摘要
针对云环境下的租户虚拟机状态监控问题,提出一种基于虚拟机内存实时在线分析的虚拟机监控技术.借助虚拟化层的高特权级,可以在虚拟机外部透明地实时获取虚拟机的物理内存.引入内存取证领域的物理内存解析机制,在虚拟化层在线地分析虚拟机内存中重要的内核数据结构,从而获取虚拟机内存语义知识,有效地解决虚拟机与虚拟化层之间的语义鸿沟问题,实现虚拟机细粒度状态信息监控.由于监控代码处于更高特权级的虚拟化层,无需在用户虚拟机中部署监控代理,因此,虚拟机内部的恶意代码无法旁路和破坏安全监控代码,提高了方法的透明性和安全性.实验表明,该方法可以在低开销下以无监控代理模式为租户提供虚拟机监控服务.
To solve the problem of user virtual machine monitoring in cloud environment,a virtual machine security monitoring method based on real time online analysis of virtual machine memory was proposed. With high privilege of the virtualization layer,virtual machine memory could be obtained outside of virtual machines online transparently. By using the memory analysis mechanism derived from the field of internal forensics,the semantic knowledge of virtual machine memory can be revealed by analyzing some important kernel structures of the virtual machine memory online in the virtualization layer,which effectively solves the semantic gap between the virtual machine and the virtualization layer and leads to achieving fine granularity of information monitoring of virtual machines. Because the monitoring code is under the virtualization layer,outside of the monitored virtual machine and isolated from virtual machine internal codes by the virtualization mechanism,there is no need to deploy monitoring agents in the users’ virtual machine. Therefore,any malicious code inside the virtual machine can not bypass and destroy the security monitoring code under the virtualization layer and the transparency and security of the method is improved. The experimental results show that the method can provide a cloud security monitoring service for virtual machines at lower performance cost with agentless.
作者
尹学渊
陈兴蜀
陶术松
陈林
Yin Xueyuan;Chen Xingshu;Tao Shusong;Chen Lin(College of Computer Science,Sichuan University,Chengdu,610065,China;Cybersecurity Research Institute,Sichuan University,Chengdu,610065,China;HIFIVE Technology Co.,Ltd,Chengdu,610065,China)
出处
《南京大学学报（自然科学版）》
CAS
CSCD
北大核心
2019年第2期221-230,共10页
Journal of Nanjing University（Natural Science）
基金
国家科技支撑计划(2012BAH18B05)
国家自然科学基金(61272447)
关键词
虚拟机监控
内存分析
语义解析
无代理
virtual machine monitoring
memory analysis
semantic analysis
agentless
