Host command auditing method and system, electronic equipment, medium and program product

Abstract

The invention discloses a host command auditing method and system, electronic equipment and a storage medium. The method is applied to modified bash and comprises the following steps: detecting a to-be-executed command input by a user; performing command interpretation on the to-be-executed command to obtain analysis information; based on the analysis information, an implanted matching engine is called to judge whether the to-be-executed command is a high-risk command or not; and when the to-be-executed command is a high-risk command, processing the high-risk command based on a pre-configured processing strategy. According to the method, auditing and intercepting functions can be implanted in a bash shell source code layer, so that complete, accurate and non-bypassing auditing and intercepting of a to-be-executed command are realized.

Description

Technical Field

[0001] This application relates to the field of host security, specifically to a host command auditing method, system, electronic device, readable storage medium, and computer program product. Background Technology

[0002] As the mainstream choice for server operating systems, Linux systems require particularly robust security monitoring. Among these systems, bash shell, the most commonly used command-line interpreter, serves as a primary entry point for attackers to conduct malicious activities such as system penetration, privilege escalation, and data theft.

[0003] Currently, host security products offer a variety of implementations for auditing Linux command execution. One approach involves replacing the native bash shell of the cloud host system with a customized bash auditing module via an agent. After executing a command, this module inserts the `send_info` function within the `add_history` function to send the command execution information to the agent via a local socket. The agent then uploads this information to a cloud-based information processing module via the TLS protocol for centralized analysis and display.

[0004] However, when attacked, this method can only audit the attacking bash commands and cannot trace which user, address, or time of the attack. Furthermore, its auditing functionality is strongly tied to the agent process; an abnormal agent exit will completely disable the auditing function, creating a security blind spot. Additionally, the audit data must pass through local sockets and the network during transmission, which undoubtedly expands the attack surface, making it vulnerable to eavesdropping, tampering, and leakage. Finally, the way this method obtains login context information is highly susceptible to being forged by advanced attackers, thus failing to provide accurate and effective login session association information. Summary of the Invention

[0005] In view of the above problems, this application provides a host command auditing method, system, electronic device, readable storage medium and computer program product, which can embed auditing and interception functions at the bash shell source code level, thereby realizing complete, accurate and unbypassable auditing and interception of commands to be executed.

[0006] Firstly, this application provides a host command auditing method, which is applied in a modified bash, including: Detect the user-input command to be executed; The command to be executed is interpreted to obtain parsed information; Based on the parsed information, the implanted matching engine is invoked to determine whether the command to be executed is a high-risk command; When the command to be executed is a high-risk command, the high-risk command is handled based on a pre-configured handling strategy.

[0007] In the above technical solution, this method can achieve command auditing and interception at the bash shell source code level, directly obtaining complete context information such as the real user, access address, and execution time of the command execution, effectively preventing the forgery of login session association information; at the same time, the auditing function is deeply bound to the bash process, eliminating the dependence on the Agent process, and even if the Agent exits abnormally, no security blind spot will be formed; in addition, it can also reduce the data transmission links, reduce the risk of audit data being eavesdropped, tampered with, and leaked, and achieve accurate identification and handling of high-risk commands.

[0008] In some implementations, the step of invoking the implanted matching engine based on the parsed information to determine whether the command to be executed is a high-risk command includes: When the host command audit scenario is a normal audit scenario, the implanted matching engine is invoked to perform regular expression matching on the parsed information to obtain the regular expression matching result; When the regular expression matching result is a suspected high-risk result, semantic parsing is performed on the parsed information to obtain the semantic parsing result; Based on the semantic parsing results, it is determined whether the command to be executed is a high-risk command.

[0009] In the above technical solution, the method can improve the efficiency of high-risk command identification while avoiding the misjudgment and omission problems that are easy to occur in simple regular expression matching, thus ensuring the accuracy and efficiency of high-risk command identification in normal audit scenarios.

[0010] In some implementations, after interpreting the command to be executed to obtain parsed information, the method further includes: When the system performance reaches the degradation trigger threshold, the host command audit scenario is determined to be an extreme audit scenario, and the implanted matching engine is invoked to perform regular expression matching on the parsed information according to the preset sampling ratio to obtain the regular expression matching result. Record the regular expression matching results.

[0011] In the above technical solution, the method can dynamically switch audit scenarios according to system performance. When the system performance reaches the degradation threshold, it automatically switches to extreme audit scenarios. By performing regular expression matching through a preset sampling ratio, it can effectively reduce the occupation of system resources by audit functions while ensuring that core audit requirements are not missed. It avoids increasing the system performance burden due to audit operations and achieves a balance between audit protection and system operation stability.

[0012] In some embodiments, the method further includes: When the command to be executed is not a high-risk command, the dedicated login session log file is read through the implanted audit function; Identify the terminal device corresponding to the command to be executed, and obtain the original login record matching the terminal device from the dedicated login session log file; the original login record includes at least the username, login IP, and login time of the terminal device; By associating the original login record with the execution information of the command to be executed, associated log information is obtained; the execution information includes at least the command text and the execution time. The associated log information is standardized to obtain standardized information; The standardized information is written to a dedicated audit log file via an atomic write operation.

[0013] In the above technical solution, the method can accurately associate command execution information with the original login records such as the username, login IP, and login time of the terminal by reading the dedicated login session log file, and generate associated log information containing complete context; at the same time, by using standardized processing and atomic write operations, the standardization and integrity of the audit log are guaranteed, and the log is effectively prevented from being tampered with or lost.

[0014] In some embodiments, the method further includes: The dedicated audit log file is analyzed to generate analysis results; Based on preset security alarm rules, trigger alarm operations corresponding to the analysis results; Based on the analysis results, the preset security alert rules and handling strategies in the bash configuration file are iteratively optimized.

[0015] In the above technical solution, the method can promptly detect security risks in host command execution by analyzing dedicated audit log files and triggering targeted alarm operations; at the same time, iteratively optimize security alarm rules and handling strategies based on the analysis results, so that the audit and interception mechanism at the bash level can continuously adapt to new attack scenarios.

[0016] In some implementations, before detecting the user-input command to be executed, the method further includes: Identify the server operating system version and obtain the bash source code that matches the server operating system version; An auditing function and a matching engine were injected into the bash source code to obtain the modified bash source code. The modified bash source code is compiled into a binary program, and the binary program is identified as the modified bash.

[0017] In the above technical solution, the method can adapt the corresponding bash source code according to the server operating system version, inject audit functions and matching engines from the source code level and compile them into binary programs, so as to deeply integrate the audit function with bash, thereby ensuring the compatibility of the modified bash with different system versions, and fundamentally making the audit function unbypassable, completely getting rid of the dependence on external agents.

[0018] In some implementations, the method further includes, prior to detecting the user-input command to be executed: Read the user terminal log files in the system to obtain historical login information; When the historical login information passes the format and integrity checks, the historical login information is standardized to obtain standardized information. The standardized information is written to a dedicated login session log file via an atomic write operation.

[0019] In the above technical solution, the method can perform dual verification of the format and integrity of the historical login information in the system user terminal record file, and then store it in a dedicated login session log file after standardization processing and atomic writing operation, thereby ensuring the accuracy, integrity and immutability of the login information.

[0020] In some implementations, the method further includes, prior to detecting the user-input command to be executed: Obtain the bash configuration file and perform hot reloading in the modified bash; The bash configuration file includes at least audit function switch information, login session log storage path, audit log storage path, log storage format requirements, high-risk command identification strategy, and high-risk command handling strategy.

[0021] In the above technical solution, the method can flexibly adjust audit rules and policies without restarting the bash process by hot-loading bash configuration files containing key configurations such as audit switches, log paths, and high-risk command identification and handling strategies. This greatly improves the flexibility and timeliness of audit configuration and can quickly adapt to different security protection needs.

[0022] Secondly, this application provides a host command auditing system, including: The detection unit is used to detect the user-inputted command to be executed. An interpretation unit is used to interpret the command to be executed and obtain parsed information; The judgment unit is used to determine whether the command to be executed is a high-risk command based on the parsed information and by calling the implanted matching engine. The processing unit is used to process the high-risk command based on a pre-configured processing strategy when the command to be executed is the high-risk command.

[0023] In the above technical solution, the system can perform command auditing and interception at the bash shell source code level, directly obtaining complete context information such as the real user, access address, and execution time of the command execution, effectively preventing the forgery of login session association information; at the same time, the auditing function is deeply bound to the bash process, eliminating the dependence on the Agent process, so even if the Agent exits abnormally, no security blind spot will be formed; in addition, it can also reduce the data transmission links, reduce the risk of audit data being eavesdropped, tampered with, and leaked, and achieve accurate identification and handling of high-risk commands.

[0024] Thirdly, this application provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor running the computer program to cause the electronic device to perform the host command auditing method described in any one of the first aspects.

[0025] Fourthly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, performs the host command auditing method described in any one of the first aspects.

[0026] Fifthly, this application provides a computer program product comprising a computer program that, when executed by a processor, performs the host command auditing method described in any one of the first aspects.

[0027] The beneficial effects of this application are as follows: by embedding audit and interception rule code into the bash history function, it can achieve automatic auditing of command execution and real-time identification and handling of high-risk commands; by reading the system utmp to obtain authoritative login information and formatting its storage, it can accurately associate command execution records with user login sessions; and by combining flexible audit configuration and reliable log management, it can achieve complete context auditing of Linux command line operations, accurate attack tracing and efficient risk interception, while eliminating dependence on external agents and improving the reliability and security of the audit mechanism. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating the host command auditing method in some embodiments of this application; Figure 2 This is a schematic diagram of the command auditing process of a modified bash program in some embodiments of this application; Figure 3 Here is an architectural flowchart of a modified bash shell auditing system in some embodiments of this application; Figure 4 This is a schematic diagram of the host command auditing system in some embodiments of this application; Figure 5 This is a schematic diagram of the structure of an electronic device in some embodiments of this application. Detailed Implementation

[0030] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0032] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more (including two), similarly, "multiple sets" refers to two or more sets (including two sets), and "multiple pieces" refers to two or more pieces (including two pieces) unless otherwise explicitly defined.

[0033] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0034] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0035] The current Linux command-line operation auditing system works by replacing the native bash of the cloud host with a customized bash auditing module through an agent. After the command is executed, the module sends the command execution information to the agent via a local socket using the send_info function that inserts the add_history function. The agent then uploads the information to the cloud information processing module via the TLS protocol for centralized analysis and display.

[0036] However, the auditing mechanism in this method relies excessively on external agent processes and multi-stage data transmission links. Therefore, if the agent exits abnormally, the auditing function will directly fail, creating a security blind spot. The process of transmitting audit data via local sockets and the network expands the attack surface, posing risks of eavesdropping, tampering, and leakage. At the same time, the login context information obtained under this coupled architecture is easily forged, making accurate attack tracing impossible, and the multi-stage communication transmission also introduces additional performance overhead, affecting the real-time performance of system operation and auditing.

[0037] To address the aforementioned technical issues, this application provides a host command auditing method. This method can automatically audit command execution and identify and handle high-risk commands in real time by embedding audit and interception rule code into the bash history function; it can obtain authoritative login information by reading the system utmp and formatting and storing it to accurately associate command execution records with user login sessions; and combined with flexible audit configuration and reliable log management, it can achieve complete context auditing of Linux command line operations, accurate attack tracing, and efficient risk interception, while eliminating dependence on external agents and improving the reliability and security of the audit mechanism.

[0038] like Figure 1 As shown, some embodiments of this application provide a host command auditing method, which is applied in a modified bash. The method includes: S101. Detect the command to be executed entered by the user; S102. Perform command interpretation on the command to be executed to obtain parsed information; S103. Based on the parsed information, call the implanted matching engine to determine whether the command to be executed is a high-risk command; S104. When the command to be executed is a high-risk command, the high-risk command shall be handled based on the pre-configured handling strategy.

[0039] In some embodiments, the command to be executed refers to the instruction text that the user enters in the bash command-line interface and expects the system to execute, which may include a single basic command, a combination of commands with parameters, or script execution statements.

[0040] In some embodiments, parsed information refers to the set of information obtained after performing syntactic analysis and structural decomposition on the user-input command to be executed, including the command body, parameter types, execution logic, associated objects, etc.

[0041] In some embodiments, the matching engine refers to a rule matching component embedded in the modified bash source code, which has a built-in high-risk command signature library and matching logic for comparing and judging command parsing information.

[0042] In some embodiments, a high-risk command refers to a command that has a high risk of execution consequences. Such commands may be used for attacks such as privilege escalation, data theft, system destruction, and malware implantation.

[0043] In some embodiments, the pre-configured handling strategy refers to the handling rules for identified high-risk commands that are pre-set in the bash configuration file, which may include different operations such as command interception, execution blocking, log alerts, and permission restrictions.

[0044] In the above embodiments, this method can achieve command auditing and interception at the bash shell source code level, directly obtaining complete context information such as the real user, access address, and execution time of command execution, effectively preventing the forgery of login session association information; at the same time, the auditing function is deeply bound to the bash process, eliminating the dependence on the Agent process, and even if the Agent exits abnormally, no security blind spot will be formed; in addition, it can also reduce data transmission links, reduce the risk of audit data being eavesdropped, tampered with, and leaked, and achieve accurate identification and handling of high-risk commands.

[0045] In some embodiments, based on the parsed information, the implanted matching engine is invoked to determine whether the command to be executed is a high-risk command, including: When the host command auditing scenario is a normal auditing scenario, the implanted matching engine is invoked to perform regular expression matching on the parsed information and obtain the regular expression matching result; When the regular expression matching result is a suspected high-risk result, semantic parsing is performed on the parsed information to obtain the semantic parsing result; Based on the semantic parsing results, determine whether the command to be executed is a high-risk command.

[0046] In some embodiments, a normal audit scenario refers to a scenario where the system performance is within the normal threshold range and the host command audit function operates according to the complete detection logic. In this scenario, the accuracy and comprehensiveness of the audit must be taken into account.

[0047] In some embodiments, regular expression matching refers to the process of using preset regular expression rules to perform feature matching on command parsing information, in order to quickly filter out suspected information that matches the characteristics of high-risk commands.

[0048] In some embodiments, the regular expression matching result refers to the judgment result obtained after performing regular expression matching on the parsed information, including two categories: matching hit (suspected high-risk result) and matching miss (non-high-risk result).

[0049] In some embodiments, a suspected high-risk result refers to a matching result in which the parsed information is identified as containing high-risk command features during the regular expression matching process, but has not yet been further verified.

[0050] In some embodiments, semantic parsing refers to the process of performing in-depth analysis of parsed information in dimensions such as command intent, execution logic, and contextual relationships to determine the true risk of a command.

[0051] In some embodiments, the semantic parsing result refers to the judgment result obtained after semantic parsing the parsed information, which is used to finally confirm whether the command to be executed is a high-risk command.

[0052] For example, this method can add high-risk command auditing and interception logic to execute_cmd.c.

[0053] Specifically, this method can insert a lightweight matching engine in execute_cmd.c or before command interpretation and execution, using a hybrid decision-making method that combines a pattern-based set of regular expressions with optional semantic parsing (e.g., recognizing contexts such as redirection, pipelining, and sudo); The criteria for determining high-risk commands include, but are not limited to: the command itself (such as rm -rf / ), potentially destructive operations in combined pipelines, commands that modify critical system configurations / accounts / permissions, and user-defined custom high-risk modes.

[0054] In the above embodiments, the method can improve the efficiency of high-risk command identification while avoiding the misjudgment and omission problems that are easy to occur in simple regular expression matching, thus ensuring the accuracy and efficiency of high-risk command identification in normal audit scenarios.

[0055] In some embodiments, after interpreting the command to be executed and obtaining parsed information, the method further includes: When the system performance reaches the degradation trigger threshold, the host command audit scenario is determined to be an extreme audit scenario, and the implanted matching engine is invoked to perform regular expression matching on the parsed information according to the preset sampling ratio to obtain the regular expression matching result. Record the regular expression matching results.

[0056] In some embodiments, the degradation trigger threshold refers to a pre-set critical indicator used to determine whether the system performance needs to be reduced in audit intensity, and may include system operating parameters such as CPU utilization, memory usage, and process load.

[0057] In some embodiments, extreme audit scenarios refer to a lightweight audit mode that switches to balance audit requirements and system stability when system performance reaches a degradation trigger threshold.

[0058] In some embodiments, the preset sampling ratio refers to a pre-configured ratio value for extracting partial parsed information for regular expression matching under extreme auditing scenarios, which is used to control the system resource consumption of the auditing function.

[0059] For example, the method can design the matching logic to prioritize lightweight operations, with negligible overhead for common, non-high-risk command paths, and provide threshold and sampling settings to degrade to logging mode in extreme scenarios.

[0060] In the above embodiments, the method can dynamically switch audit scenarios according to system performance. When the system performance reaches the degradation threshold, it automatically switches to extreme audit scenarios. By performing regular expression matching through a preset sampling ratio, it can effectively reduce the occupation of system resources by audit functions while ensuring that core audit requirements are not missed. It avoids increasing the system performance burden due to audit operations and achieves a balance between audit protection and system operation stability.

[0061] In some embodiments, the method further includes: When the command to be executed is not a high-risk command, a dedicated login session log file is read through the implanted audit function; Identify the terminal device corresponding to the command to be executed, and obtain the original login record matching the terminal device from the dedicated login session log file; the original login record includes at least the username, login IP, and login time of the terminal device; By associating the original login record with the execution information of the command to be executed, the associated log information is obtained; the execution information includes at least the command text and the execution time. Standardize the associated log information to obtain standardized information; Standardized information is written to a dedicated audit log file via atomic write operations.

[0062] In some embodiments, a dedicated login session log file refers to a file specifically used to store standardized, complete, and accurate user login session information, providing data support for associating commands with login context.

[0063] In some embodiments, a terminal device refers to a hardware device or remote connection terminal used by a user to log in to a host and enter commands to be executed, and is a key identifier carrier that associates command execution with login records.

[0064] In some embodiments, the original login record refers to a set of basic login information extracted from a dedicated login session log file that matches the terminal device, including at least the username, login IP, and login time.

[0065] In some embodiments, execution information refers to the core information generated during the execution of a command in the system, which includes at least the command text and execution time, and is a core component of the audit log.

[0066] In some embodiments, associated log information refers to log data containing a complete context formed by binding the original login record with command execution information.

[0067] In some embodiments, standardization refers to the operation of uniformly adjusting the format of associated log information according to a preset log format specification, so as to ensure the standardization and readability of log data.

[0068] In some embodiments, standardized information refers to log data that conforms to a unified format after the associated log information has undergone standardized processing.

[0069] In some embodiments, an atomic write operation refers to an indivisible log write operation that ensures standardized information is completely written to a dedicated audit log file, preventing log write interruptions, tampering, or loss.

[0070] In some embodiments, a dedicated audit log file refers to a file specifically used to store standardized information that has undergone atomic write operations, and is the final storage medium for host command audit data.

[0071] For example, this method can obtain user login information by reading the system's self-maintained local login session file (such as / var / log / bash_login_session_info) and then perform context association.

[0072] For example, this method can format command execution information and context information and write them to a specified audit log file.

[0073] For example, this method can generate an undeniable audit entry for each interception operation, including the command text, trigger time, session ID (from the local login session file), initiating terminal, executing user, and final disposal result.

[0074] In some embodiments, Figure 2 This diagram illustrates the command auditing process of the modified bash program. Specifically, Figure 2 This demonstrates the complete process in the modified bash program where, after a user inputs a command, the command execution logic triggers the built-in audit trigger function (located in `add_history`) in the source code. It then queries the system's ` / utmp` file to obtain the login session's user, IP address, and time information, and writes the associated information to the local audit log (` / var / log / bash_audit.log`). This process covers session association and log generation operations, including "querying the login session (associating it with the system's `utmp` file), obtaining the login user / IP address / time, and writing to the local audit log." It also illustrates the implementation logic of the audit trigger function embedded in `add_history` (corresponding to the modified bash source code).

[0075] In the above embodiments, the method can accurately associate command execution information with the original login records such as the username, login IP, and login time of the terminal by reading the dedicated login session log file, and generate associated log information containing complete context; at the same time, by using standardized processing and atomic write operations, the method ensures the standardization and integrity of the audit logs and effectively avoids log tampering or loss.

[0076] In some embodiments, the method further includes: Analyze the dedicated audit log file and generate analysis results; Based on preset security alarm rules, trigger alarm operations corresponding to the analysis results; Based on the analysis results, the preset security alert rules and handling strategies in the bash configuration file were iteratively optimized.

[0077] In some embodiments, the analysis results refer to the audit conclusion data obtained after statistical analysis, judgment and feature extraction of standardized information in a dedicated audit log file.

[0078] In some embodiments, a preset security alert rule refers to a set of rules pre-configured in a bash configuration file to determine whether the analysis results meet the conditions for triggering a security alert.

[0079] In some embodiments, an alarm operation refers to an alert action automatically triggered by the system when the analysis results meet preset security alarm rules, which may include log marking, message push, system notification, etc.

[0080] In some embodiments, iterative optimization refers to the process of continuously adjusting and improving the security alert rules and handling strategies in the bash configuration file based on the analysis results of audit logs.

[0081] For example, this method can manage, analyze, and handle alerts on the generated audit logs.

[0082] In the above embodiments, the method can promptly detect security risks in host command execution by analyzing dedicated audit log files and triggering targeted alarm operations; at the same time, iteratively optimize security alarm rules and handling strategies based on the analysis results, so that the audit and interception mechanism at the bash level can continuously adapt to new attack scenarios.

[0083] In some embodiments, before detecting the user-input command to be executed, the method further includes: Identify the server operating system version and obtain the bash source code that matches the server operating system version; By injecting auditing functions and a matching engine into the bash source code, a modified bash source code is obtained. The compiled and modified bash source code is a binary program, and the binary program is identified as the modified bash.

[0084] In some embodiments, bash source code refers to the original source code of the bash program, which is a collection of code that implements the core functions of the bash command interpreter and can be adapted to different operating system versions.

[0085] In some embodiments, an audit function refers to a custom function embedded in the bash source code to implement audit-related functions such as command auditing, logging, and context association.

[0086] In some embodiments, the modified bash source code refers to the bash source code that has auditing and interception capabilities after injecting auditing functions, matching engines and other functional code into the native bash source code.

[0087] In some embodiments, a binary program refers to an executable program that can be directly run on the corresponding server operating system, obtained by compiling modified bash source code.

[0088] In some embodiments, modified bash refers to a binary program compiled from modified bash source code, which is a customized bash command interpreter with auditing, high-risk command identification and interception functions.

[0089] For example, this method can obtain the bash source code and modify it for auditing functionality. Specifically, this method can first download the bash-4.2 source code, inject auditing code into the bash_add_history function call chain in the bashhist.c file; then, compile the modified bash source code into a binary program, replace the system / bin / bash, and ensure that all shell commands are executed through the modified bash.

[0090] In the above embodiments, the method can adapt the corresponding bash source code according to the server operating system version, inject audit functions and matching engines from the source code level and compile them into binary programs, so as to deeply integrate the audit function with bash, thereby ensuring the compatibility of the modified bash with different system versions, and fundamentally making the audit function unbypassable, completely getting rid of the dependence on external agents.

[0091] In some embodiments, the method further includes, before detecting the user-input command to be executed: Read the user terminal log files in the system to obtain historical login information; When historical login information passes format and integrity checks, it is standardized to obtain standardized information. Standardized information is written to a dedicated login session log file via atomic write operations.

[0092] In some embodiments, the user terminal log file refers to the raw file in the system that stores the user's login, logout, and other terminal operation traces, and serves as the data source for obtaining historical login information. The user terminal log file corresponds to a utmp file.

[0093] In some embodiments, historical login information refers to raw data read from a user terminal log file that contains the user's past login behavior.

[0094] In some embodiments, format verification refers to a check operation that verifies whether the storage format of historical login information conforms to preset specification requirements.

[0095] In some embodiments, integrity verification refers to the check operation that verifies whether historical login information is missing, corrupted, or otherwise in order to ensure that the data is complete and valid.

[0096] For example, this method can obtain the login user's information through the "utmp" system, an important mechanism in the Linux system used to record user login information. The information includes process ID, terminal device name, username, hostname, session ID, timestamp, IP address, etc., and format it into a self-maintained login session log file (such as / var / log / bash_login_session_info).

[0097] For example, after a user executes any command in bash, the modified bash triggers an audit function while recording the history.

[0098] For example, the audit function can call the setutent() and getutent() series of functions to traverse the system's utmp records.

[0099] For example, this method can precisely match the original login record that created this bash session by comparing the terminal device number of the current process (such as / dev / pts / 0).

[0100] For example, this method can extract unforgeable underlying system information such as login username, source IP address (for SSH login), and login time from the matched log records.

[0101] In the above embodiments, the method can perform dual verification of the format and integrity of historical login information in the system user terminal record file, and then store it in a dedicated login session log file after standardization processing and atomic write operation, thereby ensuring the accuracy, integrity and immutability of login information.

[0102] In some embodiments, the method further includes, before detecting the user-input command to be executed: Retrieve the bash configuration file and perform hot reloading in the modified bash; The bash configuration file should include at least the audit function switch information, login session log storage path, audit log storage path, log storage format requirements, high-risk command identification strategy, and high-risk command handling strategy.

[0103] In some embodiments, a bash configuration file refers to a file used to configure the modified bash execution rules, which includes core policies and parameter configuration items such as auditing, logging, and handling of high-risk commands.

[0104] In some embodiments, hot reloading refers to the operation of loading an updated bash configuration file and making the new configuration take effect without restarting the modified bash process.

[0105] In some embodiments, the audit function switch information refers to the configuration item in the bash configuration file used to control the on or off state of the audit function.

[0106] In some embodiments, the login session log storage path refers to the system path information specified in the bash configuration file for storing dedicated login session log files.

[0107] In some embodiments, the audit log storage path refers to the system path information specified in the bash configuration file for storing dedicated audit log files.

[0108] In some embodiments, log storage format requirements refer to the unified storage format specifications that audit logs and login session logs must follow, as defined in the bash configuration file.

[0109] In some embodiments, the high-risk command identification strategy refers to the rules and logical configurations preset in the bash configuration file for determining whether a command to be executed is a high-risk command.

[0110] For example, this method can configure parameters such as audit function switch, log path, and log format through a configuration file.

[0111] For example, the modified bash automatically calls the auditing function bash_syslog_history() every time a command is executed.

[0112] For example, high-risk command rules and handling strategies are managed by the audit configuration module, which supports hot reloading and centralized distribution (rule files can be synchronized through configuration management tools during deployment).

[0113] In the above embodiments, the method can flexibly adjust audit rules and policies without restarting the bash process by hot-loading bash configuration files containing key configurations such as audit switches, log paths, and high-risk command identification and handling strategies. This greatly improves the flexibility and timeliness of audit configuration and can quickly adapt to different security protection needs.

[0114] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below. In some embodiments, Figure 3 A flowchart illustrating the architecture of a modified bash shell auditing system is shown; the host command auditing method includes: S01. Identify the target server's operating system version and confirm that it is CentOS 7.x series; S02. Download the modified bash package corresponding to the server's operating system version; S03. Deploy the modified bash program in batches using a configuration management tool (such as Ansible); S04. Configure audit parameters and set the log path to / var / log / bash_audit.log; S05. Enable the audit function switch and activate the audit mechanism; S06. Execute various commands on the test server to verify whether the audit function is triggered normally; S07. Check the format and completeness of the audit logs; S08. Test and verify that the performance impact of the system operation is within an acceptable range; S09. Simulate an attacker launching a bash command attack to test the system's protection capabilities; S10. Verify the first layer of protection of the system and confirm that the high-risk command audit and interception function is effective; S11. Verify the second-layer association function of the system to confirm that it can accurately locate the attacker's user information; S12. Conduct security analysis based on the generated audit logs; S13. Identify abnormal command execution patterns in the logs; S14. Establish corresponding security alarm rules based on the analysis results.

[0115] In the above embodiments, the method can monitor and record user login information, enabling the tracing of the true source of the attack when an attack command is encountered during the bash audit process, thus ensuring the integrity of the audit chain.

[0116] In the above embodiments, the method can identify and intercept high-risk commands before execution, providing not only post-audit evidence but also preventing potential harms in advance, significantly reducing losses caused by misoperation or malicious operation.

[0117] In the above embodiments, the method adopts a localized intrinsic security architecture, and the audit function does not depend on any external process or network connection, fundamentally eliminating the security blind spot caused by the failure of the audit agent.

[0118] In the above embodiments, compared with eBPF-based or agent-specific solutions, this method has no requirements on the operating system kernel version, has extremely wide compatibility, and is especially suitable for legacy systems, deeply customized Linux environments, and secure isolated networks.

[0119] In the above embodiments, the method enables local generation and storage of audit logs, avoiding the risk of sensitive operation records being leaked or tampered with during network transmission, and meeting higher-level security and compliance requirements.

[0120] In the above embodiments, the method supports multiple CentOS versions and provides corresponding compilation versions to ensure compatibility in different environments.

[0121] In the above embodiments, the method integrates the auditing logic directly into the bash shell, avoiding the performance overhead of external monitoring tools and having minimal impact on system performance.

[0122] In the above embodiments, the method supports flexible configuration options, allowing the audit strategy and log format to be adjusted according to actual needs.

[0123] In the above embodiments, compared with commercial host security products, this method has low implementation cost, simple maintenance, and high cost-effectiveness.

[0124] Figure 4 This diagram illustrates the structure of a host command auditing system. It should be understood that this system is related to... Figure 1 The method executed in the middle corresponds to the steps involved in the aforementioned method. The specific functions and effects of the system can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0125] The host command auditing system includes: The detection unit 210 is used to detect the command to be executed input by the user; Interpretation unit 220 is used to interpret the command to be executed and obtain parsed information; The judgment unit 230 is used to determine whether the command to be executed is a high-risk command based on the parsed information by calling the implanted matching engine. The processing unit 240 is used to process high-risk commands based on a pre-configured processing strategy when the command to be executed is a high-risk command.

[0126] In some embodiments, the determining unit 230 includes: The regular expression matching subunit 231 is used to call the implanted matching engine to perform regular expression matching on the parsed information and obtain the regular expression matching result when the host command audit scenario is a normal audit scenario. The semantic parsing subunit 232 is used to perform semantic parsing on the parsed information when the regular expression matching result is a suspected high-risk result, and obtain the semantic parsing result; Judgment subunit 233 is used to determine whether the command to be executed is a high-risk command based on the semantic parsing result.

[0127] In some embodiments, the regular expression matching subunit 231 is further configured to, after the interpretation unit 220 interprets the command to be executed and obtains the parsed information, determine that the host command audit scenario is an extreme audit scenario when the system performance reaches the degradation trigger threshold, and call the implanted matching engine to perform regular expression matching on the parsed information according to the preset sampling ratio to obtain the regular expression matching result; and record the regular expression matching result.

[0128] In some embodiments, the host command auditing system further includes: The reading unit 250 is used to read the dedicated login session log file through the implanted audit function when the command to be executed is not a high-risk command; The acquisition unit 260 is used to identify the terminal device corresponding to the command to be executed, and to acquire the original login record matching the terminal device in the dedicated login session log file; the original login record includes at least the username, login IP and login time of the terminal device; The association unit 270 is used to associate the original login record with the execution information of the command to be executed to obtain the associated log information; the execution information includes at least the command text and the execution time; Standardization unit 280 is used to standardize associated log information to obtain standardized information; Recording unit 290 is used to write standardized information to a dedicated audit log file via atomic write operations.

[0129] In some embodiments, the host command auditing system further includes: Analysis unit 300 is used to analyze dedicated audit log files and generate analysis results; Triggering unit 310 is used to trigger alarm operations corresponding to the analysis results based on preset security alarm rules; Iteration unit 320 is used to iteratively optimize the preset security alert rules and handling strategies in the bash configuration file based on the analysis results.

[0130] In some embodiments, the host command auditing system further includes: The identification unit 330 is used to identify the server operating system version and obtain the bash source code that matches the server operating system version before the detection unit 210 detects the user-input command to be executed. Insertion unit 340 is used to inject auditing functions and a matching engine into the bash source code to obtain the modified bash source code; Compilation unit 350 is used to compile the modified bash source code into a binary program and identify the binary program as the modified bash.

[0131] In some embodiments, the reading unit 250 is further configured to read the user terminal record file in the system to obtain historical login information before the detection unit 210 detects the user-input command to be executed; The standardization unit 280 is also used to standardize the historical login information when the historical login information passes the format check and integrity check, so as to obtain standardized information; Recording unit 290 is also used to write standardized information into a dedicated login session log file via atomic write operations.

[0132] In some embodiments, the host command auditing system further includes: The hot-loading unit 360 is used to obtain the bash configuration file and perform hot-loading in the modified bash before the detection unit 210 detects the user-input command to be executed. The bash configuration file should include at least the audit function switch information, login session log storage path, audit log storage path, log storage format requirements, high-risk command identification strategy, and high-risk command handling strategy.

[0133] like Figure 5 As shown, this application provides an electronic device 400, which includes a processor 401 and a memory 402. The processor 401 and the memory 402 are interconnected and communicate with each other through a communication bus 403 and / or other forms of connection mechanism (not shown). The memory 402 stores a computer program that can be executed by the processor 401. When the computing device is running, the processor 401 executes the computer program to perform the method in any of the aforementioned optional implementations.

[0134] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method in any of the aforementioned optional implementations.

[0135] The computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0136] This application provides a computer program product, which includes a computer program that, when run by a processor, executes the method in any of the aforementioned optional implementations.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application. In particular, as long as there is no conflict, the various technical features mentioned in the embodiments can be combined in any way. This application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A host command auditing method, characterized in that, The method is applied in the modified bash, including: Detect the user-input command to be executed; The command to be executed is interpreted to obtain parsed information; Based on the parsed information, the implanted matching engine is invoked to determine whether the command to be executed is a high-risk command; When the command to be executed is a high-risk command, the high-risk command is handled based on a pre-configured handling strategy.

2. The host command auditing method according to claim 1, characterized in that, The step of calling the implanted matching engine based on the parsed information to determine whether the command to be executed is a high-risk command includes: When the host command audit scenario is a normal audit scenario, the implanted matching engine is invoked to perform regular expression matching on the parsed information to obtain the regular expression matching result; When the regular expression matching result is a suspected high-risk result, semantic parsing is performed on the parsed information to obtain the semantic parsing result; Based on the semantic parsing results, it is determined whether the command to be executed is a high-risk command.

3. The host command auditing method according to claim 1, characterized in that, After interpreting the command to be executed to obtain parsed information, the method further includes: When the system performance reaches the degradation trigger threshold, the host command audit scenario is determined to be an extreme audit scenario, and the implanted matching engine is invoked to perform regular expression matching on the parsed information according to the preset sampling ratio to obtain the regular expression matching result. Record the regular expression matching results.

4. The host command auditing method according to claim 1, characterized in that, The method further includes: When the command to be executed is not a high-risk command, the dedicated login session log file is read through the implanted audit function; Identify the terminal device corresponding to the command to be executed, and obtain the original login record matching the terminal device from the dedicated login session log file; the original login record includes at least the username, login IP, and login time of the terminal device; By associating the original login record with the execution information of the command to be executed, associated log information is obtained; the execution information includes at least the command text and the execution time. The associated log information is standardized to obtain standardized information; The standardized information is written to a dedicated audit log file via an atomic write operation.

5. The host command auditing method according to claim 4, characterized in that, The method further includes: The dedicated audit log file is analyzed to generate analysis results; Based on preset security alarm rules, trigger alarm operations corresponding to the analysis results; Based on the analysis results, the preset security alert rules and handling strategies in the bash configuration file are iteratively optimized.

6. The host command auditing method according to claim 1, characterized in that, Before detecting the user-input command to be executed, the method further includes: Identify the server operating system version and obtain the bash source code that matches the server operating system version; An auditing function and a matching engine were injected into the bash source code to obtain the modified bash source code. The modified bash source code is compiled into a binary program, and the binary program is identified as the modified bash.

7. The host command auditing method according to claim 1, characterized in that, Before detecting the user-input command to be executed, the method further includes: Read the user terminal log files in the system to obtain historical login information; When the historical login information passes the format and integrity checks, the historical login information is standardized to obtain standardized information. The standardized information is written to a dedicated login session log file via an atomic write operation.

8. The host command auditing method according to claim 1, characterized in that, Before detecting the user-input command to be executed, the method further includes: Obtain the bash configuration file and perform hot reloading in the modified bash; The bash configuration file includes at least audit function switch information, login session log storage path, audit log storage path, log storage format requirements, high-risk command identification strategy, and high-risk command handling strategy.

9. A host command auditing system, characterized in that, The host command auditing system includes: The detection unit is used to detect the user-inputted command to be executed. An interpretation unit is used to interpret the command to be executed and obtain parsed information; The judgment unit is used to determine whether the command to be executed is a high-risk command based on the parsed information and by calling the implanted matching engine. The processing unit is used to process the high-risk command based on a pre-configured processing strategy when the command to be executed is the high-risk command.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the host command auditing method according to any one of claims 1 to 8.

11. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, performs the host command auditing method according to any one of claims 1 to 8.

12. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, performs the host command auditing method according to any one of claims 1 to 8.

Images