CN104102878B - Malicious code analysis method and system under Linux platform - Google Patents

Abstract

The present invention provides a malicious code analysis method and system under the Linux platform. LKM technology can be used to realize dynamic loading, and the position of intercepting system calls is located between the VFS layer and the specific file system to obtain more information related to file operations. Provide more accurate and useful monitoring information; the interception of system calls does not need to modify the system call table, so as to avoid the security risks brought by the traditional method of modifying the system call table; the shared memory mechanism is used to improve the communication speed between the kernel module and the user process, and The amount of data transmitted by communication; the key files and processes to be monitored are selected by the user to improve the ease of use, flexibility and efficiency of the system, and better meet the user's requirements for malicious code analysis; select malicious code processes and multiple An important key file is monitored to avoid a large performance loss of the system and improve the speed of the analysis system.

Description

A malicious code analysis method and system under a Linux platform

technical field

The invention relates to the field of malicious code analysis under the Linux platform, in particular to a malicious code analysis method and system under the Linux platform.

Background technique

While the Internet brings convenience and efficiency to people's lives, security threats are increasing year by year. A large number of viruses and Trojan horses on the network have caused serious harm to people's property, social production safety and national information security. Among various hazards, the loss and harm caused by executable malicious code is particularly prominent. The prevalence of malicious codes has awakened people's security awareness and prompted people to study malicious codes from various aspects. With the continuous development and progress of malicious codes, all kinds of malicious codes are endless and unpredictable. Traditional malicious code debugger debugging detection methods and sample analysis techniques have long been unable to adapt to the analysis of new malicious codes. It can be seen that it is imminent to develop a targeted and efficient malicious code analysis platform.

Malicious code analysis is the basis of malicious code emergency response and computer forensics. Through the analysis of malicious code behavior and function, it can provide useful information for loss assessment and system recovery. Among them, the malicious code analysis based on system call behavior monitoring believes that no matter where the attacker comes from and what kind of behavior is used, the intrusion, control or destruction of the target system must ultimately be executed with the help of system calls of the target system. One of the philosophies of Linux and UNIX system design is "everything is a file", and various malicious behaviors and operations performed by malicious code on the target system can ultimately be attributed to operations on files. The system calls called during the malicious code execution process and the final files to be operated are directly related to the malicious code attack behavior and function. Therefore, the purpose of malicious code analysis can be achieved by intercepting the system calls invoked by the malicious code and monitoring the operation of the malicious code process on the file.

In the existing Linux-based malicious code analysis methods, the system call interception technology involved traditionally uses the interrupt vector table to obtain the address of the interrupt processing routine, and then searches the memory address of the interrupt service routine to obtain the characteristic instruction. The address of the system call table. Or get the address of the system call table by reading dev/kmem, System.map, kallsyms. Then save the system call service routine entry address that needs to be intercepted in the system call table, and then modify the original system call service routine entry address to the address of the custom processing function to make it jump to the monitoring program. The malicious code analysis method based on the traditional system call interception technology has the following problems:

(1) For the kernel of Linux2.6 and later versions, based on security considerations, the system call table is no longer exported as a symbol, and needs to be obtained by searching for characteristic instructions. The premise of this method is that the application request needs to fall into the kernel through the INT 0x80 instruction, but for the SYSENTER or SYSCALL instruction, this method will fail.

(2) For the method of intercepting system calls by reading the /dev/kmem device file to obtain the address of the system call table, there are potential security risks.

(3) The system call interception involved in the traditional malicious code analysis method is at the system call layer, above the VFS layer, and more specific information related to malicious code cannot be obtained.

(4) Modifying the system call table will cause security risks, and the robustness is not good in a multi-threaded environment.

Contents of the invention

In order to solve the above problems, the present invention provides a malicious code analysis method and system under the Linux platform, so as to avoid potential safety hazards caused by the traditional method of modifying the system call table, avoid large performance loss of the system, and provide more accurate and useful Monitor information, increase the amount of data transmitted by communication and the ease of use, flexibility and efficiency of the system, and better meet the user's requirements for malicious code analysis.

In order to achieve the above-mentioned purpose of the invention, the present invention provides a malicious code analysis method under a Linux platform, the method comprising:

Step 1. Set the key file information to be monitored and display it in the form of an interface, wherein the key file information includes: file name, user to which the file belongs, user group, and file access rights;

Step 2, load and execute the malicious code that needs to be analyzed, and set the process to be monitored according to the process information displayed on the interface;

Step 3, passing the key file information and the monitored process information to the monitoring module of the kernel space, and the monitoring module synchronously generates a key file list and a monitored process information list according to the key file information and the monitored process information;

Step 4, the monitoring module monitors the monitored process's access to the key file in real time, and rejects or allows the monitored process's operation on the key file according to the access rights of the key file and the monitored process;

Step 5, the monitoring module records the operation of the monitored process on the key file, and saves the operation information of the monitored process on the key file in the log queue;

Step 6, transfer the log information in the log queue to the log processing routine of the user module, and display the log information in the form of an interface.

Further, said step 2 includes:

Step 21, enter the directories named by numbers in the /proc file system in sequence, and perform the read() operation on the status files in the directories respectively to obtain process information, the process information includes: executable file name, process number, parent process number , effective user EUID, effective group EGID and memory map;

Step 22, storing the process information in the struct process_info structure, and linking it to the linked list;

Step 23, sequentially obtain the process information from the linked list, and display it to the user in the form of an interface;

Step 24, the user designates the malicious code process as the monitored process according to the displayed process information.

Further, said step 4 includes:

Step 41, the monitoring module intercepts the system call passed down from the VFS layer, and points to the self-defined interception function by modifying the VFS function jump table to obtain the file object to be operated by the upper layer system call;

Step 42, the filter_process_hash() function obtains the process number and the parent process number of the process to which the system call belongs, uses the process number as a key, and compares them sequentially in the monitoring process information list, and if the comparison is successful, it means The current process is a monitored process; if the comparison is unsuccessful, the parent process number is used as a keyword to perform comparisons in the list of monitoring process information. If the comparison is successful, it means that the current process is a monitored process, and step 43 is performed. , if the comparison is unsuccessful, do not do any processing, and continue to execute the specific file system processing function of the lower layer;

The filter_file_hash() function intercepts the file object to be operated, obtains the file name of the key file and the UID of the user to which the file belongs through the file object, and uses the file name and the UID of the user to which the file belongs as keywords, and compares them sequentially in the list of key files Yes, if both are compared successfully, it means that the current file is the key file to be monitored, and step 43 is performed; otherwise, no processing is performed, and the specific file system processing function of the lower layer is continued;

Step 43 , comparing the permissions of the monitored process and the key file, and denying or allowing the monitored process to operate on the key file according to the comparison result.

Further, said step 6 includes:

Step 61, obtaining log information from the log queue, and writing the obtained log information into the shared memory created by the monitoring module;

Step 62, asynchronously notify the log processing routine, the log processing routine reads the log information, stores it in the log buffer after processing, and stores the log information in the log buffer in the form of an interface displayed to the user.

Wherein, in the step 6:

The log information includes the executable file name of the monitored process, the process number, the parent process number, the effective user EUID, the effective group EGID, and the file name of the key file of the operation, the user UID to which the file belongs, the user group GID, and the operation command .

In order to achieve the purpose of the above invention, the present invention also provides a malicious code analysis and processing system under the Linux platform, the system comprising:

The preprocessing module sets the key file information and access rights that need to be monitored, and displays them in the form of an interface, wherein the key file information includes: file name, user UID to which the file belongs, user group GID, and file access rights;

The malicious code loading module loads and executes the malicious code that needs to be analyzed, and at the same time sets the process to be monitored according to the content displayed on the interface;

A synchronous generation module, which transmits the key file information and monitoring process information to the monitoring module of the kernel space, and the monitoring module synchronously generates a key file list and a monitored process information list according to the key file information and the monitoring process information;

A monitoring processing module, the monitoring module monitors the monitored process's access to the key file in real time, and rejects or allows the monitored process's operation on the key file according to the key file and the access authority of the monitored process ;

A record saving module, the monitoring module records the operation of the monitored process on the key file, and saves the operation information of the monitored process on the key file into the log queue;

The transfer display module transfers the log information in the log queue to the log processing routine of the user module, and displays the log information in the form of an interface.

Further, the malicious code loading module includes:

The operation processing module enters the directory named by numbers in the /proc file system in turn, and performs the read() operation on the status files in the directory respectively to obtain process information. The process information includes: executable file name, process number, parent process number, effective user EUID, effective group EGID and memory map;

The link processing module stores the process information in the struct process_info structure and links it to the linked list;

Obtaining a display module, sequentially obtaining the process information from the linked list, and displaying the information to the user in the form of an interface;

A designated processing module, the user designates a malicious code process as a monitored process according to the displayed process information.

Further, the monitoring processing module includes:

Intercept processing module, the monitoring module intercepts the system call passed down from the VFS layer, points to the self-defined interception function by modifying the VFS function jump table, and obtains the file object to be operated by the upper-level system call;

Comparing the processing module, the filter_process_hash () function obtains the process number and the parent process number of the process to which the system call belongs, and uses the process number as a keyword to compare successively in the monitoring process information list. If the comparison is successful, It means that the current process is a monitored process; if the comparison is unsuccessful, use the parent process number as a keyword to compare in sequence in the monitoring process information list. If the comparison is successful, it means that the current process is a monitored process, enter Execute the module, if the comparison is unsuccessful, do not do any processing, and continue to execute the specific file system processing function of the lower layer;

The filter_file_hash() function intercepts the file object to be operated, obtains the file name of the key file and the UID of the user to which the file belongs through the file object, and uses the file name and the UID of the user to which the file belongs as keywords, and compares them sequentially in the list of key files Yes, if the comparison between the two is successful, it means that the current file is the key file to be monitored and enters the execution module, otherwise it does not do any processing and continues to execute the specific file system processing function of the lower layer;

The execution module compares the permissions of the monitored process and the key file, and rejects or allows the monitored process to operate on the key file according to the comparison result.

Further, the delivery display module includes:

Write into the processing module, obtain log information from the log queue, and write the obtained log information into the shared memory created by the monitoring module;

The asynchronous processing module notifies the log processing routine asynchronously, the log processing routine reads the log information, stores it in the log buffer after processing, and saves the log in the log buffer in the form of an interface Information is displayed to the user.

Among them, in the transfer display module:

The log information includes the executable file name of the monitored process, the process number, the parent process number, the effective user EUID, the effective group EGID, and the file name of the key file of the operation, the user UID to which the file belongs, the user group GID, and the operation command .

The beneficial effects of the present invention are:

(1) LKM technology can be used to realize dynamic loading, and the location of intercepting system calls is located between the VFS layer and the specific file system, so that more information related to file operations can be obtained and more accurate and useful monitoring information can be provided.

(2) The system call interception does not need to modify the system call table, thus avoiding the security risks brought by the traditional method of modifying the system call table.

(3) Pass the log information obtained by the monitoring module to the user space by applying for a shared memory in the kernel. Adopting the shared memory mechanism not only improves the communication speed between the kernel module and the user process, but also increases the amount of data transmitted by communication.

(4) The key files and processes to be monitored are selected by the user, which greatly improves the ease of use, flexibility and efficiency of the system, and better meets the user's requirements for malicious code analysis.

(5) The malicious code process and multiple important key files are selected for monitoring, which avoids a large performance loss of the system and improves the speed of the analysis system.

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, but not as a limitation of the present invention.

Description of drawings

Fig. 1 is the flowchart of malicious code analysis method under the Linux platform of the present invention;

Fig. 2 is the malicious code analysis system schematic diagram under the Linux platform of the present invention;

FIG. 3 is an architecture diagram of a malicious code analysis system under a Linux platform according to an embodiment of the present invention.

detailed description

Fig. 1 is a flowchart of the malicious code analysis method under the Linux platform of the present invention. As shown in Figure 1, the method includes:

Step 1, set key file information to be monitored, and display it in an interface, wherein the key file information includes: file name, user UID to which the file belongs, user group GID, and file access rights;

Step 2, load and execute the malicious code that needs to be analyzed, and set the process to be monitored according to the content displayed on the interface;

Step 3, passing the key file information and monitoring process information to the monitoring module of the kernel space, and the monitoring module synchronously generates a key file list and a monitoring process information list according to the key file information and the monitoring process information;

Step 4, the monitoring module monitors the monitored process's access to the key file in real time, and rejects or allows the monitored process's operation on the key file according to the key file and the access authority of the monitored process;

Step 5, the monitoring module records the operation of the monitored process on the key file, and saves the operation information of the monitored process on the key file in the log queue;

Step 6, transfer the log information in the log queue to the log processing routine of the user module, and display the log information in the form of an interface.

Further, said step 2 includes:

Step 21, enter the directories named by numbers in the /proc file system in turn, and perform the read() operation on the status files in the directories respectively to obtain process information, the process information includes: executable file name, process number, parent process number, Effective user EUID, effective group EGID and memory map;

Step 22, storing the process information in the struct process_info structure, and linking it to the linked list;

Step 23, sequentially obtain the process information from the linked list, and display it to the user in the form of an interface;

Step 24, the user designates the malicious code process as the monitored process according to the displayed process information.

Further, said step 4 includes:

Step 41, the monitoring module intercepts the system call passed down from the VFS layer, and points to the self-defined interception function by modifying the VFS function jump table to obtain the file object to be operated by the upper layer system call;

Step 42, the filter_process_hash() function obtains the process number and the parent process number of the process to which the system call belongs, uses the process number as a key, and compares them sequentially in the monitoring process information list, and if the comparison is successful, it means The current process is a monitored process; if the comparison is unsuccessful, the parent process number is used as a keyword to perform comparisons in the list of monitoring process information. If the comparison is successful, it means that the current process is a monitored process, and step 43 is performed. , if the comparison is unsuccessful, it returns, that is, if the comparison is unsuccessful, no processing is performed on the system call, so that it continues to execute the lower-level specific file system processing function;

The filter_file_hash() function intercepts the file object to be operated, obtains the file name of the key file and the UID of the user to which the file belongs through the file object, and uses the file name and the UID of the user to which the file belongs as keywords, and compares them sequentially in the list of key files Yes, if the comparison between the two is successful, it means that the current file is the key file to be monitored, go to step 43, otherwise, return, that is, if the comparison is unsuccessful, it means that the file to be operated is not the key file set by the user , the system call will not be processed in any way, so that it will continue to execute the specific file system processing function of the lower layer;

Step 43 , comparing the permissions of the monitored process and the key file, and denying or allowing the monitored process to operate on the key file according to the comparison result.

Further, said step 6 includes:

Step 61, obtaining log information from the log queue, and writing the obtained log information into the shared memory created by the monitoring module;

Step 62, asynchronously notify the log processing routine, the log processing routine reads the log information, stores it in the log buffer after processing, and stores the log information in the log buffer in the form of an interface displayed to the user.

Wherein, in the step 6:

The log information includes the executable file name of the monitored process, the process number, the parent process number, the effective user EUID, the effective group EGID, and the file name of the key file of the operation, the user UID to which the file belongs, the user group GID, and the operation command .

Fig. 2 is a schematic diagram of the malicious code analysis system under the Linux platform of the present invention. As shown in Figure 2, the system includes:

The preprocessing module 100 sets the key file information that needs to be monitored, and displays it in the form of an interface, wherein the key file information includes: file name, user UID to which the file belongs, user group GID, and file access authority;

The malicious code loading module 200 loads and executes the malicious code that needs to be analyzed, and sets the process to be monitored according to the content displayed on the interface;

The synchronous generation module 300 transmits the key file information and the monitoring process information to the monitoring module of the kernel space, and the monitoring module generates a key file list and a monitoring process information list synchronously according to the key file information and the monitoring process information;

A monitoring processing module 400, the monitoring module monitors the monitored process's access to the key file in real time, and denies or allows the monitored process's access to the key file according to the key file and the access authority of the monitored process operate;

Record saving module 500, the monitoring module records the operation of the monitored process on the key file, and saves the operation information of the monitored process on the key file in the log queue;

The transfer and display module 600 transfers the log information in the log queue to the log processing routine of the user module, and displays the log information in the form of an interface.

Further, the malicious code loading module 200 includes:

The operation processing module enters the directories named by numbers in the /proc file system in turn, and executes the read() operation on the status files in each directory to obtain process information, which includes: executable file name, process number, parent process number, Effective user EUID, effective group EGID and memory map;

The link processing module stores the process information in the struct process_info structure and links it to the linked list;

Obtaining a display module, sequentially obtaining the process information from the linked list, and displaying the information to the user in the form of an interface;

A designated processing module, the user designates a malicious code process as a monitored process according to the displayed process information.

Further, the monitoring processing module 400 includes:

Intercept processing module, the monitoring module intercepts the system call passed down from the VFS layer, points to the self-defined interception function by modifying the VFS function jump table, and obtains the file object to be operated by the upper-level system call;

Comparing the processing module, the filter_process_hash () function obtains the process number and the parent process number of the process to which the system call belongs, and uses the process number as a keyword to compare successively in the monitoring process information list. If the comparison is successful, It means that the current process is a monitored process; if the comparison is unsuccessful, use the parent process number as a keyword to compare in sequence in the monitoring process information list. If the comparison is successful, it means that the current process is a monitored process, enter The execution module returns if the comparison is unsuccessful, that is, if the comparison is unsuccessful, it does not do any processing on the system call, so that it continues to execute the specific file system processing function of the lower layer;

The filter_file_hash() function intercepts the file object to be operated, obtains the file name of the key file and the UID of the user to which the file belongs through the file object, and uses the file name and the UID of the user to which the file belongs as keywords, and compares them sequentially in the list of key files Yes, if the comparison between the two is successful, it means that the current file is the key file to be monitored, enter the execution module, otherwise, return, that is, if the comparison is unsuccessful, it means that the file to be operated is not the key file set by the user , the system call will not be processed in any way, so that it will continue to execute the specific file system processing function of the lower layer;

The execution module compares the permissions of the monitored process and the key file, and rejects or allows the monitored process to operate on the key file according to the comparison result.

Further, the transfer display module 600 includes:

Write into the processing module, obtain log information from the log queue, and write the obtained log information into the shared memory created by the monitoring module;

The asynchronous processing module notifies the log processing routine asynchronously, the log processing routine reads the log information, stores it in the log buffer after processing, and saves the log in the log buffer in the form of an interface Information is displayed to the user.

Wherein, in the transfer display module 600:

The log information includes the executable file name of the monitored process, the process number, the parent process number, the effective user EUID, the effective group EGID, and the file name of the key file of the operation, the user UID to which the file belongs, the user group GID, and the operation command .

FIG. 3 is an architecture diagram of a malicious code analysis system under a Linux platform according to an embodiment of the present invention. An embodiment of the malicious code analysis method under the Linux platform of the present invention is listed in conjunction with FIG. 3 . The malicious code processing method under the Linux platform of this embodiment comprises:

Step 1, the user sets key file information through the user module;

Step 2, the user module submits the execution code routine to load and execute the malicious code that needs to be analyzed, and at the same time, the user sets the process that needs to be monitored through the user module;

Step 3, the proc communication routine of the communication module transmits the key file information and the monitored process information set by the user module to the monitoring module;

Step 4, the monitoring module monitors the access of the process to the key file in real time, and accesses the key file according to the effective user EUID, the effective group EGID, the user UID to which the key file belongs, the user group GID, and the user and user group to which the key file belongs. Permission settings to deny or allow the monitored process to operate on key files;

Step 5, the monitoring module records the access operation of the monitored process to the key file, and records the monitored process information, key file information and its operation information in the log by write_log_info();

Step 6, transfer the log information obtained by the monitoring module to the user module through the mmap communication routine of the communication module.

Further, said step 1 includes:

A1. The user provides key file information that needs to be monitored, including the file name filename, the user UID to which the file belongs, the user group GID, file access permissions and other attributes, and sets different access permissions for different users in the system;

A2. The user adds and deletes key file information through the two interface functions add_keyfile() and del_keyfile() provided by the user module;

A3. The key file setting routine of the user module displays the key file information to the user through the show_keyfile() function.

Further, said step 2 includes:

B1. The user module's submission execution code routine calls the load_execute () function to load and execute the malicious code that needs to be analyzed from the specified path. At the same time, the user module's process information setting routine calls the get_process_info () function to enter the /proc file system in turn. numerically named directories;

B2. After the process information setting routine enters each process directory, execute the read() operation on the status file respectively to obtain the executable file name, process number pid, parent process number ppid, effective user EUID, effective user group EGID and memory Process information such as image mmaps;

B3. Store the information of each process in the struct process_info structure and link it to the linked list processes_info;

B4. The process information setting routine calls the read_process_info() function to obtain the information of each process from processes_info in turn, and displays it to the user in the form of an interface through show_process_info();

B5. The user adds and deletes process information through the two interface functions add_process_info() and del_process_info() provided by the user module;

B6. The user designates the malicious code process as the monitored process according to the process information displayed by the user module.

Further, said step 3 includes:

C1. The user module sends key file information and monitored process information to the monitoring module through the interface send_config_info() function of the communication module;

C2. The key file control routine of the monitoring module calls proc_mkdir () and create_proc_entry (), and sets up the directory key_file and its affiliated file config_file in the /proc file system respectively;

C3. The process information control routine of the monitoring module calls proc_mkdir () and create_proc_entry (), and establishes the directory process_info and its belonging file config_process in the /proc file system respectively;

C4. The proc communication routine of the communication module writes key file configuration information and process configuration information into the file created by the monitoring module through create_proc_entry() through send_config_info() in /proc;

The key file control routine of C5. monitoring module is by system call sys_open () and sys_read (), obtains the key file setting command and its file information written by the user module from the /proc file system;

C6. The key file control routine calls the create_file_list () function to generate the key file list synchronously, and utilizes the update_file_list () function to update the key file list;

C7. The monitoring module process information control routine obtains the process setting command and process information thereof written by the user module from the /proc file system by calling sys_open () and sys_read ();

C8. The process information control routine calls the create_process_list() function to generate a process information list synchronously, and uses the update_process_list() function to update the process information list.

Further, said step 4 includes:

D1. The system call of the monitoring module intercepts the filter routine, by modifying the f_op object pointer in the file structure of the process to open the file, so that it does not point to the index node inode file operation method, and jumps to the my_operation( struct file*fp, void*buf, filldir_t filldir) function;

D2. Obtain the file object of the process to operate the file by the my_operation() function, and obtain the user UID and file name of the file by printing fp->f_uid and fp->f_dentry->d_name.name;

D3. Get the process number pid and the parent process number ppid of the process to which the system call belongs by the filter_process_list(current->pid, ppid) function, first use the process number pid as the keyword, and compare it in the process information list, if the process information If there is a matching process information in the list, it means that the current process is a monitored process; if the comparison is unsuccessful, then use the parent process number ppid as the keyword to compare in the process information list, if the comparison is successful, it means This process is a child process created by the user to start setting the monitored process, and it also needs to be monitored. If the comparison is unsuccessful, return;

D4. By the filter_file_list (UID, filename) function, the user UID and the file name filename of the currently obtained file object are used as keywords, and compared in the key file list, if there is a key file matching both in the key file list, It means that the current file is the key file set by the user, otherwise, return;

D5. Use the cmp_authority() function to compare the effective user EUID of the process, the effective group EGID, the user UID to which the key file belongs, and the user group GID to compare the permissions, and determine the access rights according to the access rights of the user and user group to which the key file belongs. Perform Deny or Allow actions.

Further, said step 5 includes:

E1. If the monitored malicious code process has permission to access key files, then allow its access, and record the process information, key file information and access operation information in the log queue structlog_queue by the write_log_info () function;

E2. If the monitored malicious code process does not have permission to access key files, its access is denied, and the process information, key file information and its operation information are also recorded in the log queue struct log_queue together by the write_log_info () function;

The information recorded by the E3.write_log_info() function includes the executable file name of the monitored process, the process number pid, the parent process ppid, the effective user EUID, the effective group EGID and the filename of the key file being operated, the user UID, and the user group GID, execute commands such as file I/O operations (read, write), change file pointers (lseek), open/close/create files (open, close, create), etc.;

E4. The monitoring module calls get_share_memory () to obtain a piece of shared memory in the kernel, and then the attributes of the shared memory, that is, the starting address sharememory_addr and the length sharememory_size are passed to the user module through the proc file system;

E5. The user module obtains the start address and length of the shared memory by reading the proc file system, and maps it to this shared memory by calling mmap();

E6. The monitoring module writes the log into the shared memory, and the user module uses the read() function to read the log information from the shared memory.

Further, said step 6 includes:

F1. The communication module calls get_log_info() to obtain log information from the log queue struct log_queue of the monitoring module;

The F2.mmap communication routine writes the obtained log information into the shared memory created by the monitoring module through get_share_memory() through send_log_info();

The F3.mmap communication routine asynchronously notifies the log processing routine of the user module to read the log information;

F4. The log processing routine calls read_log() to read log information from the shared memory created by the monitoring module, and after processing, call write_log() to store in the log buffer;

F5. The log processing routine calls get_log() to extract the log from the log buffer, and displays the log information in the form of an interface through show_log().

Further, in the step 6:

G1. The log information provided to the user for analysis includes the executable file name of the monitored process, the process number pid, the parent process number ppid, the effective user EUID, the user group EGID, the key file name accessed, the user UID, User group GID, operation commands (commands such as read/write/create/close);

G2. The user analyzes the malicious code according to the operation records of the monitored process on key files.

Certainly, the present invention also can have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding Changes and deformations should all belong to the protection scope of the appended claims of the present invention.

Claims (8)

1. a kind of malicious code analysis method under Linux platform is it is characterised in that include：

Step 1, setting needs the critical file information of monitoring, and it is shown with interface form, wherein said critical file letter Breath includes：Filename, file owning user UID, user's group GID, file access authority；

Step 2, loads and executes the malicious code needing analysis, simultaneously according to the curriculum offering of showing interface need to be monitored into Journey；

Step 3, described critical file information and monitored progress information is passed to the monitoring module of kernel spacing, described monitoring Module synchronously generates critical file list and monitoring process letter according to described critical file information and described monitored progress information Breath list；

Step 4, the monitored access to critical file for the process described in described monitoring module monitor in real time, and according to described crucial literary composition Part and the access rights of monitored process, refusal or the permission operation to critical file for the described monitored process；

Step 5, the monitored operation to critical file for the process described in described monitoring module record, and by monitored process to key The operation information of file is saved in journal queue；

Step 6, the log information in described journal queue is passed to the log processing routine of line module, and the shape with interface Described log information is shown by formula；

Wherein said step 6 includes：

Step 61, obtains log information from described journal queue, and the log information of acquisition is written to described monitoring module In the shared drive creating；

Step 62, log processing routine described in asynchronous notifications, described log processing routine reads log information, through processing it Afterwards, it is deposited into log buffer area, and in the form of interface, the log information in described log buffer area is showed user.

2. the malicious code analysis method under Linux platform as claimed in claim 1 is it is characterised in that described step 2 is wrapped Include：

Step 21, sequentially enter/proc file system with the catalogue of numerical designation, respectively status file in described catalogue is held Row read () operates, and obtains progress information, and this progress information includes：EXENAME, process number, parent process number, effective Family EUID, effectively group EGID and core image；

Step 22, described progress information is left in struct process_info structure, and is linked in chained list；

Step 23, obtains described progress information from described chained list successively, and shows user with interface manner；

Step 24, it is monitored process that described user specifies malicious code process according to the progress information shown.

3. the malicious code analysis method under Linux platform as claimed in claim 1 is it is characterised in that described step 4 is wrapped Include：

Step 41, described monitoring module is intercepted and captured the system transmitted from VFS layer and is called, and is referred to by changing VFS function jump table To self-defining intercepting and capturing function, obtain upper system and call file object to be operated；

Step 42, filter_process_hash () function obtains process number and the parent process number that this system calls affiliated process, With described process number as keyword, comparing successively in described monitoring process information list, if compared successfully, illustrating Current process is monitored process；If comparing unsuccessful, using parent process number as keyword, in described monitoring process information row Comparing successively in table, if compared successfully, illustrating that current process is monitored process, execution step 43, if compared not Success, is left intact, and continues executing with the concrete file system of lower floor and processes function；Filter_file_hash () function is intercepted and captured The file object that will be operated, obtains filename and the file owning user UID of critical file by file object, and with institute Stating filename and file owning user UID is keyword, compares successively, if both in described critical file list Compare successfully, then explanation current file is monitored critical file, execution step 43 otherwise, is left intact, continues to hold The concrete file system of row lower floor processes function；

Step 43, carries out authority comparison to described monitored process and described critical file, and according to comparison result refusal or permits Permitted the operation to critical file for the described monitored process.

4. the malicious code analysis method under Linux platform as claimed in claim 1 is it is characterised in that in described step 6：

Described log information includes the EXENAME of monitored process, process number, parent process number, validated user EUID, has Effect group EGID, and the critical file filename of operation, file owning user UID, user's group GID, and operational order.

5. the malicious code analysis system under a kind of Linux platform is it is characterised in that include：

Pretreatment module, setting needs the critical file information of monitoring, and it is shown with interface form, wherein said crucial literary composition Part information includes：Filename, file owning user UID, user's group GID, file access authority；

Malicious code load-on module, loads and executes the malicious code needing analysis, the curriculum offering according to showing interface simultaneously Need monitored process；

Synchronous generation module, by described critical file information and described monitoring process information transmission to kernel spacing monitoring mould Block, described monitoring module generates critical file list and prison according to described critical file information and described monitoring process synchronizing information Control progress information list；

Monitor processing module, the monitored access to critical file for the process described in described monitoring module monitor in real time, and according to institute State critical file and the access rights of described monitored process, refusal or the permission behaviour to critical file for the described monitored process Make；

Record preserving module, the monitored operation to critical file for the process described in described monitoring module record, and by be monitored into Journey is saved in journal queue to the operation information of critical file；

Transmission display module, the log information in described journal queue is passed to the log processing routine of line module, and with Described log information is shown by the form at interface；

Wherein said transmission display module includes：

Write processing module, obtains log information from described journal queue, and the log information of acquisition is written to described prison In the shared drive of control module creation；

Asynchronous process module, log processing routine described in asynchronous notifications, described log processing routine reads log information, through place After reason, it is deposited into log buffer area, and in the form of interface, the log information in described log buffer area is showed User.

6. the malicious code analysis system under Linux platform as claimed in claim 5 is it is characterised in that described malicious code Load-on module includes：

Operation processing module, sequentially enter/proc file system with the catalogue of numerical designation, respectively to status in described catalogue File execution read () operation, obtains progress information, and this progress information includes：EXENAME, process number, parent process number, Validated user EUID, effectively group EGID and core image；

Link processing module, described progress information is left in struct process_info structure, and is linked to chain In table；

Obtain display module, obtain described progress information from described chained list successively, and user is showed with interface manner；

Designated treatment module, it is monitored process that described user specifies malicious code process according to the progress information shown.

7. the malicious code analysis system under Linux platform as claimed in claim 5 is it is characterised in that described monitoring is processed Module includes：

Intercept and capture processing module, described monitoring module is intercepted and captured the system transmitted from VFS layer and called, jumped by changing VFS function Turn table and point to self-defining intercepting and capturing function, obtain upper system and call file object to be operated；

Compare processing module, filter_process_hash () function obtains process number and the father that this system calls affiliated process Process number, with described process number as keyword, compares, successively if compared in described monitoring process information list Work(, then explanation current process is monitored process；If comparing unsuccessful, using parent process number as keyword, in described monitoring Compare successively in progress information list, if comparing successfully, illustrating that current process is monitored process, entering execution mould Block, if comparing unsuccessful, is left intact, and continues executing with the concrete file system of lower floor and processes function；filter_file_ The file object that the intercepting and capturing of hash () function will be operated, obtains filename and the file of critical file information by file object Owning user UID, and with described filename and file owning user UID as keyword, in described critical file list successively Comparing, if both compared successfully, illustrating that current file is monitored critical file, enter performing module, no Then, it is left intact, continue executing with the concrete file system of lower floor and process function；

Performing module, carries out authority comparison to described monitored process and described critical file, and according to comparison result refusal or Allow the operation to critical file for the described monitored process.

8. the malicious code analysis system under Linux platform as claimed in claim 5 is it is characterised in that described transmission is shown In module：

Described log information includes the EXENAME of monitored process, process number, parent process number, validated user EUID, has Effect group EGID, and the filename of the critical file of operation, file owning user UID, user's group GID, and operational order.