An agentless virtual machine monitoring system and monitoring method

Abstract

The invention discloses an agentless virtual machine monitoring system and monitoring method, comprising the following steps: a user sets a monitoring policy through a monitoring policy setting module, and when a virtual machine is started, the code injection module executes monitoring codes according to the identifier of the virtual machine to be monitored Dynamic injection; the virtualization layer dynamically modifies the system call function pointer according to the monitoring code and monitoring policy, so that the system call function pointer points to the function address of the monitoring code; after the monitoring code intercepts the internal system call of the virtual machine, it obtains the monitoring policy from the virtualization layer, Complete the specific response of virtual machine system call interception according to the monitoring policy. The invention realizes monitoring by dynamically injecting monitoring codes into the kernel of the virtual machine after detecting that the virtual machine is started in the virtualization layer, and has high monitoring flexibility and fast real-time response. At the same time, with the help of the virtualization layer, the read-only protection of key data and codes involved in monitoring ensures that the monitoring system is always effective.

Description

technical field [0001] The invention belongs to the technical field of virtual machine monitoring, and in particular relates to an agentless virtual machine monitoring system and monitoring method. Background technique [0002] With the in-depth development and application of cloud computing, virtual machine security monitoring has always been a technical difficulty and hot spot in cloud computing. The technical implementation methods of virtual machine security monitoring can be divided into two categories: traditional host monitoring methods and virtualization-based monitoring methods. The traditional host monitoring method integrates traditional physical host monitoring methods, such as virus detection and defense systems, malicious code interception and isolation systems, etc. into the virtual machine operating system to achieve monitoring; The high privilege level implements security monitoring of the virtual machine. [0003] The monitoring method based on the tradit...

AI Technical Summary

Problems solved by technology

This solution relies heavily on the system call interception module inside the virtual machine. In the case of malicious code inside the virtual machine, the reliability and security of monitoring specific processes inside the virtual machine cannot be guaranteed.

Images