A virtual machine-based introspection automatic management, configuration and introspection method

Abstract

The present invention provides an automatic management, configuration and introspection method for introspection based on a virtual machine, comprising: 1) according to the call execution process of the operating process of the operating system, screening out the system calls to be reused to form a puppet system call, the puppet system call Executed by the target virtual machine; the target virtual machine includes a control module, a data exchange module and a system call control module; 2) inject the target virtual machine system call 3) protect the virtual machine system call execution, 4) isolate the virtual machine memory, including: Track the VCPU scheduling of the target virtual machine and operate the memory of the target virtual machine from the outside of the target virtual machine; this method can further strengthen the security, the puppet system call code executed by the target virtual machine is taken from a secure kernel image, and the reused puppet system There is no need to rely on the kernel integrity of the target virtual machine.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a virtual machine-based introspection automatic management, configuration and introspection method. Background technique [0002] In cloud computing, virtual machine introspection technology provides a means of security for cloud security. A virtual machine introspection technology (Virtual Machine Introspection, VMI) is a typical representative of a monitoring technology based on a virtual machine architecture. The architecture of the virtual machine introspection technology is to obtain the underlying state data of the virtual machine (CPU registers, I / O controller registers, memory, mass storage devices, etc.) intervene in its internal operating state. Since a virtual machine management layer (Virtual Machine Monitor, VMM) has the highest authority and there is strong isolation between virtual machines, this monitoring method has higher security and transparency. Because ...

AI Technical Summary

Problems solved by technology

But these methods face security, automation, and scalability issues

Both Hypershell and PI need virtual machine assistance to complete management and analysis, and there are problems with security and transparency. Once the virtual machine kernel is damaged, it will not work

EXT is to use the security virtual machine (SVM) to replace the target virtual machine (TVM) to process data, and then copy the results to the target virtual machine, but it faces scalability problems

Because the data to be operated by each system call is different, it needs to be processed separately, and Linux has many kinds of calls, so it is difficult to cover the functions used

Images