IO sequence-based virtual machine abnormal behavior detection method and system

Abstract

The invention discloses an IO sequence-based virtual machine abnormal behavior detection method and system. The detection system comprises an asynchronous acquisition module, a process obtaining module, a communication module and a detection module; a virtual machine IO sequence is asynchronously acquired in a VMM through an asynchronous virtual machine IO sequence acquisition technology to reduce performance loss in a virtual machine running process to the maximum extent; virtual machine process semantics is dynamically obtained by utilizing a VMM layer through a virtual machine IO sequence process semantics dynamic obtaining technology to realize reasonable mapping of the virtual machine IO sequence and a virtual machine process so as to facilitate rule analysis of the IO sequence and confirmation of a detection result; and an abnormal detection model is built in combination with a virtual machine IO short sequence and a Markov chain through a Markov chain-based virtual machine malicious behavior detection technology to finish the detection of malicious behaviors in a virtual machine. According to the method and the system, virtual machine IO-based abnormal attack behaviors can be accurately discovered, so that the security of a cloud computing platform is protected.

Description

Technical field [0001] The present invention relates to the technical field of virtualization security, in particular to a method and system for detecting abnormal behavior of a virtual machine based on an IO sequence. Background technique [0002] The rapid development of cloud computing services based on virtualization technology has led to increasing security risks in the cloud computing environment. In addition to traditional host-based security threats, such as computer viruses, Trojan horses, and kernel rootkits, there are also some new security threats, such as virtual machine escape attacks. This type of attack uses a virtual machine to attack the host, and often uses the security vulnerabilities of the host operating system or hypervisor through the virtual machine to achieve the purpose of tampering with the host operating system or hypervisor permissions. [0003] In the traditional program abnormal behavior detection method based on the system call sequence on the host...

AI Technical Summary

Problems solved by technology

[0004] The existing technical difficulties mainly include: (1) After the introduction of hardware-assisted virtualization, the I / O read and write operations of the virtual machine to the hardware device are relatively frequent during the running process, and an inappropriate IO sequence collection method of the virtual machine will cause a large number of Performance loss; (2) The collected virtual machine IO sequence is the binary semantics understood by the underlying Hypervisor. Mapping it into the high-level semantics in the virtual machine can describe the behavior of the virtual machine itself in a fine-grained manner. Anomaly detection rules are very important; (3) Traditional methods based on host system call sequence include short sequence enumeration method, data mining method, neural network method, etc. Security threats are more complicated, and the limitations brought by a single detection method can no longer meet the needs of the current cloud computing environment

Images