CN109753806B - Server protection method and device - Google Patents

Abstract

The invention discloses a server protection method and a device, which relate to the technical field of security, and mainly aim to realize security detection on newly-added behavior of a server monitoring port, and prevent hackers from utilizing loopholes to newly-added server monitoring ports to permanently control a host server, so that the security of the server can be improved. The method comprises the following steps: acquiring newly-added behavior information of a server monitoring port in a host server of a server cluster; detecting whether the newly added behavior information accords with a preset newly added condition; if yes, determining the newly added behavior as a safety behavior, and performing release processing on the newly added behavior; if the new behavior is not met, determining that the new behavior is dangerous, and performing blocking processing on the new behavior. The method and the device are suitable for protecting the server.

Description

Server protection methods and devices

Technical field

The present invention relates to the field of security technology, and in particular to a server protection method and device.

Background technique

With the rapid development of Internet technology, service providers usually use large-scale server clusters to develop service projects to meet the diverse business needs of users. In order to ensure that the service project can run normally and stably, it is usually necessary to monitor each server port in the server cluster.

Currently, in server clusters, it is usually allowed to set the listening status of server ports arbitrarily. However, in actual applications, hackers usually exploit vulnerabilities that allow the listening status of server ports to be set arbitrarily, add server listening ports to permanently control the host server, and attack the host server to run specific services stably for a long time, thus causing the failure of each server in the server cluster. Less secure. Therefore, proposing a new server protection method has become an urgent technical issue to be solved in the field of server clusters.

Contents of the invention

In view of this, the present invention provides a server method and device, whose main purpose is to enable security detection of new behavior of server listening ports, and to prevent hackers from using vulnerabilities to add new server listening ports to permanently control the host server, thereby enabling Improve server security.

According to the first aspect of the present invention, a server protection method is provided, including:

Obtain the new behavior information of the server listening port in the host server of the server cluster;

Detect whether the new behavior information meets the preset new conditions;

If it is consistent, the new behavior is determined to be a safe behavior, and the new behavior is released;

If not, the new behavior is determined to be a dangerous behavior, and the new behavior is blocked.

According to the second aspect of the present invention, a server protection device is provided, including:

The acquisition unit is used to obtain the new behavior information of the server listening port in the host server of the server cluster;

A detection unit, used to detect whether the new behavior information meets the preset new conditions;

A processing unit, configured to determine that the new behavior is a safe behavior if the detection unit detects that the new behavior information meets the preset new conditions, and perform release processing on the new behavior;

The processing unit is also configured to determine that the new behavior is a dangerous behavior and block the new behavior if the detection unit detects that the new behavior information does not meet the preset new conditions.

According to a third aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the following steps are implemented:

Obtain the new behavior information of the server listening port in the host server of the server cluster;

Detect whether the new behavior information meets the preset new conditions;

If it is consistent, the new behavior is determined to be a safe behavior, and the new behavior is released;

If not, the new behavior is determined to be a dangerous behavior, and the new behavior is blocked.

According to a fourth aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented:

Obtain the new behavior information of the server listening port in the host server of the server cluster;

Detect whether the new behavior information meets the preset new conditions;

If it is consistent, the new behavior is determined to be a safe behavior, and the new behavior is released;

If not, the new behavior is determined to be a dangerous behavior, and the new behavior is blocked.

The present invention provides a server protection method and device. Compared with the current listening state that allows arbitrary setting of server ports, the present invention can obtain new behavior information of server listening ports in the host server of the server cluster. And it can detect whether the new behavior information meets the preset new conditions; if it meets, it is determined that the new behavior is a safe behavior, and the new behavior is released; if it does not meet, it is determined that the new behavior is safe. New behaviors are dangerous behaviors, and the new behaviors are blocked, thereby enabling security detection of new behaviors on the server listening port, and preventing hackers from exploiting vulnerabilities to add new server listening ports to permanently control the host server. This can improve server security.

The above description is only an overview of the technical solution of the present invention. In order to have a clearer understanding of the technical means of the present invention, it can be implemented according to the content of the description, and in order to make the above and other objects, features and advantages of the present invention more obvious and understandable. , the specific embodiments of the present invention are listed below.

Description of the drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be construed as limiting the invention. Also throughout the drawings, the same reference characters are used to designate the same components. In the attached picture:

Figure 1 shows a schematic flow chart of a server protection method provided by an embodiment of the present invention;

Figure 2 shows a schematic flow chart of another server protection method provided by an embodiment of the present invention;

Figure 3 shows a schematic structural diagram of a server protection device provided by an embodiment of the present invention;

Figure 4 shows a schematic structural diagram of another server protection device provided by an embodiment of the present invention;

FIG. 5 shows a schematic diagram of the physical structure of a computer device provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that a thorough understanding of the disclosure will be provided, and the scope of the disclosure will be fully conveyed to those skilled in the art.

As mentioned in the background art, at present, in a server cluster, it is usually allowed to set the listening state of a server port arbitrarily. However, in actual applications, hackers usually exploit vulnerabilities that allow the listening status of server ports to be set arbitrarily, add server listening ports to permanently control the host server, and attack the host server to run specific services stably for a long time, thus causing the failure of each server in the server cluster. Less secure.

In order to solve the above technical problems, embodiments of the present invention provide a server protection method, as shown in Figure 1. The method includes:

101. Obtain the new behavior information of the server listening port in the host server of the server cluster.

The new behavior information may be a memory calling sequence corresponding to the new behavior. The memory calling sequence may be a system function function interface sequence called when the server executes the new behavior, which belongs to dynamic memory data. The same new behavior in different scenarios corresponds to different memory call sequences. In the embodiment of the present invention, the preset capture module can be injected into each server process of the server cluster through process injection technology, and then the system call of the new behavior can be hooked through hooking technology, and finally the backtracking technology can be used to hook the system call of the new behavior. System calls are used to trace back to obtain the memory call sequence corresponding to the new behavior. In addition, the new behavior information may also be port information of a new server listening port, and the port information may be a port number of a new server listening port.

102. Detect whether the new behavior information meets the preset new conditions. If they match, go to step 103; if they don't match, go to step 104.

Among them, the preset new condition can be the calling rule corresponding to the active new behavior of the server monitoring port. The active new behavior can be the behavior of operating the terminal device through the keyboard or mouse, that is, the operation and maintenance personnel can add the new behavior in the host server by the operation and maintenance personnel. The act of actively adding a server listening port. Compared with the act of actively adding a server port, the act of passively adding a server port is the act of adding a server listening port through a program or function. When developers design server clusters, they usually allow operation and maintenance personnel to actively add server ports that need to be monitored. When operation and maintenance personnel legally add server ports that need to be monitored, they usually use keyboard or mouse clicks to add new server ports that need to be monitored. Server port, the active new behavior will make system memory calls according to the calling rules set inside the host server. When hackers exploit vulnerabilities, they usually use the passive new behavior of programs or functions to add server listening ports. The passive new behavior is The behavior will be to make system memory calls according to the method or calling rules set by the virus or malicious application developer, which is inconsistent with the system memory calling method or calling rules set inside the host server. Therefore, embodiments of the present invention can perform safety detection on the new behavior by detecting whether the calling rules corresponding to the memory calling sequence of the new behavior comply with the preset calling rules, that is, detecting whether the new behavior is an active new behavior. When adding a new behavior, if the calling rules corresponding to the memory calling sequence of the new behavior comply with the preset calling rules, the new behavior is determined to be an active new behavior and is determined to be a safe behavior. If the calling rules corresponding to the memory calling sequence of the new behavior do not comply with the preset calling rules, the new behavior is determined to be a passive new behavior and is determined to be a dangerous behavior.

In addition, because the host server runs specific services stably for a long time, the port status tends to be stable, and new listening ports are rarely added. In order to prevent hackers from exploiting vulnerabilities, after the server is deployed, the host server can be prohibited from adding new server listening ports. Therefore, The preset new condition may be that the new server listening port is an open server listening port, that is, even if there is a new server listening port, the newly added server listening port should also be an open server listening port, so The open server listening ports described above can be collected during server deployment.

103. Determine the new behavior as a safe behavior, and release the new behavior.

104. Determine the new behavior as a dangerous behavior, and block the new behavior.

For the embodiment of the present invention, in order to determine the accuracy of the new behavior detection, after determining that the new behavior is a dangerous behavior, the detection results can also be uploaded to the cloud control center for further judgment or processing by operation and maintenance personnel. .

The embodiment of the present invention provides a server protection method. Compared with the current monitoring status that allows arbitrary setting of server ports, the embodiment of the present invention can obtain new behavior information of the server listening port in the host server of the server cluster. And it can detect whether the new behavior information meets the preset new conditions; if it meets, it is determined that the new behavior is a safe behavior, and the new behavior is released; if it does not meet, it is determined that the new behavior is safe. New behaviors are dangerous behaviors, and the new behaviors are blocked, thereby enabling security detection of new behaviors on the server listening port, and preventing hackers from exploiting vulnerabilities to add new server listening ports to permanently control the host server. This can improve server security.

Further, in order to better explain the above-mentioned server protection process, as a refinement and expansion of the above-mentioned embodiments, the embodiment of the present invention provides another server protection method, as shown in Figure 2, but is not limited to this. Specifically, As follows:

201. Obtain the new behavior information of the server listening port in the host server of the server cluster.

The new behavior information may be a memory calling sequence corresponding to the new behavior, or may be port information of a new server listening port.

For the embodiment of the present invention, when the new behavior information is a memory call sequence corresponding to the new behavior, in order to capture the memory call sequence, step 201 may specifically include: injecting a preset capture module into the server In each server process of the cluster, monitor the new behavior; use a preset hook function to hook the function function of the system application layer of the host server to intercept the system call corresponding to the new behavior; use a preset stack The information traceback function performs stack information traceback on the system call to obtain the memory call sequence corresponding to the new behavior.

Wherein, the preset capture module can be set by technicians based on process injection technology, the preset hook function can be written by technicians based on hook technology, and the preset stack information traceback function of the hook technology can be based on technology. Personnel based on backtracking techniques. Different capture modules can be set for different process behaviors. The capture module can be a corresponding functional dynamic link library, or write different preset hook functions and different preset stack information traceback functions, for example, for the process of opening a file. behavior, the preset hook function may be the hookNtAddPort function, and the preset stack information traceback function may be the RtlCaptureStackBackTrace function.

202a. When the new behavior information is a memory calling sequence corresponding to the new behavior, detect whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules. If yes, perform step 203; if not, perform step 204.

Wherein, the preset calling rules may be the calling rules for the active new behavior of the server port. When there is the active new behavior of the server monitoring port in the host server, that is, when the server port is added through the mouse or keyboard, the active new behavior Some system function functions or corresponding interface sequences will be called. Therefore, the calling rule for the active new behavior can be that there is a specific system function function in the memory call sequence; the specific system function function can be called for the active new behavior. system function functions or corresponding interface sequences, specifically system function functions related to message distribution, or other related system function functions called by actively adding new behaviors. The system function functions related to message distribution can include GetMessage function, TranslateMessage function function, DispatchMessage function, etc. The related system functions called by other actively added behaviors may include: SHELL32! CDefFolderMenu::InvokeCommand function, IFileOpenDialog interface related functions, IFileSaveDialog interface related functions, IFileSaveDialog interface related functions, DragQueryFile interface related functions, etc.

In a specific application scenario, the step of detecting whether the calling rules corresponding to the memory calling sequence conforms to the preset calling rules specifically includes: detecting whether there is a specific system function function in the memory calling sequence; if it exists, determining whether the The calling rule corresponding to the memory calling sequence conforms to the preset calling rule; if it does not exist, it is determined that the calling rule corresponding to the memory calling sequence does not conform to the preset calling rule.

For the embodiment of the present invention, in order to improve the accuracy of the new behavior recognition, the preset calling rule may be that there is a specific system function function in the memory calling sequence, and the specific system function function in the memory calling sequence The calling sequence conforms to the preset calling sequence. After detecting the presence of a specific system function function in the memory calling sequence, you can continue to detect whether the calling sequence of the specific system function function in the memory calling sequence conforms to the preset calling sequence; if not If it matches, it is determined that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule; if it matches, it is determined that the calling rule corresponding to the memory calling sequence conforms to the preset calling rule. For example, the active new behavior of the server listening port calls specific system function functions in the following order: GetMessage function-TranslateMessage function, DispatchMessage function. If it is found through detection that the calling sequence of specific system function functions in the memory call sequence corresponding to the new behavior of the server listening port is consistent with the above-mentioned preset calling sequence, then it is determined that the new behavior of the server listening port is an active new behavior, and then the The new behaviors mentioned above are safe behaviors. If it is found through inspection that the calling sequence of specific system function functions in the memory call sequence corresponding to the new behavior of the server listening port does not match the above-mentioned preset calling sequence, then it is determined that the new behavior of the server listening port is a passive new behavior. Then it is determined that the new behavior is a dangerous behavior.

Or the preset calling rule may be that there is a specific system function function in the memory call sequence, and the stack position where the specific system function function is located in the memory call sequence matches the preset stack position. When detecting the memory call After there is a specific system function function in the sequence, you can also continue to detect whether the position of the specific system function function in the memory call sequence matches the preset position; if it does not match, it is determined that the calling rule corresponding to the memory call sequence does not match the preset position. Assume the calling rules; if they match, it is determined that the calling rules corresponding to the memory calling sequence comply with the preset calling rules. Wherein, the preset position is the position where the specific system function function is located in the memory call sequence corresponding to the active new behavior of the server listening port. For example, the default position is 0x10. If it is found through detection that the location of the GetMessage function in the memory call sequence of the new behavior is 0x08, it is determined that the calling rules corresponding to the memory call sequence do not comply with the preset calling rules, and it is determined that the new behavior of the server listening port is not It is an active new behavior, and it is a passive new behavior for hackers to exploit vulnerabilities.

Step 202b parallel to step 202a: when the new behavior information is the port information of a new server listening port, detect whether the port information matches the port information in the default listening port whitelist. If they match, perform step 203; if they do not match, perform step 204.

The preset listening port whitelist stores open server listening ports in the server cluster and their corresponding port information. The port information may be a port number, for example, the port number of the open server listening port is 8080. Specifically, if the port information of the newly added server listening port matches the port information in the default listening port whitelist, it means that the newly added server listening port is an open server listening port, and the host server allows the newly added server monitoring port. port, therefore, the new behavior is determined to be a safe behavior. If the port information of the newly added server listening port does not match the port information in the default listening port whitelist, it means that the newly added server listening port is not an open server listening port and is not a new server listening port allowed by the host server. Therefore, the new behavior is determined to be dangerous behavior.

For embodiments of the present invention, the function of setting a preset listening port whitelist is also supported. The method further includes: during server deployment in the server cluster, collecting the opened server ports and their corresponding port information; The preset listening port whitelist is constructed based on the opened server listening ports and their corresponding port information.

Further, in order to ensure the integrity of the preset listening port whitelist and improve the security of the server, the method also includes: sending the preset listening port whitelist to the cloud control center for correction; obtaining all The following is the modified listening port whitelist of the cloud control center. Therefore, when there is a newly added server listening port, the newly added server listening port can be matched with the revised listening port whitelist.

203. Determine that the new behavior information meets the preset new conditions, determine that the new behavior is a safe behavior, and release the new behavior.

It should be noted that after the new behavior is released, a new server listening port will exist in the host server. In order to better perform security detection and protection on the server port in the future, the new server listening port can be used. Update the default listening port whitelist. Specifically, if the newly added server listening port does not exist in the default listening port whitelist, the newly added server listening port can be added to the default listening port whitelist.

204. Determine that the new behavior information does not meet the preset new conditions, determine that the new behavior is an operation behavior, and block the new behavior.

Another server protection method provided by embodiments of the present invention. Compared with the current monitoring status that allows arbitrary setting of server ports, embodiments of the present invention can obtain new behavior information of server listening ports in the host server of the server cluster. And it can detect whether the new behavior information meets the preset new conditions; if it meets, it is determined that the new behavior is a safe behavior, and the new behavior is released; if it does not meet, it is determined that the new behavior is safe. New behaviors are dangerous behaviors, and the new behaviors are blocked, thereby enabling security detection of new behaviors on the server listening port, and preventing hackers from exploiting vulnerabilities to add new server listening ports to permanently control the host server. This can improve server security.

Further, as a specific implementation of FIG. 1 , an embodiment of the present invention provides a server protection device. As shown in FIG. 3 , the device includes: an acquisition unit 31 , a detection unit 32 , and a processing unit 33 .

The obtaining unit 31 may be used to obtain new behavior information of the server listening port in the host server of the server cluster. The acquisition unit 31 is a functional module in this device that acquires the new behavior information of the server listening port in the host server of the server cluster.

The detection unit 32 may be used to detect whether the newly added behavior information meets the preset new addition conditions. The detection unit 32 is the main functional module in the device for detecting whether the new behavior information meets the preset new conditions.

The processing unit 33 may be configured to determine that the new behavior is a safe behavior if the detection unit 32 detects that the new behavior information meets the preset new conditions, and perform release processing on the new behavior. . The processing unit 33 is the main functional module of the device that determines that the new behavior is a safe behavior and performs release processing on the new behavior if it detects that the new behavior information meets the preset new conditions.

The processing unit 33 is also configured to determine that the new behavior is a dangerous behavior and block the new behavior if the detection unit 32 detects that the new behavior information does not meet the preset new conditions. deal with. The processing unit 33 is the main functional module of the device that determines the new behavior as a dangerous behavior and blocks the new behavior if it detects that the new behavior information does not meet the preset new conditions. .

In a specific application scenario, the detection unit 32 may include: a first detection module 321 and a first determination module 322, as shown in Figure 4 .

The first detection module 321 may be used to detect whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules when the new behavior information is a memory calling sequence corresponding to the new behavior.

The first determination module 322 may be used to determine that the new behavior information meets the preset new conditions if the first detection module 321 detects that the calling rule corresponding to the memory calling sequence complies with the preset calling rule.

The first determination module 322 may also be used to determine that the newly added behavior information does not comply with the preset new behavior information if the first detection module 321 detects that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule. Add conditions.

It should be noted that, in order to determine whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules, the first detection module 321 may include: a detection sub-module and a determination sub-module.

The detection sub-module may be used to detect whether there is a specific system function in the memory call sequence.

The determination sub-module may be used to determine that the calling rule corresponding to the memory calling sequence complies with the preset calling rule if the detecting sub-module detects the presence of a specific system function function in the memory calling sequence.

The determining sub-module may also be used to determine that the calling rules corresponding to the memory calling sequence comply with the preset calling rules if the detecting sub-module detects that there is no specific system function function in the memory calling sequence.

Further, in order to improve the accuracy of the new behavior recognition, the detection sub-module can also be used to detect whether the calling sequence of specific system function functions in the memory calling sequence complies with the preset calling sequence.

The determination sub-module may also be used to determine that the calling rules corresponding to the memory calling sequence do not comply with the preset calling sequence if the detection sub-module detects that the calling sequence of specific system function functions in the memory calling sequence does not comply with the preset calling sequence. Default calling rules;

The determination sub-module may specifically be used to determine that the calling rules corresponding to the memory calling sequence conform to the preset calling sequence if the detecting sub-module detects that the calling sequence of specific system function functions in the memory calling sequence conforms to the preset calling sequence. Set calling rules.

The detection sub-module can also be used to detect whether the location of a specific system function function in the memory call sequence matches the preset location.

The determination sub-module may also be used to determine that the calling rule corresponding to the memory calling sequence does not meet the preset location if the detection sub-module detects that the location of a specific system function function in the memory calling sequence does not meet the preset location. Set calling rules. Wherein, the preset position may be set according to actual conditions, for example, the preset position is 0x08 or 0x10, etc.

The determination sub-module is specifically also used to determine that the calling rule corresponding to the memory calling sequence conforms to the preset calling if the detection sub-module detects that the location of the specific system function function in the memory calling sequence matches the preset position. rule.

For the embodiment of the present invention, the acquisition unit 31 includes: a monitoring module 311, a hooking module 312 and a traceback module 313.

The monitoring module 311 may be used to inject a preset capture module into each server process of the server cluster to monitor the new behavior.

The hooking module 312 may be used to hook the functional functions of the system application layer of the host server using a preset hooking function to intercept system calls corresponding to the new behavior.

The backtracking module 313 may be used to use a preset stack information backtracking function to perform stack information backtracking on the system calls to obtain the memory call sequence corresponding to the new behavior.

In specific application scenarios, the detection unit 32 may include: a second detection module 323 and a second determination module 324.

The second detection module 323 may be used to detect whether the port information matches the port information in the preset listening port whitelist when the new behavior information is the port information of a new server listening port. The default listening port whitelist stores the open server listening ports in the server cluster and their corresponding port information;

The second determination module 324 may be used to determine that the newly added behavior information meets the preset new addition conditions if the second detection module 323 detects that the port information matches the port information in the preset listening port whitelist;

The second determination module 324 may also be used to determine that the new behavior information does not match the default new behavior information if the port information detected by the second detection module does not match the port information in the default listening port whitelist. condition.

In addition, in order to obtain the default listening port whitelist, the device also includes: a collection unit 34 and a construction unit 35.

The collection unit 34 may be used to collect the opened server ports and their corresponding port information during server deployment in the server cluster.

The construction unit 35 may be configured to construct the preset listening port whitelist based on the opened server listening ports and their corresponding port information.

Further, in order to ensure the integrity of the preset listening port whitelist and improve the security of the server, the device may also include: a correction unit 36 .

The correction unit 36 may be used to send the preset listening port whitelist to the cloud control center for correction.

The obtaining unit 31 may also be used to obtain the corrected listening port whitelist of the cloud control center.

It should be noted that, for other corresponding descriptions of the functional modules involved in the server protection device provided by the embodiment of the present invention, reference can be made to the corresponding description of the method shown in Figure 1, which will not be described again here.

Based on the above method shown in Figure 1, correspondingly, embodiments of the present invention also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by the processor, the following steps are implemented: Obtaining the data in the server cluster New behavior information on the server listening port in the host server; detect whether the new behavior information meets the preset new conditions; if so, determine that the new behavior is a safe behavior and allow the new behavior processing; if not, the new behavior is determined to be a dangerous behavior, and the new behavior is blocked.

Based on the above embodiment of the method shown in Figure 1 and the server protection device shown in Figure 3, an embodiment of the present invention also provides a physical structure diagram of a computer device, as shown in Figure 5, the device includes: a processor 41 , memory 42, and a computer program stored in the memory 42 and executable on the processor, wherein the memory 42 and the processor 41 are both arranged on the bus 43. The processor 41 implements the following steps when executing the program: obtain the New behavior information of the server listening port in the host server of the server cluster; detect whether the new behavior information meets the preset new conditions; if so, determine that the new behavior is a safe behavior, and check the new behavior The behavior will be released; if it does not comply, the new behavior will be determined to be a dangerous behavior and the new behavior will be blocked. The device also includes a bus 43 configured to couple the processor 41 and the memory 42 .

Through the technical solution of the present invention, the new behavior information of the server listening port in the host server of the server cluster can be obtained. And it can detect whether the new behavior information meets the preset new conditions; if it meets, it is determined that the new behavior is a safe behavior, and the new behavior is released; if it does not meet, it is determined that the new behavior is safe. New behaviors are dangerous behaviors, and the new behaviors are blocked, thereby enabling security detection of new behaviors on the server listening port, and preventing hackers from exploiting vulnerabilities to add new server listening ports to permanently control the host server. This can improve the security of the server.

The embodiments of the present invention also provide the following technical solutions:

A1. A server protection method, including:

Obtain the new behavior information of the server listening port in the host server of the server cluster;

Detect whether the new behavior information meets the preset new conditions;

If it is consistent, the new behavior is determined to be a safe behavior, and the new behavior is released;

If not, the new behavior is determined to be a dangerous behavior, and the new behavior is blocked.

A2. The method as described in A1, the new behavior information is a memory calling sequence corresponding to the new behavior, and the detection of whether the new behavior information meets the preset new conditions includes:

Detect whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules;

If so, it is determined that the new behavior information meets the preset new conditions;

If not, it is determined that the new behavior information does not meet the preset new conditions.

A3. The method as described in A2, detecting whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules, including:

Detect whether there is a specific system function function in the memory call sequence;

If it exists, it is determined that the calling rule corresponding to the memory calling sequence complies with the preset calling rule;

If it does not exist, it is determined that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule.

A4. The method described in A3, before determining that the calling rule corresponding to the memory calling sequence complies with the preset calling rule, the method further includes:

Detect whether the calling sequence of specific system function functions in the memory calling sequence complies with the preset calling sequence;

If not, it is determined that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule;

Determining that the calling rule corresponding to the memory calling sequence complies with the preset calling rule includes:

If so, it is determined that the calling rule corresponding to the memory calling sequence complies with the preset calling rule.

A5. The method described in A3, before determining that the calling rule corresponding to the memory calling sequence complies with the preset calling rule, the method further includes:

Detect whether the location of the specific system function function in the memory call sequence matches the preset location;

If not, it is determined that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule;

Determining that the calling rule corresponding to the memory calling sequence complies with the preset calling rule includes:

If so, it is determined that the calling rule corresponding to the memory calling sequence complies with the preset calling rule.

A6. The method described in any one of A1-A5, wherein obtaining the new behavior information of a new server listening port in the host server of the server cluster includes:

Inject the preset capture module into each server process of the server cluster to monitor the new behavior;

Use a preset hook function to hook the functional function of the system application layer of the host server to intercept the system call corresponding to the new behavior;

Use a preset stack information traceback function to perform stack information traceback on the system call to obtain the memory call sequence corresponding to the new behavior.

A7. The method as described in A1, the new behavior information is the port information of a new server listening port, and the detection of whether the new behavior information meets the preset new conditions includes:

Detecting whether the port information matches the port information in a preset listening port whitelist, which stores open server listening ports in the server cluster and their corresponding port information;

If so, it is determined that the new behavior information meets the preset new conditions;

If not, it is determined that the new behavior information does not meet the preset new conditions.

A8. The method described in A7, before detecting whether the port information matches the port information in the preset port whitelist, the method further includes:

During server deployment in the server cluster, collect the opened server ports and their corresponding port information;

The preset listening port whitelist is constructed based on the opened server listening ports and their corresponding port information.

A9. The method described in A8, after constructing the preset listening port whitelist based on the opened server listening ports and their corresponding port information, the method further includes:

Send the preset listening port whitelist to the cloud control center for correction;

Obtain the corrected listening port whitelist of the cloud control center.

B10. A server protection device, including:

The acquisition unit is used to obtain the new behavior information of the server listening port in the host server of the server cluster;

A detection unit, used to detect whether the new behavior information meets the preset new conditions;

A processing unit, configured to determine that the new behavior is a safe behavior if the detection unit detects that the new behavior information meets the preset new conditions, and perform release processing on the new behavior;

The processing unit is also configured to determine that the new behavior is a dangerous behavior and block the new behavior if the detection unit detects that the new behavior information does not meet the preset new conditions.

B11. The device as described in B10, the detection unit includes:

The first detection module is used to detect whether the calling rules corresponding to the memory calling sequence comply with the preset calling rules when the new behavior information is a memory calling sequence corresponding to the new behavior;

A first determination module, configured to determine that the new behavior information meets the preset new conditions if the first detection module detects that the calling rule corresponding to the memory calling sequence complies with the preset calling rule;

The first determination module is also configured to determine that the new behavior information does not meet the preset new condition if the first detection module detects that the calling rule corresponding to the memory calling sequence does not comply with the preset calling rule.

B12. The device as described in B11, the first detection module includes:

A detection sub-module is used to detect whether there is a specific system function function in the memory call sequence;

Determining sub-module, used to determine that the calling rules corresponding to the memory calling sequence comply with the preset calling rules if the detection sub-module detects that a specific system function function exists in the memory calling sequence;

The determination sub-module is also configured to determine that the calling rules corresponding to the memory calling sequence comply with the preset calling rules if the detection sub-module detects that there is no specific system function function in the memory calling sequence.

B13. Device as described in B12,

The detection sub-module is also used to detect whether the calling sequence of specific system function functions in the memory calling sequence conforms to the preset calling sequence;

The determination sub-module is also configured to determine that the calling rules corresponding to the memory calling sequence do not conform to the preset calling sequence if the detecting sub-module detects that the calling sequence of specific system function functions in the memory calling sequence does not comply with the preset calling sequence. Set the calling rules;

The determination sub-module is specifically also configured to determine that the calling rules corresponding to the memory calling sequence conform to the preset calling sequence if the detecting sub-module detects that the calling sequence of specific system function functions in the memory calling sequence conforms to the preset calling sequence. Call rules.

B14. Device as described in B12,

The detection sub-module is also used to detect whether the location of the specific system function function in the memory call sequence meets the preset location;

The determination sub-module is also used to determine that the calling rule corresponding to the memory calling sequence does not conform to the preset position if the detection sub-module detects that the location of the specific system function function in the memory calling sequence does not meet the preset location. calling rules;

The determination sub-module is specifically also used to determine that the calling rule corresponding to the memory calling sequence conforms to the preset calling if the detection sub-module detects that the location of the specific system function function in the memory calling sequence matches the preset position. rule.

B15. The device according to any one of B10-B14, the acquisition unit includes:

A monitoring module, used to inject the preset capture module into each server process of the server cluster and monitor the new behavior;

A hooking module, configured to use a preset hooking function to hook the functional functions of the system application layer of the host server to intercept system calls corresponding to the new behavior;

A traceback module is used to trace stack information of the system call using a preset stack information traceback function to obtain the memory call sequence corresponding to the new behavior.

B16. The device as described in B10, the detection unit includes:

The second detection module is used to detect whether the port information matches the port information in the preset listening port whitelist when the new behavior information is the port information of a new server listening port. The preset listening port The whitelist stores the open server listening ports in the server cluster and their corresponding port information;

a second determination module, configured to determine that the new behavior information meets the preset new addition conditions if the port information detected by the second detection module matches the port information in the preset listening port whitelist;

The second determination module is also configured to determine that the new behavior information does not meet the preset new addition conditions if the port information detected by the second detection module does not match the port information in the preset listening port whitelist.

B17. The device as described in B16, which further includes:

A collection unit configured to collect the opened server ports and their corresponding port information during server deployment in the server cluster;

A construction unit configured to construct the preset listening port whitelist based on the opened server listening ports and their corresponding port information.

B18. The device as described in B16, which further includes: a correction unit,

The correction unit is used to send the preset listening port whitelist to the cloud control center for correction;

The obtaining unit is also used to obtain the corrected listening port whitelist of the cloud control center.

C19. A computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any one of A1 to A9 are implemented.

D20. A computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method described in any one of A1 to A9. A step of.

In the above embodiments, each embodiment is described with its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

It can be understood that relevant features in the above methods and devices can be referred to each other. In addition, “first”, “second”, etc. in the above-mentioned embodiments are used to distinguish between the embodiments and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

The algorithms and displays provided herein are not inherently associated with any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. From the above description, the structure required to construct such a system is obvious. Furthermore, this invention is not specific to any specific programming language. It should be understood that a variety of programming languages may be utilized to implement the invention described herein, and that the above descriptions of specific languages are intended to disclose the best mode of carrying out the invention.

In the instructions provided here, a number of specific details are described. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment in order to streamline the disclosure and aid in the understanding of one or more of the various inventive aspects. figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that modules in the devices in the embodiment can be adaptively changed and arranged in one or more devices different from that in the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of the equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features of different embodiments are meant to be within the scope of the invention. within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the server protection device according to embodiments of the present invention. The invention may also be implemented as an apparatus or apparatus program (eg, computer program and computer program product) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the element claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, third, etc. does not indicate any order. These words can be interpreted as names.

Claims (16)

1. A method for protecting a server, comprising:

acquiring newly-added behavior information of a server monitoring port in a host server of a server cluster;

the step of obtaining the newly-added behavior information of the server monitoring port in the host server of the server cluster comprises the following steps: injecting a preset capturing module into each server process of the server cluster, and monitoring the newly added behavior; hooking the function of the system application layer of the host server by using a preset hooking function so as to intercept the system call corresponding to the newly added behavior; performing stack information backtracking on the system call by using a preset stack information backtracking function to obtain a memory call sequence corresponding to the newly added behavior;

detecting whether a calling rule corresponding to the memory calling sequence accords with a preset calling rule or not;

if yes, determining the newly added behavior as a safety behavior, and performing release processing on the newly added behavior;

if the new behavior is not met, determining that the new behavior is dangerous, and performing blocking processing on the new behavior.

2. The method of claim 1, wherein the detecting whether the call rule corresponding to the memory call sequence meets a preset call rule comprises:

Detecting whether a specific system function exists in the memory call sequence;

if yes, determining that a calling rule corresponding to the memory calling sequence accords with a preset calling rule;

if the memory calling sequence does not exist, determining that the calling rule corresponding to the memory calling sequence does not accord with the preset calling rule.

3. The method according to claim 2, wherein before determining that the call rule corresponding to the memory call sequence meets the preset call rule, the method further comprises:

detecting whether the calling sequence of the specific system function in the memory calling sequence accords with a preset calling sequence;

if not, determining that the calling rule corresponding to the memory calling sequence does not accord with a preset calling rule;

the determining that the call rule corresponding to the memory call sequence accords with the preset call rule comprises the following steps:

if yes, determining that the calling rule corresponding to the memory calling sequence meets the preset calling rule.

4. The method according to claim 2, wherein before determining that the call rule corresponding to the memory call sequence meets the preset call rule, the method further comprises:

and detecting whether the position of the specific system function in the memory call sequence accords with a preset position.

5. The method of claim 1, wherein the newly added behavior information is port information of a newly added server listening port, further comprising:

detecting whether the port information is matched with port information in a preset monitoring port white list, wherein the preset monitoring port white list stores the opened server monitoring ports in the server cluster and the port information corresponding to the server monitoring ports;

if yes, determining that the newly-added behavior information meets a preset newly-added condition;

if not, determining that the newly-added behavior information does not accord with a preset newly-added condition.

6. The method of claim 5, wherein before detecting whether the port information matches port information in a preset port whitelist, the method further comprises:

collecting the opened server ports and corresponding port information thereof during server deployment in the server cluster;

and constructing the preset monitoring port white list according to the opened server monitoring port and the port information corresponding to the opened server monitoring port.

7. The method according to claim 6, wherein after the preset listening port whitelist is constructed according to the opened server listening port and the corresponding port information thereof, the method further comprises:

The preset monitoring port white list is sent to a cloud control center for correction;

and acquiring the corrected monitoring port white list of the cloud control center.

8. A server guard, comprising:

the acquisition unit is used for acquiring the newly-added behavior information of the server monitoring port in the host servers of the server cluster;

wherein the acquisition unit includes: the monitoring module is used for injecting a preset capturing module into each server process of the server cluster and monitoring the newly-added behavior; the hooking module is used for hooking the function of the system application layer of the host server by utilizing a preset hooking function so as to intercept the system call corresponding to the newly added behavior; the backtracking module is used for backtracking the stack information of the system call by using a preset stack information backtracking function to obtain a memory call sequence corresponding to the newly added behavior;

the detection unit is used for detecting whether the calling rule corresponding to the memory calling sequence accords with a preset calling rule;

the processing unit is used for determining the newly added behavior to be a safety behavior if the newly added behavior is in accordance with the safety behavior, and carrying out release processing on the newly added behavior;

and the processing unit is further used for determining the newly added behavior to be dangerous if the newly added behavior is not met, and performing blocking processing on the newly added behavior.

9. The apparatus of claim 8, wherein the detection unit comprises:

the detection submodule is used for detecting whether a specific system function exists in the memory call sequence;

the determining submodule is used for determining that the calling rule corresponding to the memory calling sequence accords with a preset calling rule if the detecting submodule detects that a specific system function exists in the memory calling sequence;

and the determining submodule is further used for determining that the calling rule corresponding to the memory calling sequence accords with a preset calling rule if the detecting submodule detects that the specific system function does not exist in the memory calling sequence.

10. The apparatus of claim 9, wherein the detection submodule is further configured to detect whether a calling order of a specific system function in the memory calling sequence accords with a preset calling order;

the determining submodule is further used for determining that the calling rule corresponding to the memory calling sequence does not accord with the preset calling rule if the detecting submodule detects that the calling sequence of the specific system function in the memory calling sequence does not accord with the preset calling sequence;

The determining submodule is specifically configured to determine that a calling rule corresponding to the memory calling sequence accords with a preset calling rule if the detecting submodule detects that the calling sequence of the specific system function in the memory calling sequence accords with the preset calling sequence.

11. The apparatus of claim 9, wherein the device comprises a plurality of sensors,

the detection submodule is also used for detecting whether the position of a specific system function in the memory call sequence accords with a preset position or not;

the determining submodule is further used for determining that the calling rule corresponding to the memory calling sequence does not accord with the preset calling rule if the detecting submodule detects that the position of the specific system function in the memory calling sequence does not accord with the preset position;

the determining submodule is specifically configured to determine that a call rule corresponding to the memory call sequence meets a preset call rule if the detecting submodule detects that a location of a specific system function in the memory call sequence meets a preset location.

12. The apparatus as recited in claim 8, further comprising:

the second detection module is used for detecting whether the port information is matched with the port information in a preset monitoring port white list or not when the newly added behavior information is the port information of the monitoring port of the newly added server, and the preset monitoring port white list stores the opened server monitoring port and the port information corresponding to the opened server monitoring port in the server cluster;

The second determining module is used for determining that the newly added behavior information accords with a preset newly added condition if the second detecting module detects that the port information is matched with the port information in the preset monitoring port white list; the second determining module is further configured to determine that the newly added behavior information does not conform to a preset newly added condition if the second detecting module detects that the port information is not matched with the port information in the preset monitoring port whitelist.

13. The apparatus of claim 12, wherein the apparatus further comprises:

a collecting unit, configured to collect, during server deployment in the server cluster, the opened server port and corresponding port information thereof;

and the construction unit is used for constructing the preset monitoring port white list according to the opened server monitoring port and the port information corresponding to the opened server monitoring port.

14. The apparatus of claim 12, wherein the apparatus further comprises: a correction unit for correcting the correction value of the correction value,

the correction unit is used for sending the preset monitoring port white list to a cloud control center for correction;

the acquisition unit is further used for acquiring the monitoring port white list corrected by the cloud control center.

15. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 7.

16. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method according to any one of claims 1 to 7 when the computer program is executed by the processor.