VMI method and system based on redirection of system calls

Abstract

The invention discloses a VMI method and system based on the redirection of system calls. The method and system provide a dynamic view of VMs in the operation for an administrator by selecting a target VM, so that each VM can be monitored; the process selection and initialization in the target VM are generated by an auxiliary process to carry out the redirected system calls; each system call of a VMI application program is intercepted by the system calls, and whether or not the system calls need to be redirected is decided; redirecting one system call to the auxiliary process is executed by redirecting system calls; the safe execution of the auxiliary process is guaranteed by security protection, and the correct self-examination results are guaranteed. The VMI method and system can be used for monitoring multiple different types of VMs in the cloud environment, and achieves a writable VMI technology, and the kernel state of the VM can be modified from the outside of the target VM to bring a high automation feature, so that the VMI method and system can be used in the automated cloud management.

Description

technical field [0001] The invention belongs to the technical field of cloud computing security, and more specifically relates to a VMI method and system based on system call redirection. Background technique [0002] With the rapid development of cloud computing, more and more people will start to rent a virtual machine (Virtual Machine, VM), and the core technology behind the VM is virtualization. In recent years, with the research and development of virtualization, the virtual machine introspection (Virtual Machine Introspection, VMI) technology and tools have evolved. VMI refers to monitoring the internal running status of the VM from outside the VM to implement security functions such as intrusion detection, malware analysis, integrity check, and log audit. [0003] The core problem of VMI is the semantic gap, that is, the separation of the underlying state (binary byte or bit) that the hypervisor can see and the semantics they express inside the VM (such as process PI...

AI Technical Summary

Problems solved by technology

[0008] In view of the above defects or improvement needs of the prior art, the present invention provides a VMI method and system based on system call redirection, which can modify the kernel state of the VM from outside the target VM without any user authority , which greatly reduces the management cost of VM, and can be used to actively improve the security of the cloud environment, solving the problem that the existing VMI system is difficult to be directly applied to the cloud environment, and cannot meet some practical needs of the cloud environment at the same time: writability, high efficiency Technical issues such as compatibility, versatility, simultaneous monitoring, reliability, etc.

Images