A cloud host security baseline checking method and system based on virtual machine introspection

Abstract

The present application belongs to the technical field of computer information security, and particularly relates to a cloud host security baseline checking method and system based on virtual machine introspection, which comprises the following steps: accessing a target virtual machine through a host virtualization management program layer and dividing physical memory pages, obtaining physical memory dirty page states and system I / O load; according to the dirty page states of the physical memory pages in a historical observation window and a physical neighborhood set, obtaining an activity accumulation index and a spatial neighborhood linkage index at the current time, respectively; obtaining a checking trigger score according to the activity accumulation index, the spatial neighborhood linkage index and the system I / O load, and realizing security baseline checking based on the threshold relationship of the checking trigger score. The present application can identify normal business hotspots and abnormal tampering behaviors, and reduce the checking frequency when the system is under high load, thereby realizing low-overhead agentless security baseline checking.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology. More specifically, this invention relates to a method and system for verifying the security baseline of cloud hosts based on virtual machine introspection. Background Technology

[0002] With the development of cloud-native technologies, ensuring the integrity of critical system files on cloud hosts is a core requirement for maintaining cloud platform security. Traditional security checks typically run as agents within virtual machines, but this approach not only consumes tenant computing resources but is also easily bypassed or rendered ineffective by kernel-level malware. Therefore, agentless monitoring technology based on virtual machine introspection at the hypervisor layer is gradually becoming mainstream.

[0003] In virtual machine introspection architectures, to reduce performance overhead, discrete sampling is typically used to obtain the dirty page status of the virtual machine's physical memory pages, which serves as the basis for determining whether a file has been modified. Existing main algorithms usually trigger security checks based on instantaneous dirty page marking or simple write frequency statistics. That is, once a write operation is detected on a physical memory page, the virtual machine introspection semantic reconstruction process is initiated to parse and compare the relevant files.

[0004] However, the aforementioned simple dirty page detection algorithm still has shortcomings in practical applications: First, the algorithm lacks analysis of the historical behavior of physical memory pages, and cannot effectively distinguish between long-term silent baseline files and frequently changing hot data in normal business operations, leading to the misjudgment of normal business writes as abnormal; Second, the existing algorithm lacks correlation analysis of the spatial neighborhood of write behavior, and cannot filter out occasional isolated noise in the system, while real file tampering is usually accompanied by large-scale memory changes; Finally, existing methods often ignore the current I / O load of the host machine and lack a dynamic avoidance mechanism. If high-overhead virtual machine introspection file parsing is frequently triggered indiscriminately for all dirty pages, it will excessively occupy the host machine's CPU resources and even lead to system performance congestion. Summary of the Invention

[0005] To address the aforementioned technical problems of false alarms and resource contention during verification, this invention provides solutions in the following aspects.

[0006] In a first aspect, the present invention provides a cloud host security baseline verification method based on virtual machine introspection, comprising:

[0007] Any virtual machine to be tested is selected as the target virtual machine, and its physical memory space is divided into fixed-size physical memory pages. The target virtual machine is monitored through the host machine's virtualization management layer to obtain the dirty page status of the physical memory pages and the system I / O load. Based on the dirty page status of the physical memory pages within a preset historical observation window, the cumulative activity index of each physical memory page at the current moment is obtained. Based on the dirty page status of the physical memory pages within a preset physical neighborhood set, the spatial neighborhood linkage index of each physical memory page at the current moment is obtained. Based on the cumulative activity index, the spatial neighborhood linkage index, and the system I / O load, the verification trigger score of the physical memory page at the current moment is obtained. Based on the relationship between the verification trigger score and a preset threshold, a cloud host security baseline verification based on virtual machine introspection is implemented.

[0008] This invention utilizes historical dirty page states to assess the activity inertia of memory pages, distinguishing between long-dormant critical system configuration files and frequently changing business hotspot data. This reduces the likelihood of misjudging normal business writes as abnormal. It uses a spatial neighborhood linkage index to assess the clustering of write behavior and filters out occasional isolated noise by identifying large-scale memory changes caused by file modifications. Simultaneously, it introduces system input / output load as a regulating factor, automatically reducing the sensitivity of checks during system downtime to alleviate competition for host performance. Thus, while ensuring the integrity of the cloud host security baseline, it reduces the consumption of computing resources and the impact on business performance of the security check mechanism, achieving a virtual machine introspective security check that balances detection accuracy and system operating efficiency.

[0009] Preferably, obtaining the dirty page status of the physical memory page includes:

[0010] The extended page table corresponding to the target virtual machine is located through the virtualization hypervisor layer. At the end of each sampling period, the dirty page status of the extended page table corresponding to each physical memory page is traversed and read. If the dirty page status of the first physical memory page in the target virtual machine's physical memory space is... At the current moment, physical memory pages If a write operation occurs within the sampling period, then mark the first... At the current moment, physical memory pages dirty page status It is 1 if it is true, otherwise it is 0.

[0011] This invention locates the extended page table corresponding to the target virtual machine through the virtualization management program layer, and at the end of each sampling period, it traverses and reads the dirty page status of the extended page table corresponding to each physical memory page to determine whether there is a write operation. This makes it difficult for malicious software to detect or tamper with the monitoring data. At the same time, it uses hardware-assisted virtualization technology to read the dirty page status, which eliminates the additional virtualization overhead brought by traditional software simulation or instruction interception methods, ensuring the authenticity of the physical memory dirty page status acquisition and the low-load characteristics, and providing data support for baseline verification.

[0012] Preferably, the acquisition of the system I / O load includes:

[0013] The performance counters of the virtualization management layer are used to obtain and normalize the target virtual machine's current performance at the current moment. The disk I / O throughput at the current moment The system I / O load is denoted as ,satisfy ,in Indicates free time. Indicates that the vehicle is fully loaded.

[0014] Preferably, the cumulative activity index satisfies the following relationship:

[0015] ;

[0016] In the formula, Indicates the first At the current moment, physical memory pages Cumulative activity index; Indicates the first The length of the historical observation window for each physical memory page; Indicates the first The time step index for backtracking within the historical observation window of a physical memory page, with values ​​ranging from... arrive ; Indicates the first At the current moment, physical memory pages The previous The state of the dirty page at each sampling time; This represents the time decay coefficient.

[0017] This invention introduces computational logic incorporating a time decay coefficient, setting a historical observation window with the current moment as the endpoint. It obtains an activity accumulation index by weighted cumulative calculation of the dirty page states at historical sampling moments. This enables the assessment of the activity trend of physical memory pages over time, helping the system identify abnormal pages that have remained silent for a long time but suddenly experienced writes. Furthermore, when dealing with continuously active normal business data such as video stream buffers, it can trigger scoring through historical activity inertia suppression checks, reducing the possibility of false alarms caused by frequent writes from normal business processes.

[0018] Preferably, the setting of the historical observation window for the physical memory page includes:

[0019] At the current moment As the endpoint, set the number The historical observation window length of a physical memory page , is used to define the time range for backtracking.

[0020] Preferably, the spatial neighborhood linkage index satisfies the following relationship:

[0021] ;

[0022] In the formula, Indicates the first At the current moment, physical memory pages Spatial neighborhood linkage index; Indicates the first The physical neighborhood set of each physical memory page; Represents the physical memory page index within the physical neighborhood set; Indicates the first Within the physical neighborhood set of the nth physical memory page, the th At the current moment, physical memory pages Dirty page status; This represents the distance weight constant.

[0023] This invention sets up a physical neighborhood set based on the physical address adjacency of physical memory pages, and obtains a spatial neighborhood linkage index by calculating the weighted sum of the dirty page status of each page in the neighborhood set and the distance weight constant. By evaluating the spatial clustering degree of write behavior, it can capture large-scale memory changes caused by file tampering. At the same time, it uses the neighborhood linkage mechanism to filter out occasional system noise that occurs only on a single page while the neighborhood remains silent, reducing false alarms caused by non-attack behaviors such as random memory read / write or counter auto-increment, and improving the ability of security baseline verification to focus on real tampering behavior.

[0024] Preferably, the verification trigger score of the physical memory page at the current moment is obtained based on the activity accumulation index, the spatial neighborhood linkage index, and the system I / O load, including:

[0025] The physical memory page check trigger score is obtained by multiplying the dirty page status of the physical memory page at the current moment by the product of the preset spatial linkage amplification coefficient of the spatial neighborhood linkage index, dividing the quotient by the sum of the activity accumulation index and the preset small value, and then multiplying by 1 and subtracting the difference obtained by the current system I / O load.

[0026] Preferably, based on the relationship between the verification trigger score and the preset threshold, a cloud host security baseline verification based on virtual machine introspection is implemented, including:

[0027] Set preset threshold Real-time monitoring of the verification trigger score of each physical memory page; when the verification trigger score of any physical memory page is greater than or equal to a preset threshold... At that time, the virtual address region corresponding to the physical memory page is locked;

[0028] Start the virtual machine introspection file parsing module, use virtual machine introspection to reverse map the physical address of the virtual address region to the virtual address, locate the corresponding file system path, perform baseline rule comparison only on the file corresponding to the virtual address region, and output the verification results.

[0029] This invention sets a preset threshold and monitors the verification trigger scoring of each physical memory page in real time. Only when the score reaches the threshold is the corresponding virtual address region locked and the virtual machine introspection file parsing module activated to perform reverse mapping from physical address to virtual address and file location. This changes the high-consumption mode of traditional full scan or real-time interception and realizes on-demand verification based on risk scoring. By comparing the files corresponding to memory regions that show high-risk characteristics with baseline rules, the execution frequency of expensive semantic reconstruction and file system parsing operations is reduced. While ensuring timely detection of the risk of tampering with critical files, the security verification process minimizes the occupation of computing resources of the host machine and the target virtual machine.

[0030] Preferably, the setting of the physical neighborhood set of the physical memory page includes:

[0031] With the first A physical neighborhood set is constructed centered on each physical memory page. , Including the Each physical memory page is located four pages adjacent to each other at the physical address, for a total of eight pages.

[0032] Secondly, the present invention provides a cloud host security baseline verification system based on virtual machine introspection, including a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the above-mentioned cloud host security baseline verification method based on virtual machine introspection is implemented.

[0033] By adopting the above technical solution, a computer program is generated from the above-mentioned cloud host security baseline verification method based on virtual machine introspection and stored in the memory so that it can be loaded and executed by the processor. In this way, a terminal device can be made based on the memory and the processor for convenient use.

[0034] The beneficial effects of this invention are as follows: This invention adopts an agentless monitoring architecture based on hardware-assisted virtualization extension technology. It obtains the dirty page status of the physical memory pages of the target virtual machine through the virtualization management program layer, optimizing the problem that traditional agent software is easily blinded or bypassed by kernel-level malicious code, ensuring the authenticity and concealment of monitoring data. This invention utilizes a time decay mechanism to evaluate the historical active inertia of physical memory pages and combines physical address adjacency relationships to evaluate the spatial clustering of write behavior. By fusing spatiotemporal features, it identifies high-risk scenarios that match the tampering of critical system files, reducing the risk of misjudging continuously active business data such as video stream buffers or isolated memory noise as security threats. Simultaneously, this invention incorporates the host machine's real-time input / output load into the verification decision system, introducing a load-aware avoidance strategy. During periods of system overload, it automatically reduces the sensitivity of verification triggers to alleviate competition for computing resources. Thus, while ensuring the integrity of the cloud host security baseline, it achieves low-overhead and intelligent virtual machine introspection security verification. Attached Figure Description

[0035] Figure 1 This diagram illustrates a flowchart of a cloud host security baseline verification method based on virtual machine introspection according to the present invention.

[0036] Figure 2 A schematic diagram illustrating the temporal distribution of dirty page states is provided.

[0037] Figure 3 This diagram illustrates the comparison of cumulative activity indices.

[0038] Figure 4 This diagram illustrates the distribution of the spatial neighborhood linkage index.

[0039] Figure 5 This diagram illustrates the distribution of page types that trigger verification. Detailed Implementation

[0040] This invention discloses a cloud host security baseline verification method based on virtual machine introspection, referring to... Figure 1 This includes steps S100-S400:

[0041] S100. Select any virtual machine to be tested as the target virtual machine, divide the physical memory space of the target virtual machine into physical memory pages of fixed size, monitor the target virtual machine through the virtualization management program layer of the host machine, and obtain the dirty page status of the physical memory pages and the system I / O load.

[0042] It should be noted that traditional host security software usually runs as an agent inside the virtual machine, which not only consumes tenant resources but is also easily bypassed or blinded by malware. This invention runs on the virtualization management program layer of the host machine and uses hardware-assisted virtualization extension technology to read the physical memory state of the target virtual machine without its knowledge. At the same time, in order to balance the monitoring granularity and the performance overhead of the host machine, the monitoring process must follow the principle of discrete sampling and cannot perform full instruction-level tracking.

[0043] Specifically, any virtual machine to be tested is used as the target virtual machine. The virtualization management layer of the host machine is connected to the target virtual machine. A sampling frequency is set, and a sampling period is determined according to the sampling frequency. The physical memory space of the target virtual machine is divided into physical memory pages of fixed size. The dirty page status of the physical memory pages and the system I / O load are continuously acquired according to the sampling frequency, including:

[0044] Dirty page status of physical memory pages: The extended page table corresponding to the target virtual machine is located through the virtualization hypervisor layer. At the end of each sampling period, the dirty page status of the extended page table corresponding to each physical memory page is traversed and read. If the dirty page status of the first physical memory page in the target virtual machine's physical memory space is... At the current moment, physical memory pages If a write operation occurs within the sampling period, then mark the first... At the current moment, physical memory pages dirty page status It is 1 if it is true, otherwise it is 0.

[0045] For example, the sampling frequency is set to The sampling period is seconds; the fixed size of the physical memory page is It should be noted that dirty pages are hardware-level feedback on memory write operations, and can objectively reflect data changes.

[0046] For example, Figure 2 This is a schematic diagram of the temporal distribution of dirty page states. Active pages exhibit frequently changing pulse states, while silent and noisy pages only change states occasionally, reflecting the original write characteristics of different types of physical memory pages in the time dimension.

[0047] System I / O load: The target virtual machine's load at the current moment is obtained and normalized through the performance counters of the virtualization hypervisor layer. The disk I / O throughput at the current moment The system I / O load is denoted as ,satisfy ,in Indicates free time. This indicates full load. It should be noted that security checks should not block core user operations; therefore, it is necessary to assess the current system load.

[0048] At this point, the dirty page status of the physical memory pages and the system I / O load have been obtained.

[0049] S200: Based on the dirty page status of physical memory pages within a preset historical observation window, obtain the cumulative activity index of each physical memory page at the current moment.

[0050] It should be noted that, since security baseline files are characterized by long-term quiescence in memory, meaning they are rarely modified, while business data such as video stream buffers are subject to frequent changes, the current write behavior alone cannot distinguish between the two. Therefore, this invention evaluates the quiescence or activity level of physical memory pages by tracing back to historical states, thereby filtering sensitive pages.

[0051] Specifically, based on the physical memory page at the current moment The dirty page status, combined with the time decay factor, yields the cumulative activity index of each physical memory page, including:

[0052] At the current moment As the endpoint, set the number Length of historical observation window for each physical memory page Used to define the time range for backtracking; sets the time decay coefficient. This is used to define the influence weights of historical data. For example, It means to go back to the past. Second, .

[0053] It should be noted that, considering the time-sensitive nature of the active state of physical memory pages, recent behavior is more valuable than older behavior. Therefore, this invention introduces a time-based exponentially decaying weight sequence when constructing the activity accumulation index.

[0054] No. At the current moment, physical memory pages The cumulative activity index satisfies the following relationship:

[0055] ;

[0056] In the formula, Indicates the first At the current moment, physical memory pages Cumulative activity index; Indicates the first The length of the historical observation window for each physical memory page; Indicates the first The time step index for backtracking within the historical observation window of a physical memory page, with values ​​ranging from... arrive ; Indicates the first At the current moment, physical memory pages The previous The state of the dirty page at each sampling time; This represents the time decay coefficient.

[0057] In this relation, This represents a weight sequence that decreases exponentially over time. At that time, the weight of the most recent sample is ,and The previous weight was reduced to This ensures that the cumulative activity index reflects recent activity trends. This represents the historical accumulation of the weighted sequence. For the physical memory page storing the configuration file, since it has not been modified for a long time, it corresponds to the historical observation window. All for Then the cumulative activity index approaches This indicates that the physical memory page has silent inertia; for physical memory pages that are continuously written to, their historical observation window... Frequently The calculated cumulative activity index will remain at a high level, indicating that the physical memory page has active inertia.

[0058] For example, Figure 3 This is a diagram comparing the cumulative activity index. The index values ​​of active pages are higher than those of silent pages and noisy pages, indicating that by introducing the cumulative calculation of time decay, it is possible to distinguish the long-term active inertia and silent characteristics of physical memory pages.

[0059] At this point, the current physical memory pages are obtained. The cumulative activity index.

[0060] S300: Based on the dirty page status of physical memory pages within a preset physical neighborhood set, obtain the spatial neighborhood linkage index of each physical memory page at the current moment.

[0061] It should be noted that while the cumulative activity index can distinguish between silent and active pages, a large number of occasional isolated noises still exist in the system, and these isolated noises can also appear in silent pages. When the operating system modifies a file, it not only modifies the file content pages but also simultaneously modifies the file metadata and directory entries. This data is usually distributed in clusters in physical memory. On the other hand, noise is isolated single-page writes. Therefore, this invention constructs a spatial neighborhood linkage index in a spatial dimension to further filter noise by determining whether modifications occur in clusters.

[0062] Specifically, a physical neighborhood set is constructed based on the spatial neighborhood relationships of each physical memory page, and then the neighboring pages within the physical neighborhood set are analyzed at the current time. The dirty page status and distance weight constant are used to obtain the spatial neighborhood linkage index of each physical memory page, including:

[0063] With the first A physical neighborhood set is constructed centered on each physical memory page. And set the distance weight constant. .

[0064] For example, Including the Each physical memory page is located four pages adjacent to each other at the physical address, for a total of eight pages; .

[0065] No. At the current moment, physical memory pages The spatial neighborhood linkage index satisfies the expression:

[0066] ;

[0067] In the formula, Indicates the first At the current moment, physical memory pages Spatial neighborhood linkage index; Indicates the first The physical neighborhood set of each physical memory page; Represents the physical memory page index within the physical neighborhood set; Indicates the first Within the physical neighborhood set of the nth physical memory page, the th At the current moment, physical memory pages Dirty page status; This represents the distance weight constant.

[0068] In this relation, This indicates spatial locality of write operations. When an administrator modifies the configuration file, it triggers the simultaneous dirty page state of multiple related physical memory pages. This leads to a spatial neighborhood linkage index that is significantly greater than For example, to reach or When sporadic memory noise occurs, usually only the first... The dirty page status of each physical memory page is When other physical memory pages in the physical neighborhood set remain silent, the spatial neighborhood linkage index remains at its minimum value. .

[0069] For example, Figure 4 This is a schematic diagram of the spatial neighborhood linkage index distribution. Pages with clustered modifications exhibit higher linkage values, while isolated noise pages are concentrated in the low-value area at the bottom. This demonstrates that physical neighborhood analysis can identify mass modification behavior caused by file tampering and filter out discrete system noise.

[0070] At this point, the current physical memory pages are obtained. Spatial neighborhood linkage index.

[0071] S400: Based on the physical memory page activity accumulation index, spatial neighborhood linkage index, and system I / O load, obtain the current verification trigger score of the physical memory page; based on the relationship between the verification trigger score and a preset threshold, implement cloud host security baseline verification based on virtual machine introspection.

[0072] It should be noted that the activity accumulation index and spatial neighborhood linkage index have the ability to identify anomalies, but the virtual machine introspection semantic reconstruction is an operation that consumes host CPU resources. If all changed physical memory pages are checked, it will slow down system performance. Therefore, this invention constructs a gating mechanism that integrates spatiotemporal features and load conditions, and triggers semantic reconstruction only when the score is high, so as to realize on-demand checking and load avoidance.

[0073] Specifically, based on the cumulative activity index, spatial neighborhood linkage index, and preset spatial linkage amplification coefficient, the anomaly level of physical memory pages is obtained. This anomaly level is then adjusted based on the system I / O load to determine the anomaly level of each physical memory page at the current time. The verification trigger scoring includes:

[0074] Set the spatial linkage amplification factor This is used to weight the nonlinear amplification spatial neighborhood linkage index. For example, .

[0075] No. At the current moment, physical memory pages The verification trigger score satisfies the expression:

[0076] ;

[0077] In the formula, Indicates the first At the current moment, physical memory pages The verification triggers the scoring; Indicates the first At the current moment, physical memory pages Dirty page status; Indicates the first At the current moment, physical memory pages Spatial neighborhood linkage index; Indicates the spatial linkage amplification factor; Indicates the first At the current moment, physical memory pages Cumulative activity index; This represents a preset microvalue to prevent the denominator from being 0; it can be set to 0.001. Indicates the current time The system I / O load.

[0078] In this relation, Indicates the first The degree of abnormality of a physical memory page; the greater the degree of abnormality, the more abnormal the page. A physical memory page exhibiting both long-term historical quiescence and current large-scale writes indicates a high-risk scenario where critical configuration files have been tampered with; conversely, the smaller the anomaly, the more likely the first physical memory page is to be tampered with. A physical memory page may contain historically active hot data that suppresses the score, or it may be due to a current isolated noisy write that results in a low score. The tolerance factor represents the system load. The larger the tolerance factor, the lower the current system I / O load, allowing for a high-score check to be triggered. Conversely, the smaller the tolerance factor, or even close to 0, the higher the current system load, and the lower the check trigger score should be to avoid performance congestion.

[0079] At this point, the current physical memory pages are obtained. The verification triggers the scoring.

[0080] Preferably, a preset threshold is set. For example, .

[0081] Real-time monitoring of the verification trigger score of each physical memory page; when the verification trigger score of any physical memory page is greater than or equal to a preset threshold... At that time, the virtual address region corresponding to the physical memory page is locked.

[0082] Start the virtual machine introspection file parsing module, use virtual machine introspection to reverse map the physical address of the virtual address region to the virtual address, locate the corresponding file system path, perform baseline rule comparison only on the file corresponding to the virtual address region, and output the verification results.

[0083] For example, Figure 5 This is a schematic diagram showing the distribution of page types that trigger verification. The pie chart shows the proportion of each type of page that is locked by the system and triggered for further inspection under a specific threshold setting. This reflects the effectiveness of the verification trigger scoring mechanism in filtering and classifying pages with different behavioral characteristics, and verifies the model's ability to locate high-risk targets.

[0084] This completes the baseline verification of cloud host security based on virtual machine introspection.

[0085] This invention also discloses a cloud host security baseline verification system based on virtual machine introspection, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, a cloud host security baseline verification method based on virtual machine introspection according to this invention is implemented.

[0086] The system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.

[0087] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A cloud host security baseline verification method based on virtual machine introspection, characterized in that, include: Any virtual machine to be tested is used as the target virtual machine, and the physical memory space of the target virtual machine is divided into physical memory pages of fixed size. The virtualization management program layer of the host machine monitors the target virtual machine to obtain the dirty page status of the physical memory pages and the system I / O load. Based on the dirty page status of physical memory pages within a preset historical observation window, obtain the cumulative activity index of each physical memory page at the current moment; Based on the dirty page status of physical memory pages within a preset physical neighborhood set, obtain the spatial neighborhood linkage index of each physical memory page at the current moment; Based on the activity accumulation index, the spatial neighborhood linkage index, and the system I / O load, obtain the physical memory page's current check trigger score; Based on the relationship between the verification trigger score and the preset threshold, a cloud host security baseline verification based on virtual machine introspection is implemented.

2. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, Obtaining the dirty page status of the physical memory page includes: The extended page table corresponding to the target virtual machine is located through the virtualization hypervisor layer. At the end of each sampling period, the dirty page status of the extended page table corresponding to each physical memory page is traversed and read. If the dirty page status of the first physical memory page in the target virtual machine's physical memory space is... At the current moment, physical memory pages If a write operation occurs within the sampling period, then mark the first... At the current moment, physical memory pages dirty page status It is 1 if it is true, otherwise it is 0.

3. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, The acquisition of the system I / O load includes: The performance counters of the virtualization management layer are used to obtain and normalize the target virtual machine's current performance at the current moment. The disk I / O throughput at the current moment The system I / O load is denoted as ,satisfy ,in Indicates free time. Indicates that the vehicle is fully loaded.

4. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, The cumulative activity index satisfies the following relationship: ； In the formula, Indicates the first At the current moment, physical memory pages Cumulative activity index; Indicates the first The length of the historical observation window for each physical memory page; Indicates the first The time step index for backtracking within the historical observation window of a physical memory page, with values ​​ranging from... arrive ; Indicates the first At the current moment, physical memory pages The previous The state of the dirty page at each sampling time; This represents the time decay coefficient.

5. The cloud host security baseline verification method based on virtual machine introspection according to claim 4, characterized in that, The settings for the historical observation window of the physical memory page include: At the current moment As the endpoint, set the number Length of historical observation window for each physical memory page , is used to define the time range for backtracking.

6. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, The spatial neighborhood linkage index satisfies the following relationship: ； In the formula, Indicates the first At the current moment, physical memory pages Spatial neighborhood linkage index; Indicates the first The physical neighborhood set of each physical memory page; Represents the physical memory page index within the physical neighborhood set; Indicates the first Within the physical neighborhood set of the nth physical memory page, the th At the current moment, physical memory pages Dirty page status; This represents the distance weight constant.

7. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, Based on the cumulative activity index, the spatial neighborhood linkage index, and the system I / O load, obtain the current check trigger score of the physical memory page, including: The physical memory page check trigger score is obtained by multiplying the dirty page status of the physical memory page at the current moment by the product of the preset spatial linkage amplification coefficient of the spatial neighborhood linkage index, dividing the quotient by the sum of the activity accumulation index and the preset small value, and then multiplying by 1 and subtracting the difference obtained by the current system I / O load.

8. The cloud host security baseline verification method based on virtual machine introspection according to claim 1, characterized in that, Based on the relationship between the verification trigger score and the preset threshold, a cloud host security baseline verification based on virtual machine introspection is implemented, including: Set preset threshold Real-time monitoring of the verification trigger score of each physical memory page; when the verification trigger score of any physical memory page is greater than or equal to a preset threshold... At that time, the virtual address region corresponding to the physical memory page is locked; Start the virtual machine introspection file parsing module, use virtual machine introspection to reverse map the physical address of the virtual address region to the virtual address, locate the corresponding file system path, perform baseline rule comparison only on the file corresponding to the virtual address region, and output the verification results.

9. A cloud host security baseline verification method based on virtual machine introspection according to claim 6, characterized in that, The setting of the physical neighborhood set of the physical memory page includes: With the first A physical neighborhood set is constructed centered on each physical memory page. , Including the Each physical memory page is located four pages adjacent to each other at the physical address, for a total of eight pages.

10. A cloud host security baseline verification system based on virtual machine introspection, characterized in that, include: A processor and a memory, the memory storing computer program instructions, which, when executed by the processor, implement a cloud host security baseline verification method based on virtual machine introspection according to any one of claims 1-9.

Images