目前,国内外很多厂商推出了Linux系统中的终端检测响应(Endpoint Detection and Response,EDR)系统,为云平台、物联网、大数据计算等基础设施提供全面的安全检测和防护服务。但是,针对EDR文件防护功能的绕过攻击能够帮助恶意行为规避监...目前,国内外很多厂商推出了Linux系统中的终端检测响应(Endpoint Detection and Response,EDR)系统,为云平台、物联网、大数据计算等基础设施提供全面的安全检测和防护服务。但是,针对EDR文件防护功能的绕过攻击能够帮助恶意行为规避监控,造成严重的系统和数据安全风险。针对开源和商业闭源的Linux EDR系统,首先,阐述了文件防护功能的底层实现机制,对其核心技术原理进行了分析;其次,重点梳理了4种现有公开的文件防护绕过技术,提出了3种尚未公开的绕过技术,并且总结提炼为3种攻击类型;再次,基于上述绕过技术编写了验证工具,通过测试证明了这些技术方法对于部分Linux EDR系统的文件防护绕过能力;最后,给出了相应的安全防护建议。展开更多
This thesis introduces how to develop kernel level device driver on Linux platform in detail. On the basis of comparing proc file system with dev file system, we choose PCI device and USB device as instances to introd...This thesis introduces how to develop kernel level device driver on Linux platform in detail. On the basis of comparing proc file system with dev file system, we choose PCI device and USB device as instances to introduce the method of writing device driver for char devices by using these two file systems.展开更多
The first implementation of new E6 stack of networking protocols within the kernel of an operating system is presented. Stack E6 was developed to increase the efficiency of a network entirely built on the base of Ethe...The first implementation of new E6 stack of networking protocols within the kernel of an operating system is presented. Stack E6 was developed to increase the efficiency of a network entirely built on the base of Ethernet technology. It uses a uniform hierarchical E6 address on all the levels and annuls TCP, UDP and IP protocols. The experimental implementation adds a new system call to the kernel of Linux and a new type of Ethernet E6 frame. All the application interface standards are saved according to RFC except of E6 address usage instead of IP address and instead of Ethernet MAC address as well.展开更多
文摘This thesis introduces how to develop kernel level device driver on Linux platform in detail. On the basis of comparing proc file system with dev file system, we choose PCI device and USB device as instances to introduce the method of writing device driver for char devices by using these two file systems.
文摘The first implementation of new E6 stack of networking protocols within the kernel of an operating system is presented. Stack E6 was developed to increase the efficiency of a network entirely built on the base of Ethernet technology. It uses a uniform hierarchical E6 address on all the levels and annuls TCP, UDP and IP protocols. The experimental implementation adds a new system call to the kernel of Linux and a new type of Ethernet E6 frame. All the application interface standards are saved according to RFC except of E6 address usage instead of IP address and instead of Ethernet MAC address as well.
