Data backup method, device and system

Abstract

This application provides a data backup method, device, and system, relating to the field of computer technology. Applied to computer devices using the Linux operating system, it utilizes a kernel module running in kernel mode to extend the fanotify function, monitoring whether any process is performing write operations on existing files in the file system. A security process running in user mode performs a data backup process on the files monitored by the kernel module that have undergone write operations. Based on fanotify, interaction between kernel and user modes is achieved, reducing the likelihood of Linux operating system crashes. Furthermore, this application triggers data backup of existing files based on write operations, and data backup is only performed when the executor of the write operation is an untrusted process, and / or when the object of the write operation is a protected file, comprehensively considering both the comprehensiveness and the amount of data to be backed up.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data backup method, device and system. Background Technology

[0002] With the rapid development of information technology, data plays an increasingly important role in today's world. Accompanying this is the development and updating of ransomware, which spreads through computer vulnerabilities, emails, Trojan programs, and website backdoors. Once a computer is infected with ransomware, it encrypts the user data stored on the computer, preventing the user (victim) from accessing their data. The virus then demands a ransom for the decryption key; otherwise, the victim will permanently lose their data. The emergence of massive amounts of data and ransomware has also led to the rise of the data security field. Securely backing up data to effectively recover original data after it has been encrypted by ransomware is currently a key method for improving data security.

[0003] However, most of the data backup solutions proposed in related technologies for ransomware protection are for Windows operating systems, while ransomware targeting Linux operating systems is becoming increasingly common. Therefore, how to effectively protect against ransomware on Linux operating systems is an urgent problem to be solved. Summary of the Invention

[0004] This application provides a data backup method, device, and system.

[0005] Firstly, a data backup method is provided. This method is applied to a computer device. The operating system of the computer device is Linux. The computer device runs a security process and a kernel module. The security process runs in user mode, and the kernel module runs in kernel mode. The method includes: the kernel module, by extending the fanotify function, monitoring whether any process is performing write operations on existing files in the file system of the computer device. These write operations include one or more of the following: clearing, deleting, renaming, or modifying. In response to the kernel module detecting that a first process is performing a write operation on a first file in the file system, the security process performs a data backup process on the first file, which is an existing file in that file system. The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing a data backup on the first file to obtain backup data for the first file.

[0006] In this application, a kernel module running in kernel mode extends the functionality of fanotify to monitor file write operations occurring in the file system of a computer device. A security process running in user mode performs a data backup process on the files monitored by the kernel module that have undergone write operations. This data backup is completed in user mode, and the interaction between kernel and user modes is achieved based on fanotify, reducing the likelihood of Linux operating system crashes. Furthermore, since ransomware file operations typically involve writing to existing files in the file system, including clearing, deleting, renaming, or modifying the contents of existing files, this application triggers data backup of existing files based on write operations to them. Data backup is only performed when the executor of the write operation is an untrusted process and / or the target of the write operation is a protected file. The comprehensiveness and volume of data backup are comprehensively considered. Compared to existing data backup schemes coupled with ransomware detection, this application's scheme achieves more comprehensive data backup without relying on the accuracy of ransomware detection. Compared to existing data backup solutions that decouple data from ransomware detection, this application's solution triggers the data backup process based on specific events. By combining the determination of whether the process performing the write operation is an untrusted process and / or whether the file being written to is a protected file, the amount of backup data can be reduced, saving storage resources.

[0007] Optionally, in response to the kernel module detecting that the first process is performing a write operation on the first file in the file system, the implementation of the data backup process for the first file by the secure process includes: in response to the kernel module detecting that the first process is performing a write operation on the first file, the kernel module interrupts the execution of the first process and sends a file backup instruction to the secure process, the file backup instruction including the file identifier of the first file. In response to receiving the file backup instruction, the secure process performs the data backup process for the first file.

[0008] In this application, the kernel module extends the functionality of fanotify to monitor file write operations occurring in the file system of a computer device. Furthermore, it uses the fanotify function to block the execution of processes that perform write operations on existing files in the file system and notifies the security process to back up the data of the file to be written, so that the security process can complete the data backup before the file is written by a process, thereby improving data security.

[0009] Optionally, the file backup instruction may also include the process identifier of the first process.

[0010] In this application, by carrying the process identifier of the first process in the file backup instruction, it is indicated that the file backup instruction is triggered by the first process performing a write operation on the first file, so that the security process can determine whether the first process is a trusted process.

[0011] Optionally, in response to the completion of the data backup process for the first file by the secure process, or if the secure process receives the file backup instruction for a duration exceeding the target duration, the secure process sends a file backup termination instruction to the kernel module. Upon receiving the file backup termination instruction, the kernel module allows the first process to continue running.

[0012] In this application, a file backup end command is sent to the kernel module through a secure process, enabling the kernel module to resume the operation of the first process in a timely manner, thus avoiding the problem of the Linux kernel timeout and unresponsiveness causing the system to freeze.

[0013] Optionally, the security process includes a main process and a monitoring process. The monitoring process is used to communicate with the kernel module, while the main process is used to execute the data backup process.

[0014] Because the main process performing the data backup procedure is highly complex, it may fail to communicate with the kernel module in a timely manner, potentially leading to Linux kernel timeouts and system crashes. In this application, a monitoring process communicates with the kernel module, enabling timely feedback of file backup results and thus reducing the probability of system crashes.

[0015] Optionally, after backing up the first file, in response to the first process being ransomware, the computer device restores the first file to a state unaffected by the first process based on the backup data of the first file.

[0016] This application decouples data backup from ransomware detection. After the data backup of the files is completed, the computer device can automatically demand a rollback in response to the detection of ransomware, thereby achieving automatic data recovery.

[0017] Optionally, the computer device sends a file behavior log of the first process to the management device. This file behavior log includes information about file operations performed by the first process on the file system within a preset time period. The computer device receives a determination result of the first process sent by the management device, which indicates whether the first process is ransomware.

[0018] This application uses management equipment to determine ransomware charges against processes running on computer devices, thereby reducing the consumption of computer device processing resources.

[0019] Optionally, the computer device receives a file backup query command sent by the management device, the file backup query command including the process identifier of the second process. The computer device sends a file backup query result to the management device, the file backup query result including the backup data of the second file. The second file is an existing file in the file system, and the backup data of the second file is generated due to the second process performing write operations on the second file.

[0020] In this application, the management device sends a file backup query command to the computer device to actively query the file backup data generated by a certain process, thereby monitoring the behavior of that process.

[0021] Optionally, the computer device also receives a rollback command from the management device, which includes the process identifier of the second process. Based on the rollback command, the computer device restores the file system to a state unaffected by the second process.

[0022] In this application, the management device sends a rollback command to the computer device to cause the computer device to roll back the file status.

[0023] Optionally, the secure process can perform data backup on the first file in the following ways: the secure process stores the backup data of the first file locally on the computer device, or stores the backup data of the first file on an external storage device.

[0024] Secondly, a data backup device is provided, which is applied to a computer device whose operating system is Linux. The data backup device includes multiple functional modules that interact to implement the methods described in the first aspect and its various embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of both, and can be arbitrarily combined or divided based on specific implementations.

[0025] Thirdly, a computer device is provided, wherein the operating system of the computer device is a Linux operating system, and the computer device runs a security process and a kernel module, the security process running in user mode and the kernel module running in kernel mode. The computer device includes: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and the at least one processor reads the program instructions stored in the memory, causing the computer device to execute the methods described in the first aspect and its various embodiments.

[0026] Fourthly, a data backup system is provided, including a computer device for performing the methods described in the first aspect and its embodiments. Optionally, the data backup system further includes a management device.

[0027] Optionally, the management device is configured to receive file behavior logs of a first process sent by the computer device, determine whether the first process is ransomware based on the file behavior logs, and send the determination result of the first process to the computer device. The file behavior logs include relevant information on file operations performed by the first process on the file system of the computer device within a preset time period, and the determination result indicates whether the first process is ransomware.

[0028] Optionally, the management device is used to send a file backup query command to the computer device and receive a file backup query result sent by the computer device. The file backup query command includes a process identifier of a second process, and the file backup query result includes backup data of a second file. The second file is an existing file in the file system, and the backup data of the second file is generated due to the second process performing the write operation on the second file.

[0029] Optionally, the management device is further configured to determine whether the second process is ransomware based on the file backup query results, and after determining that the second process is ransomware, send a rollback command to the computer device, the rollback command including the process identifier of the second process. The computer device is further configured to restore the file system to a state unaffected by the second process according to the rollback command.

[0030] Fifthly, a computer-readable storage medium is provided, on which instructions are stored, which, when executed by a processor, implement the methods described in the first aspect and its various embodiments.

[0031] In a sixth aspect, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the methods described in the first aspect and its various embodiments.

[0032] In a seventh aspect, a chip is provided, the chip including programmable logic circuitry and / or program instructions, which, when the chip is running, implement the methods described in the first aspect and its various embodiments. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application;

[0034] Figure 2 This is a schematic diagram of an implementation scenario provided in an embodiment of this application;

[0035] Figure 3This is a schematic diagram illustrating the implementation process of a data backup method provided in an embodiment of this application;

[0036] Figure 4 This is a schematic diagram illustrating a computer device implementing file backup according to an embodiment of this application;

[0037] Figure 5 This is a schematic diagram illustrating the implementation process of a data backup method provided in an embodiment of this application;

[0038] Figure 6 This is a schematic diagram of the structure of a data backup device provided in an embodiment of this application. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0040] To facilitate readers' understanding of the technical solution of this application, some terms involved in this application will be explained below.

[0041] 1. Endpoint Detection and Response (EDR): This is an endpoint security solution. By deploying specific security software on computer devices, the software monitors and logs various activities and behaviors on the devices in real time, including file operations, network communications, process startup and shutdown, etc. It uses data analysis and context-based information detection to discover anomalies and malicious activities, and records data about malicious activities, enabling security teams to investigate and respond to incidents. Optionally, endpoints include, but are not limited to, personal computers (PCs) (such as laptops), servers, cloud systems, mobile devices, or IoT devices. EDR solutions typically provide threat search, detection, analysis, and response capabilities.

[0042] 2. Processes and Programs: Programs are static, while processes are dynamic. A program is binary code stored on some medium, and a process corresponds to the execution of a program. A process is one execution of a program, and a process always corresponds to at least one specific program. One program can correspond to multiple processes, and the same program can run on different data sets, thus forming several different processes. Several processes can execute the same program code concurrently, while the same process can execute several programs sequentially.

[0043] 3. Fanotify: A monitoring technology based on the Linux kernel used to monitor file system events. As a file access notification mechanism in the Linux kernel, Fanotify allows user-space programs to receive event notifications related to file system operations. When a specific event occurs in the file system, the kernel sends a notification message to user-space programs registered with Fanotify according to pre-set rules. The native Fanotify provides monitoring capabilities for file opening, open execution, and reading operations. Fanotify enables interaction between kernel mode and user mode in the Linux operating system.

[0044] 4. Perm: In the context of fanotify, perm is primarily related to file access permissions. When an existing file in the file system is accessed, fanotify can use perm to monitor whether this access conforms to specific permission rules. Different perm values ​​are typically set to correspond to different file access permission types. In fanotify, each file access permission type may be represented as a specific numerical value or symbolic constant. For example, a perm value representing read permission might be set to a specific hexadecimal number. When the kernel detects a file access event involving a read operation, it compares this perm value to determine if the operation is legal. Extending perm based on fanotify allows monitoring in kernel mode of which files and what permissions a process is attempting to acquire. For example, in this application, extending perm based on fanotify allows monitoring in kernel mode of a process's write operations on existing files in the file system. Optionally, write operations include, but are not limited to, one or more of the following: clear, delete, rename, or modify operations. For example, by extending the settings to include different perm values ​​corresponding to file clearing permissions, file deletion permissions, file renaming permissions, and file modification permissions, fanotify can monitor file clearing, deletion, renaming, and modification operations.

[0045] 5. Kprobe: A lightweight kernel debugging technique based on the Linux kernel, it allows developers to insert custom code at specific locations within kernel functions without modifying the kernel source code. As a dynamic probing mechanism in the Linux kernel, Kprobe can probe at function entry points, return points, or specific instructions within a function. For example, setting a Kprobe at a function entry point can record function call parameters, while setting a Kprobe at a return point can retrieve the function's return value. The implementation principle of Kprobe is as follows: When a Kprobe is registered on a kernel function, the Kprobe mechanism inserts a breakpoint instruction into the kernel code. When the kernel executes the probed kernel function, it triggers the breakpoint instruction, thereby executing the Kprobe-related handler. This handler can be a user-defined function used to collect information, modify data, or perform other operations. Afterward, the kernel resumes the original execution flow of the kernel function.

[0046] 6. Linux Security Modules (LSMs): These are frameworks within the Linux kernel used to implement security policies. LSMs provide a series of hook functions distributed across various critical parts of the kernel, such as the code paths related to file system operations and process management. Different security modules can implement their own security policies through these hook functions. Specifically, security modules register LSM functions to relevant hooks to embed their security logic into the normal operation flow of the kernel. For example, if the kernel module in this application needs to intercept write operations by a process when it modifies an existing file in the file system, then the kernel module can register an LSM function to the hook related to performing write operations on the file.

[0047] Ransomware is a general term for any new type of computer virus that locks the infected computer system or files and demands ransom. Ransomware spreads through computer vulnerabilities, emails, Trojan programs, and website backdoors. Once a computer is infected with ransomware, almost all file formats on the disk may be encrypted, rendering a large number of important files unusable or even leaked for businesses, schools, or individual users, severely impacting daily work and life. Generally, after a computer is infected with ransomware, important files become unreadable, critical data is corrupted, and the computer is locked and unusable. To guide the infected to pay the ransom, ransomware may also generate a ransom note in a prominent location such as the desktop, requiring the infected to pay a high ransom to obtain the decryption key and restore normal use of the computer system and files. However, in most cases, even paying a high ransom does not guarantee data recovery. Therefore, ransomware is characterized by high data recovery costs and extremely low data recovery probability.

[0048] Securely backing up data to effectively recover original data after it has been encrypted by ransomware is a key means of improving data security. Related technologies have proposed several data backup schemes for ransomware protection on the Windows operating system. For example, current data backup schemes for dealing with ransomware on Windows mainly fall into two categories: one couples data backup with ransomware detection, and the other decouples data backup from ransomware detection. There are several existing schemes that couple data backup with ransomware detection. For example, the first scheme backs up files modified by a process after it is determined to be ransomware; another example is the second scheme, which redirects the file content written by the process to memory, discards the file content if the process is determined to be ransomware, and writes the file content back to the original file if the process is not determined to be ransomware. There are several existing solutions that decouple data backup from ransomware detection. For example, the third solution performs timed incremental or full backups of the file system; another is the fourth solution, which indiscriminately backs up files modified by the process and provides versions of the files at different times, allowing users to manually select a version from a specific timeline. However, in existing solutions that couple data backup with ransomware detection, the reliability of the data backup depends entirely on the accuracy of the ransomware detection. For instance, in the first solution, if ransomware is missed, the infected files will not be backed up, making them unrecoverable. Similarly, in the second solution, if a false alarm occurs, the content written by legitimate software will be discarded, affecting the writing of normal files; conversely, if ransomware is missed, the ransomware-encrypted files will be written to legitimate files. Furthermore, existing solutions that decouple data backup from ransomware detection often generate large amounts of backup data, consuming significant amounts of computer storage resources.

[0049] Due to the increasing prevalence of ransomware targeting Linux operating systems, and the lack of effective ransomware protection for Linux in current technologies, coupled with the shortcomings of existing data backup solutions for ransomware attacks on Windows operating systems, this application provides a technical solution for Linux. By extending the fanotify functionality, for example using a technology based on the fanotify-extended perm, fanotify gains the ability to monitor file write operations. This allows for monitoring of write operations performed by processes on existing files in the file system within kernel mode, and also enables data backup to be performed in user mode. Furthermore, this technical solution decouples data backup from ransomware detection and triggers data backup based on events, achieving secure backup of existing files in the file system that may be subject to ransomware attacks, thus improving data security.

[0050] The technical solution provided in this application applies to a computer device whose operating system is Linux. The computer device runs a security process and a kernel module. The security process runs in user mode, and the kernel module runs in kernel mode. The kernel module extends the functionality of fanotify to monitor file write operations occurring in the computer device's file system. In other words, the kernel module is configured to monitor processes performing write operations on existing files in the computer device's file system. The security process is configured to perform data backup. In some embodiments, security software (such as EDR software) is installed on the computer device. The security process corresponds to the program execution process of this security software, and the kernel module is an executable file within the security software configured to run in kernel mode. After the computer device starts the security software, it creates and runs the security process in user mode and runs the kernel module in kernel mode.

[0051] The technical solution provided in this application is specifically implemented as follows: A kernel module runs in kernel mode and a security process runs in user mode on the computer device. This kernel module, by extending the fanotify function, monitors whether any process is performing write operations on existing files in the computer device's file system. Write operations include one or more of the following: clearing, deleting, renaming, or modifying. In response to the kernel module detecting that a first process is performing a write operation on a first file in the computer device's file system, the security process performs a data backup process on the first file. The first file is an existing file in the computer device's file system. The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing a data backup on the first file to obtain backup data for the first file. An untrusted process refers to a process in the computer device other than a trusted process. A trusted process is a known non-malicious process or a known normal process on the computer device. In this application, a kernel module running in kernel mode extends the functionality of fanotify to monitor file write operations occurring in the file system of a computer device. A security process running in user mode performs a data backup process on the files monitored by the kernel module that have undergone write operations. This data backup is completed in user mode, and the interaction between kernel and user modes is achieved based on fanotify, reducing the likelihood of Linux operating system crashes. Furthermore, since ransomware file operations typically involve writing to existing files in the file system, including clearing, deleting, renaming, or modifying the contents of existing files, this application triggers data backup of existing files based on write operations to them. Data backup is only performed when the executor of the write operation is an untrusted process and / or the target of the write operation is a protected file. The comprehensiveness and volume of data backup are comprehensively considered. Compared to existing data backup schemes coupled with ransomware detection, this application's scheme achieves more comprehensive data backup without relying on the accuracy of ransomware detection. Compared to existing data backup solutions that decouple data from ransomware detection, this application's solution triggers the data backup process based on specific events. By combining the determination of whether the process performing the write operation is an untrusted process and / or whether the file being written to is a protected file, the amount of backup data can be reduced, saving storage resources.

[0052] In some embodiments, a trusted program list is stored in the computer device, which records one or more trusted programs. Trusted programs are generally considered safe programs, and the trusted program list is equivalent to a program whitelist. In this implementation, the security process determines whether a first process is a trusted process by judging whether the program corresponding to the first process is a program recorded in the trusted program list. If the program corresponding to the first process is a program recorded in the trusted program list, the security process determines that the first process is a trusted process; if the program corresponding to the first process is not a program recorded in the trusted program list, the security process determines that the first process is an untrusted process. In this application, the security process determines whether a process is trustworthy based on a whitelist mechanism. By pre-configuring a trusted program list in the computer device, the security process can automatically determine whether a process is trustworthy based on the trusted program list, thereby achieving automated data backup.

[0053] Optionally, the programs recorded in the trusted program list are pre-configured by technical personnel. Alternatively, the trusted program list can be generated through self-learning. For example, parameters such as the application's digital signature, signature validity period, and application vendor information are input into the trusted program identification model to determine whether the application is a trusted program. If the application is determined to be a trusted program, it is recorded in the trusted program list.

[0054] In some embodiments, the computer device stores not only a list of trusted programs but also a list of untrusted programs, which records one or more untrusted programs. Untrusted programs are generally considered to pose security risks, and the untrusted program list is equivalent to a program blacklist. In this implementation, the security process first determines whether the program corresponding to the first process is a program recorded in the untrusted program list. If the program corresponding to the first process is a program recorded in the untrusted program list, the security process determines that the first process is an untrusted process. If the program corresponding to the first process is not a program recorded in the untrusted program list, the security process then determines whether the program corresponding to the first process is a program in the trusted program list to determine whether the first process is a trusted process. In this application, the security process determines whether a process is trustworthy based on a blacklist / whitelist mechanism. By pre-configuring a trusted program list and an untrusted program list in the computer device, the security process first determines whether the first process is an untrusted process based on the untrusted program list. If the untrusted program list cannot determine whether the first process is untrustworthy, then the trusted program list is used to determine whether the first process is trustworthy. Since ransomware may use trusted software installed by the user to perform ransomware operations, by recording programs in trusted software that may be exploited by ransomware in an untrusted program list, the security process can still back up files even when the ransomware runs a program in trusted software to perform ransomware operations, thereby improving data security.

[0055] In some embodiments, a file path list is stored in the computer device, which includes one or more file paths. The file paths in this file path set are pre-determined file paths of non-critical files that do not require ransomware protection. Accordingly, if the file path of a first file is within this file path list, the security process determines that the first file is not a protected file. Conversely, if the file path of the first file is not within this file path list, the security process determines that the first file is a protected file. This application, by pre-configuring the file paths of non-critical files that do not require ransomware protection in the computer device, enables the security process to avoid backing up data for non-critical files, thereby reducing the amount of backup data.

[0056] Optionally, during the data backup process executed by the security process, if it is necessary to determine whether the first process is trustworthy and whether the first file is a protected file, the security process first checks whether the file path list includes the file path of the first file. If the file path list does not include the file path of the first file, then it checks whether the first process is a trustworthy process. If the file path list includes the file path of the first file, the data backup process is stopped. In other words, the security process first determines whether the object of the write operation to the file system is a file that needs ransomware protection. After determining that the object is a file that needs ransomware protection, it then checks whether the first process performing the write operation is a trustworthy process; otherwise, it does not proceed to determine whether the first process is a trustworthy process. Of course, this application does not exclude the possibility that the security process first checks whether the first process is a trustworthy process, and only checks whether the file path list includes the file path of the first file if the first process is determined to be an untrustworthy process.

[0057] In some embodiments, the computer device stores a file type list, which includes one or more file types. The file types in this list are pre-determined file types that require ransomware protection. Accordingly, if the file type of a first file is within this file type list, the security process determines that the first file is a protected file. Conversely, if the file type of the first file is not within this file type list, the security process determines that the first file is not a protected file. This application, by pre-configuring important file types requiring ransomware protection in the computer device, enables the security process to back up data only for important file types and not for non-important file types, thereby reducing the amount of backup data.

[0058] Optionally, during the data backup process executed by the security process, if it is necessary to determine whether the first process is trustworthy and whether the first file is a protected file, the security process first checks whether the file type list includes the file type of the first file. If the file type list includes the file type of the first file, then it checks whether the first process is a trustworthy process. If the file type list does not include the file type of the first file, the data backup process is stopped. In other words, the computer device first determines whether the object of the write operation to the file system is a file type that needs ransomware protection. After determining that the object is a file type that needs ransomware protection, it then checks whether the first process performing the write operation is a trustworthy process; otherwise, it does not proceed to determine whether the first process is a trustworthy process. Of course, this application does not exclude the possibility that the computer device first determines whether the first process is a trustworthy process, and only if the first process is determined to be an untrustworthy process does it check whether the file type list includes the file type of the first file.

[0059] In some embodiments, after the security process backs up the data of the first file, in response to the first process being identified as ransomware, the computer device (such as the security process) restores the first file to a state unaffected by the first process based on the backup data. This application decouples data backup from ransomware detection. After completing the data backup of the file, the computer device can automatically demand a rollback in response to the detection of ransomware, thereby achieving automatic data recovery.

[0060] In some embodiments, the computer device includes a processor, and the technical solutions provided in this application are applied to the processor in the computer device, or to security software (such as EDR software) running in the computer device.

[0061] The technical solution of this application will be described in detail below from multiple perspectives, including hardware devices, implementation scenarios, methods and processes, and software devices.

[0062] The hardware device of the present application embodiment is illustrated below.

[0063] For example, Figure 1 This is a schematic diagram of the hardware structure of a computer device 100 provided in an embodiment of this application. Figure 1 As shown, the computer device 100 includes a processor 101 and a memory 102, which are connected via a bus 103. Figure 1 The processor 101 and memory 102 are described independently. Alternatively, the processor 101 and memory 102 may be integrated together.

[0064] The memory 102 is used to store computer programs, including the Linux operating system and program code. The memory 102 can be various types of storage media, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical storage, registers, optical disc storage, disk storage, or other magnetic storage devices.

[0065] The processor 101 is a general-purpose processor or a special-purpose processor. The processor 101 may be a single-core processor or a multi-core processor. The processor 101 includes at least one circuit to execute the data backup method provided in the embodiments of this application.

[0066] Optionally, the computer device 100 also includes a network interface 104, which is connected to the processor 101 and the memory 102 via a bus 103. The network interface 104 enables the computer device 100 to communicate with other devices, such as management devices.

[0067] Optionally, the computer device 100 also includes an input / output (I / O) interface 105, which is connected to the processor 101 and the memory 102 via a bus 103. The processor 101 can receive input commands or data through the I / O interface 105. The I / O interface 105 is used to connect input devices to the computer device 100, such as a keyboard and mouse. Optionally, in some possible scenarios, the network interface 104 and the I / O interface 105 described above are collectively referred to as a communication interface.

[0068] Optionally, the computer device 100 further includes a display 106, which is connected to the processor 101 and the memory 102 via a bus 103. The display 106 can be used to display intermediate and / or final results generated by the processor 101 executing the data backup method provided in this embodiment, such as backup data or modified data of a file. In one possible implementation, the display 106 is a touch screen to provide a human-computer interaction interface.

[0069] Wherein, bus 103 can be any type of communication bus used to interconnect internal devices of computer device 100. For example, a system bus. This embodiment of the application illustrates the interconnection of the aforementioned devices inside computer device 100 via bus 103 as an example. Optionally, the aforementioned devices inside computer device 100 may communicate with each other using connection methods other than bus 103, such as interconnecting the aforementioned devices inside computer device 100 via internal logical interfaces of computer device 100.

[0070] The aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether to dispose of the devices independently on different chips or integrate them on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices.

[0071] Figure 1 The computer device 100 shown is merely exemplary. In its implementation, the computer device 100 may include other components, which will not be listed hereafter. Figure 1 The computer device 100 shown can perform data backup of existing files in the file system by executing all or part of the steps of the data backup method provided in the embodiments of this application.

[0072] The following are examples illustrating the implementation scenarios of the embodiments of this application.

[0073] The data backup method provided in this application can be applied to various computer devices that may be subject to ransomware attacks and use the Linux operating system. These computer devices may be, for example, terminal devices with a file system deployed, including but not limited to servers, hosts, personal computers, mobile phones, or workstations.

[0074] Computer devices perform I / O operations on the file system by running processes. Process files in a computer device typically reside on the hard drive. These process files contain executable programs; loading these executable programs into memory and running them constitutes running the process. A process is the manifestation of an executable program within a file after it has been executed.

[0075] Optionally, the computer device stores one or more of the following lists: a trusted program list, an untrusted program list, a file path list, or a file type list. These lists are manually configured by the user on the computer device or distributed to the computer device by the management device. The trusted program list can be automatically generated and updated by the management device, while the untrusted program list, file path list, and file type list can be configured based on expert experience.

[0076] For example, Figure 2 This is a schematic diagram of an implementation scenario provided in an embodiment of this application. For example... Figure 2 As shown, this implementation scenario includes management device 201 (also referred to as "analyzer" depending on the product form) and multiple computer devices 202A-202C (collectively referred to as computer device 202). Figure 2 The number of computer devices mentioned is for illustrative purposes only and is not intended to limit the implementation scenarios involved in the embodiments of this application.

[0077] Optionally, the management device 201 may be a single server, a server cluster consisting of multiple servers, or a cloud computing platform. The hardware structure of the management device 201 may be referenced for example. Figure 1 The computer device 100 is shown. The computer device 202 is, for example, a... Figure 1 The computer device 100 shown. Optionally, the management device 201 and the computer device 202 are connected via a wireless network or a wired network.

[0078] Optionally, the management device 201 can be used to train and distribute one or more lists for computer devices 202 to perform data backup processes. For example, multiple computer devices 202 collect process logs and send the collected process logs to the management device 201. These process logs include process identifiers of processes already running on the computer devices 202. The management device 201 determines the processes already running on each computer device 202 based on the process logs sent by the multiple computer devices 202. Then, it clusters all the processes already running on the multiple computer devices 202, and identifies processes that have run more than a certain number of times as trusted processes, and identifies the programs corresponding to these trusted processes as trusted programs. This generates a list of trusted programs and distributes it to the computer devices 202. In addition, the management device 201 can also periodically update the list of trusted programs based on the process logs reported by the multiple computer devices 202, and distribute the updated list of trusted programs to the multiple computer devices 202, thereby achieving automatic generation and updating of the list of trusted programs.

[0079] Optionally, the management device 201 can also be used to determine whether a process running on the computer device 202 is ransomware. For example, the computer device 202 sends a file behavior log of the running process to the management device. This file behavior log includes information about the file operations performed by the process on the file system within a preset time period, such as I / O commands, I / O command parameters, I / O command execution results, or the time when the I / O command occurred, etc. Based on the information about the file operations performed by the process on the file system within the preset time period, the management device 201 determines whether the process is ransomware and sends the determination result of the process to the computer device 202 to indicate whether the process is ransomware.

[0080] Optionally, the management device 201 can also send a file backup query command to the computer device 202 to query the file backup data corresponding to a specified process running on the computer device 202. Furthermore, if the management device 201 determines that a process running on the computer device 202 is ransomware, the management device 201 can also send a rollback command to the computer device 202 to instruct the computer device 202 to restore its file system to a state unaffected by the ransomware.

[0081] The method flow of the embodiments of this application is illustrated below.

[0082] For example, Figure 3 This is a schematic diagram illustrating the implementation flow of a data backup method 300 provided in an embodiment of this application. For example... Figure 3 As shown, method 300 includes, but is not limited to, steps 301 to 302. Optionally, method 300 further includes step 303. Optionally, the computer device in method 300 is... Figure 1 The computer device 100 shown is, or is Figure 2 Any of the computer devices 202 shown.

[0083] It is worth noting that the computer device in method 300 uses a Linux operating system, and this computer device runs security processes and kernel modules. The security processes run in user mode, while the kernel modules run in kernel mode.

[0084] Step 301: The kernel module running in kernel mode on the computer device monitors whether any process is performing write operations on existing files in the file system of the computer device by extending the fanotify function.

[0085] The write operation includes one or more of the following: clear operation, delete operation, rename operation, or modify operation. Specifically, clearing a file means emptying its contents, reducing its size to 0 bytes. Deleting a file means deleting the file. Renaming a file means renaming the file. Modifying a file means modifying its contents, including appending new content and / or overwriting existing content. Overwriting existing content means deleting the original content and writing new content in the location where the deleted content was. In this embodiment, performing clear, delete, rename, and modify operations on an existing file in the file system is collectively referred to as performing a write operation on that existing file.

[0086] Optionally, the security process can set a file monitoring range. In this implementation, the kernel module only monitors existing files within that monitoring range; that is, the kernel module only monitors whether any process is performing write operations on existing files within that monitoring range. Alternatively, the file monitoring range can be represented by directories or folders, for example: / boot, / boot / efi, / , / root, / home, / data. Correspondingly, the kernel module monitors whether any process is performing write operations on existing files in these directories or folders. Alternatively, the security process can not set a file monitoring range. In this implementation, the kernel module performs global monitoring of all existing files in the computer device's file system; that is, the kernel module monitors whether any process is performing write operations on any existing file in the computer device's file system.

[0087] In this embodiment, the kernel module is an executable file running in the kernel mode of the Linux operating system that is related to file system events. This kernel module is, for example, named fs_event.ko. This kernel module extends the functionality of fanotify, monitoring file write events occurring in the file system in real time, such as file clearing, deletion, renaming, or modification operations. Specifically, when the kernel module is loaded, it registers with the LSM functions security_file_open(), security_path_truncate(), security_path_unlink(), security_file_permission(), or security_path_rename() via Kprobe. In this way, the kernel module can intercept file modification operations based on the security_file_open() or security_file_permission() functions, file clearing operations based on the security_file_open() and security_path_truncate() functions, file deletion operations based on the security_path_unlink() function, and file renaming operations based on the security_path_rename() function.

[0088] Furthermore, the kernel module, based on the fanotify notification mechanism, can send notifications to applications registered with the kernel module when it detects file write events in the file system. For example, by registering the program corresponding to a security process running in user space with the kernel module, the kernel module will send a notification to the security process after detecting a file write event in the file system. This event notification mechanism eliminates the need for the security process to poll the file system to check for file write operations, allowing the security process to handle events only when they occur, thereby saving system resources and improving overall system efficiency. Additionally, using fanotify to implement interaction between kernel space and user space can reduce the likelihood of Linux operating system freezes.

[0089] The Linux kernel's native fanotify only has monitoring functions for three types of file operations: opening, opening and executing, and reading. This application extends the functionality of fanotify through a kernel module to monitor file write operations occurring in the file system of a computer device, thus enabling fanotify to monitor file write operations.

[0090] Step 302: In response to the kernel module detecting that the first process is performing a write operation on the first file in the file system of the computer device, the security process running in user mode on the computer device performs a data backup process on the first file.

[0091] The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing a data backup on the first file to obtain the backup data of the first file. The first file is an existing file in the file system. The first process is any process that performs a write operation on an existing file in the file system.

[0092] Optionally, when executing the above data backup process, the security process can determine only whether the first process is a trusted process. In this implementation, if the first process is an untrusted process, the security process performs data backup on the first file; otherwise, if the first process is a trusted process, the security process does not perform data backup on the first file. Alternatively, the security process can determine only whether the first file is a protected file. In this implementation, if the first file is a protected file, the security process performs data backup on the first file; otherwise, if the first file is not a protected file, the security process does not perform data backup on the first file. Alternatively, the security process can determine both whether the first process is a trusted process and whether the first file is a protected file. In this implementation, if the first process is an untrusted process and the first file is a protected file, the security process performs data backup on the first file; otherwise, if the first process is a trusted process, or if the first file is not a protected file, the security process does not perform data backup on the first file.

[0093] Optionally, in step 302 above, in response to the kernel module detecting that the first process is performing a write operation on the first file, the kernel module interrupts the execution of the first process and sends a file backup instruction to the security process. This file backup instruction includes the file identifier of the first file. In response to receiving the file backup instruction, the security process performs a data backup process on the first file. The file identifier is, for example, a file name or a file path. Optionally, the file backup instruction also includes the process identifier of the first process. The process identifier is, for example, a universally unique identifier (UUID) or a process ID (PID).

[0094] It's worth noting that when the file backup command only includes the file identifier of the first file, but not the process identifier of the first process, the security process can determine whether to back up the first file by checking if it is a protected file. Conversely, when the file backup command includes both the file identifier of the first file and the process identifier of the first process, the security process can determine whether to back up the first file by checking if the first process is a trusted process and / or if the first file is a protected file.

[0095] In this embodiment, the kernel module extends the functionality of fanotify to monitor file write operations occurring in the file system of a computer device. Furthermore, fanotify is used to block the execution of processes that perform write operations on existing files in the file system and to notify the security process to back up the data of the file to be written. This allows the security process to complete the data backup before the file is written by a process, thereby improving data security.

[0096] Optionally, the computer device stores one or more of the following: a trusted program list, an untrusted program list, a file path list, or a file type list. The trusted program list is equivalent to a program whitelist, recording one or more trusted programs. The untrusted program list is equivalent to a program blacklist, recording one or more untrusted programs. The file path list includes one or more file paths, which are the file paths of non-critical files that do not require ransomware protection. The file type list includes one or more file types, which are the important file types that require ransomware protection. Accordingly, when the security process executes the above data backup process, it can determine whether the first process is a trusted process based on the trusted program list and / or the untrusted program list, and it can determine whether the first file is a protected file based on the file path list and / or the file type list. Specific implementation methods can be found in the relevant content of the above embodiments, and will not be repeated here.

[0097] It's worth noting that when a computer device stores multiple lists, the order in which these lists are used by the security process during file backup is not restricted. For example, the security process might first filter important files based on the file path list, then filter important file types based on the file type list, and finally determine the trustworthiness of the process performing write operations on the file based on the untrusted program list and the trusted program list. Or, for instance, the security process might first filter important file types based on the file type list, then important files based on the file path list, and finally determine the trustworthiness of the process performing write operations on the file based on the untrusted program list and the trusted program list; or, for instance, the security process might first determine the trustworthiness of the process performing write operations on the file based on the untrusted program list and the trusted program list, then filter important files based on the file path list, and finally filter important file types based on the file type list; and so on.

[0098] Optionally, the security process backs up the first file, including: the security process storing the backup data of the first file locally on the computer device, for example, the security process storing the backup data of the first file in a protected area on the local hard drive, where the stored data cannot be modified by the process. Alternatively, the security process stores the backup data of the first file on an external storage device. External storage devices include, but are not limited to, network storage or dedicated storage devices connected to the computer device.

[0099] Since ransomware file operations typically involve writing to existing files in the file system, including clearing the contents of existing files, deleting existing files, renaming existing files, or modifying the contents of existing files, this application embodiment triggers data backup of existing files based on write operations to existing files in the file system. Data backup of existing files is only performed if the execution subject of the write operation is an untrusted process, and / or if the object of the write operation is a protected file. This comprehensively considers the comprehensiveness and volume of data backup. Compared to existing data backup schemes coupled with ransomware detection, the scheme provided in this application embodiment can achieve more comprehensive data backup without relying on the accuracy of ransomware detection. Compared to existing data backup schemes decoupled from ransomware detection, the scheme provided in this application embodiment triggers the data backup process based on specific events, combined with determining whether the process performing the write operation is an untrusted process and / or whether the file being written to is a protected file, which can reduce the amount of backup data and save storage resources.

[0100] Furthermore, in response to the completion of the data backup process for the first file by the secure process, or if the secure process receives a file backup instruction from the kernel module for a duration exceeding the target duration, the secure process sends a file backup termination instruction to the kernel module. Upon receiving the file backup termination instruction, the kernel module allows the first process to continue running. The completion of the data backup process for the first file by the secure process includes: the secure process completing the data backup of the first file, or the secure process determining that no data backup of the first file is required.

[0101] In this embodiment, a file backup end command is sent to the kernel module through a security process, enabling the kernel module to resume the operation of the first process in a timely manner, thus avoiding the problem of the Linux kernel timeout and unresponsiveness causing the system to freeze.

[0102] Optionally, the security process includes a main process and a monitoring process. The monitoring process communicates with the kernel module, while the main process executes the aforementioned data backup procedure. For example, Figure 4 This is a schematic diagram illustrating a computer device implementing file backup according to an embodiment of this application. Figure 4As shown, the monitoring process registers with the kernel module, and the kernel module communicates with the monitoring process based on the fanotify notification mechanism. Optionally, the monitoring process sets a file monitoring range, which may include, for example, / boot, / boot / efi, / , / root, / home, and / data. In step S1, the kernel module monitors whether any process is performing write operations on files within the monitored range. In step S2, in response to the kernel module detecting that a first process is performing a write operation on a first file within the monitored range, the kernel module interrupts the execution of the first process and sends a file backup instruction to the monitoring process. This file backup instruction includes the file identifier of the first file. In step S3, the monitoring process sends the file backup instruction to the main process. In step S4, the main process performs a data backup process on the first file. If the main process determines that a data backup of the first file is necessary, it writes the backup data of the first file to the local hard drive or external storage device. In step S5, after completing the data backup of the first file, the main process sends the backup execution result to the monitoring process; or, if the main process determines that a data backup of the first file is not necessary, it directly sends the backup execution result to the monitoring process. The backup execution result is used to indicate the end of the data backup process for the first file by the main process. In step S6, the monitoring process, in response to receiving the backup execution result from the main process, or in response to receiving a file backup instruction from the kernel module whose duration exceeds the target duration, sends a file backup end instruction to the kernel module. In step S7, the kernel module, in response to receiving the file backup end instruction, allows the first process to continue running, that is, allows the first process to continue performing write operations on the first file.

[0103] Optionally, after the security process (main process) backs up the data of the first file, it continues to execute the following steps 303.

[0104] Step 303: In response to the first process being ransomware, the computer device restores the first file to a state unaffected by the first process based on the backup data of the first file.

[0105] Optionally, after the kernel module allows the first process to continue running, the first process can perform write operations on the first file. If the first process is ransomware, then the first file in the file system that has been written to by the ransomware needs to be recovered. For example, a secure process can restore the first file to a state unaffected by the first process based on backup data of the first file.

[0106] Optionally, the computer device can locally determine whether the first process is ransomware. For example, the computer device can determine whether the first process is ransomware based on the file operations performed by the first process on the file system within a preset time period. Alternatively, the management device can determine whether the first process is ransomware, and the computer device can determine whether the first process is ransomware based on the management device's determination result. For example, the computer device (such as a security process) sends a file behavior log of the first process to the management device. This file behavior log includes information about the file operations performed by the first process on the file system within a preset time period. The management device determines whether the first process is ransomware based on the information about the file operations performed by the first process on the file system within the preset time period. The management device sends the determination result of the first process to the computer device, which indicates whether the first process is ransomware. The computer device determines whether the first process is ransomware based on the received determination result. For example, the determination result includes the process identifier of the first process and a ransomware indication. The process identifier indicates that the object of the determination is the first process, and the ransomware indication is used to indicate whether the object of the determination is ransomware.

[0107] Optionally, there are multiple ways for a computer device or management device to determine whether a first process is ransomware based on the file operations performed by the first process on the file system within a preset time period. For example, if the number of write operations performed by the first process on the file system within the preset time period reaches a preset threshold, then the first process is determined to be ransomware. Alternatively, if the continuous write operations performed by the first process on the file system within the preset time period conform to a preset ransomware operation sequence, then the first process is determined to be ransomware. This ransomware operation sequence is set according to the attack behavior of ransomware, such as read-overwrite operations, write-delete operations, read-delete-write operations, etc., targeting the same file. This application embodiment does not limit the method of determining whether a process is ransomware. Alternatively, the management device can comprehensively determine whether the first process is ransomware based on information in the file behavior log and the traffic behavior characteristics of the computer device that sent the file behavior log. The traffic behavior characteristics may be reported by security devices in the network where the computer device is located, including firewalls, security gateways, probes, etc.

[0108] Optionally, after determining that the first process is ransomware, the computer device directly restores the first file based on its backup data, i.e., it directly performs a state rollback to restore the file system to a state unaffected by the first process. Alternatively, with user confirmation, the computer device restores the first file based on its backup data. For example, if the computer device determines the first process is ransomware, it first displays the backup data of files modified by the first process in the file system, along with the latest modified data, allowing the user to confirm whether to perform data restoration. Or, if the management device determines the first process is ransomware, the computer device sends the backup data of files modified by the first process in the file system, along with the latest modified data, to the management device. The management device displays this backup data and the latest data, allowing the user to confirm whether to perform data restoration. After user confirmation, the management device sends a rollback command to the computer device to instruct it to perform data restoration. Alternatively, the computer device performs state rollback based on a policy: in some states, it performs a direct rollback; in others, it considers user input before performing a rollback; and in still others, it performs a delayed rollback. For example, when the processor load on a computer exceeds a certain percentage, after identifying the first process as ransomware, the user decides whether to perform a state rollback. Conversely, when the processor load falls below a certain percentage, a state rollback is performed directly after identifying the first process as ransomware. Another example is that the computer device may have a pre-configured rollback period, during which files modified by ransomware are uniformly rolled back. This application does not limit the strategy for restoring ransomware-modified files from the computer device's file system.

[0109] In this embodiment, data backup and ransomware detection are decoupled. After the data backup of the files is completed, the computer device can automatically demand a rollback in response to the detection of ransomware, thereby achieving automatic data recovery.

[0110] Optionally, after determining that the first process is ransomware, the computer device deletes the files created by the first process, such as ransom note files and encrypted files created in the file system, in order to achieve a comprehensive and automated cleanup of the ransomware.

[0111] Optionally, embodiments of this application support query operations by the management device on file system events occurring on the computer device. For example, the management device sends a file backup query command to the computer device, the file backup query command including the process identifier of the second process. The computer device sends a file backup query result to the management device, the file backup query result including backup data of the second file. The second file is an existing file in the file system. The backup data of the second file is generated due to the second process performing a write operation on the second file. The second file and the first file mentioned above can be the same file in the file system, or they can be different files in the file system. The method of generating the backup data of the second file can refer to the method of generating the backup data of the first file mentioned above, and will not be repeated here in this embodiment of the application.

[0112] In this embodiment of the application, the management device sends a file backup query command to the computer device to actively query the file backup data generated by a certain process, thereby realizing the monitoring of the behavior of the process.

[0113] Furthermore, the management device can determine whether the second process is ransomware based on the file backup query results. If it confirms the second process is ransomware, it sends a rollback command to the computer device, which includes the process identifier of the second process. The security process running on the computer device then restores the file system to a state unaffected by the second process based on this rollback command.

[0114] The embodiments of this application are as follows: Figure 2 Taking the illustrated implementation scenario as an example, the implementation scheme of the above data backup method will be explained with examples. For example, Figure 5 This is a schematic diagram illustrating the implementation process of a data backup method provided in an embodiment of this application. For example... Figure 5As shown, the management device includes a whitelist training unit, a blacklist / whitelist pre-configuration unit, and a ransomware determination unit. The whitelist training unit is used to train and extract trusted programs based on process logs collected from multiple computer devices. The blacklist / whitelist pre-configuration unit stores known blacklists and whitelists, including lists of trusted programs, untrusted programs, file paths, or file types, and distributes these lists to the computer devices. The ransomware determination unit determines whether a process is a ransomware virus based on the file behavior logs reported by the computer device and sends the determination result to the computer device. The computer device runs a security process (including a main process and a monitoring process) in user mode and a kernel module in kernel mode. The kernel module monitors for processes performing write operations on existing files in the file system by extending the fanotify function. The monitoring process communicates with the kernel module. The computer device passes the received blacklists and whitelists to the main process running in user mode. The main process responds to kernel modules detecting write operations on existing files in the file system. Triggered by events such as file clearing, deletion, renaming, or modification, it uses blacklists and whitelists to perform a data backup process and stores the backup data on the local hard drive or external storage device. The computer device also obtains the process's file behavior log by running a security process and reports this log to the management device. After receiving a determination from the management device that the process is ransomware, the computer device reads the backup data from the backup location by running the security process (main process) and restores the files modified by the ransomware based on this backup data. The computer device can also output rollback confirmation information, including the backup data of the files modified by the ransomware and the latest modified data, for the user to confirm whether to roll back the file status.

[0115] The order of steps in the data backup method provided in this application can be adjusted appropriately, and steps can be added or removed as needed. Any variations that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. For example, the file path list configured in the computer device in this application includes file paths of non-critical files that do not require ransomware protection. Similarly, file paths of critical files that require ransomware protection can also be configured in the computer device, thus determining whether the file being modified by the process is a critical file. Another example is the file type list configured in the computer device in this application, which includes critical file types that require ransomware protection. Similarly, non-critical file types that do not require ransomware protection can also be configured in the computer device, thus determining whether the file type being modified by the process is a non-critical file type. These embodiments will not be described in detail here.

[0116] The software devices of the embodiments of this application are illustrated below.

[0117] For example, Figure 6 This is a schematic diagram of a data backup device 600 provided in an embodiment of this application. The data backup device 600 is applied to a computer device. The operating system of the computer device is Linux. The data backup device 600 includes a security process 601 and a kernel module 602. The security process runs in user mode, and the kernel module runs in kernel mode. Optionally, the data backup device 600 also includes a transceiver module 603.

[0118] Kernel module 602, by extending the fanotify function, monitors whether any process is performing write operations on existing files in the computer device's file system. Write operations include one or more of the following: clearing, deleting, renaming, or modifying. In response to kernel module 602 detecting that a first process is performing a write operation on a first file in the file system, security process 601 performs a data backup process on the first file, which is an existing file in the file system. The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing a data backup of the first file to obtain backup data for the first file.

[0119] Optionally, in response to kernel module 602 detecting that the first process is performing a write operation on the first file, kernel module 602 interrupts the execution of the first process and sends a file backup instruction to security process 601. The file backup instruction includes the file identifier of the first file. In response to receiving the file backup instruction, security process 601 performs a data backup process on the first file.

[0120] Optionally, the file backup instruction may also include the process identifier of the first process.

[0121] Optionally, in response to the completion of the data backup process of the first file by the security process 601, or if the duration for which the security process 601 receives the file backup instruction exceeds the target duration, the security process 601 sends a file backup termination instruction to the kernel module 602. In response to receiving the file backup termination instruction, the kernel module 602 allows the first process to continue running.

[0122] Optionally, the security process includes a main process and a monitoring process; the monitoring process is used to communicate with the kernel module, and the main process is used to execute the data backup process.

[0123] Optionally, in response to the first process being ransomware, security process 601 (or other functional modules in the computer device) is also used to restore the first file to a state unaffected by the first process based on backup data of the first file.

[0124] Optionally, the transceiver module 603 is used to send the file behavior log of the first process to the management device. The file behavior log includes relevant information about the file operations performed by the first process on the file system within a preset time period. It also receives the judgment result of the first process sent by the management device, which indicates whether the first process is a ransomware virus.

[0125] Optionally, the transceiver module 603 is used to receive a file backup query command sent by the management device, the file backup query command including the process identifier of the second process, and to send a file backup query result to the management device, the file backup query result including backup data of the second file, the second file being an existing file in the file system, and the backup data of the second file being generated due to the second process performing a write operation on the second file.

[0126] Optionally, the transceiver module 603 is used to receive a rollback command sent by the management device, the rollback command including the process identifier of the second process. The security process 601 (or other functional modules in the computer device) is used to restore the file system to a state unaffected by the second process according to the rollback command.

[0127] Optionally, security process 601 is used to store backup data of the first file locally on a computer device, or to store backup data of the first file on an external storage device.

[0128] Appendix Figure 6 The described device embodiments are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. Appendix Figure 6 The modules mentioned above can be implemented either in hardware or as software functional units. For example, when implemented in software, the security process 601 and the kernel module 602 can be implemented by an attached... Figure 1 The processor 101 reads the program instructions stored in the memory 102 and generates software function modules to implement them. Figure 6 The aforementioned modules can also be implemented separately by different hardware components of a computer device. For example, security process 601 and kernel module 602 are implemented separately by an attached... Figure 1 A portion of the processing resources in the processor 101 (e.g., one core in a multi-core processor) are used, while the transceiver module 603 is implemented by an auxiliary... Figure 1The network interface 104 and the remaining processing resources in the processor 101 (such as other cores in a multi-core processor) are used to complete the task. Obviously, the above functional modules can also be implemented by a combination of software and hardware. For example, the transceiver module 603 is implemented by a hardware programmable device, while the security process 601 and the kernel module 602 are software functional modules generated by the processor after reading the program instructions stored in the memory, such as the EDR software functional module.

[0129] This application embodiment also provides a computer device with a Linux operating system. The computer device runs a security process and a kernel module. The security process runs in user mode, and the kernel module runs in kernel mode. The computer device includes a memory, a network interface, and at least one processor. The memory stores program instructions, and the at least one processor reads the program instructions stored in the memory, causing the computer device to execute the steps performed by the computer device in the above method embodiment. Optionally, the hardware structure of the computer device is as follows: Figure 1 As shown.

[0130] This application embodiment also provides a management device, including: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and the at least one processor reads the program instructions stored in the memory, causing the management device to execute the steps performed by the management device in the above method embodiment. Optionally, the hardware structure of the management device refers to... Figure 1 The computer device 100 shown.

[0131] This application also provides a data backup system, including a computer device for performing the steps executed by the computer device in the method embodiments described above. Optionally, the data backup system further includes a management device. For example, the data backup system includes a management device and multiple computer devices. The structure of the data backup system is shown in reference, for example. Figure 2 .

[0132] Optionally, the management device is used to receive the file behavior log of the first process sent by the computer device, determine whether the first process is ransomware based on the file behavior log, and send the determination result of the first process to the computer device. The file behavior log includes relevant information on the file operations performed by the first process on the file system of the computer device within a preset time period, and the determination result indicates whether the first process is ransomware.

[0133] Optionally, the management device is used to send a file backup query command to the computer device and receive the file backup query result sent by the computer device. The file backup query command includes the process identifier of the second process, and the file backup query result includes the backup data of the second file. The second file is an existing file in the file system, and the backup data of the second file is generated due to the second process performing a write operation on the second file.

[0134] Optionally, the management device is also used to determine whether the second process is ransomware based on the file backup query results, and after determining that the second process is ransomware, to send a rollback command to the computer device. The rollback command includes the process identifier of the second process. The computer device is also used to restore the file system to a state unaffected by the second process based on the rollback command.

[0135] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor of a computer device, implement the steps performed by the computer device in the above method embodiments.

[0136] This application also provides a computer program product, including a computer program, which, when executed by the processor of a computer device, implements the steps executed by the computer device in the above method embodiments.

[0137] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0138] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, "first TCP message" and "second TCP message" are used to distinguish messages sent at different times, not to describe a specific order of messages.

[0139] In the description of the embodiments in this application, unless otherwise stated, "at least one" means one or more. "More than one" means two or more.

[0140] A references B, which means that A is the same as B or A is a simple variation of B.

[0141] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that there are three possible relationships. For example, A and / or B means: A exists alone, A and B exist simultaneously, or B exists alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0142] Optionally, in the above embodiments, all or part of the implementation is carried out by software, hardware, firmware, or any combination thereof. Optionally, when implemented using software, it is implemented in the form of a computer program product, which is implemented in whole or in part. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Optionally, the computer instructions are stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. Optionally, the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. Alternatively, the available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video disks (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0143] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data backup method, characterized in that, Applied to a computer device, wherein the computer device operates on a Linux operating system, and the computer device runs a security process and a kernel module, wherein the security process runs in user mode and the kernel module runs in kernel mode, the method includes: The kernel module monitors whether any process is performing write operations on existing files in the file system of the computer device by extending the fanotify function. The write operations include one or more of the following: clearing, deleting, renaming, or modifying operations. In response to the kernel module detecting that the first process performs the write operation on the first file in the file system, the security process performs a data backup process on the first file, where the first file is an existing file in the file system; The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing data backup on the first file to obtain backup data of the first file.

2. The method according to claim 1, characterized in that, In response to the kernel module detecting that a first process performs a write operation on a first file in the file system, the security process performs a data backup process on the first file, including: In response to the kernel module detecting that the first process is performing the write operation on the first file, the kernel module interrupts the execution of the first process and sends a file backup instruction to the security process, the file backup instruction including the file identifier of the first file; In response to receiving the file backup instruction, the security process performs the data backup procedure on the first file.

3. The method according to claim 2, characterized in that, The file backup instruction also includes the process identifier of the first process.

4. The method according to claim 2 or 3, characterized in that, The method further includes: In response to the completion of the data backup process of the first file by the security process, or if the duration for which the security process receives the file backup instruction exceeds the target duration, the security process sends a file backup end instruction to the kernel module. In response to receiving the file backup end command, the kernel module causes the first process to continue running.

5. The method according to any one of claims 2 to 4, characterized in that, The security process includes a main process and a monitoring process; wherein the monitoring process is used to communicate with the kernel module, and the main process is used to execute the data backup process.

6. The method according to any one of claims 1 to 5, characterized in that, After backing up the first file, the method further includes: In response to the first process being a ransomware virus, the first file is restored to a state unaffected by the first process based on the backup data of the first file.

7. The method according to claim 6, characterized in that, The method further includes: Send the file behavior log of the first process to the management device. The file behavior log includes information about the file operations performed by the first process on the file system within a preset time period. The system receives a determination result from the management device regarding the first process, the determination result indicating whether the first process is a ransomware virus.

8. The method according to any one of claims 1 to 7, characterized in that, The method further includes: Receive a file backup query command sent by the management device, wherein the file backup query command includes the process identifier of the second process; Send the file backup query result to the management device. The file backup query result includes the backup data of the second file, which is an existing file in the file system. The backup data of the second file is generated because the second process performs the write operation on the second file.

9. The method according to claim 8, characterized in that, The method further includes: Receive a rollback command sent by the management device, the rollback command including the process identifier of the second process; According to the rollback command, the file system is restored to a state unaffected by the second process.

10. A computer device, characterized in that, The computer device operates on a Linux operating system and runs security processes and a kernel module. The security processes run in user mode, and the kernel module runs in kernel mode. The computer device includes: memory, a network interface, and at least one processor. The memory is used to store program instructions. After the at least one processor reads the program instructions stored in the memory, the computer device causes the following operations: The kernel module monitors whether any process is performing write operations on existing files in the file system of the computer device by extending the fanotify function. The write operations include one or more of the following: clearing, deleting, renaming, or modifying operations. In response to the kernel module detecting that the first process performs the write operation on the first file in the file system, the security process performs a data backup process on the first file, where the first file is an existing file in the file system; The data backup process includes: if the first process is an untrusted process, and / or the first file is a protected file, performing data backup on the first file to obtain backup data of the first file.

11. The computer device according to claim 10, characterized in that, After the program instructions are read by the at least one processor, the computer device causes the following operations: In response to the kernel module detecting that the first process is performing the write operation on the first file, the kernel module interrupts the execution of the first process and sends a file backup instruction to the security process, the file backup instruction including the file identifier of the first file; In response to receiving the file backup instruction, the security process performs the data backup procedure on the first file.

12. The computer device according to claim 11, characterized in that, After the program instructions are read by the at least one processor, the computer device further performs the following operations: In response to the completion of the data backup process of the first file by the security process, or if the duration for which the security process receives the file backup instruction exceeds the target duration, the security process sends a file backup end instruction to the kernel module. In response to receiving the file backup end command, the kernel module causes the first process to continue running.

13. The computer device according to any one of claims 10 to 12, characterized in that, After the program instructions are read by the at least one processor, the computer device further performs the following operations: After backing up the first file, in response to the first process being a ransomware virus, the first file is restored to a state unaffected by the first process based on the backup data of the first file.

14. The computer device according to claim 13, characterized in that, After the program instructions are read by the at least one processor, the computer device further performs the following operations: Send the file behavior log of the first process to the management device. The file behavior log includes information about the file operations performed by the first process on the file system within a preset time period. The system receives a determination result from the management device regarding the first process, the determination result indicating whether the first process is a ransomware virus.

15. The computer device according to any one of claims 10 to 14, characterized in that, After the program instructions are read by the at least one processor, the computer device further performs the following operations: Receive a file backup query command sent by the management device, wherein the file backup query command includes the process identifier of the second process; Send the file backup query result to the management device. The file backup query result includes the backup data of the second file, which is an existing file in the file system. The backup data of the second file is generated because the second process performs the write operation on the second file.

16. The computer device according to claim 15, characterized in that, After the program instructions are read by the at least one processor, the computer device further performs the following operations: Receive a rollback command sent by the management device, the rollback command including the process identifier of the second process; According to the rollback command, the file system is restored to a state unaffected by the second process.

17. A data backup system, characterized in that, Includes a computer device, said computer device being used to perform the method as described in any one of claims 1 to 9.

18. The data backup system according to claim 17, characterized in that, The data backup system also includes management equipment; The management device is used to receive file behavior logs of a first process sent by the computer device, determine whether the first process is ransomware based on the file behavior logs, and send the determination result of the first process to the computer device. The file behavior logs include relevant information on file operations performed by the first process on the file system of the computer device within a preset time period, and the determination result indicates whether the first process is ransomware.

19. The data backup system according to claim 17 or 18, characterized in that, The data backup system also includes management equipment; The management device is used to send a file backup query command to the computer device and receive the file backup query result sent by the computer device. The file backup query command includes the process identifier of the second process, and the file backup query result includes the backup data of the second file. The second file is an existing file in the file system, and the backup data of the second file is generated because the second process performs the write operation on the second file.

20. The data backup system according to claim 19, characterized in that, The management device is also used to determine whether the second process is ransomware based on the file backup query result, and after determining that the second process is ransomware, to send a rollback command to the computer device, the rollback command including the process identifier of the second process; The computer device is also used to restore the file system to a state unaffected by the second process, according to the rollback command.

21. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed by a processor, implement the method as described in any one of claims 1 to 9.

Images