Method and system for detecting abnormal behavior of virtual machine process

Abstract

The invention discloses a virtual machine process exception behavior detection method and system. The detection method includes capturing virtual machine process scheduling events and reconstructing semantic information of virtual machine process of the Linux operating system and Windows operating system in Hypervisor; setting a system call entry function address pointed by virtual CPU register SYSENTER_EIP_MSR of the virtual machine in the Hypervisor as an illegal address and capturing the virtual machine process system call events to acquire virtual machine process system call data and recover operation of the virtual machine again; saving the virtual machine process semantic information and virtual machine process system call data into a virtual machine data journal file; carrying out modeling of behavior characteristics to the virtual machine data journal file; building a to-be-tested model according to the virtual machine process call data in testing, and outputting the test result to a virtual machine detection journal file according to a detection algorithm. By the method and system, security risk of cloud platform can be detected to a certain degree.

Description

technical field [0001] The invention relates to the technical field of virtualization security, in particular to a method and system for detecting abnormal behavior of a virtual machine process based on a system call vector space. Background technique [0002] With the rapid development of cloud computing technology, the security of cloud platforms has also received extensive attention from the industry. With the introduction of a virtual machine monitor (Virtual Machine Monitor, VMM), a malicious process in a virtual machine can attack the VMM or other virtual machines through vulnerabilities of the virtual machine, thereby threatening the security of the cloud platform. [0003] In the field of traditional host intrusion detection, the anomaly detection methods based on system calls mostly detect abnormal behaviors for a single privileged process in the host. The so-called privileged process means that it has super user privileges during the running process, and an attack...

AI Technical Summary

Problems solved by technology

The virtual machine in the cloud computing environment is different from the traditional host environment. It not only has the security risks in the traditional host, but also has complex and unknown security threats such as virtual machine escape. It only relies on the detection scheme of the traditional host for the privileged process. , the use of traditional host intrusion detection strategies for virtualization platforms often cannot guarantee the comprehensiveness of detection

Images