An eBPF-based hybrid host command line detection method and system

Abstract

The application discloses a hybrid host command line detection method and system based on eBPF, and belongs to the technical field of host security. The method comprises the following steps: intercepting a command execution event generated by a target host based on a shell command through an eBPF program, and encapsulating the command execution event into a unified data structure, wherein the unified data structure comprises command text information; after adding skeletonized word units corresponding to the command text information to the skeletonized word unit history of a corresponding monitoring subject, a causal window ending with the command execution event is constructed, and an abnormal score of the command execution event is obtained based on the causal window; for any monitoring subject, if the abnormal scores of the continuous K command execution events are greater than a set threshold value, the command execution event is determined as abnormal behavior. The application can realize unified association and execution restoration of command events, reduce false alarms by reducing crosstalk of different subjects, block maliciousness in advance through signature matching, and separate alarm blocking to enhance protection integrity.

Description

Technical Field

[0001] This invention relates to the field of host security technology, and in particular to a hybrid host command line detection method and system based on eBPF. Background Technology

[0002] Command execution on Linux hosts typically involves shell built-in commands, pipe operations, redirection operations, and the execution of external programs. Existing host security solutions primarily rely on log auditing, rule matching, or behavioral analysis only in user space.

[0003] Log auditing schemes typically record information after command execution, making it difficult to fully preserve the correlation between multiple execution events corresponding to the same original shell command; rule matching schemes have high determinism for known threats, but limited ability to identify unknown abnormal behaviors; schemes that only perform behavior analysis in user space usually lack the ability to implement blocking before the executable file is loaded. With the development of eBPF technology, host behavior events can be collected in kernel space with low overhead, but existing technologies still lack: a unified representation and correlation mechanism for built-in command events, pipe operation events, redirection operation events, and execve system call events of the extended Berkeley Packet Filter (eBPF); a causal sequence modeling method suitable for online command-line detection; and an implementation scheme that forms a closed loop between kernel-level signature matching of known malicious behaviors and pre-execution blocking. Summary of the Invention

[0004] To address the challenges of existing technologies in uniformly collecting and associating Bash built-in commands, pipe operations, redirection operations, and external program executions related to the same original shell command, and in simultaneously addressing the issues of online detection of unknown abnormal behavior and pre-execution blocking of known malicious external programs within the same technical framework, this invention discloses a hybrid host command-line detection method and system based on eBPF. This method enables unified association and execution reconstruction of command events, reduces crosstalk and false alarms by subject, uses signature matching to pre-block malicious attacks, and separates alarm blocking to enhance protection integrity.

[0005] To achieve the above objectives, the technical solution of the present invention includes the following:

[0006] A hybrid host command-line detection method based on eBPF, the method comprising: The eBPF program intercepts command execution events generated by the target host based on shell commands and encapsulates these events into a unified data structure. The command execution events include one or more of the following: Bash built-in command events, pipe operation events, redirection operation events, and execve system call events. The unified data structure includes command text information. After appending the skeletonized lexicon corresponding to the command text information to the skeletonized lexicon history of the corresponding monitoring subject, a causal window ending with the command execution event is constructed, and the anomaly score of the command execution event is obtained based on the causal window. For any monitoring subject, if the abnormal score of K consecutive command execution events is greater than a set threshold, the command execution event is judged as abnormal behavior.

[0007] Furthermore, the unified data structure also includes timestamps, event types, shell command identifiers, event sequence numbers, and monitoring entity identifiers.

[0008] Furthermore, after appending the skeletonized lexical elements corresponding to the command text information to the skeletonized lexical history of the corresponding monitoring subject, a causal window ending with the command execution event is constructed, including... Semantic skeletonization of command text information is performed to obtain skeletonized lexical units; The skeletonized lexical element is added to the skeletonized lexical history of the corresponding monitoring subject; The most recent W words ending with a command execution event are extracted from the skeletonized word history of the monitoring subject as the causal window; if the number of words in the skeletonized word history of the monitoring subject is less than W, a padding field is used to fill the gap.

[0009] Furthermore, the command text information includes class options, file path, IP address, network URL, and systemd unit; The semantic skeletonization process of the command text information to obtain skeletonized lexical units includes: Map class option tags to feature identifiers; Map file paths to path identifiers; Map IP addresses to address identifiers; Map network URLs to link identifiers; Map systemd unit names to service identifiers; Map other parameters that are not class options, file paths, IP addresses, network URLs, and systemd unit names to parameter identifiers; Add an end marker at the end of each command execution event.

[0010] Furthermore, based on this causal window, the exception score of the command execution event is obtained, including: A temporal convolutional network is constructed, comprising an input embedding layer, a first causal dilation convolutional layer, a second causal dilation convolutional layer, a third causal dilation convolutional layer, and an output layer; wherein the first causal dilation convolutional layer, the second causal dilation convolutional layer, and the third causal dilation convolutional layer are causal dilation convolutional layers with different dilation coefficients. The causal window is input into a temporal convolutional network, and the anomaly score is determined based on the average negative log-likelihood of the non-padded domain lexical positions corresponding to the command execution event.

[0011] Furthermore, the process of training the temporal convolutional network includes: The masked cross-entropy loss is calculated based on the non-filled domain lexical positions of the causal window of the command execution event sample. Backpropagation is performed based on the masked cross-entropy loss to update the parameters of the temporal convolutional network.

[0012] Furthermore, if the command execution event includes an execve system call event, the method further includes: The shell command is expanded to obtain the final executable file path and the corresponding command-line arguments; wherein, the final executable file path is the executable file path used for actual loading after the shell completes variable expansion, wildcard expansion and execution target determination; the command-line arguments are the argv data of the call path passed to the execve system call event; The final executable file path and the corresponding command-line arguments are matched with signatures; the signature rules include exact target path matching, path and argument combination matching, and argument pattern matching. When the signature matches successfully, a blocking flag is generated for the execve system call event; The BPF LSM program attached to the bprm_check_security hook checks the blocking flag before the execve system call event loads and returns a rejection result when the blocking flag is set.

[0013] A hybrid host command-line detection system based on eBPF, the system comprising: The command event acquisition module is used to intercept command execution events generated by the target host based on shell commands through the eBPF program, and encapsulate the command execution events into a unified data structure; wherein, the command execution events include one or more of Bash built-in command events, pipe operation events, redirection operation events and execve system call events, and the unified data structure includes command text information; The anomaly detection module is used to append the skeletonized lexicon corresponding to the command text information to the skeletonized lexicon history of the corresponding monitoring subject, construct a causal window ending with the command execution event, and obtain the anomaly score of the command execution event based on the causal window. The alarm decision module is used to determine that a command execution event is an abnormal behavior if the abnormal score of K consecutive command execution events is greater than a set threshold for any monitored subject.

[0014] Furthermore, the system also includes: The signature detection module is used to expand shell commands to obtain the final executable file path and the corresponding command-line arguments. The final executable file path is the path to the executable file actually loaded after the shell completes variable expansion, wildcard expansion, and target determination. The command-line arguments are the argv data of the call path passed to the execve system call event. The module performs signature matching on the final executable file path and the corresponding command-line arguments. The signature rules include exact target path matching, path and parameter combination matching, and parameter pattern matching. The blocking module generates a blocking flag for the execve system call event when the signature match is successful. The BPF LSM program, which is attached to the bprm_check_security hook, checks the blocking flag before the execve system call event is loaded and returns a rejection result when the blocking flag is set.

[0015] A computer device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the eBPF-based hybrid host command line detection method described above.

[0016] Compared with the prior art, the present invention has at least the following beneficial effects: Firstly, by using the original command identifier and event sequence number, it enables unified collection and association of Bash built-in command events, pipe operation events, redirection operation events, and execve system call events corresponding to the same original shell command, which is beneficial for reconstructing the command execution process; Secondly, by maintaining the lexical history according to the monitoring subject, constructing causal windows, and implementing continuous K-event gating, it is beneficial to reduce contextual crosstalk between different subjects and reduce false alarms caused by occasional high-scoring events. Third, by performing signature matching on the final executable file path and its parameters after shell expansion, and combining this with the kernel-side blocking mechanism before the executable file is loaded, it is possible to achieve pre-execution protection against known malicious external programs. Fourth, the abnormal alarm and signature blocking correspond to the detection of unknown abnormal behavior and the interception of known malicious behavior, respectively. The two are separated in terms of triggering conditions, which helps to improve the integrity of host command line security protection. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall architecture of a hybrid host command line detection system based on eBPF provided in an embodiment of the present invention, wherein: 100-system, 110-command event acquisition module, 120-ring buffer, 130-anomaly detection module, 140-signature detection module, 150-blocking module, 160-alarm decision module.

[0018] Figure 2 This is a flowchart illustrating the command execution event acquisition, unified data structure encapsulation, anomaly detection, and alarm process provided in an embodiment of the present invention, wherein: 210-command execution event acquisition, 220-unified data structure encapsulation, 230-semantic skeletonization, 240-causal window construction, 250-TCN model inference, 260-anomaly score output, and 270-continuous K-event gating.

[0019] Figure 3 The diagram illustrates the model structure and mask loss calculation of a temporal convolutional network provided in this embodiment of the invention, wherein: 310 - input embedding layer, 320 - first causal dilated convolutional layer, 330 - second causal dilated convolutional layer, 340 - third causal dilated convolutional layer, 350 - output layer, and 360 - mask cross-entropy loss calculation.

[0020] Figure 4 This is a flowchart illustrating the process of execve event signature matching and pre-execution blocking provided in an embodiment of the present invention, wherein: 410 - anomaly detection branch, 420 - continuous K event gating branch, 430 - signature matching branch, 435 - matching log output, 440 - blocking flag setting, and 450 - BPF LSM blocking determination. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0022] like Figure 1As shown, the system 100 provided in this embodiment is deployed on a Linux host that supports eBPF, BPF LSM, and kfunc (a function interface provided by the kernel or kernel extension modules for eBPF calls). The system 100 includes a command event acquisition module 110, a ring buffer 120, an anomaly detection module 130, a signature detection module 140, a blocking module 150, and an alarm decision module 160.

[0023] The command event acquisition module 110 is responsible for acquiring command execution events and writing them into the circular buffer 120; the anomaly detection module 130 reads events from the circular buffer 120, completes semantic skeletonization, causal window construction, and anomaly scoring; the signature detection module 140 completes signature matching on the execve event path, and writes a matching log and blocking flag when the matching is successful; the blocking module 150 reads the blocking flag before the executable file is loaded and refuses to load when the blocking conditions are met; and the alarm decision module 160 performs continuous K-event gating based on the anomaly score and outputs anomaly alarms.

[0024] like Figure 2 As shown in the illustration, this embodiment describes the process of command event collection and unified encapsulation. The command event collection module 110 includes the uprobes program for Bash built-in command events, pipe operation events, and redirection operation events, and the tracepoint program for execve system call events. The shell operation events include pipe operation events and redirection operation events.

[0025] The command event acquisition module 110 encapsulates the collected command execution events into a unified data structure, writes it into a circular buffer 120, and outputs it to the user space. The unified data structure includes at least one of the following: timestamp, event type, original command identifier, event sequence number, process identifier, and user identifier, as well as command text information. In some embodiments, the unified data structure may further include at least one of the following: terminal session identifier, current working directory, final executable file path, redirection target, and execution result.

[0026] In some implementations, to achieve unified association of multiple command execution events triggered by the same original shell command, the command event acquisition module 110 generates an original command identifier when the shell receives the original command input. The original command identifier is stored in a BPF map indexed by shell process or task identifier. The original command identifier can be generated by combining the shell process identifier, terminal session identifier, and a monotonically increasing command input sequence number, or by using other identifiers that can uniquely identify the original command input. For Bash built-in command events, pipe operation events, redirection operation events, and execve system call events triggered by the same original shell command, the same original command identifier is written, and event sequence numbers are assigned under this original command identifier according to the order of acquisition. The execution path of the same original command can be reconstructed using the original command identifier and event sequence numbers.

[0027] For example, for the original shell command `echo test | grep t > / tmp / out`, the triggered pipe operation event, redirection operation event, and `execve` system call event corresponding to the execution of the external program can carry the same original command identifier, and their order of occurrence can be indicated by different event numbers.

[0028] like Figure 2 As shown, this embodiment illustrates the data preprocessing process of the anomaly detection module 130. After reading the command execution events in the circular buffer 120, the anomaly detection module 130 performs semantic skeletonization processing on the command text information. Specifically, it maps the class option tags to... <flag>File path mapping is <path>IP address mapping to <ip>The network URL is mapped to <url>The systemd unit name is mapped to <service>The remaining parameters are mapped as <arg>And add to the end of each command execution event <end>.

[0029] The processed lexical sequence can be organized according to at least one of process identifier and user identifier to serve as the lexical history of the corresponding monitoring subject. In this embodiment, for each current event, the W most recent lexicals ending with the current event are extracted from the lexical history of the monitoring subject to which it belongs as a causal window; when the number of lexicals is less than W, a causal window is used. <pad>Fill in the blanks.

[0030] In some implementations, semantic skeletonization reduces sparsity caused by differences in specific literals while preserving the semantic structure of commands.

[0031] For example, the command text `curl http: / / 10.10.1.5 / p.sh -o / tmp / p.sh` can be skeletonized into a sequence of terms: `curl`. <url> <flag> <path> <end>For the command text `systemctl restartsshd.service`, skeletonization can form a lexical sequence `systemctl`. <arg> <service> <end>.

[0032] The above examples are only used to illustrate the semantic skeletonization process and do not constitute a limitation on the scope of protection of this invention.

[0033] like Figure 3 As shown, this embodiment illustrates the model structure, training method, and anomaly scoring process based on a temporal convolutional network. The model includes an input embedding layer 310, a first causal dilated convolutional layer 320, a second causal dilated convolutional layer 330, a third causal dilated convolutional layer 340, and an output layer 350. The model receives a fixed-length causal window as input and outputs the probability distribution of the next word at each position of the window. The input embedding layer 310 maps discrete symbols in the input sequence to a 64-dimensional feature vector and projects these features through one-dimensional convolution. The kernel size of the three causal dilated convolutional layers is 7, with dilation coefficients of 1, 2, and 4 respectively. Each layer includes two causal dilated convolutions, nonlinear activation, and dropout processing, and the input and convolution results are fused through residual connections. Causal convolution uses left padding, ensuring that the output at any given time depends only on current and historical information; the increasing dilation coefficients are used to expand the receptive field, extracting long-range temporal features without significantly increasing network parameters. The output layer 350 converts the 64-dimensional features at each sequence position into predicted scores in the vocabulary space through fully connected mapping.

[0034] During training, the command execution event is used as the scoring unit, and only the non-command execution events of the current event are scored. <pad>The cross-entropy loss is calculated based on the lexical position. During online execution, the anomaly score is determined by the non-lexical position corresponding to the current event. <pad>The average negative log-likelihood of the lexical position is used to determine the lexical position.

[0035] In this embodiment, training and calibration are performed based on normal command execution events before online deployment. Specifically, normal command execution events are collected, and the command text is semantically skeletonized and divided into training, validation, and calibration sets in chronological order. The model is trained using the training and validation sets. Then, a joint search is performed on the calibration set for candidate detection thresholds and continuous gating parameters K, ensuring that the actual number of alarms corresponding to every 1000 command execution events after continuous K event gating does not exceed the preset target false alarm budget. Finally, the model weights, detection thresholds, and continuous gating parameters K are loaded as runtime configurations into the anomaly detection module 130 and the alarm decision module 160. The target false alarm budget preferably represents the maximum number of alarms allowed per 1000 command execution events.

[0036] like Figure 4 As shown, this embodiment illustrates the online anomaly detection and alarm decision-making process. Whenever a new command execution event arrives, the anomaly detection module 130 first determines at least one of the process identifier and user identifier to which the event belongs, and appends the corresponding skeletonized lexical to the lexical history of the corresponding monitoring subject; then it constructs a fixed-length causal window ending with the current event, and inputs it into the model based on the temporal convolutional network for inference to obtain the anomaly score of the current event.

[0037] The alarm decision module 160 maintains continuous K-event gating status for each monitored subject: when the anomaly score of the current event is higher than the detection threshold, the counter is incremented; when the anomaly score of the current event is not higher than the detection threshold, the counter is reset to zero; when the counter reaches K, an anomaly alarm is output. This continuous K-event gating method reduces false alarms caused by a single, occasional high-score event.

[0038] like Figure 4 As shown, this embodiment illustrates the signature detection and pre-execution blocking process for the execve event. For the execve system call event, the eBPF program located on the execve call path can call the kfunc interface exported by the kernel module to perform signature matching on the final executable file path and its parameters obtained after shell expansion.

[0039] In some implementations, the final executable file path is the path to the executable file actually loaded after the shell completes variable expansion, wildcard expansion, and execution target determination; the parameter is the argv data passed to the execve call path. The kfunc interface can be used to normalize the path, extract parameters to be matched, and invoke preset signature rules. The signature rules can include at least exact target path matching, path and parameter combination matching, parameter pattern matching, or any combination of the above methods.

[0040] When a match is successful, the signature detection module 140 records a matching log for user space to read and writes the blocking flag to the task local storage according to the task identifier. In some implementations, the task local storage may be BPF task local storage or other data structures that can save the blocking status by task dimension.

[0041] The blocking module 150 is a BPF LSM program mounted on the bprm_check_security hook. It checks the blocking flag before the executable file is loaded and returns a rejection result when the blocking flag is set, thereby preventing the executable file from being loaded and executed. After completing the blocking determination or after the corresponding execve call path returns, the blocking flag is cleared to avoid affecting subsequent unrelated execution paths.

[0042] For Bash built-in command events, pipeline operation events, and redirection operation events captured via uprobes, this embodiment only records behavioral data and participates in anomaly detection, but does not treat them as actual blocking targets. Alarms generated by anomaly detection and blocking generated by signature matching are separate in their triggering conditions; anomaly alarms are not used as blocking conditions.

[0043] Without departing from the inventive concept, the monitoring subject, in addition to at least one of process identifier and user identifier, can also be extended to container identifier, cgroup identifier, or namespace identifier depending on the application scenario. Correspondingly, the anomaly detection module 130 and the alarm decision module 160 can maintain lexical history and continuous K-event gating status according to the selected monitoring subject. In some embodiments, Bash is used as an example to illustrate the interception method of built-in command events and shell operation events; for other shells that support corresponding command interpretation mechanisms, functionally equivalent probe points can also be used to achieve the same or similar event collection process. Apart from this, the remaining implementation process is the same as the aforementioned embodiments, and will not be repeated here.

[0044] Although the present invention has been described through the above preferred embodiments, those skilled in the art will understand that various modifications in form and detail can be made therein without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be defined by the appended claims.< / pad> < / pad> < / end> < / service> < / arg> < / end> < / path> < / flag> < / url> < / pad> < / end> < / arg> < / service> < / url> < / ip> < / path> < / flag>

Claims

1. A hybrid host command-line detection method based on eBPF, characterized in that, The method includes: The eBPF program intercepts command execution events generated by the target host based on shell commands and encapsulates these events into a unified data structure. The command execution events include one or more of the following: Bash built-in command events, pipe operation events, redirection operation events, and execve system call events. The unified data structure includes command text information. After appending the skeletonized lexicon corresponding to the command text information to the skeletonized lexicon history of the corresponding monitoring subject, a causal window ending with the command execution event is constructed, and the anomaly score of the command execution event is obtained based on the causal window. For any monitoring subject, if the abnormal score of K consecutive command execution events is greater than a set threshold, the command execution event is judged as abnormal behavior.

2. The method according to claim 1, characterized in that, The unified data structure also includes timestamps, event types, shell command identifiers, event sequence numbers, and monitoring entity identifiers.

3. The method according to claim 1, characterized in that, After appending the skeletonized lexical information corresponding to the command text to the skeletonized lexical history of the corresponding monitoring subject, a causal window ending with the command execution event is constructed, including... Semantic skeletonization of command text information is performed to obtain skeletonized lexical units; The skeletonized lexical element is added to the skeletonized lexical history of the corresponding monitoring subject; The most recent W words ending with a command execution event are extracted from the skeletonized word history of the monitoring subject as the causal window; if the number of words in the skeletonized word history of the monitoring subject is less than W, a padding field is used to fill the gap.

4. The method according to claim 3, characterized in that, The command text information includes class options, file path, IP address, network URL, and systemd unit; The semantic skeletonization process of the command text information to obtain skeletonized lexical units includes: Map class option tags to feature identifiers; Map file paths to path identifiers; Map IP addresses to address identifiers; Map network URLs to link identifiers; Map systemd unit names to service identifiers; Map other parameters that are not class options, file paths, IP addresses, network URLs, and systemd unit names to parameter identifiers; Add an end marker at the end of each command execution event.

5. The method according to claim 3, characterized in that, The exception score of the command execution event is obtained based on this causal window, including: A temporal convolutional network is constructed, comprising an input embedding layer, a first causal dilation convolutional layer, a second causal dilation convolutional layer, a third causal dilation convolutional layer, and an output layer; wherein the first causal dilation convolutional layer, the second causal dilation convolutional layer, and the third causal dilation convolutional layer are causal dilation convolutional layers with different dilation coefficients. The causal window is input into a temporal convolutional network, and the anomaly score is determined based on the average negative log-likelihood of the non-padded domain lexical positions corresponding to the command execution event.

6. The method according to claim 5, characterized in that, The process of training the temporal convolutional network includes: The masked cross-entropy loss is calculated based on the non-filled domain lexical positions of the causal window of the command execution event sample. Backpropagation is performed based on the masked cross-entropy loss to update the parameters of the temporal convolutional network.

7. The method according to claim 1, characterized in that, If the command execution event includes the execve system call event, the method further includes: The shell command is expanded to obtain the final executable file path and the corresponding command-line arguments; wherein, the final executable file path is the executable file path used for actual loading after the shell completes variable expansion, wildcard expansion and execution target determination; the command-line arguments are the argv data of the call path passed to the execve system call event; The final executable file path and the corresponding command-line arguments are matched with signatures; the signature rules include exact target path matching, path and argument combination matching, and argument pattern matching. When the signature matches successfully, a blocking flag is generated for the execve system call event; The BPF LSM program attached to the bprm_check_security hook checks the blocking flag before the execve system call event is loaded, and returns a rejection result when the blocking flag is set.

8. A hybrid host command-line detection system based on eBPF, characterized in that, The system includes: The command event acquisition module is used to intercept command execution events generated by the target host based on shell commands through the eBPF program, and encapsulate the command execution events into a unified data structure; wherein, the command execution events include one or more of Bash built-in command events, pipe operation events, redirection operation events and execve system call events, and the unified data structure includes command text information; The anomaly detection module is used to append the skeletonized lexicon corresponding to the command text information to the skeletonized lexicon history of the corresponding monitoring subject, construct a causal window ending with the command execution event, and obtain the anomaly score of the command execution event based on the causal window. The alarm decision module is used to determine that a command execution event is an abnormal behavior if the abnormal score of K consecutive command execution events is greater than a set threshold for any monitored subject.

9. The system according to claim 1, characterized in that, The system also includes: The signature detection module is used to expand shell commands to obtain the final executable file path and the corresponding command-line arguments. The final executable file path is the path to the executable file actually loaded after the shell completes variable expansion, wildcard expansion, and target determination. The command-line arguments are the argv data of the call path passed to the execve system call event. The module performs signature matching on the final executable file path and the corresponding command-line arguments. The signature rules include exact target path matching, path and parameter combination matching, and parameter pattern matching. The blocking module generates a blocking flag for the execve system call event when the signature match is successful. The BPF LSM program, which is attached to the bprm_check_security hook, checks the blocking flag before the execve system call event is loaded and returns a rejection result when the blocking flag is set.

10. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the eBPF-based hybrid host command line detection method as described in any one of claims 1-7.

Images