CN110516444B - Cross-terminal and cross-version Root attack detection and protection system based on kernel - Google Patents

Abstract

The invention discloses a kernel-based cross-terminal cross-version Root attack detection and protection system, which comprises a Root monitoring subsystem for monitoring and detecting Root attack, a Root protection subsystem connected with the Root monitoring subsystem and stopping the Root attack through system management, and a private data protection module connected with the Root protection subsystem and hiding private data which are required to be read by a malicious program; the Root monitoring subsystem comprises a monitoring control module for monitoring Root attack, and a file operation monitoring module, a process operation monitoring module and a memory operation monitoring module which are respectively connected with the monitoring control module. Through the scheme, the method and the device achieve the purpose of protecting the Android system when the Root attack of the malicious program occurs, and have high practical value and popularization value.

Description

Kernel-based cross-terminal cross-version root attack detection and protection system

technical field

The invention belongs to the technical field of Android, and specifically relates to a kernel-based cross-terminal and cross-version Root attack detection and protection system.

Background technique

With the continuous development of science and technology, smart phones have penetrated into people's lives. As a representative of the mobile phone operating system, as of the first quarter of 2017, the Android system has occupied 86.4% of the Chinese smartphone market share. But at the same time, root attacks against the Android system are increasing day by day, and the rooted Android system often has information leakage, including bank accounts, work content, private photos and other information. The leakage of these information is a big problem for users. Very bad thing, and if one of the mobile phones with the same Android system and the same brand is successfully attacked by Root, the other mobile phones of the same model are very likely to be attacked. Therefore, how to detect root attacks to remind other Android system users and prevent root attacks of malicious programs is a problem that those skilled in the art need to solve urgently.

Contents of the invention

The purpose of the present invention is to provide a kernel-based cross-terminal and cross-version root attack detection and protection system, which mainly solves the problem that root attacks of malicious programs in the prior art cause losses to Android users and developers.

In order to achieve the above object, the technical scheme adopted in the present invention is as follows:

Kernel-based cross-terminal and cross-version root attack detection and protection system, including a root monitoring subsystem for monitoring and detecting root attacks, a root protection subsystem connected with the root monitoring subsystem and terminating root attacks through system governance, and A privacy data protection module that is connected with the Root protection subsystem and hides the privacy data that malicious programs want to read; the Root monitoring subsystem includes a monitoring control module for monitoring Root attacks, and files connected with the monitoring control module respectively An operation monitoring module, a process operation monitoring module and a memory operation monitoring module, wherein the Root protection subsystem process operation monitoring module is connected.

Further, the Root protection subsystem includes an attack behavior recording module for recording Root attacks, an attack pattern receiving module for receiving the monitoring situation of the Root monitoring subsystem, and an attack pattern receiving module for receiving the mobile phone terminal attack behavior record module and attack pattern receiving module respectively. An attack pattern extraction module and an attack pattern database located in the cloud for module feedback information, an attack pattern comparison module for receiving the attack pattern receiving module, and an attack pattern interception module connected with the attack pattern comparison module.

Compared with the prior art, the present invention has the following beneficial effects:

(1) The present invention is based on the Android kernel, detects and intercepts Root attacks at the kernel level, analyzes the Root attack behavior, mines its behavioral characteristics, extracts its attack pattern, uploads the attack pattern to the cloud, and updates the Root attack pattern database , for other Android mobile phone users to download and use to ensure timely identification and protection of this mode; Root Defender provides privacy data protection function, adopts the method of active response, and provides false information for criminals by forging and hiding user privacy data. data, thereby maximizing the protection of privacy data. The present invention detects, intercepts and protects existing Root attack behaviors, effectively protecting user information security; learning unknown Root behaviors, effectively avoiding further harm to the information security of more users; The system can also prevent and protect the user's information security, and Root Defender supports cross-terminal and cross-version protection against Root attacks, which has played a very good role in protecting the Android system.

(2) The present invention detects the Root attack through the Root monitoring subsystem, and detects the Root behavior of the mobile phone through the monitoring control module APK with the Root function, which can effectively detect the Root behavior and display the Root attack behavior record. The Root attack behavior recording module in the Root protection subsystem of the present invention records the detected Root attack behavior after the Root monitoring subsystem detects the attack behavior, and uploads to the cloud for analysis and extraction; Root attack pattern extraction module analyzes The core behavior of Root attack, and extracting the attack mode, can analyze and extract the Root attack behavior, and record it; Root attack mode database: a database of known Root attack modes summarized in the cloud, which can contain all known Root attack mode; the root attack mode receiving module downloads the new database of Root attack behavior to different clients, and updates the old database; Root attack mode interception, when there is a known attack mode Root behavior, can be effective to intercept;

(3) The Root Defender of the present invention provides a complete set of "nanny service" for detecting malicious Root attack programs, intercepting malicious Root attack programs, and privacy data protection for each Android mobile terminal, which not only recognizes the attack behavior of malicious Root programs and prompts For users, and for each user who uses this system, it provides protection against the operation of private data by malicious Root programs.

(4) After the root monitoring subsystem of the present invention's current phase of the root monitoring subsystem detects a root attack behavior, the privacy data that the malicious program wants to read is hidden, and the malicious program is protected without response, or the The forged data is displayed to malicious programs to protect the Android system.

Description of drawings

Fig. 1 is a schematic diagram of the system structure of the present invention.

Detailed ways

The present invention will be further described below with reference to the accompanying drawings and examples, and the embodiments of the present invention include but not limited to the following examples.

Example

As shown in Figure 1, the kernel-based cross-terminal and cross-version root attack detection and protection system includes a root monitoring subsystem that monitors and detects root attacks, and a root monitoring subsystem that is connected to terminate root attacks through system governance The root protection subsystem, and the privacy data protection module connected with the root protection subsystem and hiding the private data that malicious programs want to read.

The present invention is divided into two steps of detection and protection when realizing Root attack detection and protection system, wherein, the concrete steps of carrying out Root attack detection are:

Preliminary preparation: Configure the file monitor.cfg in the monitoring control module of the Root monitoring subsystem to obtain the uid of the APK to be monitored and maintain a dynamic linked list consisting of the pid of the process generated by the uid, and filter the content that does not need to be monitored.

Step 1: After the monitoring control module is operated, the file operation monitoring module is performed. First, the user calls the sys_ioctl system to obtain the current process uid and pid. If the uid is the execution uid, record the operation timestamp, call the d_path function to find the file path from the file descriptor fd and record it, and record the program’s control command to the device obtained by the parameter cmd Open the log file.log, if successful, write the log file.log and execute orig_sys_ioctl, save the return value, cred integrity check returns the return value of orig_sys_ioctl, and end the execution.

Step 2: If the above uid is not the specified uid, but the pid is in the monitoring list, the execution can be completed normally. If the pid is not in the monitoring list, execute orig_sys_ioctl, save the return value, return the return value of orig_sys_ioctl, and end the execution.

Step 3: If opening the log file.log fails as described in the first step, create a log file.log and then write to the log file.log and complete the execution.

Step 4: The user then calls the sys_fchmodat system call to obtain the current process uid and pid. If the uid is specified, record the operation timestamp and record the changed read-write execution attribute obtained by the parameter mode. If pathname is an absolute path, record it The file path of the target file or folder. If the log file.log is successfully opened, it will be written to the log file.log, execute orig_sys_fchmodat, save the return value, cred integrity check, and return the return value of orig_sys_fchmodat.

Step 5: If the uid is not specified, but the pid is in the monitoring list, record the operation timestamp and complete the execution as described above. If the pid is not in the monitoring list, execute orig_sys_fchmodat, save the return value, return the return value of orig_sys_fchmodat, and complete the execution.

Step 6: If the pathname mentioned in Step 4 is not an absolute path, call the dirfd function to find the file path from the file path descriptor dfd, record the file path of the target file or folder, and then open the log file.log to complete the execution.

Step 7: If opening the log file.log in step 4 fails, you need to create a log file.log, write to the log file.log, and complete the execution.

Step 8: The user calls the sys_lseek system call to obtain the uid and pid of the current process. If uid is specified, record the operation timestamp, record the offset in the file obtained by the parameter offset, and record the file offset obtained by the parameter whence. The d_path function finds and records the file path from the file descriptor fd. Open the log file.log, write to file.log if successful, execute orig_sys_lseek, save the return value, cred integrity check, return the return value of orig_sys_lseek, and end the execution.

Step 9: As described in Step 2 and Step 3, the file name is orig_sys_lseek.

Step 10: After completing the above monitoring and control main module operation and file operation monitoring module operation, perform process operation monitoring module operation. The user first calls sys_execve to obtain the current process uid and pid. If the uid is specified, record the operation timestamp and record The file path obtained by the parameter filename, record the execution parameters obtained by the parameter argv, record the execution environment variable obtained by the parameter envp, and open the log proc.log. If the log is opened successfully, write to the log proc.log, execute orig_sys_execve, save the return value, and end the execution.

The eleventh step: If in the tenth step, the uid is not the specified uid, and the pid is in the monitoring list, then the execution can be completed normally. If the pid is not in the monitoring execution list, execute orig_sys_execve and return the return value of orig_sys_execve to end the execution.

Step 12: If opening the log proc.log fails in Step 10, create a log proc.log to complete the execution.

Step 13: After the user invokes the sys_setuid system call, obtain and save the current process uid and pid, execute orig_sys_setuid, and save the return value. If the uid is specified, record the operation timestamp, record the far uid of the current process, and record the new uid. And open the log proc.log, if successful, monitor the cred integrity and return the orig_sys_setuid return value.

Step 14: If no uid is specified, and the pid is in the monitoring list, normal execution will be completed. If no uid is specified and the pid is not in the monitoring list, it will directly return the return value of orig_sys_setuid and end the execution.

Step 15: After the user calls the sys_mmap system call, the kernel space obtains the uid and pid of the current process, executes orig_sys_mmap, saves the return value, and specifies the uid. If it is the specified uid, record the operation timestamp and record the value obtained by the parameter addr Start address, record the memory protection flag obtained by the parameters prot and flages, the type of the mapped object, record the file path obtained by the parameters fd and offset, and the starting position of the mapping in the file, and then open the log memory.log, if successful, write Enter the log memory.log, cred integrity monitoring, return the return value of orig_sys_mmap, and end the execution.

Step 16: If no uid is specified, and the pid exists in the monitoring list, the execution will be completed normally. If no uid is specified and the pid does not exist in the monitoring list, it will directly return the return value of orig_sys_mmap and end the execution. If opening the log memory.log fails, create a log memory.log to complete the execution.

Step 17: The user invokes the sys_mprotect system call to obtain the uid and pid of the current process, execute orig_sys_mprotect, save the return value, and specify the uid. If it is the specified uid, record the operation timestamp, and record the start of the memory area obtained by calling the parameter start Address, record the length of the memory area obtained by calling the parameters len and prot, and the memory protection flag, and can successfully open the log memory.log, write the log memory.log, and cred integrity monitoring, return the return value of orig_sys_mprotect, and complete the execution.

Step 18: If no uid is specified and the pid is in the monitoring list, the execution will be completed normally. If no uid is specified and the pid is not in the monitoring list, the return value of orig_sys_mprotect will be returned directly, and the execution will end.

The specific steps for the Root protection subsystem to implement protection are as follows:

Step 1: The information detected by the Root detection subsystem is recorded and uploaded by the upload module of the Root attack mode (the attack behavior recording module actually realizes the behavior of recording and uploading). The upload module of the Root attack module is completed locally, extracting the characteristics of the ".so" file of the Root program and recording the Root attack behavior for upload. Call dlopen(xxx.so) to run the so file, save and upload the used so file to the cloud.

Step 2: The Root attack behavior recording module records and uploads information, and the attack pattern extraction module extracts attack features. A malicious software performs random access file operations in file operations, first modifies the timestamp, then randomly modifies the path of the file, and performs an offset operation within the file, and finally performs a network operation to transfer the file go out. This series of behaviors will be monitored and recorded by the system. Then the recorded attack behavior is uploaded to the cloud for calling and comparison after all mobile terminals are connected. After detecting that the application process is a malicious Root software, it will extract the contents of the ".elf" file of the software. Extract the section header table from the ".elf" file. This part stores the information of the file section of the application process. The section name, section size, etc. can be used as a feature to identify malicious processes. Partially extracted. Upload a series of extracted features about ".elf" files to the cloud, and also for calling and comparing after all mobile terminals are connected.

Step 3: The attack features extracted by the attack pattern extraction module are compared and intercepted by the attack pattern comparison module. The Root Defender in the attack mode comparison module can intercept malicious Root software attacks. Root Defender is recording the attack behavior of each step of the currently running software and extracting the attack pattern. At a certain moment, the software also combines the cloud pattern with the local The patterns are compared locally, and the feature information in the Section header table in ".elf" is compared. If the similarity is high, the program is immediately intercepted and terminated. If the feature information in the Sectionheader table in the ".elf" file is compared with the corresponding information in the cloud as soon as the software is installed, and the similarity is extremely high, the software will be cleaned up directly to prevent any malicious activities Behavior.

Step 4: The privacy data protection module belongs to the privacy protection subsystem, but runs together with the Root protection subsystem. The attack behavior recording module notifies the privacy data protection module at the framework layer while recording the attack behavior. The privacy protection module will modify the corresponding key functions to forge the key privacy data, so that the attacker cannot read or read the forged privacy data, thus realizing the protection against Root attacks.

The foregoing embodiments are only preferred embodiments of the present invention, and are not limitations on the scope of protection of the present invention. However, all changes made by adopting the design principle of the present invention and performing non-creative work on this basis shall all belong to the protection of the present invention. within range.

Claims (1)

1. The kernel-based cross-terminal cross-version Root attack detection and protection system is characterized by comprising a Root monitoring subsystem for monitoring and detecting the Root attack, a Root protection subsystem which is connected with the Root monitoring subsystem and terminates the Root attack through system management, and a private data protection module which is connected with the Root protection subsystem and hides private data which is required to be read by a malicious program; the Root monitoring subsystem comprises a monitoring control module for monitoring Root attack, and a file operation monitoring module, a process operation monitoring module and a memory operation monitoring module which are respectively connected with the monitoring control module, wherein the Root protection subsystem is connected with the process operation monitoring module;

the Root protection subsystem comprises an attack behavior recording module for recording Root attack, an attack mode receiving module for receiving the monitoring condition of the Root monitoring subsystem, an attack mode extracting module and an attack mode database which are respectively used for receiving feedback information of the attack behavior recording module and the attack mode receiving module at a mobile phone end, an attack mode comparing module for receiving the attack mode receiving module and an attack mode intercepting module connected with the attack mode comparing module;

the specific steps of the Root protection subsystem for realizing protection are as follows:

the first step is as follows: information detected by the Root monitoring subsystem is recorded by the attack behavior recording module and uploaded to the cloud;

the second step is that: the attack behavior recording module records the uploaded information and the attack pattern extraction module extracts attack characteristics;

the third step: the attack features extracted by the attack pattern extraction module are compared and intercepted by the attack pattern comparison module;

the fourth step: the private data protection module and the Root protection subsystem operate together, the attack behavior recording module can inform the private data protection module located on a frame layer while recording attack behaviors, and the private data protection module modifies corresponding key functions to forge key private data, so that an attacker cannot read or read forged private data.

Images