Process network behavior control method and electronic device

Abstract

The application relates to a process network behavior control method and electronic equipment, and belongs to the technical field of computers.The method comprises the following steps: if the network behavior of a process is captured, a global-level network behavior control rule is inquired, and a security policy including a process-level network behavior control rule is acquired by inquiring the extended attribute of an executable file; if the security policy is acquired, a rule list of the process-level network behavior control rule is generated according to the matching priority; the network behavior is matched with each process-level network behavior control rule in the rule list according to the order from high to low of the matching priority; if the matching is successful, a control strategy is determined according to the process-level network behavior control rule; and if the matching is unsuccessful, a control strategy is determined according to the global-level network behavior control rule, the network behavior of the process generated by different executable files is subjected to differentiated network behavior control, and the strategy can be prevented from being bypassed through symbol linking, and the reliability of the process network behavior control is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a process network behavior control method and electronic device. Background Technology

[0002] In operating systems, process network behavior control is a crucial mechanism for ensuring system security. Existing technologies primarily employ the following solutions for network behavior control: 1. Pathname-based access control models (such as AppArmor): These models associate access control policies by matching the pathnames of executable files. AppArmor uses a policy binding method based on executable file pathnames, and its security verification depends entirely on the pathname resolution result. However, pathnames can be replaced and bypassed by symbolic links, hard links, or remounting, causing the binding relationship between the policy and the executable file to be broken.

[0003] 2. Filtering schemes based on network layer firewall frameworks (such as iptables / nftables): Packet filtering is implemented in the kernel network protocol stack. This scheme is host-level rather than process-level control and cannot distinguish the network behavior of different processes on the same host. All processes share the same firewall rules, and it is impossible to associate executable files with network behavior policies.

[0004] It is evident that existing technologies cannot achieve differentiated network behavior control for processes generated by different executable files. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a process network behavior control method and electronic device to solve the problem that the prior art cannot achieve differentiated network behavior control for the network behavior of different processes.

[0006] On one hand, embodiments of the present invention provide a process network behavior control method, the method comprising: in response to capturing network behavior of a process, querying global-level network behavior control rules for different processes, and obtaining a security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process; wherein, the security policy includes at least one process-level network behavior control rule for a process generated by running the executable file; in response to obtaining the security policy, generating a rule list of the process-level network behavior control rules sorted according to matching priority; matching the network behavior with each process-level network behavior control rule in the rule list according to the matching priority from high to low; in response to the network behavior successfully matching any of the process-level network behavior control rules, determining a control policy for the network behavior according to the process-level network behavior control rules; in response to the failure to successfully match any of the process-level network behavior control rules, determining a control policy for the network behavior according to the global-level network behavior control rules.

[0007] Further, the process-level network behavior control rules include control types and matching information; wherein, the matching information includes address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information; the step of matching the network behavior with each process-level network behavior control rule in the rule list includes: obtaining the address family information of the current socket; in response to the address family information being inet or inet6, matching the network behavior with the address family matching information, the socket type matching information, the protocol type matching information, the network operation matching information, and the port matching information. The address matching information and the port matching information are matched in multiple dimensions; in response to the address family information being an address family other than inet and inet6, the network behavior is matched in multiple dimensions with the address family matching information, the socket type matching information, the protocol type matching information, and the network operation matching information; in response to the successful multi-dimensional matching, it is determined that the network behavior matches the process-level network behavior control rule; the step of determining the control strategy for the network behavior according to the process-level network behavior control rule includes: determining the control strategy for the network behavior according to the control type of the process-level network behavior control rule.

[0008] Furthermore, at least one of the address family matching information, the socket type matching information, the protocol type matching information, the network operation matching information, the IP address matching information, and the port matching information includes a wildcard; and / or, the IP address matching information includes single IP address matching information or IP address range matching information, and the port matching information includes single port matching information or port range matching information.

[0009] Furthermore, the process-level network behavior control rules in the security policy are sorted according to the matching priority; generating the rule list after the process-level network behavior control rules are sorted according to the matching priority includes: sequentially adding the process-level network behavior control rules to the rule list according to the sorting of each process-level network behavior control rule in the security policy and the order of the matching priority of each process-level network behavior control rule in the rule list.

[0010] Furthermore, for process-level network behavior control rules of different granularities that are related, the more granular process-level network behavior control rules have a higher matching priority.

[0011] Furthermore, after obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: in response to not obtaining the security policy, determining a control policy for the network behavior according to the global-level network behavior control rules.

[0012] Furthermore, the global network behavior control rule is one of address family global rejection, global default rejection, and global default allow; wherein, the address family global rejection is used to reject network behaviors of a set address family, the global default rejection is used to reject all network behaviors, and the global default allow is used to allow all network behaviors.

[0013] Furthermore, before obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: in response to obtaining network behavior control rule configuration information about the target file, performing security verification on the target file to confirm whether the target file is an executable file; in response to the target file being an executable file, performing lexical analysis, syntax analysis, and semantic verification on the network behavior control rule configuration information in sequence; generating the security policy according to a preset format based on the network behavior control rule configuration information that has passed the semantic verification, and writing it into the extended attributes of the target file.

[0014] Furthermore, the semantic verification includes at least one of the following: operation direction and operation semantic consistency verification, socket type and protocol mutual exclusion verification, port range legality verification, and IP address format verification.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the process network behavior control method as described above.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the process network behavior control method as described above.

[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the process network behavior control method as described above.

[0018] The process network behavior control method and electronic device provided by this invention, by storing security policies containing process-level network behavior control rules in the extended attributes of executable files, realizes independent security policy configuration for executable files, achieves process-level network behavior control, enables differentiated network behavior control for processes generated by different executable files, reduces maintenance complexity, and improves the reliability and flexibility of process network behavior control through collaborative decision-making of global-level network behavior control rules and process-level network behavior control rules, and can prevent bypassing security policies through symbolic links and other means, thus improving the reliability of process network behavior control.

[0019] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0020] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 This is a flowchart illustrating the process network behavior control method provided by the present invention; Figure 2 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0021] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0022] Figure 1 This is a flowchart illustrating the process network behavior control method provided by the present invention. Figure 1 As shown, the method includes: Step S1: In response to the captured network behavior of the process, query the global network behavior control rules for different processes, and obtain the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process; wherein, the security policy includes at least one process-level network behavior control rule for the process generated by running the executable file.

[0023] The network behavior of processes is monitored. If network behavior of a process is captured, global-level network behavior control rules for different processes are queried, and the security policy corresponding to the executable file is obtained by querying the extended attributes of the executable file corresponding to the process. The global-level network behavior control rules apply to all monitored processes. The security policy includes at least one process-level network behavior control rule for a process generated by running the executable file. The security policy is stored in the extended attributes of the executable file, and the process-level network behavior control rules are specific to the process generated by that executable file. A security policy may include multiple process-level network behavior control rules.

[0024] Specifically, monitoring and capturing process network behavior can be achieved by setting up interception points on the operating system's network-related system call paths. For example, in Linux systems, this can be done using socket operation hooks provided by the Linux Security Module (LSM), such as `socket_bind`, `socket_connect`, and `socket_sendmsg`, or by intercepting, packaging, or monitoring socket-related system calls like `socket`, `bind`, `connect`, `listen`, `sendto`, `sendmsg`, `recvfrom`, and `recvmsg`. When process network behavior is captured, the process identifier that initiated the behavior is obtained, and the corresponding executable file is determined accordingly. This can be done by reading the ` / proc / PID / exe` symbolic link, or by using the executable file path or information recorded in the process descriptor (`task_struct`). Subsequently, the extended attributes of the executable file are queried to obtain the corresponding security policy. Information such as address family, socket type, and protocol type can be obtained through the socket's internal data (sock structure) maintained by the kernel. To balance processing efficiency, the security policy in the extended attributes can be read and parsed only when the process establishes a socket and performs critical network operations (such as bind, connect, sendmsg, recvmsg, etc.). The parsed process-level network behavior control rules are then sorted by matching priority, generated into a rule list, and cached. Subsequent network behaviors prioritize the use of the cached rule list, and the cache is invalidated and reread when changes to the executable file are detected, thereby improving processing efficiency while ensuring security.

[0025] Step S2: In response to obtaining the security policy, generate a list of rules for the process-level network behavior control rules sorted by matching priority; wherein the matching priority of the global-level network behavior control rules is the lowest.

[0026] If a security policy is obtained, it indicates the existence of process-level network behavior control rules. A list of these rules, sorted by matching priority, is then generated. The matching priority of each process-level network behavior control rule in the security policy can be explicitly marked or determined based on predefined rules.

[0027] Step S3: According to the matching priority from high to low, match the network behavior with each process-level network behavior control rule in the rule list.

[0028] The network behavior is matched against each process-level network behavior control rule in the rule list in descending order of matching priority.

[0029] Step S4: In response to the network behavior successfully matching any of the process-level network behavior control rules, a control strategy for the network behavior is determined according to the process-level network behavior control rules; in response to the failure to match any of the process-level network behavior control rules, a control strategy for the network behavior is determined according to the global-level network behavior control rules.

[0030] During the process of matching network behavior with each process-level network behavior control rule in the rule list in descending order of matching priority, if a network behavior successfully matches any process-level network behavior control rule, the control strategy for the network behavior is determined according to that process-level network behavior control rule, and no further matching is performed; if no process-level network behavior control rule is successfully matched, the global-level network behavior control rule is used as a fallback control rule, and the control strategy for the network behavior is determined according to the global-level network behavior control rule.

[0031] Alternatively, global-level network behavior control rules can be added to the rule list. Global-level network behavior control rules have a lower matching priority than any process-level network behavior control rule; that is, they have the lowest matching priority. When no process-level network behavior control rule matches successfully, the network behavior control strategy is determined based on the global-level network behavior control rule. It should be noted that adding global-level network behavior control rules to the rule list is an optional implementation method. It is functionally equivalent to using global-level network behavior control rules as an external fallback rule outside the rule list, both achieving "process-level network behavior control rules prioritize matching, and global-level network behavior control rules provide fallback decision-making." Those skilled in the art can choose according to the actual situation.

[0032] This invention directly stores security policies containing process-level network behavior control rules in the extended attributes of executable files. Guaranteed by the file system metadata itself, each executable file naturally possesses an independent security policy, and adjustments to the process-level network behavior control rules of a single executable file do not affect other executable files. Since the security policy is written in the extended attributes of the executable file, the process-level network behavior control rules remain effective even when accessing the same file via symbolic links, hard links, or remounting, significantly reducing the possibility of the security policy being bypassed. Furthermore, it eliminates the need for additional memory space to store a large number of rule files, reducing maintenance complexity.

[0033] Furthermore, considering that executable files may be upgraded, overwritten, or copied in a normal manner, resulting in the loss of their extended attributes, this invention can also set up an extended attribute maintenance mechanism: when a change is detected in the monitored executable file (e.g., changes in file inode, size, or content digest), the writing or rebinding of the security policy is retried, or the original security policy is restored to the extended attributes of the new file based on backup data; during the period when the security policy is missing or has not yet been fully restored, the network behavior of the processes generated by the executable file is handled as a fallback according to global-level network behavior control rules, thereby ensuring that even if the extended attributes are temporarily lost, the system's control over the network behavior of the processes remains reliable and controllable.

[0034] This invention enables more comprehensive multi-layered defense in depth. Based on the matching priority from high to low, network behaviors are matched against various process-level network behavior control rules in the rule list. If a matching process-level network behavior control rule exists, the first matching rule determines the control policy for the network behavior. When no matching process-level network behavior control rule exists, the global-level network behavior control rule provides a fallback decision-making basis. The two work together to meet differentiated security requirements such as "globally prohibiting IPv6 while retaining IPv4 to operate according to process policies."

[0035] The process network behavior control method provided by this invention stores security policies containing process-level network behavior control rules in the extended attributes of executable files, thereby enabling independent security policy configuration for executable files. This achieves process-level network behavior control, allowing for differentiated network behavior control for processes generated by different executable files, reducing maintenance complexity. Furthermore, by coordinating decision-making between global-level and process-level network behavior control rules, the reliability and flexibility of process network behavior control are improved, and it can prevent bypassing security policies through symbolic links and other means, thus enhancing the reliability of process network behavior control.

[0036] According to a process network behavior control method provided by the present invention, the process-level network behavior control rules include control types and matching information; wherein, the matching information includes address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information; the step of matching the network behavior with each process-level network behavior control rule in the rule list includes: obtaining the address family information of the current socket; in response to the address family information being inet or inet6, matching the network behavior with the address family matching information, the socket type matching information, the protocol type matching information, and the network operation... The matching information, the IP address matching information, and the port matching information are matched in multiple dimensions; in response to the address family information being an address family other than inet and inet6, the network behavior is matched in multiple dimensions with the address family matching information, the socket type matching information, the protocol type matching information, and the network operation matching information; in response to the successful multi-dimensional matching, it is determined that the network behavior matches the process-level network behavior control rule; the step of determining the control strategy for the network behavior according to the process-level network behavior control rule includes: determining the control strategy for the network behavior according to the control type of the process-level network behavior control rule.

[0037] Process-level network behavior control rules include control types and matching information. The matching information includes address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information. The control type is either "allow network behavior" or "deny network behavior." When determining the control policy for network behavior based on process-level network behavior control rules, the control policy is determined according to the control type of the process-level network behavior control rules.

[0038] When matching network behavior with each process-level network behavior control rule in the rule list, the address family information of the current socket is obtained. If the address family information is inet or inet6, it means that there is IP address and port information. Then, the network behavior is matched with address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information in multiple dimensions.

[0039] When performing multi-dimensional matching of network behavior with address family, socket type, protocol type, network operation, IP address, and port information, the following steps can be performed sequentially: For each matching dimension, the corresponding information is retrieved based on the dimension's type and matched against it. Address family information, socket type, and protocol type can be obtained from the socket. Retrieving address family information from the socket's internal data as input for the matching dimension, rather than using address family fields from externally imported address information, prevents applications from forging address family information to bypass security checks. Independent operation rules can be defined for different address families within the same process-level network behavior control rules, enabling differentiated access control across address families.

[0040] For example, when matching network behavior with address family matching information, the address family information of the current socket is matched with the address family matching information. Matching of multiple address families is supported (such as inet, inet6, Netlink). If the address families match, the socket type of the current socket (such as stream, datagram, etc.) is further obtained, and the socket type of the current socket is matched with the socket type matching information. If the socket types match, the protocol type of the current socket is further obtained (such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol)). Protocols (such as User Datagram Protocol) are used to match the protocol type with protocol type matching information. If the protocol type matches, network operation information (such as connection, sending, receiving, etc., distinguishing between source and destination directions) is obtained based on network behavior. This network operation information is then matched with network operation matching information. If the network operation matches, IP address information is obtained based on the network behavior and matched with IP address matching information. If the IP address matches, port information is obtained based on the network behavior and matched with port matching information. If the port information matches, then all six dimensions match, confirming that the network behavior matches the process-level network behavior control rule. If any dimension does not match during the matching process, it is determined that the network behavior does not match the process-level network behavior control rule, and subsequent dimension matching is not performed.

[0041] When matching network behavior with each process-level network behavior control rule in the rule list, the address family information of the current socket is obtained. If the address family information is a protocol family other than inet and inet6, it means that there is no IP address and port information. Then, the network behavior is matched with address family matching information, socket type matching information, protocol type matching information and network operation matching information in multiple dimensions.

[0042] When performing multi-dimensional matching of network behavior with address family, socket type, protocol type, and network operation information, these matching steps can be performed sequentially. For each matching dimension, the corresponding information is obtained based on the dimension's type and then matched against the relevant matching information. This four-dimensional matching process is similar to the six-dimensional matching process described above, except that IP address and port matching is not performed; therefore, it will not be elaborated further.

[0043] The process network behavior control method provided by this invention performs six-dimensional matching of network behavior with address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information based on the address family information of the current socket, or performs four-dimensional matching of network behavior with address family matching information, socket type matching information, protocol type matching information, and network operation matching information. Furthermore, it determines the control strategy for network behavior based on the control type of the process-level network behavior control rules, thereby achieving refined management of network behavior control.

[0044] According to a process network behavior control method provided by the present invention, at least one of the address family matching information, the socket type matching information, the protocol type matching information, the network operation matching information, the IP address matching information, and the port matching information includes wildcards; and / or, the IP address matching information includes single IP address matching information or IP address range matching information, and the port matching information includes single port matching information or port range matching information.

[0045] When matching network behavior against various dimensions in process-level network behavior control rules, precise matching can be performed based on the configured matching information, or wildcard matching can be used. At least one of the following match information categories—address family, socket type, protocol type, network operation, IP address, and port—includes a wildcard. Using wildcards simplifies the writing of matching information and improves matching efficiency.

[0046] In addition, IP address matching information can include single IP address matching information or IP address range matching information, and port matching information can include single port matching information or port range matching information. Therefore, for IP address matching, it is possible to match single IP addresses or IP address ranges. For port matching, it is possible to match single ports or port ranges.

[0047] The process network behavior control method provided by this invention simplifies the writing of matching information and improves matching efficiency by including wildcards in at least one of address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information; and improves the flexibility of IP address and port matching by including single IP address matching information or IP address range matching information and single port matching information or port range matching information in the IP address matching information.

[0048] According to a process network behavior control method provided by the present invention, the process-level network behavior control rules in the security policy are sorted according to the matching priority; generating a rule list after the process-level network behavior control rules are sorted according to the matching priority includes: sequentially adding the process-level network behavior control rules to the rule list according to the sorting of each process-level network behavior control rule in the security policy and according to the order of the matching priority of each process-level network behavior control rule in the rule list.

[0049] In security policies, process-level network behavior control rules can be written according to matching priority. These rules can be written to the security policy in descending or ascending order of matching priority, and the order in which they are written reflects their matching priority. Therefore, when generating a rule list sorted by matching priority, each process-level network behavior control rule is added to the rule list according to its order within the security policy, based on the matching priority order within the rule list.

[0050] In the rule list, process-level network behavior control rules can be sorted either from lowest to highest matching priority or from highest to lowest. Regardless of the sorting method, when matching network behaviors with each process-level network behavior control rule in the rule list, matching is always performed from highest to lowest matching priority. Since the sorting order of process-level network behavior control rules is the same as the matching priority order, the efficiency of rule list generation can be greatly improved.

[0051] If global-level network behavior control rules are also included in the rule list, and if the global-level and process-level network behavior control rules are sorted from low to high matching priority, then the first rule in the rule list is the global-level network behavior control rule, and subsequent process-level network behavior control rules are sorted from low to high matching priority. When matching network behavior with each process-level network behavior control rule in the rule list, the network behavior is matched with each process-level network behavior control rule in descending order of matching priority, that is, matching starts from the end of the rule list. If a matching process-level network behavior control rule exists, the control strategy for the network behavior is determined using that matching process-level network behavior control rule, and no further matching is performed; if no matching process-level network behavior control rule exists, the control strategy for the network behavior is determined using the global-level network behavior control rule at the top of the rule list, achieving a fallback decision.

[0052] The process network behavior control method provided by this invention improves the efficiency of rule list generation by sorting process-level network behavior control rules in the security policy according to matching priority, and adding global-level network behavior control rules and process-level network behavior control rules to the rule list in sequence according to the matching priority of global-level network behavior control rules and process-level network behavior control rules.

[0053] According to the process network behavior control method provided by the present invention, for process-level network behavior control rules of different granularities that are related, the matching priority of the more granular process-level network behavior control rule is higher.

[0054] Related process-level network behavior control rules refer to process-level network behavior control rules that are related to each other, and their matching information overlaps. For related process-level network behavior control rules of different granularities, the more granular process-level network behavior control rules have higher matching priority. For process-level network behavior control rules of the same granularity, regardless of whether the process-level network behavior control rules are related, the matching priority can be set according to the needs of network control.

[0055] It should be noted that in this application, "granularity" is used to characterize the specificity of the matching conditions of process-level network behavior control rules, which can be quantified by the quantity and specificity of the matching information contained in the process-level network behavior control rules. For example, the more matching dimensions (address family, socket type, protocol type, network operation, IP address, port, etc.) set in a process-level network behavior control rule, or the narrower the value range set in the same dimension (e.g., narrowing from wildcards to exact values, from range matching to exact matching, from multiple address families to a single address family), the finer the granularity of the process-level network behavior control rule. Accordingly, for related process-level network behavior control rules of different granularities, the process-level network behavior control rule with finer granularity has a higher matching priority and can be executed first for specific and special network behavior control, avoiding being masked by the priority matching of coarse-grained process-level network behavior control rules.

[0056] For example, one process-level network behavior control rule might reject all network operations involving the inet address family, while another process-level network behavior control rule might allow network operations involving the inet address family with the TCP protocol type. The latter process-level network behavior control rule has a finer granularity compared to the former. In this case, the matching priority of the latter process-level network behavior control rule can be set higher than that of the former. Thus, for these two process-level network behavior control rules, the finer-grained latter rule will be matched first. If the network operation involves a network operation involving the inet address family with the TCP protocol type, it will be allowed, thus implementing network control in special cases. If the network operation involves a network operation involving an inet address family with other protocol types, when matching the latter process-level network behavior control rule, since the latter rule only specifies that network operations involving the inet address family with the TCP protocol type are allowed, and does not specify the handling of network operations involving other protocol types of inet address families, this process-level network behavior control rule will not match, and the matching of the next process-level network behavior control rule will continue. If the previous process-level network behavior control rule is subsequently matched again, the request will be rejected according to the settings of the previous process-level network behavior control rule.

[0057] If the matching priority of the coarse-grained process-level network behavior control rule is set higher, then the coarse-grained process-level network behavior control rule will be matched first. If the network behavior involves network operations of the inet address family with the protocol type of TCP, it will be directly rejected, and the finer-grained process-level network behavior control rules cannot play a role, making it impossible to achieve fine-grained control in special cases.

[0058] The process network behavior control method provided by this invention achieves refined control in special cases by setting a higher matching priority for finer-grained process-level network behavior control rules for related process-level network behavior control rules of different granularities.

[0059] According to a process network behavior control method provided by the present invention, after obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: in response to not obtaining the security policy, determining a control policy for the network behavior according to the global-level network behavior control rules.

[0060] After obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, if no security policy is obtained, it means that no corresponding security policy has been set for the executable file. Then, the control policy for network behavior is determined according to the global network behavior control rules.

[0061] Before determining the control strategy for network behavior based on the global network behavior control rules, a rule list can be generated based on the global network behavior control rules. At this time, the rule list only contains the global network behavior control rule, and the final control strategy for network behavior is also determined based on the global network behavior control rule.

[0062] For rejected network behaviors, the following processing methods can be used: Forced mode rejects the network behavior and logs the audit log; Permissive mode allows the network behavior but logs the audit log (for debugging purposes); Quiet mode rejects the network behavior but does not log the audit log. For permitted network behaviors, the network behavior executes normally.

[0063] The process network behavior control method provided by this invention ensures the reliable determination of the control strategy for process network behavior by determining the control strategy for network behavior based on global-level network behavior control rules when the security policy is not obtained.

[0064] According to a process network behavior control method provided by the present invention, the global-level network behavior control rule is one of address family global rejection, global default rejection, and global default allow; wherein, the address family global rejection is used to reject network behaviors of a set address family, the global default rejection is used to reject all network behaviors, and the global default allow is used to allow all network behaviors.

[0065] Global-level network behavior control rules are one of three types: address family global deny, global default deny, and global default allow. Address family global deny is used to deny network behavior for one or more specified address families. Global default deny serves as a fallback deny rule when no process-level network behavior control rules are matched or no security label is set; similarly, global default allow serves as a fallback allow rule when no process-level network behavior control rules are matched or no security label is set. Global-level network behavior control rules can be pre-configured through the system-level configuration interface or configuration files, shared by all monitored processes, and can be automatically loaded upon system startup.

[0066] Address family global rejection can be represented using an address family global rejection bitmap. When the bit corresponding to the address family of the current socket is set to 1, the network operation corresponding to that address family is rejected.

[0067] The process network behavior control method provided by this invention improves the flexibility of fallback decision-making by setting global-level network behavior control rules to one of address family global denial, global default denial, and global default allow.

[0068] According to a process network behavior control method provided by the present invention, before obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: in response to obtaining network behavior control rule configuration information about the target file, performing security verification on the target file to confirm whether the target file is an executable file; in response to the target file being an executable file, performing lexical analysis, syntax analysis, and semantic verification on the network behavior control rule configuration information in sequence; generating the security policy according to a preset format based on the network behavior control rule configuration information that has passed the semantic verification, and writing it into the extended attributes of the target file.

[0069] Before obtaining the security policy corresponding to an executable file by querying its extended attributes, the security policy corresponding to the executable file needs to be written into the extended attributes of the executable file in advance.

[0070] The configuration information for the target file and its corresponding network behavior control rules can be set through a configuration page and passed to the process network behavior control device via an interface. The process network behavior control device is the execution entity of the process network behavior control method provided by this invention. After obtaining the network behavior control rule configuration information for the target file, the process network behavior control device performs a security verification on the target file to confirm whether it is an executable file. If the target file is determined to be executable, lexical analysis, syntax analysis, and semantic verification are performed on the network behavior control rule configuration information sequentially. If the target file is determined not to be executable, no further processing is performed.

[0071] Lexical analysis breaks down network behavior control rule configuration information into syntactic units such as control type, address family, socket type, protocol, network operation set, IP address, and port conditions. Syntactic analysis processes the segmentation results according to predefined syntactic rules, correctly identifying different levels of nested structures within the network behavior control rule configuration information. Semantic verification checks the semantic constraints on the syntactic analysis results. Finally, based on the semantically verified network behavior control rule configuration information, a security policy is generated according to a preset format and serialized into binary format, written to the extended attributes of the target file. This achieves an immutable binding between the security policy and the executable file. Verification and storage are completed atomically, effectively shortening or eliminating the intermediate state time window. When a security policy needs to be deleted, the administrator initiates a deletion command to remove the corresponding security policy from the file.

[0072] It can also provide a security policy query function. When a query request for the security policy of an executable file is received, the security policy is read from the extended attributes of the executable file. Then, the security policy is converted back into a human-readable rule string field by field. The conversion process is the reverse of the security policy writing process. Finally: control type is converted into the corresponding string, address family value is converted into the corresponding name, socket type value is converted into the corresponding name, protocol value is converted into the corresponding name, network operation code is converted into the corresponding operation name, IP address data is converted into address range representation, and port range data is converted into a readable port range representation. Then, it is returned to the requester.

[0073] The process network behavior control method provided by this invention confirms whether the target file is an executable file. In response to the target file being an executable file, the method sequentially performs lexical analysis, syntax analysis, and semantic verification on the network behavior control rule configuration information. Based on the network behavior control rule configuration information that has passed semantic verification, a security policy is generated according to a preset format and written into the extended attributes of the target file, thereby achieving accurate configuration of the security policy.

[0074] According to a process network behavior control method provided by the present invention, the semantic verification includes at least one of operation direction and operation semantic consistency verification, socket type and protocol mutual exclusion verification, port range legality verification, and IP address format verification.

[0075] Semantic verification is used to verify whether process-level network behavior control rules in security policies conform to semantic specifications. Semantic verification includes at least one of the following: operation direction and semantic consistency verification, socket type and protocol mutual exclusion verification, port range validity verification, and IP address format verification. Operation direction and semantic consistency verification requires that source address conditions can only be used with source-direction operations, and destination address conditions can only be used with destination-direction operations. If these rules are violated, the verification fails. Source-direction operations are operations that access the local end, such as `bind`, `listen`, and `getsockname`; destination-direction operations are operations that access the peer end, such as `connect` and `getpeername`. The requirement that source address conditions can only be used with source-direction operations means that the operation address of the source-direction operation must be the local address; the requirement that destination address conditions can only be used with destination-direction operations means that the operation address of the destination-direction operation must be the peer address.

[0076] The process network behavior control method provided by the present invention improves the accuracy and comprehensiveness of semantic verification by setting semantic verification including at least one of operation direction and operation semantic consistency verification, socket type and protocol mutual exclusion verification, port range legality verification, and IP address format verification.

[0077] In another embodiment, the present invention also provides a process network behavior control device, the device comprising: A capture and query unit is configured to: in response to capturing the network behavior of a process, query global-level network behavior control rules for different processes, and obtain the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process; wherein, the security policy includes at least one process-level network behavior control rule for a process generated by running the executable file; a generation unit is configured to: in response to obtaining the security policy, generate a rule list after sorting the process-level network behavior control rules according to matching priority; a matching unit is configured to: match the network behavior with each process-level network behavior control rule in the rule list according to the matching priority from high to low; a control unit is configured to: in response to the network behavior successfully matching any of the process-level network behavior control rules, determine a control policy for the network behavior according to the process-level network behavior control rules; in response to the failure to successfully match any of the process-level network behavior control rules, determine a control policy for the network behavior according to the global-level network behavior control rules.

[0078] The specific implementation of each of the above units can be referred to the methods described in the various embodiments of the present invention, and will not be repeated here.

[0079] Figure 2 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 2As shown, the electronic device may include a processor 210, a communications interface 220, a memory 230, and a communication bus 240, wherein the processor 210, the communications interface 220, and the memory 230 communicate with each other via the communication bus 240. The processor 210 can call logical instructions in the memory 230 to execute the process network behavior control methods provided in the above embodiments.

[0080] Furthermore, the logical instructions in the aforementioned memory 230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0081] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the process network behavior control method provided in the above embodiments.

[0082] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the process network behavior control methods provided in the above embodiments.

[0083] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0084] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0085] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0087] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for controlling process network behavior, characterized in that, include: In response to the captured network behavior of a process, global-level network behavior control rules for different processes are queried, and the security policy corresponding to the executable file is obtained by querying the extended attributes of the executable file corresponding to the process; wherein, the security policy includes at least one process-level network behavior control rule for a process generated by running the executable file; In response to obtaining the security policy, a list of rules for the process-level network behavior control rules is generated, sorted by matching priority. According to the order of matching priority from high to low, the network behavior is matched with each process-level network behavior control rule in the rule list; If the network behavior successfully matches any of the process-level network behavior control rules, a control strategy for the network behavior is determined according to the process-level network behavior control rules; if no process-level network behavior control rule is successfully matched, a control strategy for the network behavior is determined according to the global-level network behavior control rules.

2. The process network behavior control method according to claim 1, characterized in that, The process-level network behavior control rules include control types and matching information; wherein, the matching information includes address family matching information, socket type matching information, protocol type matching information, network operation matching information, IP address matching information, and port matching information; The step of matching the network behavior with each process-level network behavior control rule in the rule list includes: Get the address family information of the current socket; In response to the address family information being inet or inet6, the network behavior is matched against the address family matching information, the socket type matching information, the protocol type matching information, the network operation matching information, the IP address matching information, and the port matching information in a multi-dimensional manner. In response to the address family information being an address family other than inet and inet6, the network behavior is matched with the address family matching information, the socket type matching information, the protocol type matching information, and the network operation matching information in a multi-dimensional manner; In response to the successful multi-dimensional matching, it is determined that the network behavior matches the process-level network behavior control rule; The step of determining the control strategy for the network behavior according to the process-level network behavior control rule includes: determining the control strategy for the network behavior according to the control type of the process-level network behavior control rule.

3. The process network behavior control method according to claim 2, characterized in that, At least one of the address family matching information, the socket type matching information, the protocol type matching information, the network operation matching information, the IP address matching information, and the port matching information includes a wildcard; And / or, the IP address matching information includes single IP address matching information or IP address range matching information, and the port matching information includes single port matching information or port range matching information.

4. The process network behavior control method according to claim 1, characterized in that, The process-level network behavior control rules in the security policy are sorted according to the matching priority. The process-level network behavior control rules are generated by sorting the rules according to matching priority, including: Based on the order of the process-level network behavior control rules in the security policy and the order of the matching priority of the process-level network behavior control rules in the rule list, the process-level network behavior control rules are added to the rule list in sequence.

5. The process network behavior control method according to claim 1, characterized in that, For process-level network behavior control rules of different granularities that are related, the more granular process-level network behavior control rules have a higher matching priority.

6. The process network behavior control method according to claim 1, characterized in that, After obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: In response to the failure to obtain the security policy, a control policy for the network behavior is determined based on the global-level network behavior control rules.

7. The process network behavior control method according to claim 1, characterized in that, The global network behavior control rule is one of address family global deny, global default deny, and global default allow; wherein, the address family global deny is used to deny network behaviors of a set address family, the global default deny is used to deny all network behaviors, and the global default allow is used to allow all network behaviors.

8. The process network behavior control method according to claim 1, characterized in that, Before obtaining the security policy corresponding to the executable file by querying the extended attributes of the executable file corresponding to the process, the method further includes: In response to obtaining network behavior control rule configuration information about the target file, a security verification is performed on the target file to confirm whether the target file is an executable file; In response to the fact that the target file is an executable file, the network behavior control rule configuration information is sequentially subjected to lexical analysis, syntax analysis and semantic verification. The security policy is generated according to a preset format based on the network behavior control rule configuration information that has passed the semantic verification, and written into the extended attributes of the target file.

9. The process network behavior control method according to claim 8, characterized in that, The semantic verification includes at least one of the following: operation direction and operation semantic consistency verification, socket type and protocol mutual exclusion verification, port range legality verification, and IP address format verification.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the process network behavior control method as described in any one of claims 1 to 9.

Images