Detection method and device for hidden process based on virtual machine monitor

Abstract

The invention provides a detection method and a device for a hidden process based on a virtual machine monitor, wherein the method comprises the steps of obtaining a user mode, a kernel mode and progress information in the virtual machine monitor; comparing the process information in the user mode with the process information in the kernel mode to obtain the hidden process in the user mode; comparing the process information in the kernel mode with the process information in the virtual machine monitor to obtain the hidden process in the kernel mode. The device comprises an acquision module, a first comparison module and a second comparison module. The scheme provided by the invention achieves multi-view hidden process detection and identification technology and provides good security for the virtual machine.

Description

technical field [0001] The present invention relates to virtual machine technology, in particular to a hidden process detection method and device based on a virtual machine monitor (Virtual Machine Monitor, VMM for short), and belongs to the field of computer technology. Background technique [0002] The development of virtualization technology has promoted the emergence of virtual machine technology. A virtual machine is realized through virtual hardware, and a physical computer system is virtualized into one or more virtual computer systems, and each virtual computer system has its own virtual hardware (such as CPU, memory, and equipment, etc.). Various advantages of virtual machines have prompted the development of virtual computing environments. Of course, as the core of the computing environment, the security of the virtual machine must be better guaranteed, which has become an important issue to be studied in the current virtual computing environment. In addition, th...

AI Technical Summary

Problems solved by technology

The hidden object detection mechanism based on the system level has the danger of tampering, disabling, and bypassing, while the one based on auxiliary hardware requires the support of special hardware, which increases the cost and realizes incomplete functions

VMM-based security technology has been greatly developed, and the security is increasing, but there are also some shortcomings: some are coarse-grained detection; some use the kernel data structure for semantic conversion, in the absence of verification , some information will be missed; some have sacrificed some complete semantic information in order to achieve higher security; more research has been placed on the research process, and there are fewer studies on files and network connections. If there is, only terminate The hidden process ignores the legacy hidden files, or does not pay attention to hidden network connections, these connections are likely to be created by non-hidden processes, etc. In some cases, the scope of detection is limited

In addition, some commercial systems that do not support open source also have certain restrictions on the scope of research and use

Images