WO2020000741A1

WO2020000741A1 - Rootkit measurement method, apparatus, and server

Info

Publication number: WO2020000741A1
Application number: PCT/CN2018/108469
Authority: WO
Inventors: 郑彪
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-06-30
Filing date: 2018-09-28
Publication date: 2020-01-02
Also published as: CN108959915B; CN108959915A

Abstract

Disclosed by the embodiments of the present invention are a rootkit measurement method, apparatus, and server; said method can be applied to a Linux system; said Linux system comprises a secure backup area which is backed up with a system call table; the Linux system is divided into a ring3 state and a ring0 state. The method comprises: if it is detected that a Linux system is running, then loading a kernel module pre-deployed in the Linux system, and triggering an obtain program in the kernel module to obtain a current system call table in the ring0 state; obtaining the system call table, which has been backed up beforehand, from the secure backup area, and calling a comparison program in the ring3 state to determine whether the backed-up system call table is consistent with the current system call table; if not, then determining that the ring0 state of the Linux system has been attacked by the rootkit. The embodiments of the present invention are advantageous to improving the accuracy of rootkit detection.

Description

Rookit detection method, device and server

This application claims priority from a Chinese patent application filed on June 30, 2018 with the Chinese Patent Office, application number 201810706457.2, and application name "A rookit detection method, device, and server", the entire contents of which are incorporated herein by reference. Applying.

Technical field

The present invention relates to the field of computer technology, and in particular, to a method, a device, and a server for detecting rookit of malicious software.

Background technique

With the rapid development of computer technology and the widespread application of various websites, mobile terminals, and app services on mobile terminals, the security of server systems has received increasing attention. As an important member of the server system, the linux system has an increasing number of servers using the linux system, and various Trojan viruses targeting the linux system are also constantly updated. Rookit is the most stubborn malicious virus on Linux system, and it is also a special type of malware. It can hide almost any software, including file servers, keyloggers, botnets and remailers.

At present, although rookit detection is increasing, malware developers are constantly looking for new ways to cover up rookit's tracks. Therefore, how to detect rookit more accurately has become an urgent problem.

Summary of the invention

Embodiments of the present invention provide a rookit detection method, device, and server, which is beneficial to improve the accuracy of rookit detection.

In a first aspect, an embodiment of the present invention provides a rookit detection method. The method is applied to a Linux system. The Linux system includes a secure backup area in which a system call table is backed up in advance. The Linux system is divided into a user mode ring3 mode and Kernel state ring0 state, the method includes:

When detecting that the linux system is running, loading a kernel module pre-deployed in the linux system;

When it is detected that the loading of the kernel module is completed, triggering an obtaining program in the kernel module to obtain the current system call table in the ring0 state;

Obtain the system call table backed up in advance from the secure backup area, and call the comparison program in the ring3 state to determine the system call table backed up in the secure backup area and the acquired current system call table Whether consistent

If the system call table backed up in advance is inconsistent with the obtained current system call table, it is determined that the ring0 state of the linux system has been rookit attacked.

In a second aspect, an embodiment of the present invention provides a rookit detection device, and the rookit detection device includes a module for executing the method in the first aspect.

According to a third aspect, an embodiment of the present invention provides a server. The server includes a processor, a network interface, and a memory. The processor, the network interface, and the memory are connected to each other. The network interface is controlled by the processor. The memory is configured to receive and send messages, and the memory is configured to store a computer program that supports a server to execute the foregoing method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

According to a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause all the The processor executes the method of the first aspect.

Using this application, rookit can be detected against the system call table. On the one hand, because the system call table is compared, the detection effect can be achieved with very little overhead; on the other hand, because the system call table is specified and detected at the kernel compilation stage, It will not be changed during the process, which can improve the accuracy of rookit detection.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flowchart of a rookit detection method according to an embodiment of the present invention;

2 is a schematic flowchart of another rookit detection method according to an embodiment of the present invention;

3 is a schematic block diagram of a rookit detection device according to an embodiment of the present invention;

FIG. 4 is a schematic block diagram of a server according to an embodiment of the present invention.

detailed description

In the following, the technical solutions in the embodiments of the present invention will be clearly and completely described with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The Linux operating system is divided into the kernel state ring0 state and the user state ring3 state. Most of the user's operations are in the ring3 state. All system commands and applications basically call system files. These system files are read by ring0. System call table syscall table to affect the hardware. When the ring0 state of the Linux system is attacked by the rootkit, the memory address of the syscall in the syscall table can be tampered, causing the program to read the modified syscall address and execute malicious functions to implement special functions (such as hiding background malicious processes, etc.) ).

Therefore, an embodiment of the present invention proposes a rogueit detection method for malicious software. When it detects that the Linux system is running, it loads a kernel module that is pre-deployed in the Linux system, and triggers the kernel module when it detects that the kernel module is loaded completely. The obtaining program in the ring obtains the current system call table in the ring0 state, and then obtains the pre-backed-up system call table from the secure backup area, and calls the comparison program in the ring3 state to determine the pre-backed-up system call table in the secure backup area and the acquired current Whether the system call tables are consistent. If they are not consistent, it is determined that the ring0 state of the Linux system is attacked by rookit. Detecting rookit against the system call table. On the one hand, because the system call table is compared, the detection effect can be achieved with very little overhead; on the other hand, because the system call table is specified during the kernel compilation stage, it will not be detected during the detection process. Changes can improve the accuracy of rookit detection.

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a rookit detection method according to an embodiment of the present invention. The method is applied to a linux system. The linux system is divided into a security backup area in advance, and the security backup area is backed up with a system call table in advance. The Linux system is divided into user mode ring3 mode and kernel mode ring0 mode. As shown in the figure, the rookit detection method may include:

101. When the server detects that the Linux system is running, it loads a kernel module that is pre-deployed in the Linux system.

In one embodiment, a developer can design a separate partition during system installation to mount a backup partition file used as the system call table syscall_table through a separate mount point. Linux uses ring3 level user mode, and ring0 is used as the kernel mode. The kernel state ring0 state and the user state ring3 state are two operating levels of the operating system. For example, the user runs a program. The process created by the program starts in user mode. If you want to perform file operations, network data sending, and other operations, you must use various system calls. These system calls will call the code in the kernel to complete Operation, at this time, you must switch to ring0 state, and then enter the kernel address space to execute these codes to complete the operation. After completion, switch back to ring3 state, that is, return to user mode. In this way, the program in the ring3 state cannot manipulate the kernel address space at will, and has certain security protection.

Among them, the kernel module is a socket provided by the Linux kernel to the outside, which is called a dynamically loadable kernel module (Loadable Kernel Module, LKM), and can be referred to as a module for short. The reason the linux kernel provides a module mechanism is because it is a monolithic kernel. The biggest advantage of a single kernel is high efficiency, because everything is integrated, but its disadvantage is that scalability and maintainability are relatively poor. The module mechanism is to make up for this shortcoming.

In one embodiment, when the server detects that the Linux system is running, the server may load a kernel module that is pre-deployed in the Linux system. The specific manner of loading the kernel module can be loaded by using a driver of the Linux system, and the driver can be, for example, insmod and modprobe. Among them, modprobe loads all required modules according to the output of depmod-a /lib/modules/version/modules.dep; insmod loads the kernel when needed by mode.

Among them, there are the following differences between the two loading methods: a. Modprobe can solve the dependency relationship when loading kernel modules. For example, if kernel module A is loaded, kernel module B must be loaded first. It is through / lib / modules / <kernel -version> /modules.dep file to find dependencies. And insmod cannot solve the dependency problem. b.modprobe will look for kernel modules under / lib / modules / <kernel-version> / by default, while insmod only looks for kernel modules in the parameters given to it (by default it looks in the current directory).

In one embodiment, the server may call the driver of the Linux system to start the loading process, and after the loading process is started, the module loading function is called to embed the pre-deployed kernel module into the ring0 state, thereby completing the loading of the kernel module. The driver of the Linux system may be, for example, insmod; and the loading function may be, for example, a load module function.

102. When the server detects that the loading of the kernel module is completed, the server triggers the obtaining program in the kernel module to obtain the current system call table in the ring0 state.

103. The server obtains a pre-backed-up system call table from the secure backup area, and calls a comparison program in the ring3 state to determine whether the pre-backed-up system call table in the secure backup area is consistent with the obtained current system call table.

104. If the pre-backed-up system call table is inconsistent with the obtained current system call table, the server determines that the ring0 state of the linux system is attacked by rookit.

In one embodiment, a comparison program is stored in the ring3 state in advance, and the comparison program is used to compare whether the system call table pre-backed up in the secure backup area is consistent with the current system call table obtained in step 102, and whether it has been tampered with. Was redirected. In this case, when the server detects that the kernel module is loaded, it triggers the fetch program in the kernel module to obtain the current system call table in ring0 state in real time, and obtains the previously backed up system call table from the secure backup area, and then calls The comparison program in the ring3 state determines whether the system call table backed up in the secure backup area is consistent with the obtained current system call table. If they are not consistent, it is determined that the ring0 state of the linux system has been rookit attacked. Detecting rookit against the system call table, on the one hand, because the system call table is compared, the detection effect can be achieved with very little overhead; on the other hand, because the system call table is specified during the kernel compilation stage, it will not be changed, which can improve rookit detection accuracy.

When the comparison program in the ring3 state is called to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table, a timing function may be set for the comparison program, that is, at a preset time interval. The comparison program in the ring3 state is called to perform a step of determining whether the system call table backed up in the secure backup area is consistent with the obtained current system call table.

In the embodiment of the present invention, the server may call a comparison program in the ring3 state to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table. If they are not consistent, it is determined that the ring0 state of the linux system is rookit attacked. Detecting rookit against the system call table. On the one hand, because the system call table is compared, the detection effect can be achieved with very little overhead; on the other hand, because the system call table is specified during the kernel compilation stage, it will not be detected during the detection process. Changes can improve the accuracy of rookit detection.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of another rookit detection method according to an embodiment of the present invention. As shown in the figure, the rookit detection method may include:

201. When the server detects that the Linux system is running, it loads a kernel module that is pre-deployed in the Linux system.

202. When the server detects that the loading of the kernel module is completed, the server triggers the obtaining program in the kernel module to obtain the current system call table in the ring0 state.

For specific implementations of steps 201 to 202, reference may be made to related descriptions of steps 101 to 102 in the foregoing embodiment, and details are not described herein again.

203. The server obtains the comparison program in the ring3 state, and obtains a system backup table and comparison program that are backed up in advance from the secure backup area.

204. The server compares whether the comparison program in the ring3 state and the comparison program in the secure backup area are consistent.

205: If the comparison program in the ring3 state is consistent with the comparison program in the secure backup area, the server calls the comparison program in the ring3 state to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table.

In one embodiment, the secure backup area is backed up with a comparison program in advance. In this case, after the server obtains the current system call table in the ring0 state, it can obtain the pre-backed-up system call table and comparison program from the secure backup area, and compare the comparison program in the secure backup area with the ring3 state. The comparison program in the ring3 state is compared to determine whether the comparison program in the ring3 state is consistent with the comparison program in the secure backup area. If the comparison program in the ring3 state and the comparison program in the secure backup area are consistent, the comparison program in the ring3 state is called. Determine whether the system call table backed up in the secure backup area is consistent with the current system call table obtained.

If it is determined that the comparison program in the ring3 state is inconsistent with the comparison program in the secure backup area, it can be determined that the comparison program in the ring3 state has been tampered with. In this case, the server can output a prompt message to indicate that the comparison program in the ring3 state has been tampered with. When the operation and maintenance personnel sees the prompt message, it can be processed in time.

Among them, when the server compares whether the comparison program in the ring3 state is consistent with the comparison program in the secure backup area, the server can compare the file content verification information of the two. If the file content verification information of the two is inconsistent, it can determine the The comparison program and the comparison program backed up in the secure backup area are inconsistent. The file content checking information may include a cyclic redundancy check (Cyclic Redundancy Check, CRC), a message digest algorithm value (such as Message Digest Algorithm 5 (MD5)), and the like.

Among them, the cyclic redundancy check code CRC is a hash function that generates a short fixed-digit check code based on data such as network data packets or computer files. It is mainly used to detect or verify that data may appear after transmission or storage. mistake. The generated number is calculated before being transmitted or stored and appended to the data. The receiver then checks to determine if the data has changed. That is, if the contents of the two files are exactly the same, the CRCs of the two files must be the same. Therefore, in the embodiment of the present invention, the CRC value of the comparison program can also be used to determine whether the comparison program in the ring3 state and the comparison program backed up in the secure backup area are consistent.

Among them, MD5 has been widely used to judge the reliability of file transmission. For example, the sending terminal provides an MD5 checksum in advance. After receiving the file, the receiving terminal uses the MD5 algorithm to calculate the MD5 checksum of the received file. Then, by checking whether the two checksums are consistent, the received file can be judged. Whether there is an error. Even if you make a small change in the original text (such as replacing d with c), the MD5 checksum will change dramatically. Therefore, in the embodiment of the present invention, the MD5 value of the comparison program can also be used to determine whether the comparison program in the ring3 state and the comparison program backed up in the secure backup area are consistent.

It should be noted that, in general, the reliability of the message digest algorithm is greater than the cyclic redundancy check, that is, if the CRCs of the two comparison programs are different, it can be proven that the contents of the two comparison programs are definitely different. However, if The CRC codes of the two comparison programs are the same, but the contents of the two comparison programs are not necessarily the same. However, the CRC only takes 2 bytes, and the MD5 takes 16 bytes. Therefore, when using the CRC code for verification, the efficiency will be relatively high. In summary, when comparing whether the contents of the two comparison programs are the same, you can first compare based on the CRC code. If they are different, directly determine that the contents of the two comparison programs are different; if the CRC codes are the same, then further compare the two comparisons. Whether the MD5 values of the programs are the same. If they are the same, it is determined that the contents of the two comparison programs are the same. Otherwise, it is determined that the contents of the two comparison programs are different. In this way, it is equivalent to first filter out comparison programs with definitely different contents through the CRC code, and then further verify only the comparison programs with the same CRC code. Therefore, it is equivalent to comprehensively utilize the advantages of the two verification codes, which can improve verification Efficiency can also ensure the reliability of verification.

206. If the system call table backed up in advance is inconsistent with the obtained current system call table, the server determines that the ring0 state of the linux system has been rookit attacked.

In one embodiment, the server can obtain the function address of the current system call table and output alarm information, which is used to remind the user that the current system call table located at the function address has been tampered with. In this way, after viewing the alarm information, the operation and maintenance personnel can directly find the current system call table through the function address and process the system call table.

In one embodiment, after the server determines that the ring0 state of the linux system has been attacked by rookit, it can also determine the memory address of the current system call table in the ring0 state, find the current system call table according to the memory address, and use the previously backed up The system call table replaces the current system call table, and then restores and repairs the system.

Among them, the server determines the memory address of the current system call table in the ring0 state in various ways. In one embodiment, the server may obtain a system call table address file in the linux system, which records the mapping relationship between the memory address of the current system call table in the ring0 state and the system call table backed up in advance. . Further, the server may determine the memory address of the current system call table from the system call table address file according to the mapping relationship and the system call table backed up in advance.

Exemplarily, the system call table address file may be a system.map file. The system.map file is used to store a kernel symbol table. The kernel symbol table is a mapping table of all kernel symbols and their memory addresses. Through the address, you can find the symbol, that is, find the variable and function; through the symbol, you can also know its address. In the present invention, the memory address of the current system call table can be obtained by using a symbol. The known symbol is the system call table backed up in advance. Through the system call table, the memory address of the current system call table can be found in the system.map file.

In another embodiment, the server may also obtain the interrupt descriptor table IDT in the linux system, and determine the entry point of the interrupt int0 × 80 according to the IDT, and move back from the entry point to the address where the three bytes are located. Determine the memory address of the current system call table in the ring0 state. In addition, the way the server determines the memory address of the current system call table in the ring0 state can also be brute-forced from the memory space to find the memory address of the current system call table in the ring0 state. It can also use the pre-backed up system call table. Feature search is performed in the machine code of the unexported function to determine the memory address of the current system call table in the ring0 state. The invention does not specifically limit this.

In the embodiment of the present invention, the server may obtain the pre-backed-up system call table and comparison program from the secure backup area, and then compare whether the comparison program in the ring3 state and the pre-backup comparison program are consistent. The program determines whether the system call table backed up in the secure backup area is consistent with the current system call table obtained, and the server determines that the ring0 state of the Linux system has been rookit attacked. Detect rookit against the system call table. On the one hand, because the system call table is compared, the detection effect can be achieved with very little overhead, and because the system call table is specified during the kernel compilation stage, it will not be changed, and rookit can be improved. The accuracy of the detection; on the other hand, when it is determined that the comparison program in the ring3 state has not been tampered with, the comparison program is called to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table, Can further improve the accuracy of rookit detection.

An embodiment of the present invention further provides a rookit detection device, which is applied to a linux system. The linux system includes a secure backup area in which a system call table is backed up in advance. The linux system is divided into a user state ring3 state and a kernel state ring0 state. The apparatus includes a module for performing the method described in FIG. 1 or FIG. 2. Specifically, referring to FIG. 3, it is a schematic block diagram of a rookit detection device according to an embodiment of the present invention. The rookit detection device in this embodiment includes:

A loading module 301 for loading a kernel module pre-deployed in the linux system when the linux system is detected to be running;

An obtaining module 302, configured to trigger an obtaining program in the kernel module to obtain a current system call table in the ring0 state when the loading of the kernel module is detected;

The obtaining module 302 is further configured to obtain the system call table backed up in advance from the secure backup area;

A determining module 303 is configured to call a comparison program in the ring3 state to determine whether the system call table backed up in the secure backup area is consistent with the current system call table obtained by the obtaining module. If the system call table is inconsistent with the obtained current system call table, it is determined that the ring0 state of the linux system has been rookit attacked.

In one embodiment, a comparison program is also backed up in the secure backup area, and the device further includes a comparison module 304, where:

An obtaining module 302, configured to obtain a comparison program in the ring3 state, and the comparison program backed up in the secure backup area in advance;

The comparison module 304 is configured to compare whether the comparison program in the ring3 state and the comparison program in the secure backup area are consistent. If the comparison program in the ring3 state and the comparison program in the secure backup area are consistent, then The comparison module in the ring3 state is called by the determination module 303 to determine whether the system call table backed up in the secure backup area and the obtained system call table are consistent.

In one embodiment, the apparatus further includes a replacement module 305, wherein:

A determining module 303, configured to determine a memory address of the current system call table in the ring0 state;

The replacement module 305 is configured to find the current system call table according to the memory address, and replace the current system call table with the system call table that is backed up in advance.

In one embodiment, the determining module 303 is specifically configured to obtain a system call table address file in the linux system, where the file records a memory address and a preset address of the current system call table in the ring0 state. The mapping relationship of the backed up system call table; according to the mapping relationship and the previously backed up system call table, a memory address of the current system call table is determined from the system call table address file.

In one embodiment, the determining module 303 is specifically configured to obtain the interrupt descriptor table IDT in the linux system, and determine an entry point of the interrupt int0 × 80 according to the IDT; from the entry point to The address where the three bytes are shifted backward is determined as the memory address of the current system call table in the ring0 state.

In one embodiment, the loading module 301 is specifically used to call the driver of the Linux system to start the loading process. After the loading process is started, a module loading function is called to embed a pre-deployed kernel module into the ring0. state.

In one embodiment, the apparatus further includes: an output module 306, wherein:

The obtaining module 302 is further configured to obtain a function address of the current system call table.

An output module 306 is configured to: after the obtaining module 302 obtains the function address of the current system call table, and output alarm information, the alarm information is used to prompt the user that the current system call table at the function address has been tampered with .

It should be noted that the functions of the functional modules of the rookit detection device described in the embodiment of the present invention may be specifically implemented according to the method in the method embodiment described in FIG. 1 or FIG. 2, and its specific implementation process may refer to FIG. 1 or FIG. The description of the method embodiment of 2 is not repeated here.

Please refer to FIG. 4. FIG. 4 is a schematic block diagram of a server provided by an embodiment of the present invention. The server is applied to a linux system. The linux system includes a secure backup area in which a system call table is backed up in advance. Ring3 state for user mode and ring0 state for kernel mode. As shown in FIG. 4, the server includes a processor 401, a memory 402, and a network interface 403. The processor 401, the memory 402, and the network interface 403 may be connected through a bus or in other manners. In FIG. 4 shown in the embodiment of the present invention, connection through a bus is taken as an example. The network interface 403 is controlled by the processor to send and receive messages, and the memory 402 is used to store a computer program. The computer program includes program instructions, and the processor 401 is used to execute the program instructions stored in the memory 402. Wherein, the processor 401 is configured to call the program instructions for execution: when the Linux system is detected to be running, load a kernel module pre-deployed in the Linux system; and when it is detected that the kernel module is loaded completely Next, the obtaining program in the kernel module is triggered to obtain the current system call table in the ring0 state; the system call table backed up in advance is obtained from the secure backup area, and the comparison program in the ring3 state is called to determine Whether the system call table backed up in the secure backup area is consistent with the acquired current system call table; if the system call table backed up in advance is inconsistent with the acquired current system call table, determining the The ring0 state of the linux system was attacked by rookit.

It should be understood that, in the embodiment of the present invention, the processor 401 may be a central processing unit (CPU), and the processor 401 may also be another general-purpose processor or a digital signal processor (Digital Signal Processor, DSP). ), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 402 may include a read-only memory and a random access memory, and provide instructions and data to the processor 401. A part of the memory 402 may further include a non-volatile random access memory. For example, the memory 402 may also store information of a device type.

In specific implementation, the processor 401, the memory 402, and the network interface 403 described in the embodiment of the present invention may execute the implementation manner described in the method embodiment shown in FIG. 1 or FIG. 2 provided by the embodiment of the present invention, and may also execute The implementation manner of the rookit detection device described in the embodiment of the present invention is not repeated here.

In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions are implemented when executed by a processor: When the linux system is detected to be running, a kernel module pre-deployed in the linux system is loaded; when the completion of the loading of the kernel module is detected, an acquisition program in the kernel module is triggered to obtain the ring0 state. Obtain the current system call table backed up from the secure backup area, and call a comparison program in the ring3 state to determine the system call table backed up in the secure backup area and the acquired Whether the current system call table is consistent; if the system call table backed up in advance is inconsistent with the obtained current system call table, it is determined that the ring0 state of the linux system has been rookit attacked.

The computer-readable storage medium may be an internal storage unit of the server according to any of the foregoing embodiments, such as a hard disk or a memory of the server. The computer-readable storage medium may also be an external storage device of the server, such as a plug-in hard disk, a Smart Media Card (SMC), and a Secure Digital (SD) card provided on the server. , Flash card (Flash card) and so on. Further, the computer-readable storage medium may further include both an internal storage unit of the server and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the server. The computer-readable storage medium may also be used to temporarily store data that has been or will be output.

Those of ordinary skill in the art can understand that all or part of the processes in the method of the foregoing embodiment can be implemented by using a computer program to instruct related hardware. The program can be stored in a computer-readable storage medium. When executed, the processes of the embodiments of the methods described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

The above disclosure is only part of the embodiments of the present invention. Of course, the scope of rights of the present invention cannot be limited by this. Those of ordinary skill in the art can understand all or part of the process of implementing the above embodiments and make according to the claims of the present invention. The equivalent changes still fall within the scope of the invention.

Claims

A malware rookit detection method, characterized in that the method is applied to a linux system, which includes a secure backup area with a system call table backed up in advance, and the linux system is divided into a user state ring3 state and a kernel state ring0 state ,include:

When detecting that the linux system is running, loading a kernel module pre-deployed in the linux system;

When it is detected that the loading of the kernel module is completed, triggering an obtaining program in the kernel module to obtain the current system call table in the ring0 state;

Obtain the system call table backed up in advance from the secure backup area, and call the comparison program in the ring3 state to determine the system call table backed up in the secure backup area and the acquired current system call table Whether consistent

If the system call table backed up in advance is inconsistent with the obtained current system call table, it is determined that the ring0 state of the linux system has been rookit attacked.
The method according to claim 1, wherein a comparison program is also backed up in the secure backup area, and the comparison program in the ring3 state is called to determine the system call backed up in the secure backup area in advance. Before the table is consistent with the obtained current system call table, the method further includes:

Acquiring the comparison program in the ring3 state and the comparison program backed up in the secure backup area in advance;

Comparing whether the comparison program in the ring3 state and the comparison program in the secure backup area are consistent;

If the comparison program in the ring3 state is consistent with the comparison program in the secure backup area, triggering the calling of the comparison program in the ring3 state to determine the system call table and A step of obtaining whether the current system call table is consistent.
The method according to claim 1 or 2, wherein after determining that the ring0 state of the linux system is attacked by rookit, the method further comprises:

Determining a memory address of the current system call table in the ring0 state;

Find the current system call table according to the memory address, and replace the current system call table with the system call table backed up in advance.
The method according to claim 3, wherein the determining a memory address of the current system call table in the ring0 state comprises:

Obtaining a system call table address file in the linux system, where the file records a mapping relationship between a memory address of the current system call table in the ring0 state and the system call table backed up in advance;

According to the mapping relationship and the system call table backed up in advance, a memory address of the current system call table is determined from the system call table address file.
The method according to claim 3, wherein determining a memory address of the current system call table of the ring0 state comprises:

Obtaining the interrupt descriptor table IDT in the linux system, and determining an entry point of the interrupt int0 × 80 according to the IDT;

The address where three bytes are moved backward from the entry point is determined as the memory address of the current system call table in the ring0 state.
The method according to any one of claims 1-5, wherein the loading a kernel module pre-deployed in the linux system comprises:

Calling the driver of the Linux system to start the loading process;

After the loading process is started, a module loading function is called to embed a pre-deployed kernel module into the ring0 state.
The method according to any one of claims 1 to 6, wherein after determining that the system call table backed up in the secure backup area in advance is inconsistent with the obtained current system call table, the method Also includes:

The function address of the current system call table is obtained, and alarm information is output, and the alarm information is used to prompt a user that the current system call table located at the function address has been tampered with.
A malicious software rookit detection device, characterized in that the device is applied to a linux system, which includes a secure backup area with a system call table backed up in advance, and the linux system is divided into a user state ring3 state and a kernel state ring0 state ,include:

The loading module is fast, and is used to load a kernel module pre-deployed in the linux system when the linux system is detected to be running;

An obtaining module, configured to trigger an obtaining program in the kernel module to obtain a current system call table in the ring0 state when the loading of the kernel module is detected;

The obtaining module is further configured to obtain the system call table backed up in advance from the secure backup area;

A determining module for invoking a comparison program in the ring3 state to determine whether the system call table backed up in the secure backup area is consistent with the current system call table obtained by the obtaining module; If the system call table is inconsistent with the obtained current system call table, then it is determined that the ring0 state of the linux system is attacked by rookit.
The device according to claim 8, characterized in that the security backup area further backups a comparison program in advance, and the device further comprises: a comparison module, wherein:

The obtaining module is configured to obtain a comparison program in the ring3 state and the comparison program backed up in the secure backup area in advance;

The comparison module is configured to compare whether the comparison program in the ring3 state and the comparison program in the secure backup area are consistent. If the comparison program in the ring3 state and the comparison program in the secure backup area are consistent, Then, the comparison module in the ring3 state is called by the determining module to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table.
The device according to claim 8 or 9, wherein the device further comprises: a replacement module, wherein:

The determining module is further configured to determine a memory address of the current system call table in the ring0 state;

The replacement module is configured to find the current system call table according to the memory address, and replace the current system call table with the system call table backed up in advance.
The device according to claim 10, wherein the determining module is specifically configured to obtain a system call table address file in the linux system, and the file records the current system call in the ring0 state. Mapping relationship between the memory address of the table and the system call table backed up in advance; and determining the current system call from the system call table address file according to the mapping relationship and the system call table backed up in advance The memory address of the table.
The device according to claim 10, wherein the determining module is further configured to obtain an interrupt descriptor table IDT in the linux system, and determine an entry point of the interrupt int0 × 80 according to the IDT; The address where three bytes are moved backward from the entry point is determined as the memory address of the current system call table in the ring0 state.
The device according to any one of claims 8-12, wherein the loading module is fast, and is specifically configured to call a driver of the Linux system to start a loading process, and after the loading process is started, a module loading is called The function embeds a pre-deployed kernel module into the ring0 state.
The device according to any one of claims 8-13, wherein the device further comprises: an output module, wherein:

The obtaining module is further configured to obtain a function address of the current system call table

The output module is configured to output alarm information after the acquisition module obtains the function address of the current system call table, and the alarm information is used to remind the user that the current system call table at the function address has been tampered with. .
A server is characterized in that the server is applied to a linux system, the linux system includes a secure backup area in which a system call table is backed up, and the linux system is divided into a user mode ring3 state and a kernel mode ring0 state, and the server The processor includes a processor and a memory, where the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute : When detecting that the linux system is running, loading a kernel module that is pre-deployed in the linux system; when detecting that the kernel module is loaded completely, triggering an obtaining program in the kernel module to obtain the ring0 The current system call table in the state; obtain the system call table backed up in advance from the secure backup area, and call the comparison program in the ring3 state to determine the system call table backed up in the secure backup area and Whether the obtained current system call table is consistent; if the system call table backed up in advance is identical to the obtained current call The system call table is inconsistent, it is determined that the state of the linux ring0 rookit system is attacked.
The server according to claim 15, wherein a comparison program is also backed up in the secure backup area, and the processor is further configured to obtain the comparison program in the ring3 state and the secure backup area. The comparison program backed up in advance; comparing whether the comparison program in the ring3 state and the comparison program in the secure backup area are consistent; if the comparison program in the ring3 state and the comparison program in the secure backup area are consistent Then triggering the step of determining, by the determining module, calling a comparison program in the ring3 state to determine whether the system call table backed up in the secure backup area is consistent with the obtained current system call table.
The server according to claim 15 or 16, wherein the processor is further configured to determine a memory address of the current system call table in the ring0 state; and find the current address according to the memory address. A system call table, and replacing the current system call table with the system call table backed up in advance.
The server according to claim 17, wherein the processor is further configured to obtain a system call table address file in the linux system, and the file records the current system call in the ring0 state. Mapping relationship between the memory address of the table and the system call table backed up in advance; and determining the current system call from the system call table address file according to the mapping relationship and the system call table backed up in advance The memory address of the table.
The server according to claim 17, wherein the processor is further configured to obtain an interrupt descriptor table IDT in the linux system, and determine an entry point of the interrupt int0 × 80 according to the IDT; The address where three bytes are moved backward from the entry point is determined as the memory address of the current system call table in the ring0 state.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of claims 1-7 is required.