to access sensitive files, malware attempting privilege escalation, or establishing an illegal network connection, the eBPF program no longer simply logs the information like traditional monitoring systems. Instead, it proactively returns a specific error code to the kernel, directly interrupting the execution of the illegal system call and preventing the malicious operation from completing at the lowest level. This kernel-mode real-time detection mechanism can block security threats within microseconds, achieving true real-time protection.

[0241] Unlike Implementation Case 1, which relies on remote policy issuance, this case demonstrates that all security decisions are made in real-time at the kernel level, completely eliminating security risks caused by network latency. The malicious process identification algorithm based on deep behavioral analysis accurately distinguishes between normal operations and attack behaviors. Combined with a locally maintained malicious signature database, it achieves fully autonomous security protection without relying on external services. This deeply integrated security protection mechanism is particularly suitable for scenarios with extremely high real-time security requirements, such as industrial control systems, military facilities, and financial transaction systems, ensuring effective blocking the attack the instant it occurs.

[0242] 5. Configure the metrics agent and local report generation

[0243] The metrics agent, serving as the system's data aggregation and analysis center, employs a specially optimized localized architecture. Unlike Implementation Case 1, which periodically reports data to a remote server, the metrics agent in this case is configured to periodically collect integrity data from various monitoring components, including kernel invariant measurement results, file integrity status, and kernel security events. However, all data processing and storage are performed locally. The agent integrates the collected data into structured integrity monitoring logs, digitally signs the logs using the AIK private key to ensure non-repudiation, and then stores them in a locally specified secure directory (e.g., / var / log / integrity / ).

[0244] The log management system implements intelligent storage optimization strategies, including a time- and size-based dual-dimensional log rotation mechanism to prevent disk space exhaustion; the use of the LZ4 real-time compression algorithm to reduce storage overhead; and the use of TPM-protected encryption keys to encrypt and store sensitive logs. The system also establishes a complete log auditing process, supporting content-based security event retrieval and statistical analysis, providing comprehensive data support for security auditing and troubleshooting.

[0245] 6. Implement local policy execution and proactive defense.

[0246] The host utilizes eBPF Maps to build a local security policy storage and execution engine. These policies can be based on the analysis results of local machine learning algorithms or predefined security rules by the administrator. When a kernel event is triggered, the eBPF monitoring program compares the event data with the policy benchmark library in real time to perform a multi-level risk assessment. For operations that violate the policy, the system will not only block the execution of the operation but also trigger corresponding response measures according to the risk level: generating alarm logs for low-risk events, blocking operations and notifying the administrator for medium-risk events, and immediately isolating the relevant processes and initiating emergency response procedures for high-risk events.

[0247] The system implements an advanced proactive defense mechanism, establishing a dynamically updated security baseline by continuously monitoring and learning normal system behavior. When abnormal behavior deviating from the baseline is detected, the system can automatically adjust its protection strategy, gradually improving monitoring accuracy and protection strength. Administrators can periodically review security logs through a local management interface, analyze the protection effectiveness, optimize security strategies, and form a closed loop of continuous improvement in security protection.

[0248] This standalone integrated deployment model achieves autonomous security protection in network-isolated environments by building a complete intrinsic security system. Compared with distributed architectures, this solution has shorter response latency, higher reliability, and stronger environmental adaptability, making it particularly suitable for deployment in scenarios with stringent requirements for network security and real-time performance, such as military, financial, and industrial control. Through localized policy enforcement and real-time alerting mechanisms, the system can quickly respond to security incidents, effectively reducing reliance on external services and providing enterprise-level security even in completely offline environments.

[0249] In summary, the host system multi-element integrity monitoring method proposed in this invention achieves effective capture and real-time protection against malicious process unauthorized operations by constructing a comprehensive monitoring system covering kernel invariants, user-space sensitive files, and kernel security events. The innovation of this method lies not only in its multi-dimensional monitoring capabilities but also in its flexible and scalable architecture design, which can adapt to application scenarios of different scales and needs.

[0250] As shown in Implementation Case 1, in a distributed deployment mode, this invention enables unified security management of large-scale hosts at the enterprise level. Through the aggregation and analysis of monitoring data from multiple nodes by the central server, a comprehensive network security situation awareness can be built, and based on this, unified protection policies can be formulated and distributed to each host for execution. This centralized management and control mode is particularly suitable for scenarios such as cloud data centers and large enterprise networks that require unified security management of a large number of hosts.

[0251] As shown in Implementation Case 2, this invention also demonstrates excellent autonomous security capabilities in a standalone integrated deployment mode. By integrating policy verification and real-time blocking functions into the eBPF monitoring program, the system can independently complete security decisions and malicious process detection locally, without relying on instructions from an external server. This autonomous characteristic makes this method particularly suitable for environments with limited network conditions or extremely high real-time requirements, such as edge computing and industrial control systems.

[0252] Both deployment modes embody the core value of this invention: it enables large-scale collaborative protection through centralized management, while ensuring the continuous security of critical business operations through distributed autonomy. This flexibility and scalability ensure that this invention can smoothly extend from traditional data centers to emerging edge computing scenarios, providing effective technical support for building a comprehensive, multi-layered network security protection system. Through multi-element collaborative monitoring, a dynamic and static combined protection mechanism, and a flexible and scalable architecture design, this invention provides a complete and efficient solution for host system security, possessing significant practical value and broad application prospects.

[0253] The embodiments of the present invention have been described in detail above with reference to the examples, but the present invention is not limited to the above embodiments. For those skilled in the art, after learning the contents described in the present invention, several equivalent modifications and substitutions can be made (such as using other hardware security modules or adjusting the order of monitoring elements) without departing from the principle of the present invention, and these modifications and substitutions should also be considered to fall within the protection scope of the present invention.

[0254] Finally, the above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention (such as adaptation to other operating systems or architectures) should be included within the scope of protection of the present invention.

Claims

1. A method for monitoring the integrity of multiple elements in a host system, characterized in that, Comprise: Step 1) based on TPM / TCM chip, generate EK, PIK and AIK unique to the host platform, prepare for subsequent integrity monitoring interaction, prevent tampering of the host report through TPM / TCM chip binding, generate the key, synchronize the public key of EK and AIK to the server for subsequent identity verification; Step 2) write a custom kernel module to measure and monitor the key invariants and memory data structure information of the host system kernel; Step 3) based on the cryptographic algorithm, measure the user state sensitive file and monitor the file change; Step 4) write eBPF integrity monitoring program to monitor the running state of kernel event of host system, pass the state data of kernel event to user space through eBPFMaps, so as to realize the monitoring of kernel event state; Step 5) the measurement agent periodically acquires the measurement information of kernel invariants, user state sensitive files and kernel events, forms an integrity monitoring report, and uploads it to the server; Step 6) after the server receives the integrity monitoring report, it verifies the identity information of the report, and then writes the report data into the database, analyzes it based on the security management platform or data analysis tool, formulates the personalized trusted protection strategy of the host, and finally synchronizes the strategy with the host. The host continues to run according to the new protection strategy.

2. The host system multi-element integrity monitoring method of claim 1, wherein, In step 1), based on TPM / TCM chip as the root of trust, bind the host platform to provide trusted identity verification and security guarantee for the credibility and integrity of the integrity monitoring report.

3. The host system multi-element integrity monitoring method of claim 1, wherein, In step 2), the kernel invariant information is obtained in the kernel space, and the user kernel module is used to realize the acquisition and measurement of the kernel invariant information, which is then transmitted to the user space through the kernel module.

4. The host system multi-element integrity monitoring method of claim 1, wherein, In step 3), the user state stores sensitive user data, including user, group related, and user sensitive information, which prevents malicious tampering of related data files through integrity measurement.

5. The host system multi-element integrity monitoring method of claim 1, wherein, In step 4), based on the eBPF technology, the system security event monitoring relies on the characteristics of eBPF technology to realize the state monitoring of system kernel events, and realizes the collection of data from kernel state to user state through eBPF Maps, so as to form the monitoring log.

6. The host system multi-element integrity monitoring method of claim 5, wherein, The integrity monitoring program of system kernel security event follows the coding requirements of eBPF, is bound to the kernel after compilation and verification, and actively triggers to collect the state of kernel security event and write the data into eBPF Maps.

7. The host system multi-element integrity monitoring method of claim 1, wherein, In step 5), the measurement agent periodically collects the integrity monitoring data of kernel invariant monitoring module, user state sensitive file monitoring module and system security event monitoring module, forms an integrity monitoring report, and uploads it to the server after signing by TPM / TCM chip.

8. The host system multi-element integrity monitoring method of claim 7, wherein, The integrity monitoring report includes: signed integrity monitoring log, EK public key of host platform and host AIK certificate.

9. The host system multi-element integrity monitoring method of claim 1, wherein, In step 6), the server verifies the integrity monitoring report, and the server verifies the integrity monitoring report by relying on the key generated by TPM / TCM, verifies the authenticity and credibility of the report source, and writes the integrity monitoring log into the database.

10. The host system multi-element integrity monitoring method of claim 9, wherein, After the integrity monitoring log is stored for multiple cycles, analysis is performed on specific files or system kernel security events to form a duration integrity monitoring data chain for analyzing the running state of a process and further formulating an effective trusted protection policy; Analysis of the integrity monitoring log uses specific data analysis tools or specific security management to display different categories of integrity monitoring, thereby more intuitively viewing the change process of the monitoring events and facilitating formulation and issuance of a trusted protection policy. The server end statistically analyzes one or more host integrity monitoring logs, implements a distributed management mode, and formulates a personalized trusted protection policy according to the running characteristics of different hosts and maintains synchronization of the policies of the hosts.

Images