A virtual machine malicious software behavior detection method and system

Abstract

The embodiment of the invention provides a virtual machine malicious software behavior detection method and system, and the method comprises the steps: carrying out the interaction with a target virtual machine based on a virtual machine monitor of a host machine where the target virtual machine is located, and obtaining the internal state information of the target virtual machine through a virtual machine self-provincial method; Reconstructing the internal state information according to a software basic structure knowledge base in a memory evidence obtaining framework, and obtaining a high-level data structure of the internal state information; And according to the advanced data structure, detecting malicious software behaviors in the target virtual machine. According to the embodiment ofthe invention, the detection of the malicious software behavior is more accurate and comprehensive, the abnormal behavior can be processed in a targeted manner, the security of the target virtual machine is ensured, the influence on the performance of the virtual machine is greatly reduced, and the detection of the malicious software behavior is realized on the premise of no perception.

Description

technical field [0001] Embodiments of the present invention belong to the technical field of computer security, and more specifically, relate to a virtual machine malware behavior detection method and system. Background technique [0002] With the development of virtualization technology, many physical resources including computing, network and storage have been fully utilized, and the subsequent security issues have attracted widespread attention. Among them, a very important security risk is that there may be malicious software on the virtual machine. A typical example of malware is a kernel rootkit. Kernel rootkits mostly exist in the memory and are concealed and destructive. They hide their traces in the system by hooking or modifying some data structures. They seldom leave traces on hardware resources such as disks, and then communicate to them through various network connections. An attacker outside the system provides private information about the victim machine. ...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the problems of time-consuming, labor-intensive, large resource consumption and poor detection effect of the above-mentioned existing virtual machine malware behavior detection methods, or at least partially solve the above problems, embodiments of the present invention provide a virtual machine malware behavior detection method and system

Images