Xen-based operating system identification method

Abstract

The invention discloses a Xen-based operating system identification method, and belongs to the technical field of computer virtualization technology. The method is applied in identification of operating system type in virtualization environment. The method includes combination of accurate identification of fine grain and flexible identification of coarse grain, the operating system type is identified overfull, and the accurate identification of the fine grain is performed in two identification methods of interrupt descriptor tables and global descriptor table bases. By means of the accurate identification of the fine grain, the operating system type in a client domain from a management domain can be identified accurately, if the accurate identification of the fine grain is failed to identify the operating system, the operating system type in the client domain can be identified by utilizing TCP fingerprinting coarse grain, and accordingly the operating system type in the client domain from the management domain can be identified. According to the method, the client operating system is not modified during identification, information is acquired from the management domain, client operating system is not required to participate, the method is protected from being found by the client operating system and guarantees own safety.

Description

technical field [0001] The invention belongs to the technical field of computer virtualization, in particular to a method for identifying the type of an operating system in a virtualization environment. Applied to the identification of the operating system category in the virtualization environment. Background technique [0002] In recent years, virtualization technology has become the development trend of computer system structure, and provides a solution for security monitoring. Since the virtual machine manager has a higher authority and a smaller trusted computing base, using the virtual machine manager to deploy security tools in a separate virtual machine can detect the target virtual machine. This method can ensure the effectiveness and anti-attack of monitoring tools. [0003] Virtual machine monitoring is very different from traditional monitoring. Traditional monitoring is carried out within the operating system, which is aimed at the monitoring of a single syst...

AI Technical Summary

Problems solved by technology

Multiple virtual machines can run on the virtual machine monitor at the same time, and each virtual machine can run different types of operating systems. If each system needs to be modified or manually obtained system information, it is not only inconvenient, but also installed in the client domain. Files or human-identified operating systems pose a potential threat, which reduces the usefulness of these research findings

[0006] The difference between the virtual environment architecture and the traditional architecture brings opportunities and challenges to the field of virtualization monitoring

Images