CN100367230C

CN100367230C - Action control method based on LSM programme

Info

Publication number: CN100367230C
Application number: CNB2004100139631A
Authority: CN
Inventors: 张衡; 吴礼发
Original assignee: PLA University of Science and Technology
Current assignee: PLA University of Science and Technology
Priority date: 2004-01-19
Filing date: 2004-01-19
Publication date: 2008-02-06
Anticipated expiration: 2024-01-19
Also published as: CN1648869A

Abstract

The present invention relates to a program action controlling method by utilizing an LSM interception point. The method of the present invention comprises the following steps: intercepting LSM control point information through which a monitored program passes to generate an LSM interception point sequence whose length is 10; comparing the generated sequence with an available sequence in a normal action mode library and adding the sequence into the normal action mode library when a matched sequence can not exist in the library; monitoring a designated program; intercepting the LSM control point information through which the monitored program passes; comparing the generated sequence with the available sequence in the normal action mode library and sending an alarm to a system if no matched sequence. The present invention provides a program action control method which uses LSM interception points as program action modeling data source, and can increase the capacity for identifying abnormal programs of safe server equipment.

Description

Program behavior control method based on LSM

One, technical field

The present invention relates to security server equipment, particularly the method for in the security server program behavior being controlled as the Internet server.

Two, background technology

Along with going deep into gradually of social informatization, networking process, the safety of infosystem becomes more and more important.Increasing Internet server (as Web server, ftp server, Email server, dns server) brings into operation on security server equipment.In traditional security server, security control mainly realizes by access control.But this controling mechanism still exists a lot of problems, therefore, the program behavior control technology occurred.The ultimate principle of program behavior control is to judge according to the behavior of program or the normal degree of resource behaviour in service whether system is used by user's malice.It generally by to the program behavior modeling, is monitored its behavior and whether meets behavior model.Compare with traditional access control technology, program behavior is controlled the program that can guarantee effectively and can be moved according to the mode of desired design.The key issue of program behavior control is the foundation of normal behaviour model, and its essence is summed up as the processing to selected monitored procedural audit data.Therefore, the quality of Audit data source quality directly influences the effect of behavior control.At present, the Audit data source is generally system call in the existing program behavior control method.

LSM (Linux Security Modules; the Linux security module) framework is analyzed the resource that system needs protection; determine which is the object that will protect, and further determine corresponding which data structure of these objects, and which function is operated it by analyzing source program.In final (is granularity with the function) function that object is conducted interviews, insert hook (hook) and intercept and capture visit, call security mechanism, and pass through the data structure that other hooks revises the object correspondence, to satisfy the needs of security mechanism.Utilize capture point that the LSM capture point has following benefit: LSM as the data source of program behavior modeling in system call or kernel function, its size ratio system call is also thin, and all is positioned on the accessing points to various resources, and is close with security relationship; The action sequence that system call record the process and kernel are mutual, the sequence of LSM record the process access resources is safer relevant.

But the existing system call sequence that utilizes exists deficiency to be as the program behavior control method of program behavior modeling: the normal behaviour library is too huge, and detection efficiency is lower, rate of false alarm is high.

Three, summary of the invention

It is too huge as the normal behaviour library that the program behavior control technology of program behavior modeling exists that the present invention is primarily aimed in the security server equipment the existing system call sequence that utilizes, the problem that detection efficiency is low, rate of false alarm is high, provide a kind of LSM of utilization capture point as the program behavior control method of the data source of program behavior modeling with the auxiliary ability that improves the unusual program behavior of security server recognition of devices.

For realizing purpose of the present invention, the invention provides a kind of based on utilizing LSM to carry to obtain the method for a little carrying out program behavior control, this method may further comprise the steps: (1) if the normal procedure behavior pattern storehouse that utilizes the LSM capture point to describe is not also set up fully, then execution in step 2, otherwise change step 4; (2) intercept and capture monitored program the LSM control point information of process, generate the LSM capture point sequence that a length equals 10; (3) sequence of generation and the existing sequence in the normal behaviour library are compared,, then this sequence is joined in the normal behaviour library, change step (1) if there is not the sequence of coupling to exist; (4) begin to monitor the program of appointment; (5) intercept and capture monitored program the LSM control point information of process, generate the LSM capture point sequence that a length equals 10; (6) sequence that generates is compared with the existing sequence in the normal behaviour library,, then send alarm (abnormal behaviour is arranged) to system if there not be the sequence existence of coupling, if EOP (end of program) then the step of changeing (7), otherwise commentaries on classics step (5); (7) monitoring finishes.

The invention provides a kind of LSM of utilization capture point as the program behavior control method of the data source of program behavior modeling with the auxiliary ability that improves the unusual program behavior of security server recognition of devices.Library is little, and detection efficiency is higher, rate of false alarm is low.

Below in conjunction with accompanying drawing specific embodiment is elaborated.

Four, description of drawings

Fig. 1 is the process flow diagram of security server monitoring of tools program behavior

Fig. 2 is the process flow diagram of the inventive method

Fig. 3 is the process flow diagram that obtains the LSM capture point

Five, embodiment

As shown in Figure 1.The user is starting the program object that needs monitoring as manually being provided with according to demand after the security server monitoring of tools program of Internet server.Behind the intercepted data that has obtained monitored program, security server is given recognition mechanism with it and is handled, and normally the data of intercepting and capturing and the normal behaviour library of monitored program is compared, and carries out necessary abnormality processing, normally then continues.The normal behaviour library of the monitored program of prior art is very big.

The inventive method as shown in Figure 2.Step 10 is initial actuatings.Step 11 is finished security server equipment and is obtained LSM capture point data and generate the LSM capture point sequence that a length equals 10.This data sequence obtains with the custom-designed processing mode of the present invention, is different from the short sequence of traditional system call.Step 11 will be specifically introduced in conjunction with Fig. 3 in the part of back.

Security server equipment can independently be provided with certain specific program behavior according to user's demand, video and in a computer system, may move a plurality of program implementation simultaneously, therefore the step 12 of Fig. 2 will judge whether this process needs monitoring according to the process number of program behavior, monitoring if desired, step 13 will find the corresponding normal behaviour library of this program.Step 14 judges whether recognition mechanism trains, if execution in step 17 then, otherwise execution in step 15.Step 15 is finished the function of on-line study, under the situation that recognition mechanism does not train, this step is compared data sequence and the normal behaviour library intercepted and captured, illustrate that then this sequence is a new normal sequence if in the storehouse, can not find matching sequence, step 16 is kept at it in normal behaviour library of program, otherwise abandons.

Step 17 is finished real monitoring function.Concrete matching mechanisms is with step 15.If obtain a unmatched data sequence, security server equipment will carry out necessary abnormality processing automatically, otherwise return step 11 after upgrading related data.

Fig. 3 describes step 11 in detail, and its effect is to obtain the LSM capture point data that are different from system call.Step 100 is origination action.In order to obtain LSM capture point data, step 102 has been revised the entry address of Hook Function acquiescence in the system, carries out self-defining Hook Function by step 103, obtains LSM capture point data.Whether step 104 judgment data sequence length equals 10, does not then return step 101 if do not wait, otherwise execution in step 105 finishes this process.

For example, can protect the Email server program with the inventive method.After the normal behaviour library of having set up the Email server program of using LSM capture point sequence description, start real-time monitoring to the Email server program.If the assailant successfully carries out buffer overflow attack to the Email server program, and obtained the control of system, then when the assailant begins to carry out some illegal operations, watchdog routine can monitor the LSM capture point sequence that does not have appearance in the normal behaviour library, thereby discovery and prevention assailant carry out any operation.

Because the capture point of LSM is in system call or kernel function, and all be positioned on the accessing points to various resources, therefore have the granularity thinner with the close LSM capture point of security relationship than system call, replace with it that original system call sequence that utilizes can reduce normal behaviour library scale as the program behavior control technology of program behavior modeling in the security server equipment, improve detection efficiency, reduce rate of false alarm.So LSM capture point data sequence is the core of the inventive method among Fig. 3.

Claims

1. program behavior control method based on LSM, it is characterized in that utilizing in the security server monitoring of tools programming system Linux security module LSM capture point to carry out program behavior control, this method may further comprise the steps, step 1: if the normal procedure behavior pattern storehouse that utilizes the LSM capture point to describe is not also set up fully, then execution in step 2, otherwise change step 4; Step 2: intercept and capture monitored program the LSM control point information of process, generate the LSM capture point sequence that a length equals 10; Step 3: the sequence of generation and the existing sequence in the normal behaviour library are compared,, then this sequence is joined in the normal behaviour library, change step 1 if there is not the sequence of coupling to exist; Step 4: the program that begins to monitor appointment; Step 5: intercept and capture monitored program the LSM control point information of process, generate the LSM capture point sequence that a length equals 10; Step 6: the sequence that generates is compared with the existing sequence in the normal behaviour library,, then send alarm to system if there not be the sequence existence of coupling, if EOP (end of program) then change step 7, otherwise commentaries on classics step 5; Step 7: monitoring finishes.

2. by the described program behavior control method of claim 1, it is characterized in that obtaining LSM capture point data and generate a length that to equal the step of 10 LSM capture point sequence as follows, step 100: origination action based on LSM; Step 101: call the LSM Hook Function; Step 102: the entry address of having revised Hook Function acquiescence in the described system; Step 103: carry out self-defining Hook Function, obtain LSM capture point data; Step 104: whether the judgment data sequence length equals 10, does not then return step 101 if do not wait, otherwise execution in step 105; Step 105: finish this process.