Cloud platform security monitoring system and method based on virtual machine introspection technology

Abstract

The invention discloses a cloud platform security monitoring system and method based on virtual machine self-examination technology. The system includes a local security data acquisition subsystem, a platform security data processing subsystem, a platform security reporting subsystem and a security data storage subsystem; the local security The data collection subsystem is used to collect the security data of each monitored system; the platform security data processing subsystem is used to analyze and process the data of each monitored system collected by the local security data collection subsystem according to the detection strategy and algorithm ; The platform security report subsystem is used to generate security reports to users; the security data storage subsystem is used to store the security data and original security data collected by each local data collector. The invention can realize uninterrupted monitoring of the virtual machine, can provide smooth handover of monitoring data when the virtual machine migrates, can quickly stop the virtual machine attacked by intrusion, and prevent more virtual machines from being attacked by intrusion.

Description

technical field [0001] The invention relates to the field of cloud platform intrusion detection, in particular to a cloud platform security monitoring system and method based on virtual machine introspection technology. Background technique [0002] The IDS based on the virtual machine introspection technology VMI (Virtual Machine Introspection) is a method of monitoring the internal running status of the virtual machine outside the virtual machine. It can observe the internal status of the monitored system and isolate it from the monitored system, thus solving the problem of Difficulties brought by traditional IDS. [0003] The architecture of the current VMI-based intrusion detection system is based on the physical server as the basic unit, and a monitoring virtual machine is deployed on each physical server to monitor other virtual machines on the same server. However, these intrusion detection systems are independent of each other, do not support information sharing, an...

AI Technical Summary

Problems solved by technology

[0006] Second, a joint attack on multiple virtual machines cannot be detected

Therefore, if you need to audit a virtual machine, you can only find relevant information from the monitoring records of physical servers on all platforms, which will be a very complicated and time-consuming task

Also, there will be monitoring gaps

Images