CN101777102B - Security audit method and system for kernel - Google Patents

Abstract

The invention discloses a method and a system for safety audit of a kernel, which mainly comprise the following steps: by integrating the kernel anti-hooking technology into the host security system and organically combining the host security audit technology with the kernel anti-hooking technology, each kernel module in the equipment is scanned, a kernel hook installed in each kernel module is determined, the kernel module with illegal software installed is determined, and the determined kernel module is uninstalled, so that the security and the reliability of the kernel system are improved.

Description

A security audit method and system for the kernel

technical field

The invention relates to the field of computers, in particular to a method and a system for performing security audits on computer kernels using security audit technologies.

Background technique

There are many kinds of computer security auditing techniques, such as host computer security auditing techniques. The purpose of host security audit technology is to improve the security of the system host, and to achieve the purpose of protecting the computer host through the control and audit of computer peripherals. Control and audit of computer peripherals includes control of computer interfaces and control of computer equipment classes. Specifically, the host security audit technology includes the following technical content:

Dial-up behavior control: allow/prohibit internal network users to dial into the external network through MODEM or ADSL;

Network communication control: allow/record/prohibit communication between intranet hosts;

Host characteristic control: record the host software and hardware characteristics, and realize computer asset management;

Host file control: allow/record/prohibit operations on specified files on the host;

Host device control: allow/record/prohibit the use of host local devices, such as: U disk, floppy drive, parallel port, serial port, printer, etc.;

Operation behavior control: record/view host operator behavior, including: current screen, keyboard input.

The security management of the kernel refers to the security management of software running in the kernel, that is, the management of kernel hooks. Hooks are a key point of the message processing mechanism in WINDOWS. By installing various hooks in the computer, the application program can set up corresponding subroutines to monitor the message delivery in the system and process them before these messages reach the target window program. There are many types of hooks, each of which can intercept and process corresponding message classes. For example: keyboard hooks can intercept keyboard messages, mouse hooks can intercept mouse messages, shell hooks can intercept messages for starting and closing applications, log hooks can monitor and record input events, etc.

Kernel hooking is to implement hook-like behavior at the kernel layer of Windows, so as to achieve the purpose of controlling some functions at the bottom of the system. There are also many types of kernel hooks, such as: system service descriptor table (systemservices descriptor table, SSDT) kernel hook, system service descriptor table (Shadow SSDT) kernel hook related to the graphical interface, file system driver (File system driver, FSD) kernel hook, interrupt descriptor table (Interrupt Descriptor Table, IDT) kernel hook, kernel embedded hook (Inline Hook), I/O request package (I/O Request package, IRP) filter hook, filter driver hook and system Callback routine (CallBack) hook, etc.

Currently, anti-hook technology is mainly used in some small professional security detection tools to detect system kernel hooks; while in the existing host security audits, it mainly focuses on desktop-level audits, which can only be performed by computer peripherals. The control and auditing of the computer can achieve the purpose of protecting the computer host, but the software behavior in the computer kernel state cannot be audited. The existing anti-hook technology cannot correctly evaluate the legality of software behavior in the kernel state. At the same time, the detected kernel state information is complex, and it is difficult for ordinary technicians to know the current kernel state; further, the existing anti-kernel hook Without the support of the database, the technology cannot record and analyze the software behavior in the kernel state.

Contents of the invention

Embodiments of the present invention provide a method and system for security auditing of the kernel, so as to solve the problem that the security audit of the kernel of the device cannot be performed in the existing host security audit.

A method for security auditing of the kernel, said method comprising: a kernel scanning step: scanning each kernel module in the device to determine the kernel hooks installed in each kernel module; a comparison step: using a plurality of preset The behavior information group compares the kernel hooks installed in each kernel module, wherein each behavior information group contains at least one kernel hook identifier; matching step: the comparison result obtained in the comparison step is that the installed kernel hook covers any The kernel hook identifier in the behavior information group is determined to match each other, and the kernel module to which the kernel hook belongs is further determined; unloading step: unloading the kernel module determined in the matching step. .

A security audit system for the kernel, said system comprising: a kernel scanning module, used to scan each kernel module in the device, to determine the kernel hooks installed in each kernel module; a kernel audit module, used to utilize pre-installed Multiple behavior information groups are set, and the kernel hooks in each kernel module are compared. If the comparison result shows that the installed kernel hook covers the kernel hook identifier in any behavior information group, it is determined that they match each other, and the kernel hook is further determined. The kernel module, wherein each behavior information group includes at least one kernel hook identifier; the audit execution module is used to unload the kernel module determined by the kernel audit module.

The beneficial effect of the embodiment of the present invention:

Since the embodiment of the present invention integrates the kernel anti-hook technology into the host security system, organically combines the host security audit technology and the kernel anti-hook technology, scans each kernel module in the device and determines the Kernel hooks to determine the kernel modules with illegal software installed, and uninstall the determined kernel modules, so as to improve the security and reliability of the kernel system.

Description of drawings

FIG. 1 is a schematic diagram of a security audit method for a kernel in Embodiment 1 of the present invention;

FIG. 2 is a schematic structural diagram of a security audit system for the kernel in Embodiment 2 of the present invention;

FIG. 3 is a schematic diagram of a scenario in which the security audit system for the kernel is applied in Embodiment 2 of the present invention.

Detailed ways

In order to conduct a security audit of software behavior in the computer kernel state, the embodiment of the present invention integrates the kernel anti-hook technology into the host security system, and organically combines the host security audit technology and the kernel anti-hook technology to achieve monitoring of the computer from the kernel state. The action behavior of all software from user mode to improve the security and reliability of the computer.

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

Embodiment one:

Embodiment 1 of the present invention applies the kernel anti-junzi technology to the host security audit technology, and proposes a new kernel security audit method, as shown in Figure 1, the method includes the following steps:

Step 101: Scan each kernel module in the device, and determine the kernel hooks installed in each kernel module.

The devices involved in this step may be terminal devices such as computers, or other terminals that need to perform a security audit on the kernel state of the device.

The device to be processed has a kernel system, and at least one software is installed in the kernel system, and each software can correspond to a kernel module, where the kernel module refers to a driver file (equivalent to an exe file in the application layer), in each Kernel hooks may in turn be installed in kernel modules.

In order to conduct a security audit of the software behavior of the kernel state of the device, it is necessary to scan the kernel module in the device. The scanning method can be real-time scanning or periodic scanning. The scanning cycle can be based on experience values or security If the security requirements for the device kernel are high, you can set a shorter scan cycle so that you can quickly find out when the kernel software state is abnormal; if you have low security requirements for the device kernel, you can set Short scan cycle to save device resources.

After the kernel hooks installed in the kernel module are determined in this step, the kernel hook identifier corresponding to each kernel module can be recorded.

Step 102: Using multiple preset behavior information groups, compare the kernel hooks in each kernel module.

Wherein, each behavior information group contains at least one kernel hook identifier, and further, the sum of the kernel hook identifiers contained in each behavior information group indicates that the set of kernel hooks corresponding to the kernel hook identifier is illegal.

In this step, the behavior information group can be set according to the actual experience of the administrator, and the set behavior information group can be stored in the database. The database here can be a storage component of the application layer of the device, or can be a other database devices for communication.

Step 103: Determine the kernel module whose installed kernel hook matches the kernel hook identifier in the at least one behavior information group, and uninstall the determined kernel module.

The specific method of using the behavior information group to compare with the kernel hook in the kernel module is:

Determine the kernel hook identifier corresponding to the kernel module according to the kernel hook in the determined kernel module, and then compare the kernel hook identifier corresponding to the kernel module with the kernel hook identifier in each behavior information group, if the kernel module corresponds to The hook identifiers are all contained in the kernel hook identifiers in a certain behavior information group (including the kernel hook identifier corresponding to the kernel module is exactly the same as the kernel hook identifier in the behavior information group, or the kernel hook identifier corresponding to the kernel module contains the behavior information group If the kernel hook identifier in the behavior information group matches the kernel hook identifier), it means that the kernel module is a kernel module that matches the kernel hook identifier in the behavior information group, and it is determined that illegal software (such as malware or spyware) is installed in the kernel module; otherwise, it is determined that the No illegal software is installed in the kernel module.

In order to ensure the security of the device kernel, after the kernel with illegal software is determined to be installed in this step, the illegal kernel hook installed in the kernel module can be restored first, that is, the kernel in the matching behavior information group found from the determined kernel module can be restored The hook identifies the corresponding kernel hook, and then unloads the determined kernel module.

The following example illustrates the restoration of illegal kernel hooks installed in a kernel module: If four kernel hooks A, B, C, and D are running in a kernel module, a certain behavior information group contains three kernel hook identifiers of A, B, and C , indicating that the three kernel hooks A, B, and C are installed together as a spyware behavior, and then restore the three kernel hooks A, B, and C running in the kernel module.

The execution means of resuming the kernel hook may be: overwrite the hook code with the normal code from the disk file. For example: if the malware installs an IDT keyboard hook to read the password entered by the user through the keyboard, after recovery through the hook, since the keyboard hook code does not exist, it will no longer be able to read the password entered by the user through the keyboard.

Through the scheme of steps 101 to 103 above, use the host security audit technology to conduct a security audit on the kernel module of the device, and use the preset insecure strategy to find out which kernel modules in the kernel system have illegal software installed, so as to increase security The accuracy of the determination of the malicious kernel module enables non-professional technicians to conduct security audits on the kernel state of the device through the solution provided by the embodiment of the present invention.

In Embodiment 1 of the present invention, the security audit method is further optimized by means of a white list, and the specific method is as follows:

The following steps are also included between step 101 and step 102:

Step A: Determine a legal kernel module from multiple kernel modules according to preset kernel whitelist information.

The kernel whitelist information in this step can also be stored in the same database as the behavior information group, or can be stored in different databases respectively.

Since the legal kernel module has been screened out in step A, therefore, in step 102, the kernel module that needs to determine whether an illegal kernel hook is installed is: other kernel modules except the legal kernel module in the kernel system, and Kernel modules belonging to the kernel whitelist information can be ignored when determining whether an illegal kernel hook is installed.

Embodiment two:

The embodiment of the present invention also provides a security audit system for the kernel under the same inventive concept as Embodiment 1, as shown in Figure 2, the system includes the following components: a kernel scanning module 11, a kernel audit module 12 and an audit execution module 13, wherein: the kernel scanning module 11 is used to scan each kernel module in the device to determine the kernel hooks installed in each kernel module; the kernel audit module 12 is used to use a plurality of preset behavior information groups to Compare the kernel hooks in each kernel module, and determine the kernel module that the installed kernel hook matches the kernel hook identifier in the at least one behavior information group, wherein each behavior information group contains at least one kernel hook identifier; audit execution Module 13 is used to unload the kernel module determined by the kernel audit module.

The kernel security audit system in this embodiment can be installed in the device, and further, can be applied to the application layer of the device. As shown in Figure 3, the kernel security audit system is installed in the user computer system, and communicates with the kernel system to complete the security audit of each kernel module in the kernel system. Specifically, the host audit system server process and the audit system management service web interface read the preset insecure policies (including behavior information group and kernel whitelist information) from the database, and then send them from the LAN network to A security audit system for the kernel.

The kernel scanning module 11 needs to scan the various hooks installed in the kernel module, and its scanning content can be the kernel driver shown in Figure 2, filter driver, FSD hook, SSDT hook, Shadow SSDT hook, IDT hook, CallBack hook and kernel Code inline hooks.

If what current audit is non-kernel routine behavior, then directly check according to present host computer security auditing technology, if what current audit is the behavior of whether kernel installs software illegal software, then kernel scanning module 11 sends the kernel auditing module 12 with scanning result. Kernel audit module 12 audits each kernel module according to the unsafe policy from server system, finally restores some or all kernel hooks in the kernel module that illegal software has been installed by audit execution module 13, and unloads described kernel audit module 12 to determine The kernel module.

The kernel audit module 12 is also used to find the kernel hook corresponding to the kernel hook identifier in the matching behavior information group from the determined kernel module; then the audit execution module 13 is also used to restore the found Kernel hooks.

The system also includes a legal determination module 14 for determining a legitimate kernel module from a plurality of kernel modules according to preset kernel whitelist information; Other kernel modules other than legitimate kernel modules, and compare the kernel hooks in the other kernel modules by using the behavior information group.

Embodiment three:

The schemes of Embodiment 1 and Embodiment 2 of the present invention will be described in detail below through a specific example.

Assume that two behavior information groups are preset in the third embodiment, wherein: the kernel hook identifier contained in behavior information group 1 is IDT keyboard hook identifier+TDI network communication hook identifier; the kernel hook identifier contained in behavior information group 2 IDT keyboard hook identifier + NDIS network communication hook identifier.

Kernel scanning module 11 scans each kernel module of computer, obtains the behavior of installing hooks in 3 kernel modules respectively, and sends the identification of these 3 kernel modules to legal determination module 14; Legal determination module 14 according to preset Kernel whitelist information, determine that kernel module 3 is a legal kernel module; Legal determination module 14 sends the scan result of kernel module 1 and kernel module 2 to kernel audit module 12, wherein: the hook installed in kernel module 1 is: IDT keyboard Hook + TDI network communication hook + FSD hook; the hook installed in kernel module 2 is: IDT keyboard hook + CallBack hook. If the kernel audit module 12 determines that the identifier corresponding to the hook installed in the kernel module 1 includes the kernel hook identifier included in the behavior information group 1, then illegal software is installed in the kernel module 1 . The audit execution module 13 recovers the kernel hook corresponding to the IDT keyboard hook identifier and the TDI network communication hook identifier in the kernel module 1, and then uninstalls the kernel module 1.

Through the schemes of Embodiment 1 to Embodiment 3 of the present invention, the kernel anti-hook technology is applied to the host security audit system to form a new generation of host security audit system with anti-kernel spyware functions; use the host security audit technology to check the kernel module of the device Carry out safety audit, and utilize pre-set unsafe policy to find out which kernel modules in the kernel system have installed illegal software, to increase the accuracy of judging malicious kernel modules, so that non-professional technicians can also pass through the embodiment of the present invention The provided solution performs security audit on the kernel state of the device.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (9)

1. the method for auditing safely to kernel is characterized in that, said method comprises:

The kernel scanning step: each kernel module in the equipment scans, and confirms the kernel hooking of installing in each kernel module;

Comparison step: utilize predefined a plurality of behavioural information group, the kernel hooking of installing in each kernel module is compared, wherein, comprise at least one kernel hooking sign in each behavioural information group;

The coupling step: kernel hooking identifies the comparative result that comparison step draws in arbitrary behavioural information group for the kernel hooking of installing covers, and then judges coupling each other, further confirms the kernel module that this kernel hooking is affiliated;

Unloading step: the kernel module of confirming in the unloading coupling step.

2. the method for claim 1 is characterized in that, the set that the kernel hooking sign sum that comprises in each behavioural information group is represented the kernel hooking that the kernel hooking sign is corresponding is for illegal.

3. the method for claim 1 is characterized in that, after the coupling step, before the unloading step, said method also comprises:

From the said kernel module of confirming, find out with the behavioural information group of mating in kernel hooking identify corresponding kernel hooking;

The said kernel hooking that recovery finds out.

4. the method for claim 1 is characterized in that, after the kernel scanning step, before the coupling step, said method also comprises:

According to predefined kernel white list information, from a plurality of kernel modules, confirm legal kernel module;

Utilize the behavioural information group that the kernel hooking in each kernel module is compared, comprising:

From a plurality of kernel modules, confirm other kernel modules except that legal kernel module, and utilize the behavioural information group that the kernel hooking in said other kernel modules is compared.

5. the safety auditing system to kernel is characterized in that, said system comprises:

The kernel scan module is used for each kernel module in the equipment is scanned, and confirms the kernel hooking of installing in each kernel module;

Kernel audit module; Be used to utilize predefined a plurality of behavioural information group, the kernel hooking in each kernel module is compared, comparative result covers kernel hooking sign in arbitrary behavioural information group for the kernel hooking of installing; Then judge coupling each other; Further confirm the kernel module that this kernel hooking is affiliated, wherein, each behavioural information group comprises at least one kernel hooking sign;

The audit execution module is used to unload the kernel module that said kernel audit module is confirmed.

6. system as claimed in claim 5 is characterized in that, the set that the kernel hooking sign sum that comprises in each behavioural information group is represented the kernel hooking that the kernel hooking sign is corresponding is for illegal.

7. system as claimed in claim 5 is characterized in that,

Said kernel audit module, also be used for from the said kernel module of confirming find out with the behavioural information group of mating kernel an ancient unit of weight identify corresponding kernel hooking;

Said audit execution module also is used to the said kernel hooking of recovering to find out.

8. system as claimed in claim 5 is characterized in that, said system also comprises:

Legal determination module is used for according to predefined kernel white list information, from a plurality of kernel modules, confirms legal kernel module;

Said kernel audit module specifically is used for confirming other kernel modules except that legal kernel module from a plurality of kernel modules, and utilizes the behavioural information group that the kernel hooking in said other kernel modules is compared.

9. like the arbitrary described system of claim 5～8, it is characterized in that said safety auditing system to kernel is applied to the application layer of equipment.

Images