Virtual machine safety monitoring method and system based on introspection technology

Abstract

The invention relates to a virtual machine safety monitoring method and system based on an introspection technology. The method comprises the following steps: establishing a plug-in library of virtual machine behaviors, selecting a plug-in to be monitored from the plug-in library according to a monitoring instruction, reading an API function name and a relative offset address of an API function in the plug-in library, and calculating a virtual address of the API function; reading a virtual address of an API function in the plug-in library, storing a machine code stored in the virtual address, and then modifying the machine code stored in the virtual address into a machine code of an interrupt instruction; after the virtual machine accesses the modified virtual address and triggers interruption, semantic analysis is carried out on the virtual machine; and after semantic analysis is completed, writing the original machine code stored in the virtual address back into the virtual address, setting the virtual machine as single-step execution, and then recovering the execution of the virtual machine. According to the method, the detection requirement of the user on the host behavior is dynamically received, the corresponding behavior plug-in library is called, and high-performance, high-precision and high-coverage behavior monitoring can be carried out on the virtual machine.

Description

technical field [0001] The invention relates to the field of virtualization safety monitoring, in particular to a virtual machine safety monitoring method and system based on introspection technology. Background technique [0002] Virtualization technology can integrate the underlying physical computing resources into an operating environment, and logically abstract and unify the underlying computing resources. Virtualization technology is the basic key technology for cloud computing, and its security directly determines the security of user data in the entire cloud platform. Safety. At present, there are various forms of network attacks, the duration of attacks and the number of attacks are increasing, and equipment and applications are facing huge security threats. Compared with traditional environments, cloud computing brings huge economic benefits, so that hackers from all over the world have seen the benefits. Turning to the attack on the virtualized environment, the s...

AI Technical Summary

Problems solved by technology

[0005] There are two main modes of virtual machine introspection (VMI), in-band and out-of-band. In the in-band mode, a monitoring module needs to be deployed in the virtual machine to learn more about the state information in the virtual machine. Since the monitoring module is deployed inside the virtual machine, Vulnerable to malicious attacks, not a safe and effective security model

Images