KR102325291B1 - Method, device, computer-readable storage medium and computer program for tracking task - Google Patents

Abstract

According to various embodiments, there is provided a method for tracking a task by a kernel, the method comprising: checking one or more running processes; confirming generation of a task to be traced in the one or more processes using ptrace (process trace); checking information corresponding to the generated task; and transmitting the checked information to a designated engine.

Description

Method, device, computer readable recording medium and computer program for tracing tasks

The present invention relates to a method, an apparatus, a computer-readable recording medium and a computer program for tracking a task.

Recently, various technologies have been developed to enhance the security of an operating system (OS). The anti-virus function for enhancing the security of the operating system may be performed based on the identification of the start time of a task that is the subject of input/output (I/O). The start of the task may be from the creation (generation) of a process and/or thread, and accordingly, the anti-virus function determines whether a malicious code for the task infection can be determined. Accordingly, in order to perform an anti-virus function for security enhancement on the operating system, a technology for tracking and controlling child processes and/or threads may be required.

Meanwhile, the Linux kernel of Linux, which is a type of operating system, provides filtering functions in various ways. However, the filtering function provided by the conventional Linux kernel tends to depend on specific kernel compilation options. This trend can be seen, for example, in a Linux kernel of Security-Enhanced Linux (SELinux), a Linux kernel compiled to use kprobe and/or ktrace, and the like.

Korean Patent Publication No. 10-2019-0109524, published on September 25, 2019

In an embodiment of the present invention, in a Linux operating system, ptrace (process trace), a technology that enables a debugger to be implemented at a user level in general, is used at the kernel level to trace child processes and/or threads. It is possible to provide a method, an apparatus, a computer-readable recording medium, and a computer program for tracking a task so as to be able to control it.

According to one embodiment, there is provided a method for tracking a task by a kernel, the method comprising: checking one or more running processes; confirming generation of a task to be traced in the one or more processes using ptrace (process trace); checking information corresponding to the generated task; and transmitting the checked information to a designated engine.

According to an embodiment, there is provided a computer-readable recording medium storing a computer program, the method comprising: identifying one or more processes being executed; confirming generation of a task to be traced in the one or more processes using ptrace (process trace); checking information corresponding to the generated task; and instructions for causing the processor to perform a method including an operation of transmitting the checked information to a designated engine.

According to an embodiment, as a computer program stored in a computer-readable recording medium, the operation of checking one or more processes being executed; confirming generation of a task to be traced in the one or more processes using ptrace (process trace); checking information corresponding to the generated task; and instructions for causing the processor to perform a method including an operation of transmitting the checked information to a designated engine.

According to one embodiment, there is provided an apparatus for tracking a task, comprising: a processor; and a memory electrically connected to the processor and executed by the processor, wherein the memory is configured to store an operating system and one or more applications, wherein a kernel included in the operating system is one or more executing in the one or more applications Check the process, check the creation of a task to be traced in the one or more processes using ptrace (process trace), check information corresponding to the created task, and transfer the checked information to a designated engine It may include a command to pass it to .

Accordingly, the method, apparatus, computer-readable recording medium, and computer program for tracing a task according to an embodiment of the present invention are ptrace, which is a technology that enables a debugger to be implemented at a user level in a Linux kernel in general. (process trace) can be used at the kernel level to trace and control child processes and/or threads.

For example, according to an embodiment of the present invention, it is possible to provide a technology for filtering and controlling the initial subject that starts input/output (I/O). In addition, the above technology may be applied to a basic technology of a user-level application.

1 is a block diagram of an apparatus for tracking a task according to an embodiment of the present invention.
2 is a flowchart of an operation for tracking a child process and/or a thread of a process according to an embodiment of the present invention.
3 is a diagram for explaining an operation for tracking a child process and/or a thread of a process according to an embodiment of the present invention.
4 is a flowchart of an operation for tracking a task according to an embodiment of the present invention.

First, the advantages and features of the present invention, and a method for achieving them will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. Here, the present invention is not limited to the embodiments disclosed below, but may be implemented in a variety of different forms, and only these embodiments allow the disclosure of the present invention to be complete, and are common in the technical field to which the present invention pertains. The technical scope of the present invention should be defined by the claims since it is provided by way of example so that those with knowledge can clearly understand the scope of the invention.

In addition, in the following description of the present invention, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary depending on the intentions or customs of users, operators, etc., of course. Therefore, the definition should be made based on the technical idea described throughout this specification.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an apparatus 100 for tracking a task according to an embodiment of the present invention.

Referring to FIG. 1 , the device 100 may include a processor 101 and a memory 111 .

According to an embodiment, the processor 101 drives, for example, software (eg, the program 121 ) to run at least one other component (eg, hardware or software) of the device 100 connected to the processor 101 . component) and can perform various data processing and operations.

According to an embodiment, the memory 111 includes various data used by at least one component of the device 100 (the processor 101 ), for example, software (eg, the program 121 ), and It can store input data or output data for related commands. The memory 111 may include a volatile memory or a non-volatile memory.

According to an embodiment, the program 121 is software stored in the memory 111 , and may include, for example, an operating system 130 and/or an application 140 (also referred to as an application process or an application program). can

The operating system 130 may control one or more resources (eg, the processor 101 and the memory 111 ) of the device 100 . The operating system 130 may include a kernel 131, which is used to execute an operation or function implemented in, for example, programs (eg, the application 140). One or more resources may be controlled or managed.

According to an embodiment, by the processor 101 , the kernel 131 included in the operating system 130 checks one or more processes running in the application 140 , and generates a ptrace (process trace). By using this, it is possible to confirm creation of a task of the one or more processes, check information corresponding to the created task, and transmit the checked information to a designated engine.

For example, the kernel 131 may track the creation time of the task of the one or more processes.

For example, based on the tracking of the creation time of the task of the one or more processes, the state of the created task may be set to be a standby state.

For example, the kernel 131 receives a signal corresponding to control of the generated task from the designated engine and stores it in the memory 111 using the ptrace in response to the delivery of the checked information. and, based on the signal stored in the memory 111 , the generated task may be processed to correspond to control of the generated task.

For example, the signal corresponding to the control of the task may include a control signal for removing the task in the standby state or a control signal for releasing the standby state of the task in the standby state.

For example, the kernel 131 may determine whether the created task is a child process or a thread based on identification information stored in the memory using the ptrace based on the task creation confirmation. The child process refers to another process created (forked from the specific process) by a specific process (eg, also referred to as a parent process) during program execution.

2 is a flowchart of an operation for tracking a child process and/or a thread of a process according to an embodiment of the present invention.

In operation 201 , the kernel (eg, the kernel 121 ) may generate one or more tracers (also referred to as kernel thread tracers).

According to an embodiment, based on the start of an operating system (eg, the operating system 120 ), the kernel may operate, and the kernel may generate the one or more tracers. For example, the kernel may determine the number of tracers to be generated based on the operating system state, CPU state (eg, number of CPUs), etc., and may generate the one or more tracers according to the determined number. have. Since the tracer is created at the kernel level in this way, one or more processors created at the user level can be checked through the tracer from the time of creation.

In operation 203, the kernel may identify one or more processes that are created and currently operating (running) by a device (eg, device 101) (also referred to as a system) at the user level.

According to an embodiment, the kernel may collect information on all processes currently running in the device to check all processes currently running.

According to an embodiment, information (a list of all processes) of all processes currently in operation (execution) is stored on a run-queue of the memory (eg, memory 111) of the device, and the run-queue Through the entire traversal of , it is possible to check all the currently operating processes. For example, the kernel may track the creation of a process and/or a thread by checking the run-queue through ptrace.

In operation 205, the kernel may determine at least one process from which a ptrace tracing operation is to start among the one or more identified processes.

According to an embodiment, the kernel may determine at least one process to start the ptrace tracing operation using ptrace by excluding a process preset so that the ptrace tracing operation is not applied to the one or more identified processes. The preset process includes a process corresponding to the basic function of the operating system, an important process that should be excluded from application of the ptrace trace operation, a process whose stability has been confirmed, and/or a process that does not need to determine whether or not a malicious code is infected. may include

According to an embodiment, the kernel may cause the tracer to enter a standby state based on the determination of operation 205 .

In operation 207, the kernel may determine whether tasks of the identified one or more processes have been created.

According to an embodiment, the task creation may include creation of a child process and/or creation of a thread.

According to an embodiment, the identified one or more processes may create a child process and/or a thread through the clone system call, and perform an operation in the current state (the child process and/or thread creation state). A stop, for example, may cause the created child process and/or thread to be put into a waiting state. When the clone system call occurs, a corresponding signal may be delivered to a signal queue of each of one or more tracers through the ptrace. For example, the at least one identified process may be an application process. For example, the clone system call may be generated based on input of commands such as fork and pthread_create.

According to an embodiment, the kernel may check whether the task has been created based on a ptrace tracking operation using ptrace. For example, the kernel may release the waiting state of the one or more tracers based on a ptrace trace operation, so that the one or more tracers may check a signal delivered to a corresponding signal queue. For example, the one or more tracers may determine that the task has been generated based on a signal transmitted to the signal queue and confirmed.

In operation 209, the kernel may check information corresponding to the generated task.

According to an embodiment, the one or more tracers may identify information corresponding to the task based on identification information included in a signal transmitted to the signal queue through the ptrace and confirmed.

For example, the information corresponding to the task may include information on whether the created task is a child process creation or a thread creation, and information on a relationship between the created task and a previously created task. can

For example, the identification information included in the signal may include, for example, tgid (thread group identification (ID)) and pid (process ID).

For example, when a thread is first created, the tgid and pid of the first created thread are identically created and given, and when a second thread is created, the tgid of the second created thread is the same as the first created tgid, The pid of the second generated thread may be generated and assigned to be different from the pid of the first generated thread.

For example, when a process is first created, the tgid and pid of the first created process are the same, and when a child process of the first created process is created, the tgid and pid of the child process are the same, but the first It can be created and assigned differently from the tgid and pid of the created process.

For example, based on the tgid and the pid, it may be checked whether a thread is created or a child process is created. For example, based on the tgid, a group including the created thread may be identified when a thread is created, and a parent process of the created child process may be identified when a child process is created.

In operation 211, the kernel may transmit information corresponding to the generated task to a designated engine.

According to an embodiment, when the task creation is confirmed, the state of the task may be a standby state, and the task may be stopped.

According to an embodiment, the designated engine may set control for the task using information corresponding to the task, for example, based on information corresponding to the transmitted task.

For example, if the designated engine is an engine that monitors whether or not a malicious code is infected, the engine may determine whether the task is infected with a malicious code based on information corresponding to the transmitted task, , based on the presence of the infection, it is possible to set the control for the task. For example, the control may be a failure control (also called kill or kill control) to prevent the task from being performed (to cause the task to fail) or a failure control to cause the task to be performed (to allow the task to pass). It can be a success control.

For example, in response to the transmission of information corresponding to the created task, the kernel may change the state of the stopped task when the task is created (when the task creation is confirmed) through ptrace. have. For example, the kernel may receive a signal corresponding to the control of the task through ptrace, and change the state of the task in a stopped state when the task is created (when the task creation is confirmed). The status change of the task may include a change such that the suspended task corresponding to the success control is made to run again (running), a change such that the stopped task corresponding to the failure control is removed (killed or deleted). may include. Based on the change in the state of the operation, the suspended test may be reactivated or eliminated. For example, the kernel may receive a signal corresponding to the removal of the task through ptrace, and remove the removed task-related information from the memory.

According to another embodiment, the designated engine may monitor (confirm) information corresponding to the task. For example, the engine may only perform an operation of confirming information corresponding to the task.

In the above-described embodiment of FIG. 2 , additionally, an additional child process and/or an additional thread may be created, and when the additional child process and/or the additional thread are created, the kernel performs the operation of the above-described embodiment of FIG. 2 . An operation corresponding to .

3 is a diagram for explaining an operation for tracking a child process and/or a thread of a process according to an embodiment of the present invention.

Referring to FIG. 3 , the kernel 121 of the kernel level 301 may generate one or more tracers, for example, a first tracer 302 , a second tracer 304 , and a third tracer 306 . have. Each of the first tracer 302 , the second tracer 304 and the third tracer 306 , via a corresponding signal queue in memory, for example, a signal queue 312 , a signal queue 314 . and one or more processes (eg, the application process 140) of the user level 321 through each of the signal queues 316 to transmit and/or receive a signal. For example, when each of the first tracer 302 , the second tracer 304 and the third tracer 306 starts ptrace tracing, the first tracer 302 , the second tracer 304 , and each of the third tracers 306 may deliver a signal corresponding to the start of ptrace trace to each of the signal queue 312 , the signal queue 314 , and the signal queue 316 .

According to an embodiment, the signal corresponding to the start of the ptrace trace may include information requesting that a message about an event at the user level 321 be delivered. For example, the kernel is configured such that, based on a user input, the signal corresponding to the start of the ptrace trace includes information to transmit a signal (also referred to as a message) corresponding to the creation of a thread and/or the creation of a child process. can be set. For example, when the application process 140 creates a thread 322 , a process 324 , and/or a process 326 , based on the start of tracking of the ptrace, the ptrace may become a thread 322 , a process 324 , and/or a signal according to the generation of the process 326 may be delivered to a corresponding signal queue. The kernel 121 uses each of the first tracer 302 , the second tracer 304 , and the third tracer 306 to receive the signal queue 312 , the signal queue 314 , and the signal queue 316 . You can check the transmitted and stored signal. The kernel 121 may determine whether a thread is created or a child process is created based on the identified signal.

According to an embodiment, based on the creation of a thread or the creation of a child process in one or more processes (eg, the application process 140 ) of the user level 321 , the kernel 121 performs a filtering function, that is, the Whether one or more processes has created a thread or a child process can be transmitted to a specific engine. For example, the specific engine may vary according to user settings, such as a configuration for monitoring whether the one or more processes are infected with a malicious code using the filtering function.

4 is a flowchart of an operation for tracking a task according to an embodiment of the present invention.

Referring to FIG. 4 , in operation 401 , the kernel (eg, the kernel 131 ) may check one or more running processes.

In operation 403 , the kernel may check creation of tasks of the one or more processes using ptrace (process trace).

According to an embodiment, the kernel may track the creation time of the task of the one or more processes.

For example, based on the tracking of the creation time of the task of the one or more processes, the state of the created task may be set to be a standby state.

In operation 405, the kernel may check information corresponding to the generated task.

According to an embodiment, the kernel may receive a signal corresponding to the control of the generated task from the designated engine using the ptrace in response to the delivery of the checked information and store it in the memory. Also, the kernel may process the generated task to correspond to control of the generated task based on the signal stored in the memory.

For example, the signal corresponding to the control of the generated task may include a control signal for removing the task in the standby state or a control signal for releasing the standby state of the task in the standby state.

According to an embodiment, the kernel may determine whether the created task is a child process or a thread based on identification information stored in the memory using the ptrace based on the task creation confirmation.

In operation 407, the kernel may transmit the checked information to a designated engine.

Various embodiments of the present document include instructions stored in a machine-readable storage media (eg, memory 111 (internal memory or external memory)) readable by a machine (eg, a computer). It may be implemented in software (eg, a program). The device is a device capable of calling a stored command from a storage medium and operating according to the called command, and may include an electronic device (eg, the device 100 ) according to the disclosed embodiments. When the instruction is executed by a processor (eg, the processor 101), the processor may directly or use other components under the control of the controller to perform a function corresponding to the instruction. Instructions may include code generated or executed by a compiler or interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' means that the storage medium does not include a signal and is tangible, and does not distinguish that data is semi-permanently or temporarily stored in the storage medium.

According to an example, the method according to various embodiments disclosed in this document may be included and provided in a computer program product.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains may make various substitutions, modifications, and changes within the scope not departing from the essential characteristics of the present invention. It will be easy to see that this is possible. That is, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments.

Accordingly, the protection scope of the present invention should be interpreted by the claims described below, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

An embodiment of the present invention can be applied to a function of a Linux (linux) application. In addition, an embodiment of the present invention can be used as a technology of Linux endpoint detection and response (EDR).

Claims (9)

In the method for tracing a task by a kernel performed by a device for tracing a task,
generating at least one tracer capable of using ptrace (process trace) at the kernel level;
checking one or more processes generated at the user level through the tracer;
confirming through the tracer and the ptrace that a task to be traced is created in the one or more processes;
checking information corresponding to the generated task; and
and forwarding the identified information to a designated engine. The method of claim 1, wherein confirming creation of a task of the one or more processes comprises:
and tracking creation time of the task of the one or more processes. 3. The method of claim 2, wherein a state of the created task is set to be a waiting state based on the tracking of the creation time of the task of the one or more processes. 4. The method of claim 3,
an operation of receiving a signal corresponding to control of the generated task from the designated engine and storing it in a memory using the ptrace in response to the delivery of the checked information; and
and processing the generated task to correspond to control of the generated task based on the signal stored in the memory. According to claim 4, wherein the signal corresponding to the control of the task,
and a control signal for causing the task in the waiting state to be removed or a control signal to causing the task in the waiting state to be released. The method of claim 1, wherein the checking of information corresponding to the generated task comprises:
and determining whether the created task is a child process or a thread based on identification information stored in a memory using the ptrace based on confirmation of the task creation. As a computer-readable recording medium storing a computer program,
generating at least one tracer capable of using ptrace (process trace) at the kernel level;
checking one or more processes generated at the user level through the tracer;
confirming through the tracer and the ptrace that a task to be traced is created in the one or more processes;
checking information corresponding to the generated task; and
A computer-readable recording medium comprising instructions for causing a processor to perform a method including transmitting the identified information to a designated engine. As a computer program stored in a computer-readable recording medium,
generating at least one tracer capable of using ptrace (process trace) at the kernel level;
checking one or more processes generated at the user level through the tracer;
confirming through the tracer and the ptrace that a task to be traced is created in the one or more processes;
checking information corresponding to the generated task; and
and instructions for causing a processor to perform a method comprising forwarding the identified information to a designated engine. A device for tracking a task, comprising:
processor; and
It is electrically connected to the processor and includes a memory executed by the processor, wherein the memory is configured to store an operating system and one or more applications, a kernel included in the operating system,
Creates at least one tracer that can use ptrace (process trace) at the kernel level, checks one or more processes created at the user level through the tracer, and a task to be traced in the one or more processes It is confirmed through the tracer and the ptrace to generate
A device for tracking tasks.

Images