Virtualization escape defense method based on kernel debugger

Abstract

The invention relates to a virtualization escape defense method based on a kernel debugger, which mainly comprises the following steps: command reading: adding a virtual machine process into a Windbgkernel debugger, and reading an RPCI command received by the process; analyzing the data packet: analyzing a suspicious instruction in the RPCI command, and judging whether the length of the data packet has overflow possibility or not; memory allocation protection: when overflow possibility exists, carrying out automatic judgment on an allocation mode of the target block, and realizing predictability of an address; and overflow defense: automatically judging an address relationship between an overflow point and an overflowed object, and carrying out early warning on an overflow attack behavior. By using the kernel debugger Windbg under the Windows operating system, suspicious overflow behaviors under the virtualization environment are automatically judged, and the heap layout is accuratelypredicted, virtual machine escape attacks can be effectively defended, more efficient and complete heap overflow prevention is achieved, and the safety of the virtualization environment is guaranteed.

Description

technical field [0001] The invention belongs to the technical field of virtualization security, in particular relates to a computer operating system and virtualization technology, in particular to a virtualization escape defense method based on a kernel debugger. Background technique [0002] With the rapid application of cloud computing technology, the traditional independent host model can no longer meet the needs of users, and more and more virtualization environments have emerged. Virtualization technology was first developed by Chris Toffer, a computer professor at Oxford University in 1959. In 2010, it was proposed in an academic report titled "Time Sharing in Large-Scale High-Speed ​​Computers". This article is considered to be the earliest discussion of virtualization technology, and since then it has opened the curtain of virtualization development. In computer science, virtualization technology is a resource management or resource optimization technology that abstr...

AI Technical Summary

Problems solved by technology

In 2008, VMware's Workstation product had the first virtual machine escape attack. Attackers can use the vulnerability to make the virtual machine escape to the virtual machine manager, thereby threatening the security of the host.

Images