CN102902909A - System and method for preventing file from being tampered - Google Patents
System and method for preventing file from being tampered Download PDFInfo
- Publication number
- CN102902909A CN102902909A CN2012103823660A CN201210382366A CN102902909A CN 102902909 A CN102902909 A CN 102902909A CN 2012103823660 A CN2012103823660 A CN 2012103823660A CN 201210382366 A CN201210382366 A CN 201210382366A CN 102902909 A CN102902909 A CN 102902909A
- Authority
- CN
- China
- Prior art keywords
- system call
- file
- application
- monitoring
- monitoring means
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a system for preventing file from being tampered. The system is arranged in computing equipment equipped with an operation system, which includes a kernel space for providing kernel operation and a user space for providing various kinds of application. The system for preventing the file from being tampered comprises a monitor unit arranged in the kernel space, a monitor client and a plurality of applications located in the user space, and a system calling system between the user space and the kernel space, wherein the monitor client is suitable for communicating with the monitor unit; the plurality of applications in the user space are connected with the monitor unit through the system calling interface respectively, and respectively initiate a system calling request to the kernel operation of the kernel space through the system calling interface; and the monitor unit is used for monitoring the system calling request. In addition, the invention also discloses a method for preventing file from being tampered. The system and the method provided by the invention can prevent file and directory from being tampered by a hacker even if the hacker gets the highest priority.
Description
Technical field
The present invention relates to field of information security technology, be specifically related to a kind of monitoring means and method and prevent the system and method that file is tampered.
Background technology
Along with the development of computer and network technologies, Network Based providing more and more is provided, the security of network application becomes more and more important.Increasing hacker has taken a fancy to the marketable value of network application and has tried hard to invade network application server and obtain various information, thereby therefrom makes a profit.
File security in the network application server also becomes more and more important, and a lot of hackers can distort the file in the server, writes hereof invalid information, implants wooden horse etc., thereby so that utilize the user of server application to incur loss.How the file security in the protecting network application server is the important challenge of information security field.
Existing access control to the file system in the network application server mainly is to realize by file permission is set, and the user who for example only has certain authority just can revised file.But, if the hacker has obtained the highest (root) authority then will lose efficacy by the method restriction file access.
In addition, also has a kind of mode that prevents that file is tampered, it is by regularly monitoring objective file or catalogue, if finding file destination or catalogue is revised or deletes by the hacker, the content of just utilizing the good file of in advance backup and catalogue to recover to revise, even file and catalogue have been modified like this, also can in time recover.But there is following shortcoming in this mode: always need to backup for the content that will protect, when tampering occurs, always need to do to revert to the content synchronization of purpose, and if monitor untimelyly, can there be the situation that content temporarily is not resumed that is tampered.At this moment, if the user has accessed file or the catalogue that is tampered content, will obtain the content of some malice, thereby cause the user to incur loss.In addition, if adopt file on the polling server incessantly, if protected quantity of documents is huge, will certainly affect the performance of hardware device, cause the access speed of network application server to reduce.
Summary of the invention
In view of the above problems, having proposed the present invention overcomes the problems referred to above or the monitoring means that addresses the above problem at least in part and method and prevents the system and method that file is tampered in order to provide a kind of.
According to one aspect of the present invention, a kind of monitoring means is provided, it loads in the kernel spacing of operating system, comprising: intercept and capture module, be suitable for intercepting and capturing described system call before the core operation corresponding with system call is performed; Judge module is suitable for judging whether described system call is legal; Alarm module when it judges that at described judge module this system call is illegal, is refused this system call and is generated warning information; Recover module, when it judges that at described judge module this system call is legal, allow this system call, recover the execution of this system call.Wherein, described core operation is various operations associated with the file, and described system call is the various system calls relevant with file operation.
Alternatively, described judge module comprises configuration information, and described configuration information comprises one or more configuration item, and each configuration item comprises the fileinfo of the file that described system call relates to and/or initiates the application message of the application of this system call.Wherein said judge module judges according to described configuration information whether this system call is legal.
Alternatively, described fileinfo comprises routing information and/or the title of file, and described application message comprises the described unique identifying number that is applied in the operating system.
According to a further aspect in the invention, a kind of system that prevents that file is tampered is provided, it is placed in the computing equipment, this computing equipment has operating system, this operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided, and this system that prevents that file is tampered comprises: the foregoing monitoring means that is arranged in kernel spacing; Be arranged in monitoring client and a plurality of application of user's space, wherein said monitoring client is suitable for communicating with described monitoring means; And the system call interfaces between user's space and kernel spacing, the described a plurality of application that are arranged in user's space are connected with described monitoring means by this system call interfaces respectively.Wherein, a plurality of application that are arranged in user's space are initiated system call request, described monitoring means monitoring said system call request by system call interfaces to the nuclear operation of kernel spacing respectively.
Alternatively, the system that prevents that file is tampered of the present invention also comprises: virtual module, it is arranged in the kernel spacing, load on after the monitoring means, the next module of its pointed monitoring means in the single-track link table that representation module loads, and do not point to described monitoring means, thereby make monitoring means invisible in single-track link table.
According to another aspect of the invention, the monitoring method of monitor operating system is provided, wherein said operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided, application in the described user's space is by initiating the corresponding core operation that system call is called to be provided in the kernel spacing, described core operation is various operations associated with the file, and described system call is the various system calls relevant with file operation.Described monitoring method comprises: intercepted and captured described system call before the core operation corresponding with system call is performed; Judge whether described system call is legal, when it is legal, allow this system call, otherwise refuse this system call.
In accordance with a further aspect of the present invention, a kind of method that prevents that file is tampered is provided, it is carried out in computing equipment, this computing equipment has operating system, this operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided, and the method comprises: receive application in the user's space by system call calling the corresponding core operation that provides in the kernel spacing; And the step in the foregoing monitoring method.Alternatively, prevent in the method that file is tampered of the present invention, also comprise step after the step in the described monitoring method in front: carry out a pseudo operation, so that the next one operation of the monitoring operation that the pointed monitoring method noted earlier of this pseudo operation is carried out in the single-track link table that each operation of expression loads, and do not point to described monitoring operation, thereby it is invisible that described monitoring is operated in the single-track link table.
According to monitoring means of the present invention, prevent that even system that file is tampered and corresponding method from can obtain in the situation of highest weight limit the hacker, can prevent that also it from distorting file and catalogue, need not thus the file on the polling server in real time, thereby the performance that can guarantee system is unaffected.
Above-mentioned explanation only is the general introduction of technical solution of the present invention, for can clearer understanding technological means of the present invention, and can be implemented according to the content of instructions, and for above and other objects of the present invention, feature and advantage can be become apparent, below especially exemplified by the specific embodiment of the present invention.
Description of drawings
By reading hereinafter detailed description of the preferred embodiment, various other advantage and benefits will become cheer and bright for those of ordinary skills.Accompanying drawing only is used for the purpose of preferred implementation is shown, and does not think limitation of the present invention.And in whole accompanying drawing, represent identical parts with identical reference symbol.In the accompanying drawings:
Fig. 1 shows and comprises the according to an embodiment of the invention schematic block diagram that prevents the system that file is tampered of monitoring means;
Fig. 2 shows the according to an embodiment of the invention interactive relation between monitoring means, monitoring client and the kernel;
Fig. 3 shows the according to an embodiment of the invention synoptic diagram of monitoring means loading procedure;
Fig. 4 illustrates the synoptic diagram of an example of the system that prevents that according to an embodiment of the invention file is tampered; And
Fig. 5 shows the according to an embodiment of the invention process flow diagram of monitoring method.
Fig. 6 shows the process flow diagram of the method that prevents that according to an embodiment of the invention file is tampered.
Embodiment
Exemplary embodiment of the present disclosure is described below with reference to accompanying drawings in more detail.Although shown exemplary embodiment of the present disclosure in the accompanying drawing, yet should be appreciated that and to realize the disclosure and the embodiment that should do not set forth limits here with various forms.On the contrary, it is in order to understand the disclosure more thoroughly that these embodiment are provided, and can with the scope of the present disclosure complete convey to those skilled in the art.
Modern computing machine all by the configuration operation system come managing computer system hardware, software and data resource, control program operation, improve man-machine interface, provide support etc. for other application, all resources of computer system are played a role to greatest extent, for the user provide convenience, effectively, friendly service interface.
Operating system is the bridge that both link up between the bottom hardware and user of computer system.The user can be by the user interface input command of operating system.Operating system then makes an explanation to order, drives hardware device, realizes customer requirements.The most basic member of kernel of operating system is kernel.Kernel provides a series of many kernel function that possess predetermined function, presents to the user by one group of interface that is called (the system call) of system call.
The basic reason that adopts system call is to protect for the data of operation that computer system is rely.The memory headroom of operating system is divided into: the space of operating system nucleus operation is kernel spacing, and the space of various application operation is user's space, and they operate in respectively in kernel state and two kinds of runlevels of user's attitude, in logic mutually isolation.Operating system oneself is not destroyed by ordinary procedure in order to protect, and kernel spacing has been carried out some definition, such as access rights, swapping in and out, priority etc.That is to say that kernel spacing only allows the kernel access, various being applied in generally do not allow access kernel space, namely do not allow to access kernel data, can't use kernel function yet, and they can only operate user data at user's space, call kernel function.If access kernel space is wanted in the application of user's space, obtain system service (being the calling system program), must be through system call, system call has stipulated that each application enters the particular location of kernel, in other words, the path that the user accesses kernel provides in advance, can only enter kernel from assigned position, wantonly jump into kernel and disapprove, can guarantee Kernel security like this.Therefore, from in logic, system call can be regarded as the mutual interface of application of kernel and user's space, system call will be carried out the kernel that the request of using conveys to kernel spacing, call corresponding kernel function and finish required processing, after kernel is disposed request, again result is sent back to application.For example, the user can open file by the relevant system call Request System of file system, close file or reading and writing of files, can obtain system time or timer etc. is set by the relevant system call of clock.
Yet, between operating system runtime, the hacker may obtain the access rights of application access kernel spacing, thereby or obtain various information and therefrom make a profit, perhaps write hereof invalid information, implantation wooden horse etc. and make the user when access kernel space, obtain contents of some malice, cause the user to sustain a loss.
For this reason, the invention provides a kind of monitoring means of monitor operating system.As shown in Figure 1, monitoring means 130 according to an embodiment of the invention loads in the kernel spacing 102 of operating system, comprises intercepting and capturing module 1310, judge module 1320, alarm module 1330 and recovering module 1340.For convenience of description, also show user's space 101 and the kernel spacing 102 of operating system among Fig. 1, be arranged in monitoring client 110 and the various application 115 of user's space 101, and the system call interfaces 120 between user's space 101 and kernel spacing 102.The user is carrying out when mutual with various application 115, uses 115 and calls to the kernel spacing transmitting system by system call interfaces 120.But, before the core operation corresponding with this system call was performed in kernel spacing, the intercepting and capturing module 1310 of monitoring means 130 was intercepted and captured this system call, then, the system call of intercepting and capturing is sent to judge module 1320, judges by judge module 1320 whether this system call is legal.When judging that this system call is illegal, refuse this system call, force end user to the access of kernel spacing, avoiding the destruction to the kernel data, and allow alarm module 1330 generate warning information, this warning information is sent to monitoring client 110; When judge module 1320 judges that this system call is legal, then allow this system call, inform and recover the execution that module 1340 is recovered these system calls, finish the core operation corresponding with this system call by kernel, thereby and finish this system call to monitoring client 110 feedback informations.
Here, core operation can be various operations associated with the file, and system call can be the various system calls relevant with file operation.
In the described embodiment of Fig. 1, intercept and capture module 1310 and judge module 1320 and can realize by hook (HOOK) or Hook Function particularly.
Hook is the program segment of a processing messages, by system call, it is hung into system.Whenever specific message is sent, before not arriving the purpose window, hook is just caught first this message, that is the controlled power of hook elder generation.At this moment hook namely can be processed this message of processing (for example change), also can not deal with and continues to transmit this message, can also force the transmission of end.
Utilize above-mentioned Hook Mechanism, intercept and capture module 1310 and intercept and capture and use 115 system calls of sending to the kernel of kernel spacing 102, judge module 1320 judges according to the related fileinfo of this system call and/or the application message of initiating the application of this system call whether this system call is legal.Wherein, the related fileinfo of system call comprises routing information and/or the title of file, and application message comprises the unique identifying number that is applied in the operating system.Judge module 1320 comprises configuration information, and this configuration information comprises one or more configuration item, and each configuration item comprises the fileinfo of file and the unique identifying number of application.When the related fileinfo of system call and/or the application message of initiating the application of this system call are present in a certain configuration item of described configuration information, then judge module 1320 judges that this system call is legal, in the time of if there is no in arbitrary configuration item of described configuration information, then judge module 1320 judges that this system call is illegal.
Alternatively, the configuration item in the configuration information of judge module 1320 can also comprise operating right.When the fileinfo of the file that system call relates to and the unique identifying number of initiating the application of this system call are present in the configuration item of described configuration information, when but the operating right in the needed file operation authority of this system call and the described configuration item did not mate, judge module 1320 judged that also this system call is for illegal.The unique identifying number that only has the fileinfo of the file that relates to when system call and initiate the application of this system call is present in the configuration item of described configuration information, and during the coupling of the operating right in the needed file operation authority of this system call and the described configuration item, judge module 1320 judges that just this system call is legal.
The below is take (SuSE) Linux OS as example, and the monitoring means 130 of employing Hook Mechanism of the present invention is specifically described.
In the operating system of Linux, the process of calling during client-side program access application interface API is:
INT0x80 → system call (system call) → system call service routine → kernel program
The API here is exactly the built-in function that system provides in fact.
Particularly, in (SuSE) Linux OS, the kernel of operating system is divided into user's space and kernel spacing.The application of user's space is by the system call access kernel space.In user's space, be provided with the order of file or catalogue being carried out various operations, for example, touch, mkdir, rm, unlink, rmdir, mv, vim, vi, gedit, notepad, chmod, chown, cp etc.System call mainly realizes some user's attitudes of operating system and the switching of kernel state by soft interrupt instruction INT 0x80, and this instruction is encapsulated in the built-in function.The execution of INT 0x80 instruction can allow operating system jump to a default kernel spacing address, that is, make operating system enter kernel state from user's attitude.The kernel spacing address pointing system calling processor here, i.e. system call function.
In kernel spacing, at first the system call function number finds the entrance of the corresponding 0x80 of interrupt vector table according to system call, obtain the address of corresponding subsystem call table sys_call_table, value in the save register among the current C R0, then empty the 16bit among the register CR0, record original correct system call interfaces, be designated as orig_sys_xxx.Next the function interface (being designated as new_sys_xxx) that has a same type with predefined and original system call interfaces is replaced original entrance.
Monitoring means 130 utilizes the object of Hook Mechanism monitoring mainly to comprise to use the path of wanting the file of accessing and the PID of application.Here PID is the unique identifying number of each application in the server.The path of the file by limiting application access and the PID of application can limit only certain application and just can make amendment to the file under certain path.When monitoring means 130 is monitored, judging unit 1320 wherein can be based on the information the configuration file of the path white list that reads from monitoring client 110 (namely allowing path and/or the listed files of access) and process white list (thereof using PID that namely allows to operate is tabulated), being path and PID in new_sys_xxx checks, if the process PID among the new_sys_xxx does not exist in the process white list or file is not present in the catalogue of path white list, judge that then this system call is illegal operation, the current system call of refusing user's is directly returned forbidding and/or warning information to monitoring client 110; If the process PID among the new_sys_xxx exists in the process white list sequence or file is present in the catalogue of path white list, judge that then this system call is legal operation, this system call of clearance user, directly enter orig_syx_xxx, carry out core operation corresponding to normal system call, and then recovery register CR0 is the value of preserving before.
The system call that monitoring means 130 is monitored can comprise: sys_rmdir(deletes empty list: the one or more sub-directory items of deletion from a catalogue must be empty before a catalogue is deleted), sys_unlink, sys_open(arranges the pattern of opening of file), sys_write, sys_mkdir(creates the system call of a new directory), sys_unlinkat, sys_rename, sys_openat, sys_fchmodat, sys_f chownat, sys_link, sys_symlink, sys_chown, the authority of sys_chmod(change file or catalogue).These system calls all relate to some important processes of operating system.Therefore, when 115 pairs of the application of user's space when as above any file carries out system call, monitoring means 130 all will be tackled, and whether detect this system call legal, call program in the related kernel in case the malice such as hacker are distorted said system, destroy operating system.
Alternatively, monitoring means 130 also comprises communication module 1350, monitoring client 110 in this communication module 1350 and the user's space 101 communicates, monitoring means 130 through communication module 1350 read monitoring in the client 110 configuration file and send it to judge module 1320, and be sent to monitoring client 110 through the warning information that communication module 1350 generates alarm module 1330.For example, communication module 1350 can utilize netlink to realize monitoring mutual between client 110 and the kernel spacing 102.When monitoring means 130 loads successfully, and when monitoring client 110 starts, can set up the netlink communication connection between monitoring means 130 and the monitoring client 110, the Content of Communication of this communication connection carrying comprises: monitoring means 130 original upload and receive from monitoring client 110 read the instruction of Reconfigurations file wherein the time, can read the configuration file that comprises process white list configuration file and path white list configuration file from monitoring client 110, the process white list configuration file here comprises legal process (namely using) tabulation, it for example can be the PID tabulation of using, these are used and can by the monitoring of monitoring means, not rejected and be not treated as rubbish; Path white list configuration file comprises legal path and/or listed files, and these paths can not be rejected access and can not be treated as rubbish by the monitoring of monitoring means yet, can greatly improve security and agility like this.In addition, the Content of Communication of the carrying of the communication connection between the monitoring client 110 in this communication module 1350 and the user's space 101 can also comprise: the warning information that Alarm Unit 1330 sends also sends to monitoring client 110 by netlink.Also have, by this communication connection, 110 pairs of monitoring means 130 of monitoring client can be done regularly heartbeat detection, whether are in normal operating conditions to detect monitoring means 130.
In addition, the present invention also provides a kind of system 100 that prevents that file is tampered, and as shown in Figure 1, this system 100 is placed in the computing equipment, and described computing equipment is such as thinking computing machine etc.Computing equipment has operating system, and this operating system comprises the kernel spacing 101 that core operation is provided and the user's space 102 that various application are provided, and core operation is carried out in the kernel of kernel spacing.The system 100 that prevents that file is tampered of the present invention comprises aforesaid monitoring means 130, the monitoring client 110 in user's space 101 and various application 115 and the system call interfaces 120 between user's space 101 and kernel spacing 102 in kernel spacing 102.Various application 115 in the user's space 101 are connected with monitoring means 130 by system call interfaces 120 respectively, monitoring means 130 in the kernel spacing 102 and the monitoring client in the user's space 101 110 communicate between the two, for example realize the communication connection of the two by the netlink communication mode.
Illustrate the application 115 of user's space and monitoring means 130 and the interactive relation between the kernel 170 and the performed function of each parts of monitoring client 110, kernel spacing 102 below by Fig. 2.
As shown in Figure 2, store the configuration file that comprises process white list and path white list in monitoring client 110, this configuration file can upgrade.The process white list comprises the list of application about the application that allows to operate.The path white list comprises path and/or the listed files that allows access.At C1, monitoring means 130 successfully is carried in kernel spacing, in this case, monitoring client 110 is carried out the function of A1, that is, monitoring client 110 starts, and send to monitoring means 130 and to set up the handshake information that TCP connects, request is set up netlink with monitoring means 130 and is connected.After monitoring means 130 receives the request of setting up the netlink connection of monitoring client 110 transmissions, at C2, set up the feedback information that netlink connects to 110 transmissions of monitoring client, thus, at A2, finish netlink between the two and communicate to connect.
After monitoring client 110 and monitoring means 130 are set up the netlink communication connection, at A3, when the configuration file in the monitoring client 110 upgraded, monitoring client 110 can communicate to connect the instruction of again reading configuration file to monitoring means 130 issues by this netlink.Correspondingly, at C3, when monitoring means 130 receive that monitoring client 110 sends again read the instruction of configuration file the time, can read the configuration file of renewal from monitoring client 110 by this netlink communication connection.
In addition, also show among Fig. 2 when the application 115 of user's space is initiated the request (shown in B1) of system call to kernel spacing, monitoring means 130 is carried out the function of C4, C5, C6, namely at C4, tackle this system call, detect to judge whether it is legal, concrete judgment mode is with reference to the relevant description of front about judge module 1320.At C6, when monitoring means 130 judges that this system call is illegal, can send a warning message to monitoring client 110 by this netlink communication connection.And monitoring client 110 is correspondingly carried out the function of A4, and warning information is done categorised collection, is kept in the database for example to show at monitoring client 110 webpages.On the other hand, at C5, when monitoring means 130 judges that this system call is legal, this system call of then letting pass, thus kernel 170 is carried out the function of D1, namely carries out the core operation corresponding with this system call.
In addition, shown also among Fig. 2 that monitoring client 110 sends heartbeat detection bag (shown in A5) to monitoring means 130 at regular intervals, remove to connect monitoring means 130 by this netlink communication connection, monitoring means 130 then can send corresponding feedback information (shown in C7) to monitoring client 110, to prove existing of oneself.Can whether exist by monitoring means 130 thus, whether be in normal operating conditions, so as monitoring means 130 occur unusual or by the unloading such as hacker or situation about destroying under, monitoring client 110 sides can in time be known situation.
Alternatively, the above-mentioned system 100 that prevents that file is tampered of the present invention can also comprise virtual (dummy) module 150, this virtual module 150 is arranged in the kernel spacing 102, be connected with monitoring means 130, be suitable for making monitoring means 130 to hide and when other people inquire about current operating system, can't see and loaded monitoring means 130 in the operating system, thereby can prevent from the hacker from having loaded monitoring means 130 in inquiring current operating system after it being uninstalled the security that therefore can further improve current operation system.For example, in being similar to the operating system of linux and so on, can be by similar orders such as lsmod, the module that loads in the inquiry current operation system.According to the principle of linux system, the module that can find to load in the kernel spacing 102 always adds in the gauge outfit of a single-track link table, and this is waited by the hacker easily and finds any module that newly loads in the kernel spacing 102.In order to prevent that the hacker from seeing the monitoring means 130 that loads in the kernel spacing 102, in kernel spacing 102, loaded after the monitoring means 130, reload a virtual module 150 in kernel spacing 102, the effect of this virtual module 150 is the monitoring means 130 that conceal its next pointer wish sensing in single-track link table.
Particularly, as shown in Figure 3, it shows the according to an embodiment of the invention synoptic diagram of the loading procedure of monitoring means.In the present invention, the loading of module can reflect that by a single-track link table in single-track link table, each module is pointed to next module by pointer.Among Fig. 3 the single-track link table of the first row show t1 constantly the module of current system real-time loading be modules A, module B and other module of before load-on module B, loading.The single-track link table of the second row show subsequently t2 constantly the current system real-time loading new module---monitoring means 130.The single-track link table of the third line show subsequently t3 constantly the current system real-time loading new module---virtual module 150.Pointer next module pointed that the single-track link table of fourth line shows virtual module 150 in the single-track link table of the third line is modules A rather than points to its monitoring means 130 of next-door neighbour, by such mode, can be so that hackers etc. can't see the monitoring means 130 that current system loads when utilizing lsmod instruction inquiry kernel, thus monitoring means 130 can not unloaded easily.
The below further specifies the present invention by an example shown in Figure 4 again.
As shown in Figure 4, content management server CMS 400 for a safety, the content of content issue source 410 issues is to be synchronized to server 430 by mode (for example by forwarding server 420) indirectly, and server 430 for example can be webserver webserver or Ftp server ftp-server.Two kinds of situations have been shown among Fig. 4, a kind of situation is, application A on server 430 is the application that the special content that receives forwarding server 420 forwardings is issued the synchronizing content of source 410, use the A(identification number, for example process number is PID-A) send request by system call to the kernel of the kernel spacing of operating system, wanting to issue the information that source 410 receives from content is written to the catalogue DIR-A, at this moment, be arranged in monitoring means 130 these requests of intercepting of kernel spacing, and according to the process white list configuration file that reads from the monitoring client, when in it detects the configuration file of process white list, comprising " allowing PID-A to write catalogue DIR-A " this process, the process requested of determining this application A is legal, then 130 couples of aforesaid PID-A of the monitoring means in kernel spacing write operation of writing this process of catalogue DIR-A is let pass, and carries out the information of receiving is written to write operation among the catalogue DIR-A in kernel.And when the client-side program PID-A requirement of using A is carried out read operation to catalogue DIR-A, monitoring means 130 these requests of intercepting of kernel spacing, and determine that according to the process white list configuration file that reads from the monitoring client this request is illegal, then refuse client-side program PID-A to the request that catalogue DIR-A carries out read operation, in kernel, do not carry out this read operation.
Also show another kind of situation among Fig. 4.When Another application B attempts to read content among the catalogue DIR-A, use the B(identification number, for example process number is PID-B) send request by system call to the kernel of the kernel spacing of operating system, want reading information from catalogue DIR-A, at this moment, be arranged in monitoring means 130 these requests of intercepting of kernel spacing, and according to the process white list configuration file that reads from the monitoring client, when comprising " allowing PID-B that catalogue DIR-A is done read operation " when it detects in the process white list configuration file, the process requested of determining this application B is legal, then the process of this read operation is let pass, kernel 170 is carried out this read operation; And when using B to catalogue DIR-A execution write operation, monitoring means 130 determines that according to the process white list configuration file that reads from the monitoring client this process is illegal, then refuses this process, and namely kernel is not carried out the write operation to DIR-A.
Can be seen by above-mentioned example, even the hacker does at the machine that file service is provided and tampers with a document, the operation of deleted file, since the monitoring means 130 in the kernel spacing can detect the hacker to this provide file service machine be operating as illegal operation, therefore can refuse this process, thereby can defend hacker's behavior, make its operation can't be successful.And normal file distribution is by content issue source and utilizes special application A indirectly to finish.
Describe the method for monitor operating system according to an embodiment of the invention in detail below in conjunction with Fig. 5.Fig. 5 shows the process flow diagram of the monitoring method of monitor operating system according to an embodiment of the invention.Wherein operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided.Application in the user's space is by initiating the corresponding core operation that system call is called to be provided in the kernel spacing.The core operation here is various operations associated with the file, and system call is the various system calls relevant with file operation.As shown in Figure 5, monitoring method of the present invention starts from step S505, at step S510, after the corresponding core operation that the application of user's space provides in kernel spacing is initiated system call but before this corresponding core operation is performed, intercept and capture this system call.Then in step S520, judge whether this system call is legal, when judging that it allows this system call when legal, otherwise refuse this system call.Like this, before core operation corresponding to this system call is performed, it is detected, can prevent that hacker etc. from utilizing this system call and invading kernel spacing, revise or delete the file in the kernel spacing or implant therein wooden horse etc.
In step S520, particularly, the fileinfo that relates to according to system call and/or the application message of initiating the application of this system call judge whether this system call is legal.Wherein, the fileinfo that system call relates to comprises routing information and/or the title of file, and the application message of initiating the application of this system call comprises that this is applied in the unique identifying number in the operating system.For example, when the user A of client wants to read file abc123 under the catalogue DIR-A, at this moment can be read to judge according to file abc123 whether the read operation of user A is legal, if file abc123 can not be read, the read operation of judging so user A is illegal, refuses its system call; If file abc123 can be read, the read operation of judging so the user is legal, and the user A that then lets pass is to the behavior of reading of file abc123, and kernel spacing is carried out this read operation.
Further, store configuration information in kernel spacing, configuration information comprises one or more configuration items, and each configuration item comprises the fileinfo of file and the unique identifying number of application.This configuration information be kernel spacing according to from the monitoring client to the configuration file update instruction and read and store from the monitoring client.In this case, when the fileinfo of the file that system call relates to and the unique identifying number of initiating the application of this system call are not present in any configuration item of configuration information, judge this system call for illegal, otherwise judge that this system call is legal.
In addition, the configuration item that the configuration information of storing in the above-mentioned kernel spacing comprises can also comprise operating right.In this case, when the fileinfo of the file that system call relates to and the unique identifying number of initiating the application of this system call are present in the configuration item of configuration information, when but the operating right in the needed file operation authority of this system call and the described configuration item does not mate, judge that this system call is for illegal.The unique identifying number that only has the fileinfo of the file that relates to when system call and initiate the application of this system call is present in the configuration item of configuration file, and the operating right in the needed file operation authority of this system call and described configuration item when coupling, judge that this system call is legal.
When judging that system call is legal in step S520, this system call of then letting pass enters step S540, carries out core operation corresponding to this system call at kernel spacing.And when in step S520, judging that system call is illegal, then enter step S530, refuse this system call, generate warning information and also feed back to the monitoring client, can avoid like this hacker to wait utilizing system call and destroy content in the kernel spacing of operating system.
After execution of step S530 or S540, can directly enter ending step S555, alternatively, after execution of step S530 or S540, also can execution in step S550, receive the heartbeat detection that the monitoring client sends at set intervals, and send corresponding feedback information to the monitoring client, be in normal duty with the monitoring of informing this kernel spacing of client, then enter ending step S555.In addition, want to be noted that step S550 not necessarily is positioned at after step S530 or the S540, it can at any time be performed as required.
In the monitoring method of monitor operating system provided by the invention, kernel spacing from monitoring client file reading and to the monitoring client send a warning message, heartbeat detection, monitoring client send the instruction of reading configuration file to kernel spacing etc. all needs to establish a communications link between user's space and the kernel spacing, this can be by realizing such as modes such as netlink.
In addition, the method that the present invention also provides a kind of anti-file to be tampered, as shown in Figure 6, it comprises the step of monitoring method shown in Figure 5, particularly, the method that is tampered of anti-file of the present invention is as in step S605, subsequently, in step S610, receive application in the user's space by system call calling the corresponding core operation that provides in the kernel spacing.Afterwards, carry out the step of monitoring method shown in Figure 5: i.e. execution in step S510, intercepted and captured described system call before the core operation corresponding with system call is performed; Subsequently, execution in step S520 judges whether described system call is legal, when judging that this system call is legal, allows this system call, and then execution in step S540 carries out core operation corresponding to this system call at kernel spacing; When judging that this system call is illegal, then execution in step S530 refuses this system call, generates warning information.
After execution of step S530 or S540, can directly enter ending step S655.Alternatively, after execution of step S530 or S540, also can execution in step S550, receive the heartbeat detection that the monitoring client sends at set intervals, and to the monitoring client send corresponding feedback information, be in normal duty with the monitoring of informing this kernel spacing of client, then enter ending step S655.In addition, want to be noted that step S550 not necessarily is positioned at after step S530 or the S540, it can at any time be performed as required.
Alternatively, the method that anti-file of the present invention is tampered can also comprise step S620 after step S530 or S540, in this step S620, carry out a pseudo operation, it is so that representing that each operates in the single-track link table that loads, the aforementioned monitoring of pointed of this pseudo operation operates (from step S510 to S530 or step S540, when having step S550, then also comprise step S550) next one operation, and do not point to described monitoring operation, thereby it is invisible that described monitoring is operated in the single-track link table.Structure about single-track link table is shown in Figure 3 referring to the front, the operation that module wherein is corresponding described here.After step S620, enter ending step S655.
The present invention finishes some inspections or preventing mechanism by the system call relevant with file and catalogue of hook (HOOK) mechanism, prevents that user's catalogue or file are not tampered.By in hook (HOOK) function, reading the respective profiles of user's space, check application identities PID and courses of action information, can be combined into multiple different strategy, so that only just can make amendment to the file under the particular category and catalogue from the application of application-specific identification number PID.Like this, for behavior improper and that hit block rule, directly can be in Hook Function, return to the user by different wrong round valuess, in this case, though the user has the highest (root) authority, also can be limited when doing corresponding operating.And for normal system call, can pass through again normal entrance, do normal clearance.Therefore, utilize the present invention can not affect normal user's operation, but the illegal user's operation of absolute prohibition.
In addition, the present invention can also introduce virtual module, in order to conceal the monitoring means of carry on the module single-track link table, prevents that monitoring means is by illegal unloadings such as hackers.Intrinsic not relevant with any certain computer, virtual system or miscellaneous equipment with demonstration at this algorithm that provides.Various general-purpose systems also can be with using based on the teaching at this.According to top description, it is apparent constructing the desired structure of this type systematic.In addition, the present invention is not also for any certain programmed language.Should be understood that and to utilize various programming languages to realize content of the present invention described here, and the top description that language-specific is done is in order to disclose preferred forms of the present invention.
In the instructions that provides herein, a large amount of details have been described.Yet, can understand, embodiments of the invention can be put into practice in the situation of these details not having.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand one or more in each inventive aspect, in the description to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes in the above.Yet the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires the more feature of feature clearly put down in writing than institute in each claim.Or rather, as following claims reflected, inventive aspect was to be less than all features of the disclosed single embodiment in front.Therefore, follow claims of embodiment and incorporate clearly thus this embodiment into, wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and can adaptively change and they are arranged in one or more equipment different from this embodiment the module in the equipment among the embodiment.Can be combined into a module or unit or assembly to the module among the embodiment or unit or assembly, and can be divided into a plurality of submodules or subelement or sub-component to them in addition.In such feature and/or process or unit at least some are mutually repelling, and can adopt any combination to disclosed all features in this instructions (comprising claim, summary and the accompanying drawing followed) and so all processes or the unit of disclosed any method or equipment make up.Unless in addition clearly statement, disclosed each feature can be by providing identical, being equal to or the alternative features of similar purpose replaces in this instructions (comprising claim, summary and the accompanying drawing followed).
In addition, those skilled in the art can understand, although embodiment more described herein comprise some feature rather than further feature included among other embodiment, the combination of the feature of different embodiment means and is within the scope of the present invention and forms different embodiment.For example, in the following claims, the one of any of embodiment required for protection can be used with array mode arbitrarily.
All parts embodiment of the present invention can realize with hardware, perhaps realizes with the software module of moving at one or more processor, and perhaps the combination with them realizes.It will be understood by those of skill in the art that and to use in practice microprocessor or digital signal processor (DSP) to realize according to some or all some or repertoire of parts in the embodiment of the invention.The present invention can also be embodied as be used to part or all equipment or the device program (for example, computer program and computer program) of carrying out method as described herein.Such realization program of the present invention can be stored on the computer-readable medium, perhaps can have the form of one or more signal.Such signal can be downloaded from internet website and obtain, and perhaps provides at carrier signal, perhaps provides with any other form.
It should be noted above-described embodiment the present invention will be described rather than limit the invention, and those skilled in the art can design alternative embodiment in the situation of the scope that does not break away from claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and is not listed in element or step in the claim.Being positioned at word " " before the element or " one " does not get rid of and has a plurality of such elements.The present invention can realize by means of the hardware that includes some different elements and by means of the computing machine of suitably programming.In having enumerated the unit claim of some devices, several in these devices can be to come imbody by same hardware branch.The use of word first, second and C grade does not represent any order.Can be title with these word explanations.
Claims (16)
1. system that prevents that file is tampered, it is placed in the computing equipment, and this computing equipment has operating system, and this operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided, and this system that prevents that file is tampered comprises:
Be arranged in the monitoring means of kernel spacing;
Be arranged in monitoring client and a plurality of application of user's space, wherein said monitoring client is suitable for communicating with described monitoring means; And
System call interfaces between user's space and kernel spacing, the described a plurality of application that are arranged in user's space are connected with described monitoring means by this system call interfaces respectively;
Wherein, a plurality of application that are arranged in user's space are initiated the system call request by system call interfaces to the nuclear operation of kernel spacing respectively, described monitoring means monitoring said system call request, and
This monitoring means comprises:
Intercept and capture module, be suitable for before the core operation corresponding with system call is performed, intercepting and capturing described system call;
Judge module is suitable for judging whether described system call is legal;
Alarm module when described judge module judges that this system call is illegal, is refused this system call and is generated warning information; And
Recover module, when described judge module judges that this system call is legal, allow this system call, recover the execution of this system call,
Wherein, described core operation is various operations associated with the file, and described system call is the various system calls relevant with file operation.
2. system according to claim 1, wherein,
Described judge module comprises configuration information, and described configuration information comprises one or more configuration item, and each configuration item comprises the fileinfo of the file that described system call relates to and/or initiate the application message of the application of this system call,
Wherein said judge module judges according to described configuration information whether this system call is legal.
3. system according to claim 2, wherein said fileinfo comprises routing information and/or the title of file, described application message comprises the described unique identifying number that is applied in the operating system.
4. according to claim 2 or 3 described systems, wherein each configuration item in described configuration information comprises under the situation of unique identifying number of the fileinfo of file and application, when the fileinfo of the file that described system call relates to and the unique identifying number of initiating the application of this system call were not present in any configuration item of described configuration information, described judge module judged that this system call is for illegal.
5. system according to claim 4, wherein each configuration item also comprises operating right;
When the fileinfo of the file that described system call relates to and the unique identifying number of initiating the application of this system call are present in the configuration item of described configuration information, when but the operating right in the needed file operation authority of this system call and the described configuration item did not mate, described judge module judged that this system call is for illegal.
6. according to claim 4 or 5 described systems, wherein monitoring means also comprises:
Communication module, the monitoring client of itself and described user's space communicates, and read the configuration information in the described monitoring client and send it to judge module, and the warning information that alarm module is generated is sent to described monitoring client.
7. any described system according to claim 1-6, wherein,
Whether described monitoring client detects described monitoring means and works by described monitoring means being done regularly heartbeat detection.
8. any described system according to claim 1-7, wherein,
The configuration information at described monitoring client place is stored in the configuration file;
Described configuration file comprises the configuration file and the relevant path of access and/or the configuration file of listed files of allowing about the process list that allows to operate.
9. each described system according to claim 1-8 also comprises:
Virtual module, it is arranged in the kernel spacing, loads on after the monitoring means, the next module of its pointed monitoring means in the single-track link table that representation module loads, and do not point to described monitoring means, thus make monitoring means invisible in single-track link table.
10. method that prevents that file is tampered, it is carried out in computing equipment, and this computing equipment has operating system, and this operating system comprises the kernel spacing that core operation is provided and the user's space that various application are provided, and the method comprises:
Receive application in the user's space by system call calling the corresponding core operation that provides in the kernel spacing
Before being performed, intercept and capture the core operation corresponding with system call described system call; And
Judge whether described system call is legal, when it is legal, allow this system call, otherwise refuse this system call.
11. method according to claim 10, wherein, describedly judge whether legal step comprises in described system call: the fileinfo that relates to according to described system call and/or the application message of initiating the application of this system call judge whether this system call is legal.
12. method according to claim 11, wherein,
Described fileinfo comprises routing information and/or the title of file, and described application message comprises the described unique identifying number that is applied in the operating system,
Described method also comprises:
In described kernel spacing store configuration information, described configuration information comprises one or more configuration item, and each configuration item comprises the fileinfo of file and the unique identifying number of application;
Wherein, describedly judge whether legal step is in described system call: when the fileinfo of the file that system call relates to and the unique identifying number of initiating the application of this system call are not present in any configuration item of described configuration information, judge this system call for illegal, otherwise judge that this system call is legal.
13. method according to claim 12, wherein,
Each configuration item also comprises operating right;
The illegal step of the described system call of described judgement is: when the fileinfo of the file that system call relates to and the unique identifying number of initiating the application of this system call are present in the configuration item of described configuration information, when but the operating right in the needed file operation authority of this system call and the described configuration item does not mate, judge that this system call is for illegal.
14. any described method according to claim 10-13, wherein,
The step of refusing this system call when judging that this system call is illegal also comprises afterwards: generate warning information.
15. any described method according to claim 10-14 also comprises:
Receive the heartbeat detection that the monitoring client sends at set intervals, and send corresponding feedback information to the monitoring client.
16. any described method according to claim 10-15 also comprises step:
Carry out a pseudo operation, so that the next one operation of the monitoring operation that the pointed monitoring method noted earlier of this pseudo operation is carried out in the single-track link table that each operation of expression loads, and do not point to described monitoring operation, thereby it is invisible that described monitoring is operated in the single-track link table.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210382366.0A CN102902909B (en) | 2012-10-10 | 2012-10-10 | A kind of system and method preventing file to be tampered |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210382366.0A CN102902909B (en) | 2012-10-10 | 2012-10-10 | A kind of system and method preventing file to be tampered |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102902909A true CN102902909A (en) | 2013-01-30 |
| CN102902909B CN102902909B (en) | 2015-09-16 |
Family
ID=47575136
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210382366.0A Expired - Fee Related CN102902909B (en) | 2012-10-10 | 2012-10-10 | A kind of system and method preventing file to be tampered |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102902909B (en) |
Cited By (30)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104252380A (en) * | 2013-06-28 | 2014-12-31 | 百度在线网络技术（北京）有限公司 | Control method and device for system call under Linux system |
| CN104731892A (en) * | 2015-03-17 | 2015-06-24 | 中国人民解放军信息工程大学 | Mimicry tampering resisting method for centralized file service system |
| CN105100120A (en) * | 2015-08-31 | 2015-11-25 | 宇龙计算机通信科技(深圳)有限公司 | Monitoring method and device for subscriber identity model and terminal |
| CN105100074A (en) * | 2015-07-01 | 2015-11-25 | 小米科技有限责任公司 | Data operation processing method, device and terminal equipment |
| CN105550599A (en) * | 2015-12-29 | 2016-05-04 | 山东中创软件商用中间件股份有限公司 | Linux virtual file system-based tamper-proof method and system |
| CN105760496A (en) * | 2016-02-19 | 2016-07-13 | 北京金山安全软件有限公司 | Shortcut processing method and device and electronic equipment |
| CN105956467A (en) * | 2016-04-21 | 2016-09-21 | 北京金山安全软件有限公司 | System time setting method and device and electronic equipment |
| CN106055453A (en) * | 2016-06-01 | 2016-10-26 | 北京百度网讯科技有限公司 | Equipment monitoring method and device |
| CN106709334A (en) * | 2015-11-17 | 2017-05-24 | 阿里巴巴集团控股有限公司 | Method, device and system for detecting intrusive script files |
| CN106778243A (en) * | 2016-11-28 | 2017-05-31 | 北京奇虎科技有限公司 | Kernel Hole Detection document protection method and device based on virtual machine |
| CN107305534A (en) * | 2016-04-22 | 2017-10-31 | 三星电子株式会社 | The kernel mode and user model carried out simultaneously to the device using NVMe interfaces is accessed |
| CN107423325A (en) * | 2017-04-07 | 2017-12-01 | 杭州安恒信息技术有限公司 | A kind of method for tracing webpage tamper behavior source |
| CN107547566A (en) * | 2017-09-29 | 2018-01-05 | 新华三信息安全技术有限公司 | A kind of method and device of processing business message |
| CN107645480A (en) * | 2016-07-22 | 2018-01-30 | 阿里巴巴集团控股有限公司 | Data monitoring method and system, device |
| CN107766351A (en) * | 2016-08-16 | 2018-03-06 | 腾讯科技（深圳）有限公司 | The recognition methods of file directory and device |
| CN107958152A (en) * | 2017-12-04 | 2018-04-24 | 山东中创软件商用中间件股份有限公司 | Tamper resistant method, device and equipment based on Virtual File System |
| CN108256298A (en) * | 2017-12-14 | 2018-07-06 | 大唐微电子技术有限公司 | A kind of resource access method and device |
| CN108334788A (en) * | 2017-01-20 | 2018-07-27 | 腾讯科技（深圳）有限公司 | File tamper resistant method and device |
| CN108416210A (en) * | 2018-03-09 | 2018-08-17 | 北京顶象技术有限公司 | A kind of program protection method and device |
| CN108629197A (en) * | 2017-03-21 | 2018-10-09 | 中国航发商用航空发动机有限责任公司 | File access control method and system for the integration environment |
| CN108959918A (en) * | 2017-05-18 | 2018-12-07 | 北京搜狗科技发展有限公司 | A kind of guard method, device and the electronic equipment of input method file |
| CN109660579A (en) * | 2017-10-11 | 2019-04-19 | 阿里巴巴集团控股有限公司 | Data processing method, system and electronic equipment |
| CN109936528A (en) * | 2017-12-15 | 2019-06-25 | 阿里巴巴集团控股有限公司 | Monitoring method, device, equipment and system |
| CN111158937A (en) * | 2019-12-31 | 2020-05-15 | 奇安信科技集团股份有限公司 | Software core file endogenous protection method and device based on kernel drive |
| CN111783087A (en) * | 2020-06-02 | 2020-10-16 | Oppo广东移动通信有限公司 | Method and device for detecting malicious execution of executable file, terminal and storage medium |
| CN114048469A (en) * | 2022-01-10 | 2022-02-15 | 荣耀终端有限公司 | Directory operation management method, electronic device and readable storage medium |
| CN115599929A (en) * | 2022-09-30 | 2023-01-13 | 荣耀终端有限公司（Cn） | File management method and electronic equipment |
| TWI802040B (en) * | 2021-10-08 | 2023-05-11 | 精品科技股份有限公司 | Method of application control based on file attributes |
| CN117407118A (en) * | 2022-07-08 | 2024-01-16 | 北京火山引擎科技有限公司 | Container operation control method, device, electronic equipment and readable storage medium |
| CN111158937B (en) * | 2019-12-31 | 2024-06-04 | 奇安信科技集团股份有限公司 | Kernel-driven software core file endophytic protection method and device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020065945A1 (en) * | 2000-11-29 | 2002-05-30 | Brad Calder | System and method for communicating and controlling the behavior of an application executing on a computer |
| CN102043927A (en) * | 2010-12-29 | 2011-05-04 | 北京深思洛克软件技术股份有限公司 | Computer system for data divulgence protection |
| CN102592076A (en) * | 2011-12-20 | 2012-07-18 | 北京神州绿盟信息安全科技股份有限公司 | Data tamper-proof method and device |
-
2012
- 2012-10-10 CN CN201210382366.0A patent/CN102902909B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020065945A1 (en) * | 2000-11-29 | 2002-05-30 | Brad Calder | System and method for communicating and controlling the behavior of an application executing on a computer |
| CN102043927A (en) * | 2010-12-29 | 2011-05-04 | 北京深思洛克软件技术股份有限公司 | Computer system for data divulgence protection |
| CN102592076A (en) * | 2011-12-20 | 2012-07-18 | 北京神州绿盟信息安全科技股份有限公司 | Data tamper-proof method and device |
Cited By (46)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104252380A (en) * | 2013-06-28 | 2014-12-31 | 百度在线网络技术（北京）有限公司 | Control method and device for system call under Linux system |
| CN104252380B (en) * | 2013-06-28 | 2017-11-17 | 百度在线网络技术（北京）有限公司 | The control method and device that system is called under linux system |
| CN104731892A (en) * | 2015-03-17 | 2015-06-24 | 中国人民解放军信息工程大学 | Mimicry tampering resisting method for centralized file service system |
| CN104731892B (en) * | 2015-03-17 | 2018-03-27 | 中国人民解放军信息工程大学 | A kind of mimicry tamper resistant method of centralized File Serving System |
| CN105100074A (en) * | 2015-07-01 | 2015-11-25 | 小米科技有限责任公司 | Data operation processing method, device and terminal equipment |
| CN105100120A (en) * | 2015-08-31 | 2015-11-25 | 宇龙计算机通信科技(深圳)有限公司 | Monitoring method and device for subscriber identity model and terminal |
| CN105100120B (en) * | 2015-08-31 | 2019-04-12 | 宇龙计算机通信科技(深圳)有限公司 | Monitoring method, device and the terminal of client identification module |
| CN106709334A (en) * | 2015-11-17 | 2017-05-24 | 阿里巴巴集团控股有限公司 | Method, device and system for detecting intrusive script files |
| CN105550599A (en) * | 2015-12-29 | 2016-05-04 | 山东中创软件商用中间件股份有限公司 | Linux virtual file system-based tamper-proof method and system |
| CN105550599B (en) * | 2015-12-29 | 2018-07-17 | 山东中创软件商用中间件股份有限公司 | A kind of tamper resistant method and system based on Linux Virtual File Systems |
| CN105760496A (en) * | 2016-02-19 | 2016-07-13 | 北京金山安全软件有限公司 | Shortcut processing method and device and electronic equipment |
| CN105956467A (en) * | 2016-04-21 | 2016-09-21 | 北京金山安全软件有限公司 | System time setting method and device and electronic equipment |
| CN107305534B (en) * | 2016-04-22 | 2022-02-18 | 三星电子株式会社 | Method for simultaneously carrying out kernel mode access and user mode access |
| CN107305534A (en) * | 2016-04-22 | 2017-10-31 | 三星电子株式会社 | The kernel mode and user model carried out simultaneously to the device using NVMe interfaces is accessed |
| CN106055453A (en) * | 2016-06-01 | 2016-10-26 | 北京百度网讯科技有限公司 | Equipment monitoring method and device |
| CN107645480B (en) * | 2016-07-22 | 2021-04-30 | 阿里巴巴集团控股有限公司 | Data monitoring method, system and device |
| CN107645480A (en) * | 2016-07-22 | 2018-01-30 | 阿里巴巴集团控股有限公司 | Data monitoring method and system, device |
| CN107766351B (en) * | 2016-08-16 | 2020-12-25 | 腾讯科技（深圳）有限公司 | File directory identification method and device |
| CN107766351A (en) * | 2016-08-16 | 2018-03-06 | 腾讯科技（深圳）有限公司 | The recognition methods of file directory and device |
| CN106778243A (en) * | 2016-11-28 | 2017-05-31 | 北京奇虎科技有限公司 | Kernel Hole Detection document protection method and device based on virtual machine |
| CN106778243B (en) * | 2016-11-28 | 2020-06-09 | 北京奇虎科技有限公司 | Virtual machine-based kernel vulnerability detection file protection method and device |
| CN108334788B (en) * | 2017-01-20 | 2023-01-06 | 腾讯科技（深圳）有限公司 | File tamper-proofing method and device |
| CN108334788A (en) * | 2017-01-20 | 2018-07-27 | 腾讯科技（深圳）有限公司 | File tamper resistant method and device |
| CN108629197B (en) * | 2017-03-21 | 2020-07-28 | 中国航发商用航空发动机有限责任公司 | File access control method and system for integrated environment |
| CN108629197A (en) * | 2017-03-21 | 2018-10-09 | 中国航发商用航空发动机有限责任公司 | File access control method and system for the integration environment |
| CN107423325A (en) * | 2017-04-07 | 2017-12-01 | 杭州安恒信息技术有限公司 | A kind of method for tracing webpage tamper behavior source |
| CN108959918A (en) * | 2017-05-18 | 2018-12-07 | 北京搜狗科技发展有限公司 | A kind of guard method, device and the electronic equipment of input method file |
| CN108959918B (en) * | 2017-05-18 | 2021-09-03 | 北京搜狗科技发展有限公司 | Input method file protection method and device and electronic equipment |
| CN107547566A (en) * | 2017-09-29 | 2018-01-05 | 新华三信息安全技术有限公司 | A kind of method and device of processing business message |
| CN107547566B (en) * | 2017-09-29 | 2020-11-20 | 新华三信息安全技术有限公司 | Method and device for processing service message |
| CN109660579A (en) * | 2017-10-11 | 2019-04-19 | 阿里巴巴集团控股有限公司 | Data processing method, system and electronic equipment |
| CN109660579B (en) * | 2017-10-11 | 2022-02-25 | 阿里巴巴集团控股有限公司 | Data processing method and system and electronic equipment |
| CN107958152A (en) * | 2017-12-04 | 2018-04-24 | 山东中创软件商用中间件股份有限公司 | Tamper resistant method, device and equipment based on Virtual File System |
| CN108256298A (en) * | 2017-12-14 | 2018-07-06 | 大唐微电子技术有限公司 | A kind of resource access method and device |
| CN109936528A (en) * | 2017-12-15 | 2019-06-25 | 阿里巴巴集团控股有限公司 | Monitoring method, device, equipment and system |
| CN108416210A (en) * | 2018-03-09 | 2018-08-17 | 北京顶象技术有限公司 | A kind of program protection method and device |
| CN108416210B (en) * | 2018-03-09 | 2020-07-14 | 北京顶象技术有限公司 | Program protection method and device |
| CN111158937A (en) * | 2019-12-31 | 2020-05-15 | 奇安信科技集团股份有限公司 | Software core file endogenous protection method and device based on kernel drive |
| CN111158937B (en) * | 2019-12-31 | 2024-06-04 | 奇安信科技集团股份有限公司 | Kernel-driven software core file endophytic protection method and device |
| CN111783087A (en) * | 2020-06-02 | 2020-10-16 | Oppo广东移动通信有限公司 | Method and device for detecting malicious execution of executable file, terminal and storage medium |
| TWI802040B (en) * | 2021-10-08 | 2023-05-11 | 精品科技股份有限公司 | Method of application control based on file attributes |
| CN114048469A (en) * | 2022-01-10 | 2022-02-15 | 荣耀终端有限公司 | Directory operation management method, electronic device and readable storage medium |
| CN114048469B (en) * | 2022-01-10 | 2022-06-14 | 荣耀终端有限公司 | Directory operation management method, electronic device and readable storage medium |
| CN117407118A (en) * | 2022-07-08 | 2024-01-16 | 北京火山引擎科技有限公司 | Container operation control method, device, electronic equipment and readable storage medium |
| CN115599929A (en) * | 2022-09-30 | 2023-01-13 | 荣耀终端有限公司（Cn） | File management method and electronic equipment |
| CN115599929B (en) * | 2022-09-30 | 2023-08-04 | 荣耀终端有限公司 | File management method and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102902909B (en) | 2015-09-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102902909B (en) | A kind of system and method preventing file to be tampered | |
| CN102930205A (en) | Monitoring unit and method | |
| US7895651B2 (en) | Content tracking in a network security system | |
| US8984636B2 (en) | Content extractor and analysis system | |
| US8782800B2 (en) | Parametric content control in a network security system | |
| CN104885092A (en) | Security system and method for operating systems | |
| US20090089879A1 (en) | Securing anti-virus software with virtualization | |
| CN102999726B (en) | File macro virus immunization method and device | |
| CN103001947A (en) | Program processing method and program processing system | |
| CN103020524A (en) | Computer virus monitoring system | |
| CN104091125A (en) | Floating window processing method and device | |
| EP1920338A2 (en) | Network security systems and methods | |
| CN103473501B (en) | A kind of Malware method for tracing based on cloud security | |
| CN102081722A (en) | Method and device for protecting appointed application program | |
| CN103620613A (en) | System and method for virtual machine monitor based anti-malware security | |
| CN103679031A (en) | File virus immunizing method and device | |
| CN103765430A (en) | Data leak prevention system and method | |
| CN102882875B (en) | Active defense method and device | |
| CN102999720A (en) | Program identification method and system | |
| CN103049695A (en) | Computer virus monitoring method and device | |
| CN102982281A (en) | Program condition detecting method and system | |
| CN103198253A (en) | Method and system of file operation | |
| CN103294955A (en) | Macro-virus searching and killing method and system | |
| CN105631312A (en) | Method and system for processing rogue programs | |
| CN103218561A (en) | Tamper-proof method and device for protecting browser |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20150916 Termination date: 20211010 |