A virtualization platform security monitoring method and system

Abstract

The invention discloses a method and system for virtualization platform security monitoring and control. The method comprises the first step that a server terminal is arranged on a main engine or a virtual machine, and a client-side is arranged on a virtualization machine monitor unit of a virtual host being monitored; the second step that the server terminal analyzes the safety need made by a user to a needed configuration file with a standard format and stores the needed configuration file; the third step that the client-side obtains the needed configuration file from the server terminal, monitors and collects in real time the operating information of the virtual machine monitor unit, and sends the operating information to the server terminal; the fourth step that the server terminal sets an abnormal threshold value according to historical collecting data, then conducts abnormal detection on the data collected in real time based on the abnormal threshold value, and sends the data collected in real time to the user; the fifth step that the server terminal generates label data according to a normal event and an abnormal attack event in a confirming result of the user, then establishes a disaggregated model based on the label data and historical collecting data, then utilizes the disaggregated model to conduct the abnormal detection on the data collected in real time, and sends a detection result to the user.

Description

technical field [0001] The invention relates to the security of a virtualization platform, in particular to a method and system for monitoring the security of a virtualization platform. It belongs to the field of information security technology. Background technique [0002] With the continuous maturity and wide application of virtualization technology and cloud computing technology, users gradually migrate their IT infrastructure to the virtualization platform to take advantage of various conveniences brought by virtualization technology: on-demand expansion, flexible migration, Data backup, failure recovery, etc. [0003] A virtualization platform refers to an infrastructure platform built using virtualization technology, including underlying hardware, a virtual machine monitor (VMM) and user virtual machines. Among them, the virtual machine monitor is the core part of the whole system. It is a system software that directly controls the underlying hardware and abstracts ...

AI Technical Summary

Problems solved by technology

[0005] However, there are currently few technical solutions that can monitor and protect the virtual machine monitor (VMM).

Patent CN201610229787.8 uses TPM trusted hardware to monitor the integrity of VMM. This solution has two disadvantages: 1. It is necessary to install TPM trusted custom hardware on a general-purpose X86 server, and the cost is relatively high; 2. This solution can only The integrity of the underlying VMM is detected when the virtual machine starts, and security monitoring at runtime cannot be achieved

[0006] At present, realizing the runtime monitoring of the virtual machine monitor (VMM) to ensure the normal operation of the virtual machine monitor (VMM) cannot be solved by existing technical solutions

Images