CPU vulnerability detection device and method based on virtual machine

Abstract

The invention discloses a CPU vulnerability detection device and method based on a virtual machine. The CPU vulnerability detection device comprises a process monitoring module and a driving module. The process monitoring module is suitable for sending process information of an unknown process to the cloud server when monitoring the unknown process, and providing the process information of the unknown process to the driving module when determining that the unknown process is a process of a preset level according to a query result returned by the cloud server; the drive module is suitable forsending the process information of the unknown process provided by the process monitoring module to a preset host device, is used for monitoring whether an unknown process executes an instruction related to the CPU vulnerability or not by the host device and providing a monitoring result returned by the host device to the process monitoring module, so that the process monitoring module processes according to the monitoring result returned by the host device. By means of the method, instruction level monitoring can be achieved, then all instructions related to CPU vulnerabilities can be monitored, and a more comprehensive defense effect is achieved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a CPU vulnerability detection device and method based on a virtual machine. Background technique [0002] The central processing unit (CPU) vulnerability is undoubtedly a high-risk vulnerability. Once a malicious program exploits the CPU vulnerability to launch an attack, it will have an immeasurable negative impact on the user's personal device, and even cause major problems such as equipment paralysis. [0003] In the prior art, it is only possible to judge whether there is an attack on the CPU vulnerability by monitoring the interface provided by the operating system. For example, when a malicious program attempts to launch an attack on a CPU vulnerability by calling an interface provided by the operating system, the malicious behavior can be monitored and intercepted by setting a hook or other monitoring method at the interface provided by the operating system. [0004] Ho...

AI Technical Summary

Problems solved by technology

[0004] However, the inventor found in the process of implementing the present invention that the above-mentioned methods in the prior art have at least the following defects: the interception operation of malicious behavior can only be realized from the interface level provided by the operating system, once the malicious program bypasses the operation The interface provided by the system directly enters the operating system, which will lead to serious consequences

Images