Method for implementing application software behavior monitoring system based on CPU temporal-spatial isolation mechanism

Abstract

The invention discloses a method for implementing an application software behavior monitoring system based on a CPU temporal-spatial isolation mechanism. Two CPU virtual cores of different states, which are usually divided into a safety core and a common core, are run in a time slice manner by using a CPU virtualization technology; a system memory domain is spatially divided by a memory management unit (MMU), and a register relating to memory control is configured for ensuring the access authorities to different memory areas, thus the effects of access control and memory isolation are achieved; and application software behaviors in the general operating environment are controlled by using the safety operating environment based on the CPU temporal-spatial isolation mechanism. The method provided by the invention has the advantages of improving the timeliness and reliability of the application software behavior monitoring system, and enhancing the safety of the computer application system.

Description

technical field [0001] The invention relates to a software monitoring method, in particular to a method for realizing an application software behavior monitoring system based on a CPU time-space isolation mechanism, and belongs to the field of software monitoring. Background technique [0002] With the continuous development of information technology and the popularization of the application of national economy and national defense military information technology, the computer application system is in the basic support position of the economy and national defense, and its security has become the key to determine the security of the economy and national defense. Once the computer application system A system compromised can have catastrophic consequences. As an important part of the security protection of computer application systems, the current traditional computer protection software based on the matching of malicious code behavior characteristics cannot timely detect malic...

AI Technical Summary

Problems solved by technology

Once malicious codes gain access to the system kernel, the effectiveness of the kernel-level monitoring technology will be challenged, and the application software behavior monitoring system may be bypassed

3. The monitoring technology based on hardware virtualization, through the virtual machine management software running between the computer hardware platform and the operating system kernel, monitors information such as system memory space usage, application software behavior characteristics, and dynamic kernel object access rights, which is higher The privileged CPU running state can guarantee the high reliability of the application behavior monitoring system. However, the virtual machine management software can only obtain the system hardware level information, such as the parameter information of the register in the CPU, the memory address, etc., so it can be obtained directly from the hardware platform. There are semantic differences between the received system information and the operating system, and the readability is poor. Additional system semantic conversion seriously affects system performance

Images