System call monitoring methods and devices, electronic equipment, and computer storage media

Abstract

This disclosure provides a system call monitoring method and apparatus, electronic device, and computer storage medium. It relates to the field of computer technology, and the specific implementation scheme is as follows: In response to receiving a user's system call request, system call information is extracted from the system call request; a pre-built trampoline function is run, sending the system call information to the trampoline function, the trampoline function including an instruction logic algorithm for jumping to a custom processing function; the system call dispatch function is modified through the trampoline function to forward the system call information to the custom processing function, the system call dispatch function being a function that performs system call jumps based on switch-case logic; through the custom processing function, the corresponding security audit logic algorithm is executed or the system call logic algorithm of the system call dispatch function is resumed.

Description

Technical Field

[0001] This disclosure belongs to the field of computer technology, and relates to technical fields such as computer network security and data protection, in particular to a system call monitoring method and device, electronic equipment, and computer-readable storage medium. Background Technology

[0002] During the security development process, a driver module is needed to intercept system calls, obtain parameter data of some system calls, and perform security auditing.

[0003] Intercepting file-related system calls enables multiple functions such as file anti-tampering and file leakage prevention. Intercepting process-related system calls can prevent malicious processes from starting, killing, or modifying process memory. Intercepting module-related system calls can prevent malicious drivers from loading. Intercepting network-related system calls can prevent malicious IPs and domains from connecting to the system.

[0004] Currently, most security functions rely on system call interception. However, in kernel versions 6.9 and later, or kernels optimized with specific compilers, system call jump protection is based on direct branch logic using switch-case. This renders previous system call interception schemes unusable. If system calls cannot be intercepted, security auditing functions will malfunction, and in severe cases, security protection may fail. Summary of the Invention

[0005] This disclosure provides a system call monitoring method and apparatus, an electronic device, and a computer-readable storage medium.

[0006] According to the first aspect, a system call monitoring method is provided, the method comprising: in response to receiving a system call request from a user, extracting system call information from the system call request; running a pre-built trampoline function to send the system call information to the trampoline function, the trampoline function including an instruction logic algorithm for jumping to a custom processing function; modifying a system call dispatch function through the trampoline function to forward the system call information to the custom processing function; and executing a corresponding security audit logic algorithm or resuming the execution of the system call dispatch function through the custom processing function.

[0007] According to a second aspect, a system call monitoring device is provided, comprising: an extraction unit configured to extract system call information from a system call request received from a user; a running unit configured to run a pre-built trampoline function and send the system call information to the trampoline function, the trampoline function including an instruction logic algorithm for jumping to a custom processing function; a modification unit configured to modify a system call dispatch function through the trampoline function to forward the system call information to the custom processing function, the system call dispatch function being a function that performs system call jumps based on switch-case logic; and an execution unit configured to execute a corresponding security audit logic algorithm or resume the execution of the system call logic algorithm of the system call dispatch function through the custom processing function.

[0008] According to a third aspect, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a method as described in any implementation of the first aspect.

[0009] According to a fourth aspect, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing a computer to perform the method described in any implementation of the first aspect.

[0010] The system call monitoring method and apparatus provided in this disclosure first extract system call information from a received system call request from a user; second, a pre-built trampoline function is run to send the system call information to the trampoline function, which includes an instruction logic algorithm for jumping to a custom processing function; third, the system call dispatch function is modified through the trampoline function to forward the system call information to the custom processing function; finally, the custom processing function executes the corresponding security audit logic algorithm or resumes the execution of the system call dispatch function's system call logic algorithm. Thus, by dynamically intercepting the kernel system call dispatch process through the trampoline function, seamless, auditable, and recoverable security monitoring is achieved, balancing protection strength and system stability.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0012] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1This is a flowchart of an embodiment of the system call monitoring method according to this disclosure; Figure 2 This is a schematic diagram of the structure of one embodiment of the system call monitoring device disclosed herein; Figure 3 This is a block diagram of an electronic device used to implement the system call monitoring method of the embodiments of this disclosure. Detailed Implementation

[0013] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0014] The technical solutions of this disclosure are illustrated below through specific embodiments. It should be understood that one or more steps mentioned in this disclosure do not preclude the existence of other methods and steps before or after the combined steps, or that other methods and steps may be inserted between these explicitly mentioned steps. It should also be understood that these examples are for illustrative purposes only and are not intended to limit the scope of this disclosure. Unless otherwise stated, the numbering of each method step is only for the purpose of identifying each method step, and not to limit the order of each method or to limit the scope of implementation of this disclosure. Changes or adjustments to their relative relationships, without substantial changes to the technical content, can also be considered as within the scope of implementation of this disclosure.

[0015] The raw materials and instruments used in the examples are not subject to any specific restrictions on their source; they can be purchased from the market or prepared according to conventional methods known to those skilled in the art.

[0016] Currently, most security features rely on system call interception. However, in kernel versions 6.9 and later (such as Linux 6.9+ kernels with specific architectures), or kernels optimized with specific compilers, system call jump protection is based on direct branch logic using switch-case, rendering previous system call interception solutions unusable.

[0017] Specifically, in kernel versions prior to Linux 6.9, system call interception could be achieved using the traditional technique of replacing sys_call_table. However, in kernel versions after Linux 6.9, the actual execution flow of system call jumps no longer goes through sys_call_table for system call distribution. If the method of replacing sys_call_table is still used for system call interception, it will fail, thus affecting the protective effect of security functions.

[0018] The kprobe approach monitors systems by inserting interrupts. However, this approach wastes significant performance resources and requires rewriting the locations of locks and memory in the driver code, greatly increasing workload. Furthermore, it cannot intercept switch-case functions and requires interception for each system call.

[0019] The ftrace method intercepts functions by instrumenting function headers. This method cannot intercept switch-case functions; it can only intercept them by instrumenting the function headers of each system call. However, it only supports pre-emptive blocking and does not support post-event audit blocking, which affects some functions.

[0020] To address the above situation, this disclosure adopts a system call interception scheme based on direct branch logic jumps using switch-case logic, optimized for kernel versions 6.9 and later, or kernels with specific compiler optimizations enabled. The scheme primarily intercepts system calls through function jumps. First, the function header of the switch-case function needs to be modified, preserving the original assembly instructions and replacing them with new ones. The main instructions are the jump instruction plus the jump address. This core jump instruction causes the function to jump to the custom switch-case function during execution, thus achieving the effect of system call interception.

[0021] Specifically, this disclosure proposes a system call monitoring method. Figure 1 A flow 100 is shown as an embodiment of a system call monitoring method according to the present disclosure, the system call monitoring method comprising the following steps: Step 101: In response to receiving a user's system call request, extract system call information from the system call request. In this embodiment, x86_64 architectures prior to kernel version 6.8 used the `sys_call_table` array for system call jumps, while kernel versions 6.9 and later use switch-case functions for jumps. Although the kernel still retains the `sys_call_table` array, it can only obtain the actual system call function address and cannot directly jump. That is, in kernel versions 6.9 and later, it is not possible to intercept system calls by replacing the function addresses in the `sys_call_table` array. The interception effect of the previous `sys_call_table` can only be achieved by using the switch-case function to intercept system calls.

[0022] In this embodiment, the system call dispatch function is a function that performs system call jumps based on switch-case logic. That is, the system call dispatch function treats the system call number as an integer constant, uses the switch-case statement in C language for a first-level hard comparison, and immediately executes the dispatcher of the corresponding service routine if a match is found.

[0023] In this embodiment, the switch-case function is optimized with static branching, allowing the insertion of multiple static branches for security checks, which facilitates the development of security modules. The system call dispatch function includes a registry center for receiving registration requests from multiple security modules and assigning weights; and a runtime scheduler that, after a system call is intercepted, constructs an execution chain based on the weights and comprehensively determines the final release status of the system call based on a preset conflict arbitration strategy (such as prioritizing the highest security level).

[0024] In this embodiment, in the target kernel, the system call dispatch function is implemented as a switch-case structure indexed by the system call number: when the user mode triggers an interrupt / exception and enters the kernel mode, the kernel retrieves the system call number from the register or stack, and then performs multi-way branch judgment in the dispatch function with the number as the case label. After matching the corresponding case, it directly jumps to the kernel implementation function entry point of the corresponding system call to complete the call jump.

[0025] In this embodiment, system call information may include: system call number and function parameters. The system call number is a unique integer assigned by the kernel to each system call. Before a user-mode program executes kernel instructions, it must first write the corresponding number into a designated register. The kernel entry code uses this number to determine which kernel service routine to execute.

[0026] In this embodiment, the function parameters are business data in the user-space scenario. According to their purpose, function parameters can be divided into the following categories: File / I / O parameters, including pathname, file descriptor, buffer address, length, offset, mode flags, etc., such as `read(fd, buf, count)`, where `fd` is the file descriptor, `buf` is the user-space buffer address, and `count` is the number of bytes to read; Process or thread control parameters, including pid, tid, scheduling priority, CPU mask, exit status, clone flag, such as `wait4(pid, &status, options, rusage)` which specifies the PID of the child process to wait for; Memory management parameters, including starting address, length, protection bits, mapping flags, file descriptor, offset, etc., such as `mmap(addr, len, prot, flags, fd, off)` which maps a file or anonymous page to memory; Network or communication parameters, including socket descriptor, IP address, port number, socket address structure pointer, length, etc., such as `connect(sockfd, (struct sockaddr *)&addr,` `addrlen` provides the remote IP address and port; signal or IPC classes include signal number, signal set, timeout, message queue ID, buffer size, etc., for example, `sigtimedwait(&set, &info, &timeout)` waits for the specified signal set; time or clock classes include time value pointer, clock ID, resolution pointer, timer flag, etc., for example, `clock_gettime(CLOCK_REALTIME, &ts)` retrieves the wall time; device or system information classes include device number, ioctl command code, buffer address, length, capability version, etc., for example, `ioctl(fd, VIDIOC_QUERYCAP, &cap)` queries camera capabilities; security or permission classes include uid, gid, permission mode, capability set, key ring ID, etc., for example, `setresuid(ruid, euid, suid)` sets three user IDs simultaneously.

[0027] In this embodiment, after receiving a user's system call request, the kernel first reads the system call number through a register or stack frame to index the system call table and determine the target service routine. Then, according to the function prototype of the routine, it sequentially extracts and parses each function parameter from the agreed register or stack. After completing the parameter validity check and format conversion, it passes the system call number and the processed parameters to the corresponding service function for execution.

[0028] Step 102: Run the pre-built trampoline function and send system call information to the trampoline function.

[0029] In this embodiment, the trampoline function includes an instruction logic algorithm for jumping to a custom processing function. The trampoline function is a binary / system-level trampoline function. When the trampoline function performs an inline-hook, it can both execute the original instruction and jump back to the subsequent process. The execution flow of the trampoline function is as follows: first, the original instruction at the hook point is moved to a new memory page, and then a jump back to the remaining part of the original function is added at the end. This "instruction copy + tail jump" is the trampoline. The hook function can "call the trampoline" at any time to complete the original function, avoiding recursive re-entry issues.

[0030] In this embodiment, a pre-built trampoline function is run, and the system call number and related parameters are passed to the function. The trampoline function contains a specific instruction logic algorithm, which is used to redirect the execution flow to a user-defined processing function, thereby intercepting and replacing the system call.

[0031] Step 103: Modify the system call dispatch function through the trampoline function to forward system call information to the custom processing function.

[0032] In this embodiment, modifying the system call dispatch function through the trampoline function means modifying the system call dispatch function using the trampoline function mechanism. The usual operation is to modify the kernel memory using the initialization code (InitRoutine) when the driver is loaded, and change the dispatch function header to jump to the trampoline function, which is the target of the jump.

[0033] In this embodiment, the custom processing function is a custom switch-case function. This function mainly imitates the system's switch-case function to jump to system calls. It only needs to implement the system call jump that needs to be intercepted. Other uninterrupted system calls can call the original switch-case system call function to execute code. By using this function JUMP to intercept switch-case calls, it is possible to intercept kernel versions 6.9 and later.

[0034] In this embodiment, at the system call entry point, the original dispatch logic is replaced with a trampoline: first, the context is saved, the system call number and parameters in the current register are packaged into a structure, and then the user jumps to our pre-defined custom processing function; after the function completes the audit / filtering, the structure is returned as is, and the trampoline restores the context and re-indexes the actual kernel entry point based on the call number in the structure, thereby achieving transparent interception of "passing through us first, and then entering the kernel normally".

[0035] Step 104: Execute the corresponding security audit logic algorithm or resume the execution of the system call dispatch function through a custom processing function.

[0036] In this embodiment, after jumping to the custom switch-case function, it is determined whether the system call is intercepted based on the passed function parameters. If the system call is intercepted, the custom system call in the driver module is used, and the function address in sys_call_table is called to implement the original function of the system call. If the system call is not intercepted, the original function logic is directly called.

[0037] In this embodiment, when the kernel intercepts a user-mode system call, it first jumps to a custom security audit function. This function performs a real-time policy judgment based on the current process context, call number, and parameters. If the operation is determined to be risky, it immediately blocks and records the audit log, then returns -EPERM. If the audit passes, it restores the original system call dispatch function pointer and continues to execute the kernel's standard logic, thereby completing the transparent hardening of "audit first, then restore" without modifying the original system call table.

[0038] The system call monitoring method disclosed herein uses a function jump to intercept switch-case function headers and jump to a new custom switch-case function. This function primarily mimics the system's switch-case function for system call jumps. Only the system calls to be intercepted need to be implemented; other uninterrupted system calls can invoke the original switch-case system call function for code execution. This function jump approach for switch-case interception enables interception in kernel versions 6.9 and later. By intercepting system call functions, kernel-level security checks are performed, including checking process startup, process termination, file creation, deletion, modification, and retrieval, and network connection domain names and connect statements.

[0039] The system call monitoring method provided in this disclosure first extracts system call information from a received system call request from a user; second, it runs a pre-built trampoline function, sending the system call information to the trampoline function, which includes an instruction logic algorithm for jumping to a custom processing function; third, it modifies the system call dispatch function through the trampoline function to forward the system call information to the custom processing function; finally, it executes the corresponding security audit logic algorithm or resumes the execution of the system call logic algorithm of the system call dispatch function through the custom processing function. Thus, by using the trampoline function to instantly replace the kernel dispatch path, all system calls are diverted to the custom audit logic within milliseconds, achieving "unobtrusive, full, and programmable" real-time security monitoring.

[0040] In some optional implementations of this disclosure, the above-mentioned modification of the system call dispatch function through the trampoline function to forward system call information to the custom processing function includes: modifying the function header of the system call dispatch function through the trampoline function; saving the original assembly instructions in the function header and modifying the original assembly instructions into new assembly instructions that jump to the custom processing function; executing the new assembly instructions to forward the system call information to the custom processing function.

[0041] In this optional implementation, the function JUMP method uses a self-developed dynamic instruction repair and relocation (Trampoline generation technology) to construct an intelligent "trampoline" function in the binary file. When performing a function JUMP, the function jumps to the trampoline function at the beginning of the function. The trampoline function uses NOP instructions, which facilitates subsequent modification of the JUMP instructions. Furthermore, the offset of the jump instruction is dynamically modified by the disassembler engine to prevent the jump instruction from failing to jump due to a large difference in function address.

[0042] In this optional implementation, the first few assembly instructions of the system call dispatch function are rewritten in the trampoline function. The original instructions are backed up to the trampoline space and then replaced with a jump instruction that directly jumps to the custom processing function. Subsequently, when any system call triggers the dispatch function, the CPU will first execute this implanted jump instruction, thereby transferring control along with the current system call number and the parameters in the register to the custom processing function, achieving seamless interception.

[0043] In some optional implementations of this disclosure, before modifying the system call dispatch function via the trampoline function, the method further includes: adding obfuscation code to the system call dispatch function; and ignoring the obfuscation code when resuming the execution of the system call logic algorithm of the system call dispatch function.

[0044] In this optional implementation, the obfuscated code is a type of junk code. To prevent detection by other security vendors, a fixed JMP directive is not used. Each time a hook occurs, a random "obfuscated code" + "jump logic" is dynamically generated, ensuring that the signature of each hook point is unique.

[0045] In this optional implementation, before modifying the system call dispatch function, several "pseudo-branches" are inserted into its entry point. These branches have always false conditions and no actual function; they are only used to disrupt static analysis. When the process is taken over by the trampoline function and the original call logic is to be restored, all pseudo-branches are dynamically parsed and skipped, and only the valid instruction sequence is retained to continue execution, thereby completing obfuscation and deobfuscation without affecting the functionality.

[0046] In some optional implementations of this disclosure, the aforementioned system call information includes: system call number and function parameters. The system call logic algorithm that executes the corresponding security audit logic algorithm or resumes the execution of the system call dispatch function through the custom processing function includes: querying a pre-built shadow table based on the system call number using the custom processing function to obtain the query result; determining the processing strategy for the current system call based on the query result and function parameters; and executing the corresponding security audit logic algorithm or resuming the execution of the system call dispatch function based on the processing strategy.

[0047] In this optional implementation, the custom processing function uses a shadow table for mapping, where the index of the shadow table is the system call number. If the shadow table `ShadowTable[ID]` is empty, it means that this call is not relevant, and the original function is executed directly, i.e., the system call logic algorithm of the system call dispatch function is restored. If it is not empty, it contains a pointer to the "checkpoint list head" corresponding to that ID, and the corresponding security audit logic algorithm is executed.

[0048] In this optional implementation, the custom processing function first retrieves the corresponding policy record from the preset shadow table using the current system call number as the keyword. Then, it matches the query result with the passed function parameters to determine whether the call should be "audited" or "allowed". If the policy requires auditing, it jumps to the security audit logic algorithm to collect logs and perform compliance checks. Otherwise, it directly restores the original system call logic of the system call dispatch function to ensure that the business continues to operate normally.

[0049] Optionally, the aforementioned system call information includes: system call number and function parameters. The system call logic algorithm that executes the corresponding security audit logic algorithm or resumes the execution of the system call dispatch function through the custom processing function includes: querying a pre-constructed binary tree based on the system call number using the custom processing function to obtain the query result; determining the processing strategy for the current system call based on the query result and function parameters; and executing the corresponding security audit logic algorithm or resuming the execution of the system call dispatch function based on the processing strategy.

[0050] In some optional implementations of this disclosure, the above-mentioned querying of a pre-built shadow table based on the system call number through a custom processing function to obtain the query result includes: querying the pre-built shadow table indexed by the system call number through the custom processing function; checking whether the index entry corresponding to the system call number in the shadow table is empty; if the index entry is empty, determining that the system call has not been intercepted, and directly jumping back to the query result of the system call dispatch function; if the index entry is not empty, reading the head pointer of the checkpoint linked list stored in the index entry, and traversing and executing the security check callback functions attached to the linked list to obtain the query result.

[0051] In this optional implementation, a pre-built shadow table is retrieved in the custom processing function using the current system call number as the key. If the corresponding slot is empty, it is immediately determined that the call has not been intercepted, and the system call dispatch function is returned to the original path. If the slot is not empty, the head pointer of the checkpoint linked list stored therein is retrieved, and all security check callbacks attached to the linked list are traversed sequentially and executed. The combined result is used as the conclusion of this query.

[0052] In some optional implementations of this disclosure, the aforementioned system call information includes: system call number; the aforementioned system call logic algorithm for restoring the execution of the system call dispatch function through a custom processing function includes: within the custom processing function, obtaining the original processing logic address of the system call in the kernel based on the system call number; and directly calling the original processing logic address to restore the system call logic algorithm for restoring the execution of the system call dispatch function.

[0053] In this optional implementation, the original processing logic address of the kernel sys_call_table is obtained based on the system call number inside the custom processing function, and then the execution is directly jumped to the original processing logic address to continue execution, thereby seamlessly restoring the intercepted process to the original system call path.

[0054] In some optional implementations of this disclosure, the aforementioned security audit logic algorithm executed through a custom processing function includes at least one of the following: if the current system call involves file operations, check the file path and operation permissions to perform anti-tampering or anti-leakage blocking; if the current system call involves process management, check process startup parameters or memory modification behavior to prevent malicious process startup or injection; if the current system call involves network connection, check the target IP address or domain name to block malicious network connection; if the current system call involves kernel module loading, check the module signature to prevent malicious driver loading.

[0055] In this optional implementation, a custom processing function is injected into a kernel hook. When a system call is triggered, the hook takes over: if the call is a file call, the path and requested permissions are parsed in real time and compared with a pre-defined whitelist / sensitive flag. If they do not match, -EACCES is returned and an audit log is written. If the call is a process call, the startup parameters, image hash, and memory write protection flag are checked. If abnormal parameters or code segment tampering are found, the process is immediately terminated and reported. If the call is a network call, the target IP / domain name is extracted and matched with the threat intelligence database. If a match is found, packets are dropped and the connection is reset. If the call is a module loading call, the digital signature and certificate chain are forcibly verified. If they fail or are signed by blacklisted entities, loading is refused, and a blocking alarm is triggered. This completes real-time security auditing and blocking in kernel mode to prevent tampering, leakage, injection, and malicious drivers.

[0056] Further reference Figure 2As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a system call monitoring device, which is similar to... Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0057] like Figure 2 As shown, the system call monitoring device 200 provided in this embodiment includes: an extraction unit 201, a running unit 202, a modification unit 203, and an execution unit 204. The extraction unit 201 can be configured to extract system call information from a system call request received from a user. The running unit 202 can be configured to run a pre-built trampoline function, sending system call information to the trampoline function, which includes an instruction logic algorithm for jumping to a custom processing function. The modification unit 203 can be configured to modify the system call dispatch function through the trampoline function to forward system call information to the custom processing function, where the system call dispatch function is a function that performs system call jumps based on switch-case logic. The execution unit 204 can be configured to execute a corresponding security audit logic algorithm or resume the execution of the system call logic algorithm of the system call dispatch function through the custom processing function.

[0058] In this embodiment, the specific processing and technical effects of the extraction unit 201, the running unit 202, the modification unit 203, and the execution unit 204 in the system call monitoring device 200 can be found in the following references. Figure 1 The relevant descriptions of steps 101, 102, 103, and 104 in the corresponding embodiments will not be repeated here.

[0059] In some embodiments of this disclosure, the modification unit 203 is configured to: modify the function header of the system call dispatch function through the trampoline function; save the original assembly instructions in the function header and modify the original assembly instructions into new assembly instructions that jump to the custom processing function; execute the new assembly instructions to forward the system call information to the custom processing function.

[0060] In some embodiments of this disclosure, the apparatus further includes an obfuscation unit (not shown in the figures), which is configured to: add obfuscation code to the system call dispatch function; and ignore the obfuscation code when resuming the execution of the system call dispatch function's system call logic algorithm.

[0061] In some embodiments of this disclosure, the system call information includes a system call number and function parameters. The execution unit 204 is configured to: query a pre-built shadow table based on the system call number using a custom processing function to obtain the query result; determine the processing strategy for the current system call based on the query result and function parameters; and execute the corresponding security audit logic algorithm or resume the execution of the system call dispatch function based on the processing strategy.

[0062] In some embodiments of this disclosure, the execution unit 204 is configured to: query a pre-built shadow table indexed by the system call number through a custom processing function; check whether the index entry corresponding to the system call number in the shadow table is empty; if the index entry is empty, determine that the system call has not been intercepted, and directly jump back to the query result of the system call dispatch function; if the index entry is not empty, read the head pointer of the checkpoint linked list stored in the index entry, and traverse and execute the security check callback functions attached to the linked list to obtain the query result.

[0063] In some embodiments of this disclosure, the system call information includes a system call number. The execution unit 204 is further configured to: within a custom processing function, obtain the original processing logic address of the system call in the kernel based on the system call number; and directly call the original processing logic address to restore the system call logic algorithm for executing the system call dispatch function.

[0064] In some embodiments of this disclosure, the execution unit 204 is further configured to: if the current system call involves file operations, check the file path and operation permissions to perform anti-tampering or anti-leakage blocking; if the current system call involves process management, check process startup parameters or memory modification behavior to prevent malicious process startup or injection; if the current system call involves network connection, check the target IP address or domain name to block malicious network connection; if the current system call involves kernel module loading, check the module signature to prevent malicious driver loading.

[0065] The system call monitoring device provided in the embodiments of this disclosure firstly extracts system call information from a received system call request by an extraction unit 201. Secondly, an execution unit 202 runs a pre-built trampoline function, sending the system call information to the trampoline function, which includes an instruction logic algorithm for jumping to a custom processing function. Then, a modification unit 203 modifies the system call dispatch function through the trampoline function to forward the system call information to the custom processing function, which is a function that performs system call jumps based on switch-case logic. Finally, an execution unit 204 executes the corresponding security audit logic algorithm or resumes the execution of the system call dispatch function through the custom processing function. Thus, this device, through trampoline function hot-patching technology, can intercept and audit system calls in real time without restarting the kernel, achieving "unobtrusive" transparent security protection.

[0066] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0067] Figure 3 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their patterns are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0068] like Figure 3 As shown, device 300 includes a computing unit 301, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 302 or a computer program loaded from storage unit 308 into random access memory (RAM) 303. The RAM 303 may also store various programs and data required for the operation of device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0069] Multiple components in device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of monitors, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0070] The computing unit 301 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as the system call monitoring method. For example, in some embodiments, the system call monitoring method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the system call monitoring method described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the system call monitoring method by any other suitable means (e.g., by means of firmware).

[0071] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0072] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to the processor or controller of a general-purpose computer, special-purpose computer, or other programmable system call monitoring device, such that when executed by the processor or controller, the program code causes the patterns / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0073] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0074] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0075] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0076] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0077] The foregoing description of specific exemplary embodiments of this disclosure is for illustrative and explanatory purposes. These descriptions are not intended to limit this disclosure to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of this disclosure and their practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of this disclosure, as well as various different choices and variations. The scope of this disclosure is intended to be defined by the claims and their equivalents.

Claims

1. A system call monitoring method characterized by comprising: The method comprises: in response to receiving a system call request of a user, extracting system call information from the system call request; running a pre-constructed trampoline function, sending the system call information to the trampoline function, the trampoline function comprising an instruction logic algorithm for jumping to a custom processing function; modifying a system call distribution function by the trampoline function to forward the system call information to the custom processing function, the system call distribution function being a function for system call jumping based on switch-case logic; by the custom processing function, executing a corresponding security audit logic algorithm or restoring a system call logic algorithm of the system call distribution function.

2. The method of claim 1, wherein, The modification of the system call distribution function by the trampoline function to forward the system call information to the custom processing function comprises: modifying the function header of the system call distribution function by the trampoline function; saving original assembly instructions in the function header and modifying the original assembly instructions into new assembly instructions for jumping to the custom processing function; executing the new assembly instructions to forward the system call information to the custom processing function.

3. The method of claim 1 or 2, wherein, Before the modification of the system call distribution function by the trampoline function, the method further comprises: adding obfuscated code in the system call distribution function; ignoring the obfuscated code when restoring the system call logic algorithm of the system call distribution function.

4. The method of claim 1 or 2, wherein, The system call information comprises a system call number and function parameters, and the execution of a corresponding security audit logic algorithm or the restoration of the system call logic algorithm of the system call distribution function by the custom processing function comprises: querying a pre-constructed shadow table based on the system call number by the custom processing function to obtain a query result; determining a processing strategy of the current system call according to the query result and the function parameters; executing a corresponding security audit logic algorithm or restoring the system call logic algorithm of the system call distribution function according to the processing strategy.

5. The method of claim 4, wherein, The querying of the pre-constructed shadow table based on the system call number by the custom processing function to obtain a query result comprises: querying a pre-constructed shadow table indexed by the system call number by the custom processing function; checking whether an index item corresponding to the system call number in the shadow table is empty; if the index item is empty, determining that the system call is not intercepted and directly jumping back to the query result of the system call distribution function; if the index item is not empty, reading a checkpoint linked list head pointer stored in the index item and traversing and executing security check callback functions mounted on the linked list to obtain a query result.

6. The method of claim 1, wherein, The system call information comprises a system call number, and the restoration of the system call logic algorithm of the system call distribution function by the custom processing function comprises: in the custom processing function, obtaining a raw processing logic address of a system call in a kernel based on the system call number; directly calling the raw processing logic address to restore the system call logic algorithm of the system call distribution function.

7. The method of claim 1, wherein, The executing, by the custom processing function, of a corresponding security audit logic algorithm includes at least one of the following: If the current system call involves file operations, checking file paths and operation permissions to perform tamper-proofing or leakage prevention blocking; If the current system call involves process management, checking process startup parameters or memory modification behavior to prevent malicious process startup or injection; If the current system call involves network connection, checking target IP addresses or domain names to block malicious network connections; If the current system call involves kernel module loading, checking module signatures to prevent malicious driver loading.

8. A system call monitoring apparatus, the apparatus comprising: an extraction unit configured to extract system call information from a system call request of a user in response to receiving the system call request; a running unit configured to run a trampoline function pre-built, send the system call information to the trampoline function, the trampoline function including instruction logic algorithms for jumping to a custom processing function; a modification unit configured to modify a system call distribution function by the trampoline function to forward the system call information to the custom processing function, the system call distribution function being a function for system call jumping based on switch-case logic; an execution unit configured to execute, by the custom processing function, a corresponding security audit logic algorithm or a system call logic algorithm for resuming execution of the system call distribution function.

9. An electronic device, comprising: comprise: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-7.

Images