基于系统调用的macOS软件行为监测技术和框架

macOS Software Behavior Monitoring Technology and Framework Based on System Call

通过基于系统调用hooking的技术手段,实现了macOS系统下系统调用hooking的通用框架.该框架可根据用户配置对指定系统调用进行监控并输出定制日志,构建了基于策略的安全事件监测与处理机制.实验测试结果表明,该框架具备对macOS底层系统所有系统调用函数的监控能力,其基于策略的事件监测机制运行有效,可为macOS系统下的安全研究及应用提供良好支撑.

Based on system call hooking technique, a configurable generic system call hooking framework of macOS was designed and implemented. According to the user configuration, this framework can monitor the system call and output custom log. At the same time, a policy based on security event faonitoring mechanism was constructed. The experimental results show that the framework is able to monitor all the system calls of the macOS system, and the policy based on event monitoring mechanism was effective. The framework can provide excellent support for the security research and application of macOS.