Linux platform process memory malicious code evidence obtaining method, controller and medium

Abstract

The invention relates to a Linux platform process memory malicious code evidence obtaining method, a controller and a medium, and the method comprises the steps: traversing all processes of a Linux system, and reading memory mapping files of all the processes; Obtaining one or more of all memory segment data corresponding to the process based on each process memory mapping file, program file pathinformation and dynamic library file path information based on each process memory mapping file; and detecting the malicious code of the process according to all the memory segment data and the program file path information corresponding to each process, or all the memory segment data and the dynamic library file path information contained in the memory mapping file, or the dynamic library file path information corresponding to the program file. According to the invention, the process memory mapping file of the Linux operation system is utilized; The memory address layout of the process is determined, the complete memory of each process in the system is accurately obtained, malicious codes in the memory of the Linux system are effectively discovered, the security of the Linux system is improved, and the memory evidence obtaining method has universality and stability.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a Linux platform process memory malicious code forensics method, controller and medium. Background technique [0002] Linux system is a widely used computer operating system, which is widely deployed and used in many fields such as important national institutions, banks, operators, and the Internet industry. Hacker groups have long attached importance to the penetration and control of Linux systems, and Linux servers are also an important target for advanced persistent threats (APTs). At present, there are two main bottlenecks in the forensics of malicious code in the Linux system: first, malicious programs use advanced hiding technology and coding technology, making it difficult to find and analyze, and these malicious programs bring threats and harm to the entire information system. It is immeasurable; second, the current attack forensics technology for Linux server s...

AI Technical Summary

Problems solved by technology

[0003] Existing security detection methods for Linux systems include: virus scanning detection, general rootkit detection class, host intrusion detection, log analysis detection and specific detection, etc., but the above methods are all for system file feature detection or detection of some specific content ( Such as hidden process, hidden connection), lack of a complete set of malicious code detection technology for Linux system process memory

Images