An intrusion detection method for network data in xen virtualization environment

Abstract

The invention relates to the technical field of cloud computing, and specifically discloses a method for detecting intrusion of network data in a Xen virtual environment. The method comprises the following steps: creating a network bridge by using Open vSwitch on a host computer; establishing virtual machine equipment, and adding the virtual machine equipment into the network bridge; making a real network interface correspond to the virtual interface of the virtual machine equipment; bridging the virtual interface of the virtual machine equipment with the network bridge, and creating a virtual port for each piece of virtual machine equipment simultaneously; performing communication of the network data via the virtual port of corresponding virtual machine equipment; and after the Open vSwitch receives data packets transmitted from each data port, forwarding the header information of the data packets to a controller, filtering and processing the header information through the controller, and deciding a subsequent processing or forwarding port of the data packets. An intrusion defense main body is set as the virtual machine equipment, so that failure in intrusion defense due to IP (Internet Protocol) address change is avoided; and the intrusion of the network data of the virtual machine equipment can be monitored effectively, detected and defended.

Description

technical field [0001] The invention relates to the technical field of cloud computing, in particular to an intrusion detection method for network data in a Xen virtualization environment. Background technique [0002] Xen is an open source virtual machine device monitor developed by the University of Cambridge. It is intended to run up to 100 fully featured operating systems on a single computer. The operating system must be explicitly modified ("ported") to run on Xen (but provide compatibility with user applications). This enables Xen to achieve high-performance virtualization without special hardware support. [0003] At present, due to the complexity and diversity of the virtualized network, it is impossible to obtain the network data of the virtual machine device inside the Host host machine, and it is impossible to prevent intrusion of the network data; moreover, in the current traditional network environment, The main body of intrusion prevention is still IP, and ...

AI Technical Summary

Problems solved by technology

[0003] At present, due to the complexity and diversity of the virtualized network, it is impossible to obtain the network data of the virtual machine device inside the Host host machine, and it is impossible to prevent intrusion of the network data; moreover, in the current traditional network environment, The main body of intrusion prevention is still IP, and the IP of virtual machine equipment can be changed dynamically. How to deal with the variability of virtualized network in the virtual network environment and carry out intrusion defense; so far there is no effective solution

Images