CN101872400A - Establishing a computer information security protection method for judging the security of computer operation requests based on the association relationship of computing system operation requests - Google Patents

Abstract

The invention relates to a computer information security protection method for establishing a computer information security protection method for judging the security of a computer operation request based on a computing system operation request association relationship. It includes the following steps: intercepting the operation requests generated by the computer operating system kernel or the hardware abstraction layer in the computing running state; creating a virtual node under a certain node known in the existing association structure according to the attributes of the intercepted operation requests, Establish an association relationship to form a virtual association structure; trace back to the root node of the virtual node in the virtual association structure to obtain the association rules of the current operation request in the virtual association structure; match the defined dangerous operation rules according to the association rules obtained by backtracking , determine whether there is a hazard; determine whether the current operation is allowed to be executed according to the matching result with the dangerous operation rule, and update the association structure. The invention overcomes the need of other systems to specifically analyze the characteristics of malicious codes and the characteristics of different operating systems and different application systems, and has the ability to prevent unknown malicious codes in advance.

Description

Establishing a computer information security protection method for judging the security of computer operation requests based on the association relationship of computing system operation requests

Technical field:

The invention relates to a computer system security protection method, and more specifically relates to a computer information security protection method for judging the security of computer operation requests based on the association relationship of computing system operation requests.

Background technique:

Due to the popularization of computer application technology and network communication technology, the information platform composed of computer application and network communication has become one of the basic conditions for people's daily life such as work, study and shopping. People are fully enjoying the systematic convenience brought by the information platform. At the same time, probably no one is immune to malicious code.

At present, the common systems for protecting information security platforms that people use daily mainly include "blacklist" categories such as antivirus software and firewall software, "whitelist" categories such as firewall software and active defense software, and very Common examples include "trusted" operating systems, "secure" operating systems, and "shielded" security systems.

Among the above-mentioned security systems, the "blacklist" type system is relatively widely used, while the "white list" type system, "trusted system" and "operating system hardening" type systems are relatively limited due to their high application technical requirements. Small.

The "blacklist" system specifically implements security protection through "checking and killing". The implementation method includes four steps: checking system problems, locating the side of the malicious code, analyzing the signature of the malicious code, and clearing the malicious code. The "killing" system must have the following technical guarantees: ①The problems existing in the computing system must be discovered in time; ②The cause of the problem must be accurately located; ③The characteristics of the malicious code must be accurately analyzed; ④The malicious code must be completely removed. But in fact it is very difficult to find all the existing problems of the computer, let alone guarantee the accuracy and completeness of other steps. Therefore, the "killing" system is an after-the-fact remedial measure, which does not guarantee the security of the operating system, nor does it have the ability to prevent unknown malicious codes.

The "white list" type system is to determine which programs are allowed to run and which programs are not allowed to run. The outstanding problem of the "white list" system is that it cannot guarantee the correctness of the allowed executable program to be loaded and called during code execution. It is also impossible to guarantee the correctness of the associated loading and calling between programs. Therefore, the "white list" system is difficult to promote in practical applications.

"Trusted systems" and "shelter" systems generally have strong anti-malicious code capabilities, and theoretically have the ability to resist unknown malicious codes, but the requirements of "trusted systems" and "shelter" systems for users Extremely high, users must not only be familiar with the operating system, but also be very familiar with the application system, and be able to define the corresponding security for the operating system and application system, and require the user to have the ability to track and analyze system execution. Due to the extremely high technical requirements for the users, such systems are only used in high-end applications.

Invention content:

The purpose of the present invention is to provide a computer information security protection method for judging the security of computer operation requests based on the association relationship between computer system operation requests in view of the deficiencies of existing information security theories and information security technologies.

The object of the present invention is achieved by the following measures: a computer information security protection method that establishes a computer information security protection method for judging the security of a computer operation request according to a computing system operation request association relationship, is characterized in that, comprising the following steps:

Step 1, intercepting the operation requests generated by the computer operating system kernel or the hardware abstraction layer in the computing running state;

Step 2, according to the attribute of the intercepted operation request, create a virtual node under a certain node known in the existing association structure, establish an association relationship, and form a virtual association structure;

Step 3, trace back the root node of the virtual node in the virtual association structure, and obtain the association rules of the current operation request in the virtual association structure;

Step 4, according to the association rules obtained backtracking, match with the defined dangerous operation rules to determine whether there is a hazard;

Step 5: Determine whether the current operation is allowed to be executed according to the matching result with the dangerous operation rule, and update the association structure.

The first intercepting step is to use the filtering functions of file filtering, device filtering and network packet filtering inside the operating system to intercept.

The step one intercepting operation requests refers to intercepting file operation requests, configuration operation requests, memory operation requests, disk operation requests, and network operation requests inside the computer.

The attributes of the operation request in step 2 are the operator request initiator, the requested operation object, and the requested operation type.

The existing association structure of step 2 is defined as the root node for the operation requests initiated by the operating system kernel, components, and services, and the application system operation requests initiated by the direct user, and the operation requests initiated by the above-mentioned root nodes are sub-nodes, The request initiated by the child node is a system operation request tracing structure of the grandchild node.

A certain node in the step 2 refers to a node in the association structure that matches the initiator of the operation request in the attribute of any intercepted operation request.

The association relationship in step 2 means that when any request is intercepted, first assume that the request is established, and according to the intercepted operation request attribute, virtualize a child node under the initiator node of the current operation request, when an existing node When calling, a virtual sub-association is established, so that all operation request initiators are associated with the requested operation object, and a virtual association node is obtained.

The virtual association structure in the second step is to create a virtual child node under the request initiator node according to the request initiator information in the intercepted current operation request attribute, and the virtual association node and the existing association structure together form a virtual association structure .

The root node in the step 3 is through the established virtual association structure, starting from the virtual node, backtracking the association relationship between the current node and the upper-level node, and finally backtracking to the initial initiator node of the virtual node.

The association rules in Step 3 are the request initiator, request operation object, request operation type, root node type, and virtual association type information of the current operation request.

The defined risky operation rules in step 4 include: file risky operation request rules, memory risky operation request rules, disk risky operation request rules, configuration risky operation request rules, and network risky operation request rules.

The step four matching matches the associated operation rules obtained by backtracking the virtual node of the current operation request with the defined dangerous operation rules, and judges whether the operation rules of the current operation request fall into the scope of the dangerous operation rules.

The step 5 updating the association structure is: when the matching is successful, the current operation request is not allowed to run, and the virtual current node in the computer operation request association structure is deleted, and the original association structure is maintained; when the matching is unsuccessful, the operation is allowed, And the current operation request virtual node in the computer operation request association structure is changed to a valid node, and the new association structure is updated.

Compared with the prior art, due to the adoption of a computer information security protection method proposed by the present invention to determine the security of computer operation requests based on the association between computing system operation requests, the current analysis of malicious code characteristics or analysis of operating systems and applications has been changed. The idea of system characteristics. In the present invention, any operation based on the system is firstly a request within the system, and there is an association between the requests. The present invention analyzes the characteristics of the system operation request on the basis of establishing the association, and establishes the relationship between the requests. The illegal operation request rule determines the security of the request by analyzing the association relationship of the operation request. The present invention overcomes other systems that need targeted analysis of the characteristics of malicious codes and different operating systems and different application systems, and does not require the user to have a relevant technical level, and the present invention has prior defense capabilities and has the ability to defend against unknown malicious codes Capability, that is to say, the operation requests of known and unknown malicious codes are all analyzed and blocked in the present invention, which can better make up for the deficiencies of other security theory systems and security products.

Detailed ways:

Definition of Terms:

Operation request: refers to a request for loading, executing, and changing operations on a certain device, such as hardware and software codes, during the computer application process;

Application request: refers to the request initiated based on the need of the operating system to establish an operating environment or the need of the application code to run;

Operation request association structure: When the calculation is running, the computer system constructs its operation state from the operations generated by each operation request. The operation request association structure refers to the establishment of a logical structure that uses the operation request as the response of the node to calculate the operation state at the current moment;

Dangerous operation request rule: refers to the operation request association structure, and an operation request that violates the association relationship between certain operation requests is defined as a dangerous operation request rule;

The method of the present invention is described in detail below: it comprises the following steps:

Step 1: In the running state of the computer, intercept the operation request generated by the kernel of the computer operating system or the hardware abstraction layer. The interception is carried out by using the filtering functions of file filtering, device filtering, and network packet filtering inside the operating system. Usually, during the computer startup process, the computer performs power-on self-test, loads the microkernel, loads the kernel, loads operating system components, and loads applications to complete the loading of the operating system; after the application environment is loaded, the user will perform corresponding operations as required. During the loading of the computer operating system and the user's application operation, hardware operations, configuration operations, file operations, memory operations, and network communication detection operations were performed respectively. Before each of the above operations is executed, a series of operation requests will be generated in the operating system kernel and the hardware abstraction layer. These operation requests request to operate the corresponding devices, and the corresponding devices allocate resources to perform corresponding steps according to each operation request. . In computer operating systems such as Windows, Linux, and Unix, corresponding filtering functions such as file filtering, device filtering, and network packet filtering are provided, which can realize file operation requests, configuration operation requests, and memory Operation requests, disk operation requests, and network operation requests are intercepted. The intercepting operation request refers to intercepting file operation requests, configuration operation requests, memory operation requests, disk operation requests, and network operation requests inside the computer. File operation requests mainly refer to the operation requests for reading, writing, loading, modifying attributes, and executing files and file contents; configuration operation requests refer to the operation requests for reading and rewriting system configuration variables or operating parameters; Operation requests mainly refer to read, write, and execute operation requests for memory; disk operation requests mainly refer to non-file storage and retrieval operation requests for storage devices; network operation requests mainly refer to local files initiated through the network. , device, memory and other operation requests.

Step 2: According to the attribute of the intercepted operation request, a virtual node is created under a certain node known in the existing association structure, and an association relationship is established to form a virtual association structure. The attributes of the operation request are operator request initiator, requested operation object and requested operation type. The existing association structure is defined as the root node for only the operation requests initiated by the operating system kernel, components, and services, and the application system operation requests initiated by direct users, and the operation requests initiated by the above-mentioned root nodes are sub-nodes, sub-nodes The initiated request is a system operation request traceability structure of the grandchild node. A certain node in the step 2 refers to a node in the association structure that matches the initiator of the operation request in the attribute of any intercepted operation request. The creation of a virtual node in the second step means that when any request is intercepted, first assume that the request is established, and according to the intercepted operation request attribute, virtualize a child node under the initiator node of the current operation request. When the node is invoked, a virtual sub-association is established, so that all operation request initiators are associated with the requested operation object to obtain a virtual associated node. The association relationship in step 2 means that in the operation request association structure, based on the current node, starting from the current node, backtracking the association between the current node and the upper-level node, until the current node obtained by backtracking to the root node of the current node The associated attributes of a node and its superior nodes. The virtual association structure in the second step is to create a virtual child node under the request initiator node according to the request initiator information in the intercepted current operation request attribute, and the virtual association node and the existing association structure together form a virtual association structure . Because the node is not yet a valid node, that is, the node cannot reflect the current operating state of the computer, so this structure with virtual nodes is called a virtual association structure. By establishing a virtual association structure, it is to establish the internal connection between the current operation request and the known operation request.

Step 3: Backtrack to the root node of the virtual node in the virtual association structure to obtain the association rules of the current operation request in the virtual association structure. The root node in the step 3 is through the established virtual association structure, starting from the virtual node, tracing back the association relationship between the current node and the upper-level node, and finally tracing back to the initial initiator of the virtual node. The association rules in Step 3 are the request initiator, request operation object, request operation type, root node type, and virtual association type information of the current operation request. In the virtual association structure, the purpose of tracing back the association relationship between virtual nodes and related nodes is to accurately locate how the current operation request is triggered and generated, and what association characteristics exist in each step of generating the current operation until it is traced back to the current The root node of the operation, that is, the current operation request is caused by the application request of the operating system application layer. So far, the association characteristics of the current node and each node constitute the association rule of the current operation request. It can be seen from the above that the acquisition of the association rules of the operation request is obtained in the association structure reflecting the dynamic operating state of the computer, so it is a dynamic process, which overcomes the shortcomings of the static code analysis and system function analysis that other security systems rely on.

Step 4: According to the association rules obtained backtracking, match the defined dangerous operation rules to determine whether there is a hazard. The defined risky operation rules in step 4 include: file risky operation request rules, memory risky operation request rules, disk risky operation request rules, configuration risky operation request rules, and network risky operation request rules. The file dangerous operation request rule refers to the operation request process of reading, writing, loading, modifying attributes, and executing files and file contents in the computer system. The writing and attribute modification of the executable program initiated by the application program; the interpreter program performs the read and write operations of the non-interpretable program through the interpreted script program. The memory risk operation request rules mainly refer to the definition of security threat operation rules included in the process of initiating memory read, write, and execution operation requests; operate. Configuration risky operation request rules refer to the operation rules that pose security threats during the process of reading and rewriting system configuration variables or operating parameters, such as modifying configuration files by applications and modifying configuration parameters by applications. Network dangerous operation request rules refer to operation rules that have security threats in operation requests to local files, devices, and memory initiated through the network, such as requesting memory address operations, requesting to load new threads, and other dangerous operations. Disk operation request rules mainly refer to the threatening operation rules in non-file mode storage and retrieval operation requests initiated from the network to storage devices, such as requesting non-file system operation mode to operate disks, requesting specified storage block operations and other dangerous operations . Current computer system security threats can be divided into external intrusion and internal control in terms of attack direction. The completion of these attacks mainly relies on system vulnerabilities to illegally call system functions and implant malicious codes. In fact, it is impossible to analyze system vulnerabilities and find all uncoded ones. The purpose of defining these rules in this step is to avoid malicious code analysis and system function definition. All hazards are realized by using the existing computer system environment, changing some associations of operation requests, and adding requests required by attackers. The addition of these requests is realized by using the kernel of the operating system and the hardware device layer. Traditional and code analysis, behavior analysis can hardly prevent a large number of hazards from happening. Because the initial security threat is due to the change of the association rule of the operation request, the present invention makes it difficult to form a security threat by defining the rules for the association of the operation request, and also has the ability to prevent harm and prevent unknown malicious codes. The matching matches the associated operation rules obtained by backtracking the virtual node of the current operation request with the defined dangerous operation rules, and judges whether the operation rules of the current operation request fall into the scope of the dangerous operation rules. After obtaining the operation association rules of the current operation request, match with the defined corresponding rules such as file, memory, configuration, storage device, and network dangerous operation request to determine whether the current operation request is dangerous.

Step 5: Determine whether the current operation is allowed to be executed according to the matching result with the dangerous operation rule, and update the association structure. The step five changes the association structure to match the operation request rule successfully: prevent the execution of the current operation request, delete the virtual current node in the computer operation request association structure, and keep the original association structure; when the operation request rule is not matched successfully: then The current operation is allowed to execute, and the virtual node of the current operation request in the computer operation request virtual association structure is changed to a more effective node to form a new association structure. According to the matching result, this step releases and blocks the current operation request, completes the effective interception of the operation request, and updates the association structure of the computer operation request at the same time, so that the association structure of the computer operation request can always accurately reflect the current operation status of the computer , providing structure for subsequent virtual nodes.

Examples are given below to further illustrate:

Example 1: Assuming that an Office document contains malicious script code, which can infect executable programs, the blocking logic is as follows:

When the kernel of the operating system intercepts a write operation request for the content of the executable file, according to the request initiator attribute item in the operation request attribute, it can be known that the request is issued by the VBA script engine, in order to find the association relationship of the current operation request , Create a virtual node of the current operation under the VBA script engine node of the known association structure of the computer operation request, and trace back the association relationship of the current operation. The final result of the traceback is that the request to open an Office document triggers the current operation request , take the current operation rules, Office is a common application, the request is triggered by the user, Office requests the VBA script engine to be called normally, the current operation pair is a PE file, the operation type is a write operation, and the match is: ordinary non-installation application Write operation rules for executable file contents; result is dangerous action: block this operation request, delete virtual node in computer operation request structure.

Example 2.: Assuming that the system allows the hacker program to run, the hacker directly calls the operation of a certain system through the hard address

When a hard address operation request for the memory operation request space is intercepted, a virtual node is constructed according to the attribute of the operation request, and the request is determined to be initiated by the operating system kernel, and its association relationship is traced back, and it is found that the memory hard address operation of the kernel is called by the application; The request association rules of the current memory operation request are matched with the defined memory risk operation request association rules, and the match is successful: 1. Operations that do not call for memory requests are dangerous operations; 2. It is dangerous to remotely perform hard address operations on memory; the result: Dangerous operation request. Block memory operations, delete virtual nodes in the computer operation request structure.

Claims (13)

1. a foundation is judged according to computing system operation requests incidence relation and be it is characterized in that the computer information safe means of defence of computer operation request security being may further comprise the steps:

Step 1 is being calculated under the running status, and the operation requests of operating system nucleus or hardware abstraction layer generation is tackled;

Step 2 according to the attribute of the operation requests of intercepting, is created dummy node under known certain node of existing relational structure, set up incidence relation, forms a virtual associated structure;

Step 3 is recalled the root node of dummy node in the virtual associated structure, obtain the correlation rule of current operation request in the virtual associated structure;

Step 4 according to recalling the correlation rule of obtaining, with defined risky operation rule match, determines whether to exist harm;

Step 5, foundation determines with risky operation rule match result whether current operation allows to carry out, and upgrades relational structure.

2. foundation according to claim 1 is characterized in that according to the computer information safe means of defence of computing system operation requests incidence relation judgement computer operation request security described step 1 interception is for file filter, the equipment that utilizes operating system inside filters, the filtering function of network packet filtration is tackled.

3. foundation according to claim 1 is characterized in that according to the computer information safe means of defence of computing system operation requests incidence relation judgement computer operation request security described step 1 interception operation requests is meant file operation requests, configuration operation request, internal memory operation request, disk operating request, the network operation request of interception computer-internal.

4. foundation according to claim 1 is characterized in that according to the computer information safe means of defence of computing system operation requests incidence relation judgement computer operation request security the attribute of the operation requests of described step 2 is asked the promoter, is requested operand and solicit operation type for the operator.

5. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, it is characterized in that the existing relational structure of described step 2 only is defined as the operation requests of being initiated by operating system nucleus, assembly, service and the application system operation requests of being initiated by the end user is root node, the operation requests of being initiated by above-mentioned root node is that request that child node, child node are initiated is that structure is reviewed in a kind of system operation request of grandson's node.

6. foundation according to claim 1 is judged the computer information safe means of defence of computer operation request security according to computing system operation requests incidence relation, certain node that it is characterized in that described step 2 be meant in relational structure with its attribute of any one operation requests of being intercepted in the node that is complementary of operation requests promoter.

7. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, the incidence relation that it is characterized in that described step 2 is when referring to intercept any one request, at first the hypothesis request is set up, according to the operation requests attribute of intercepting, a virtual child node under the initiator node of current operation request, when the node that has been existed calls, then set up a virtual subnet association, it is related that all operations request promoter and requested operand are carried out, and obtains the virtual associated node.

8. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, it is characterized in that described step 2 virtual associated structure is the request initiator information in the basis current operation request attribute of intercepting, create virtual child node under the request initiator node, this virtual associated node and existing relational structure constitute the virtual associated structure jointly.

9. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, the root node that it is characterized in that described step 3 is the virtual associated structure by having set up, from dummy node, recall the incidence relation of present node and even higher level of node, finally date back the original initiator node of dummy node.

10. foundation according to claim 1 is characterized in that request promoter, solicit operation object, solicit operation type, root node type, virtual associated type information that described step 3 correlation rule is a current operation request according to the computer information safe means of defence of computing system operation requests incidence relation judgement computer operation request security.

11. foundation according to claim 1 is characterized in that according to the computer information safe means of defence of computing system operation requests incidence relation judgement computer operation request security the defined risky operation rule of described step 4 contains: file risky operation request rule, internal memory risky operation request rule, disk risky operation request rule, configuration risky operation request rule, network risky operation request rule.

12. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, it is characterized in that described step 4 coupling recalls the operation associated rule and the defined risky operation rule that obtain with the current operation request dummy node and mate, judge whether the working rule of current operation request falls into the regular scope of risky operation.

13. the computer information safe means of defence of computer operation request security is judged in foundation according to claim 1 according to computing system operation requests incidence relation, it is characterized in that described step 5 renewal relational structure is: when the match is successful, current request does not allow operation, and, keep original relational structure with present node deletion virtual in the computer operation request relational structure; Unsuccessful when coupling, then allow operation, and current operation request dummy node in the computer operation request relational structure is changed into effective node, be updated to new relational structure.