A virtual machine abnormal behavior detection method and system based on io sequence

Abstract

The invention discloses an IO sequence-based virtual machine abnormal behavior detection method and system. The detection system comprises an asynchronous acquisition module, a process obtaining module, a communication module and a detection module; a virtual machine IO sequence is asynchronously acquired in a VMM through an asynchronous virtual machine IO sequence acquisition technology to reduce performance loss in a virtual machine running process to the maximum extent; virtual machine process semantics is dynamically obtained by utilizing a VMM layer through a virtual machine IO sequence process semantics dynamic obtaining technology to realize reasonable mapping of the virtual machine IO sequence and a virtual machine process so as to facilitate rule analysis of the IO sequence and confirmation of a detection result; and an abnormal detection model is built in combination with a virtual machine IO short sequence and a Markov chain through a Markov chain-based virtual machine malicious behavior detection technology to finish the detection of malicious behaviors in a virtual machine. According to the method and the system, virtual machine IO-based abnormal attack behaviors can be accurately discovered, so that the security of a cloud computing platform is protected.

Description

technical field [0001] The invention relates to the technical field of virtualization security, in particular to an IO sequence-based virtual machine abnormal behavior detection method and system. Background technique [0002] The rapid development of cloud computing services based on virtualization technology has increased the security risks in the cloud computing environment. In addition to traditional host-based security threats, such as computer viruses, Trojan horses, and kernel rootkits, there are also some new security threats, such as virtual machine escape attacks. This type of attack uses the virtual machine to attack the host machine, often through the virtual machine to exploit the security loopholes in the host operating system or Hypervisor, to achieve the purpose of usurping the host operating system or Hypervisor permissions. [0003] In the traditional program abnormal behavior detection method based on the system call sequence on the host, the system call ...

AI Technical Summary

Problems solved by technology

[0004] The existing technical difficulties mainly include: (1) After the introduction of hardware-assisted virtualization, virtual machines frequently perform IO read and write operations on hardware devices during operation, and inappropriate virtual machine IO sequence collection methods will cause a large amount of performance loss ; (2) The collected virtual machine IO sequence is the binary semantics understood by the underlying Hypervisor. Mapping it into the high-level semantics in the virtual machine can describe the behavior of the virtual machine itself in a fine-grained manner. Rules are crucial; (3) Traditional methods based on host system call sequences include short sequence enumeration methods, data mining methods, neural network methods, etc. More complicated, the limitations brought by a single detection method can no longer meet the needs of the current cloud computing environment

Images