Method and system for processing access requests based on instrumentation

Abstract

The application discloses a kind of based on the processing method and system of access request of insertion peg, wherein, the method includes: host computer detection module is determined as target memory page with the memory page corresponding to the address to be monitored, the target memory page is copied to obtain mirror memory page;Into the target memory page with the preset insertion peg instruction corresponding to the address to be monitored, and cancel the access authority of the target memory page;Host computer detection module is replaced as the mirror memory page according to the virtual machine exit event triggered by the access request of the target memory page to the target memory page, and restore the access authority of the target memory page, so that the access request to the target memory page is processed according to the mirror memory page.The mode can avoid the problem that the insertion peg instruction in the memory page that has been inserted is read or covered due to the access behavior of other processes or threads in the virtual machine.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an access request processing method and system based on instrumentation. BACKGROUND

[0002] Virtual Machine (VM) refers to a complete computer system which is simulated by software and runs in a completely isolated environment and has complete hardware system functions. In the prior art, a virtual machine can be used to detect malicious behaviors so as to detect threat sources. For example, a sandbox environment can be constructed by using virtual machine technology so as to perform security detection in the sandbox environment. In addition, during the security detection, an instrumentation operation is usually performed on specific instructions to monitor the execution process of the instructions.

[0003] However, the inventors have found in the implementation of the present application that the above-mentioned method in the prior art at least has the following defects: after the execution of the instruction instrumentation, the memory data of the instrumented new instruction can be read or overwritten due to the access behaviors of other processes or threads inside the virtual machine. When the memory data of the instrumented new instruction is read by other processes or threads inside the virtual machine, the instrumentation instruction will be leaked, thus facilitating the attack of hackers. When the memory data of the instrumented new instruction is overwritten by other processes or threads inside the virtual machine, the instrumentation instruction will be lost, thus affecting the execution result of the instrumentation operation. SUMMARY

[0004] In view of the above problems, the present application is proposed to provide an access request processing method and system based on instrumentation which can overcome the above problems or at least partially solve the above problems.

[0005] According to one aspect of the present application, an access request processing method based on instrumentation is provided, comprising:

[0006] The host detection module determines a memory page corresponding to the to-be-monitored address as a target memory page, and copies the target memory page to obtain a mirror memory page;

[0007] A preset instrumentation instruction corresponding to the to-be-monitored address is inserted into the target memory page, and the access permission of the target memory page is cancelled;

[0008] The host detection module replaces the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request of the target memory page, and restores the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page.

[0009] According to another aspect of the present application, there is provided a stub-based access request processing system, comprising:

[0010] a host detection module and a virtual machine detection module; wherein the host detection module further comprises:

[0011] a mirror unit adapted to determine a memory page corresponding to the address to be monitored as a target memory page, and to copy the target memory page to obtain a mirror memory page;

[0012] a stub unit adapted to insert a preset stub instruction corresponding to the address to be monitored into the target memory page, and to cancel the access permission of the target memory page;

[0013] a processing unit adapted to replace the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request for the target memory page, and to restore the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page.

[0014] According to still another aspect of the present application, there is provided an electronic device, comprising a processor, a memory, a communication interface and a communication bus, the processor, the memory and the communication interface being in communication with each other through the communication bus;

[0015] The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform the operations corresponding to the above-described stub-based access request processing method.

[0016] According to still another aspect of the present application, there is provided a computer storage medium, the storage medium storing at least one executable instruction, and the executable instruction causes the processor to perform the operations corresponding to the above-described stub-based access request processing method.

[0017] According to the stub-based access request processing method and system disclosed in the present application, the host detection module copies a target memory page corresponding to an address to be monitored to obtain a mirror memory page, cancels the access permission of the target memory page after inserting a preset stub instruction corresponding to the address to be monitored into the target memory page, and accordingly, replaces the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request for the target memory page, and restores the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page. In this way, when an access request is directed to a memory page that has been stubbed, a virtual machine exit event will be triggered, so that the target memory page is replaced with the mirror memory page, and then the access request is implemented based on the mirror memory page. In this way, the problem that the stub instructions in the stubbed memory page are read or overwritten due to the access behavior of other processes or threads inside the virtual machine can be avoided.

[0018] The above description is only a summary of the technical solutions of the present application. In order to enable one skilled in the art to better understand the technical means of the present application and to implement the same according to the contents of the description, and in order to enable the above and other purposes, features and advantages of the present application to be more apparent and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0019] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Furthermore, the same reference numerals are used throughout the several views that follow. In the drawings:

[0020] Figure 1 A flowchart of a method for processing an access request based on a plug-in according to an embodiment of the present application is shown;

[0021] Figure 2 A flowchart of a method for processing an access request based on a plug-in according to another embodiment of the present application is shown;

[0022] Figure 3 A system structure diagram of a system for processing an access request based on a plug-in according to another embodiment of the present application is shown;

[0023] Figure 4 A structure diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are shown. While the present disclosure is shown in the drawings and described as being implemented in exemplary embodiments, it is to be understood that the present disclosure is not limited to the embodiments explicitly set forth and can be carried out in various forms. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0025] Figure 1 A flowchart of a method for processing an access request based on a plug-in according to an embodiment of the present application is shown. As shown in Figure 1 the method includes:

[0026] Step S110: The host machine detection module determines a memory page corresponding to the address to be monitored as a target memory page, and copies the target memory page to obtain a mirror memory page.

[0027] The address to be monitored is an address that needs to be monitored by means of the insertion of a probe. The memory page corresponding to the address to be monitored is determined as a target memory page, so as to copy the target memory page, thereby obtaining a mirror memory page that is completely the same as the target memory page. As can be seen, the insertion of a probe has not been performed on the target memory page before the target memory page is copied, and therefore the mirror memory page is the same as the original memory page and does not contain the probe instruction.

[0028] Step S120: inserting a preset probe instruction corresponding to the address to be monitored into the target memory page, and canceling the access permission of the target memory page.

[0029] The preset probe instruction is used to monitor the address to be monitored, and can be a virtual machine privilege instruction, an interrupt instruction, or other types of instructions. After the insertion of a probe, the target memory page contains the probe code and is different from the original memory page. In this embodiment, in order to prevent the probe instruction from being read or overwritten, the access permission of the target memory page needs to be canceled.

[0030] Step S130: the host detection module replaces the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request for the target memory page, and restores the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page.

[0031] Since the access permission of the target memory page has been canceled, when an access request for the target memory page is received, a virtual machine exit event is triggered, so that the host detection module switches to a root mode, so as to replace the target memory page with the mirror memory page. When the replacement is completed, the access permission of the target memory page is restored, and accordingly the access request for the target memory page is processed according to the mirror memory page. As can be seen, through the virtual machine exit event and the memory page replacement operation, the access request can be redirected from the target memory page to the mirror memory page, thereby preventing the probe instruction in the target memory page from being read or overwritten.

[0032] As can be seen, when the access request points to the memory page that has been inserted with a probe, the virtual machine exit event is triggered, so as to replace the target memory page with the mirror memory page, and then the access request is implemented based on the mirror memory page. Through this way, the problem that the probe instruction in the memory page that has been inserted with a probe is read or overwritten due to the access behavior of other processes or threads in the virtual machine can be avoided.

[0033] For the convenience of understanding, the specific implementation details of the above method in the present application are described in detail below with a specific example. The method in the present application runs in a distributed cluster server sandbox, and is used to perform a high-level threat real-time detection task for a target sample file. Specifically, the present application is implemented based on a virtual machine monitor (VMM, Hypervisor) of full virtualization mode virtual machine management software in a host operating system (Host OS, Dom-0, Linux) kernel. The server host runs in a virtual machine sandbox isolation environment to perform a target sample file task. At the same time, the client driver module (belonging to the virtual machine detection module) loaded in the virtual machine operating system (also called the guest operating system, Guest OS, Dom-U, Windows) kernel and the global detection module (belonging to the host detection module) loaded in the host operating system (Dom-0) kernel are cooperatively linked to realize real-time monitoring of the activity behavior of the target task process, and to realize real-time collection and recording of task activity behavior and abnormal events. The behavior detection in the present application includes but is not limited to tasks with sensitive and abnormal behaviors such as vulnerability exploitation, kernel privilege escalation, highly suspicious environment destruction, information stealing, persistence, concealment, propagation and infection. The method in the present embodiment is mainly implemented by a global detection module located in the host operating system kernel and a client driver module located in the virtual machine operating system kernel, wherein the global detection module is also called the host detection module, and there is usually one; the client driver module is also called the virtual machine detection module, and there are usually multiple (located in different virtual machines), thereby realizing a "one-to-many" management relationship.

[0034] The global detection module is implemented based on a virtual machine monitor component of full virtualization mode virtual machine management software in the host operating system kernel. The code of the global detection module is integrated in the virtual machine management software source code. The modified and recompiled virtual machine management software module is installed in the server-side Linux operating system, and is loaded and initialized in the host operating system kernel at the time of server startup. When the startup initialization is completed, the global detection module will reside in the host operating system kernel and will not be affected by operations such as virtual machine instance creation, startup, shutdown and destruction. By hooking the virtual machine physical memory management and responding to the virtual machine control interface, the global detection module initializes the detection point data structure and object associated with a specific virtual machine when the virtual machine management software starts and closes the virtual machine. The global detection module realizes the detection function according to the pre-information data provided by the client driver module, and the pre-information data is collected in the guest operating system by the client driver module. In addition, there are also auxiliary modules such as log processing module, virtual machine scheduling module and task control module in the host operating system environment to assist the global detection module to realize the detection function.

[0035] The client driver module is located in the kernel of the virtual machine operating system, and is a kernel mode driver loaded in the kernel of the target guest operating system. The client driver module is loaded and initialized after the guest operating system is started, and the life cycle ends when the virtual machine operating system is closed. After being loaded and initialized, the client driver module collects pre-information data in the guest operating system according to the configuration information provided by the auxiliary component, including but not limited to operating system version information, key data structure definition and member offset, key system data or object address, key system function address, specific monitoring code block address, etc. In addition, the virtual machine detection module can also perform part of the detection functions that cannot be implemented in the external virtual machine manager component, including but not limited to various system event notifications, filter drivers, etc. The detection functions implemented in the virtual machine are output through the instant communication of the global detection module and the client driver module.

[0036] Figure 2 A schematic diagram of a method for processing an access request based on a plug-in provided by another embodiment of the application is shown. As shown in Figure 2 The method comprises the following steps:

[0037] Step S200: The virtual machine detection module obtains a list of key system function addresses and a list of preset monitoring code block addresses, and generates a monitoring list according to the list of key system function addresses and the list of preset monitoring code block addresses.

[0038] Specifically, when the virtual machine environment is started, the virtual machine detection module is loaded and initialized. The virtual machine detection module is responsible for pre-data information collection and the like. According to the operating system version and kernel module version information, a list of key system function addresses and a list of specific monitoring code blocks are obtained. The key system functions include but are not limited to: key functions in the system service descriptor table (SSDT), important exported functions of kernel modules, and important non-exported functions that need to be located through instruction matching calculation. The specific monitoring code block refers to: a code block in the system module that has a historical vulnerability. When the instruction is executed, the code block is monitored and conditionally judged according to the register and memory context, and the corresponding exploitation behavior for the historical vulnerability can be accurately identified. Accordingly, a monitoring list is generated according to the list of key system function addresses and the list of preset monitoring code block addresses. In addition, the virtual machine detection module can further determine the target process initially started, the process started by the target process or injected by the target process, and the process loading the file released by the target process as a process to be monitored, so as to add the process to be monitored to the monitoring list. Moreover, the monitoring list can be dynamically updated, and the updated monitoring list is transmitted to the host detection module through the instant communication function.

[0039] In addition, the virtual machine detection module can also store the instructions of the location of each address of the key system function address list and the specific monitoring code block address list according to a preset policy and initialize a jump interval (i.e., a jump interval) for jumping back to the original function execution. Of course, the operation of initializing the jump interval can also be implemented by the host detection module, and the present application does not limit this.

[0040] Step S210: The host detection module acquires the monitoring list containing the addresses to be monitored generated by the virtual machine detection module through a first virtual machine exit event triggered by the virtual machine call instruction.

[0041] Specifically, after the virtual machine detection module generates the monitoring list, the first virtual machine exit event is triggered by executing the virtual machine call instruction, and accordingly, the host detection module is switched to the root mode, so as to acquire and change the register values and other state information of the virtual machine processor, and then acquire the monitoring list generated by the virtual machine detection module. The instant communication function between the virtual machine detection module and the host detection module is realized by triggering the virtual machine exit event, and the specific implementation details of the instant communication function will be described in detail below, which will not be described here.

[0042] Step S220: The host detection module determines the memory page corresponding to the address to be monitored as a target memory page, and copies the target memory page to obtain a mirror memory page.

[0043] The address to be monitored mainly refers to the address contained in the monitoring list, and of course can also be an address obtained in other ways. This step needs to be operated for each address to be monitored. In specific implementation, before the plug-in operation of the behavior monitoring function based on plug-in is executed, the host detection module allocates and copies a mirror memory page for each guest linear address (GLA) in the monitoring address information array. The data in the mirror memory page is the same as that in the original memory page, which serves as the initial backup of the original memory page. In the inactive state, the mirror memory page does not exist in the extended page table (EPT) of the guest machine. The monitoring address information array is an array for storing each address to be monitored.

[0044] Step S230: Inserting a preset plug-in instruction corresponding to the address to be monitored into the target memory page, and canceling the access permission of the target memory page.

[0045] Specifically, the access permission of the target memory page can be canceled by the following method: determining the page table entry corresponding to the target memory page, setting the read-write bits in the page table entry to zero to cancel the read-write access permission of the target memory page, and retaining the execution permission of the target memory page.

[0046] In implementation, the host detection module parses the 4-level page table structure from the extended page table (EPT) associated with the current domain according to the guest frame number (GFN) of the original memory page (i.e. the target memory page), locates and records the page table entry (PTE) corresponding to the original memory page. When the virtual machine detection module informs the host detection module to enable the monitoring function, the host detection module traverses each node in the monitoring address information array, sets the read and write bits in each page table entry (PTE) stored in the previous step to zero, thereby canceling the read and write access permissions of the corresponding guest memory page and only retaining the execution permission.

[0047] Step S240: The host detection module replaces the target memory page with the mirror memory page according to the virtual machine exit event triggered by the access request of the target memory page, and restores the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page.

[0048] The access request is triggered by a thread or process in the virtual machine operating system. Since the access permission of the target memory page has been canceled, the access request for the target memory page will trigger a second virtual machine exit event caused by EPT-VIOLATION due to violation of the EPT, so that the host detection module switches to the root mode, in which the host detection module has the permission to obtain and change the register values and other state information of the virtual machine processor, so that the target memory page can be replaced with the mirror memory page and the access permission of the target memory page can be restored in the ROOT mode. Specifically, the page table entry of the target memory page pointed by the access request is found, the read and write bits in the page table entry are set to one to restore the read and write access permissions of the target memory page, and the frame number value of the mirror memory page is written into the page table entry to activate the mirror memory page and make the mirror memory page process the access request instead of the target memory page.

[0049] In implementation, when a thread of the guest operating system attempts to read or write access the memory page (i.e. target memory page) of the instrumented new instruction, the access operation will cause the logical processor to trigger a VM-EXIT event with the EPT VIOLATION reason to return to the ROOT mode execution, since the read and write access permissions of the memory page have been cancelled by the previous step through the extended page table (EPT). The processing function in the host detection module for processing the VM-EXIT event acquires the execution environment related information according to the reason of triggering the VM-EXIT and the guest physical address (GPA) being accessed, and looks up the node corresponding to the address in the monitoring address information array. Then, the processing function sets the read and write bits of the page table entry (PTE) of the monitoring address information node, to restore the read and write access permissions; and writes the host physical page frame number (HFN) value of the mirror memory page created in the previous step into the page frame number value position of the page table entry (PTE), to activate the mirror memory page, so as to replace the accessed memory page in the guest with the mirror memory page.

[0050] Therefore, when the logical processor returns to the guest context execution, the read and write access instructions for the target memory page will continue to be executed, and the access instructions will be able to successfully perform the read and write access operations, but the actual target object of the read and write access operations is the mirror memory page, thereby ensuring that the instrumented new instruction in the original memory page will not be read or overwritten. In other words, although the access instructions are directed to the target memory page, since the target memory page is replaced by the mirror memory page by switching to the ROOT mode after receiving the access instructions in the embodiment, the actual access object of the access instructions is the mirror memory page.

[0051] In addition, further alternatively, in order to enable the mirror memory page to be restored to the target memory page again after the current access request is processed, thereby ensuring the execution of the inserted instruction, after the mirror memory page is activated, further comprising: setting a monitor trap flag bit (i.e. MTF control flag bit) for the virtual machine processor. Wherein, by setting the monitor trap flag bit, the processor triggers a virtual machine exit event due to an exception after executing an instruction each time. Correspondingly, the method in the embodiment further comprises: when the access request is processed, triggering a virtual machine exit event corresponding to the monitor trap flag bit to cancel the monitor trap flag bit; and restoring the read-write bit position of the page table entry to zero state, and restoring the page frame number value of the mirror memory page which has been written into the page table entry to the page frame number value of the target memory page. As can be seen, the virtual machine exit event triggered by the monitor trap flag bit enables the host detection module to detect the event (or opportunity) that the access request is processed, and then cancels the monitor trap flag bit at the first time point when the access request is processed, thereby enabling the target memory page to restore to the state before the access request is triggered. In specific implementation, when the read and write access operations are completed, the logical processor will generate a VM-EXIT event of type MONITORTRAPFLAG due to the MTF control flag bit set by the virtual machine processor. The processing function of the host detection module cancels the MTF control flag bit of the virtual machine processor at this time, restores the zero state of the read and write bit positions of the previous step page table entry (PTE), and rewrites the host physical page frame number (HFN) of the original memory page into the page frame number value position of the page table entry (PTE), and returns to the guest context to continue execution.

[0052] As can be seen, in the embodiment, the inserted trace is hidden and protected, and the modification trace of the memory address inserted in the virtual machine environment can be hidden for the processes or threads inside the virtual machine. Thus, the inserted memory address is protected, and the memory block of the inserted new instruction cannot be read or overwritten by any process or thread inside the virtual machine. The hiding and protection function of the inserted trace in the embodiment is mainly realized based on the extended page table (EPT) mechanism of the hardware virtualization technology. The target of the hiding and protection is the set of inserted points described in the inserted behavior monitoring function.

[0053] In addition, the embodiment can be further used to realize the inserted behavior monitoring function, and accordingly, after step S220, the method further comprises the following steps:

[0054] Step one: respectively for each to-be-monitored address contained in the monitoring list, determine the memory position corresponding to the to-be-monitored address, and insert a preset inserted instruction into the memory position.

[0055] Specifically, for each to-be-monitored address contained in the monitoring list, a memory page where the to-be-monitored address is located is determined as a target memory page, an offset position corresponding to the to-be-monitored address in the target memory page is determined, and the offset position is determined as a memory position corresponding to the to-be-monitored address. In addition, in order to facilitate data recovery, when a preset instrumentation instruction is inserted into the memory position, a previous instruction corresponding to the memory position is further determined, and the previous instruction is stored in association with the memory position; wherein, when the monitoring operation is completed, data recovery is performed according to the previous instruction. Wherein, the memory position corresponding to the to-be-monitored address mainly refers to the target memory page mentioned above.

[0056] In a specific implementation, the host detection module initializes a monitoring address information array according to an address list of the to-be-monitored addresses in the monitoring list. The initialized monitoring address information array is used to store each to-be-monitored address in an array form. Wherein, each to-be-monitored address can be a guest linear address (GLA). The host detection module inserts a specific instruction, such as a virtualization-related privileged instruction or an interruption instruction, into an offset position corresponding to each GLA in the monitoring address information array according to a preset strategy. In addition, the original instruction that is covered before inserting the new instruction is stored for data recovery when the monitoring function is closed.

[0057] Step two: when the host detection module detects a second virtual machine exit event triggered by the execution process of the preset instrumentation instruction, data information related to the execution process of the preset instrumentation instruction is queried according to the second virtual machine exit event.

[0058] Specifically, when a thread or process of the guest operating system executes the instrumented new instruction, the logical processor triggers a VM-EXIT event of a corresponding reason to return to the ROOT mode for execution. Correspondingly, a processing function in the host detection module for processing the VM-EXIT event acquires execution environment related information at that time according to the reason for triggering the VM-EXIT and the value of the instruction pointer register, looks up a node corresponding to the address in the monitoring address information array, and further determines the data information related to the execution process of the preset instrumentation instruction.

[0059] Step three: a detection task is performed according to the queried data information to realize behavior monitoring.

[0060] Specifically, according to the queried data information and a preset processing strategy, it is judged whether the detection task is completed by the virtual machine detection module; if yes, the detection task is executed by the virtual machine detection module, and after the detection task is completed, the program is jumped to a preset landing interval address; if not, the detection task is executed by the host detection module, and after the detection task is completed, the program is jumped to the preset landing interval address.

[0061] In implementation, according to the pre-set policy, the processing function in the host machine detection module for processing the VM-EXIT event judges whether the current triggering event processing mode needs to return to the guest machine context to perform the detection task:

[0062] If yes, the processing function modifies the instruction pointer register of the virtual machine processor to the guest machine context processing function address (GLA) corresponding to the current calling address, and returns to the guest machine context to resume execution. In addition, according to the information of the number and type of parameters, the type of return value and the like specified and stored in advance, the processing function performs the detection task in the virtual machine detection module. When the detection task is completed, the processing function calls or jumps to the corresponding trampoline interval address to continue executing the original function.

[0063] If no, according to the information of the number and type of parameters, the type of return value and the like specified and stored in advance, the processing function performs the detection task in the host machine detection module. When the detection task is completed, the processing function modifies the instruction pointer register of the virtual machine processor to the trampoline interval address (GLA) corresponding to the current calling address, and returns to the guest machine context to resume execution.

[0064] In addition, after performing the detection task according to the queried data information, a detection log is further output according to the detection result. Specifically, the processing function performing the detection task judges whether the current execution context belongs to the monitored process and thread, and whether the current thread is in a recordable state, and determines whether to output the detection log according to the judgment result. Specifically, the processing function parses the parameter data according to the parameter type of the current calling function and generates the detection log.

[0065] It can be seen that in the embodiment, the behavior monitoring based on the insertion includes the monitoring of the specified key system function calling behavior, the context judgment when the specific monitoring code block instruction is executed and the like detection functions. The behavior monitoring function based on the insertion is implemented by inserting specific instructions at specified positions. This way realizes the state switching of the virtual machine processor during execution by inserting virtualization related privileged instructions or interrupt instructions at specified memory addresses, and further realizes the behavior monitoring. According to the pre-set policy, the behavior monitoring function based on the insertion can be executed in the processing function of the host machine detection module in the host machine context, or can be directed to return to the processing function of the virtual machine detection module in the guest machine context. In addition, in the embodiment, the number of to-be-monitored addresses contained in the monitoring list generated by the virtual machine detection module can be dynamically updated, and correspondingly, the updated monitoring list is synchronized to the host machine detection module through the instant communication function, so that the host machine detection module performs the insertion and behavior monitoring operation according to the updated monitoring list.

[0066] The steps one, two and three above are executed in parallel with the step S230 and the step S240, so that the behavior monitoring function based on the instrumentation can be realized, and the target memory page can be ensured not to be read or overwritten by the access request in the instrumentation process, so that the hiding and protection function of the instrumentation instruction can be realized.

[0067] In addition, in addition to being able to realize the behavior monitoring function based on the instrumentation, the access request processing method in the application can realize the following three functions, which are the two-end instant communication function, the memory access behavior monitoring function, and the abnormal event monitoring function of the virtual machine operating system. The following three examples will be described in detail with respect to the above three functions:

[0068] Example one, two-end instant communication function

[0069] Step one: the virtual machine detection module is initialized and the pre-data information is collected.

[0070] When the virtual machine environment is started, the virtual machine detection module and the driving sub-module contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definition and member offset, key system data or object address, key system function address, and specific monitoring code block address, etc.

[0071] Step two: the virtual machine detection module encapsulates the data information related to the threat detection process obtained in the virtual machine environment into serialized data.

[0072] The data information related to the threat detection process includes the pre-data information collected above and / or the threat data information related to the threat source obtained by the virtual machine detection module. In order to comply with the communication specification between the virtual machine and the host, in the application, the data information related to the threat detection process is encapsulated into serialized data in the agreed serialization protocol and format, and the parsing operation is performed according to the serialization protocol. The serialization protocol and format agree on the authentication string, data type, size of the header structure, member field, and length of the appended data, etc.

[0073] Step three: cache the serialized data to the preset memory space, and store the space address of the preset memory space in the preset register.

[0074] Specifically, the preset memory space includes one or more continuous memory pages, and correspondingly, the serialized data is cached to the preset buffer, and the preset buffer is located in the memory page, and the linear address of the preset buffer contained in the memory page is stored in the preset register. The memory pages contained in the preset memory space can be a plurality of memory pages continuous in the linear address view.

[0075] Step four: the virtual machine detection module triggers a virtual machine exit event through a virtual machine call instruction.

[0076] The virtual machine detection module determines the call number corresponding to the data type of the serialized data, triggers a virtual machine exit event through a virtual machine call instruction corresponding to the call number, and correspondingly, the preset register further includes a plurality of general registers corresponding to different call numbers. The data type of the serialized data can be determined in combination with the client context. As can be seen, by pre-setting a plurality of call numbers corresponding to different data types and pre-setting the correspondence between each register and the call number, a variety of types of information can be flexibly transmitted. In specific implementation, the call number and the linear address of the preset buffer are assigned to the preset general registers such as EAX / RAX, EBX / RBX, and the VMCALL instruction is executed. When the VMCALL instruction is executed, the virtual machine processor unconditionally triggers a VM-EXIT event of the VMCALL cause, and the processor control right temporarily returns to the ROOT environment, so that the VM-EXIT processing function in the host detection module can be executed.

[0077] Step five: the host detection module queries the preset register according to the above virtual machine exit event to obtain and process the serialized data stored in the preset memory space.

[0078] Specifically, the virtual machine exit processing function (i.e. the VM-EXIT processing function) in the host detection module obtains the linear address stored in the preset register, and converts the linear address into a virtual machine physical address; according to the mapping relationship between the virtual machine physical address and the host physical address, the virtual machine physical address is converted into a host physical address; according to the host physical address, the serialized data stored in the preset memory space is obtained and processed. When the serialized data stored in the preset memory space is obtained and processed according to the host physical address, the physical page of the host physical address is mapped to the host operating system kernel address space to obtain a host linear address; the serialized data is read from the memory page mapped to the host operating system kernel address space. In addition, the host detection module also needs to obtain the call number of the virtual machine call instruction corresponding to the virtual machine exit event, query the general register corresponding to the obtained call number, and obtain and process the serialized data stored in the preset memory space according to the general register.

[0079] In implementation, the VM-EXIT processing function in the host machine detection module obtains the Call ID and the GLA of the transmitted data buffer according to the aforementioned assigned general registers. The processing function converts the GLA into the GPA, and then converts the GPA into the HPA according to the mapping relationship between the GPA and the HPA. Then, the processing function maps the converted HPA into the host operating system kernel address space to obtain the HLA (virtual address). Finally, the processing function reads the buffer data from the memory page mapped into the host operating system kernel address space, parses the serialized data according to the agreed protocol and format, obtains the information content of the current communication transmission, and uses the obtained information according to the strategy.

[0080] In addition, further optionally, the virtual machine detection module needs to send detection logs and other information to the host machine detection module during the detection task. Similarly, the log data is serialized and packaged through the separately agreed Call ID and protocol format corresponding to the log type, the VMCALL instruction is executed to unconditionally trigger the VM-EXIT event of the VMCALL reason, so that the processing function of the host machine detection module can parse and process the corresponding serialized data. The virtual machine detection module sends data information to the host machine detection module, including but not limited to: detection log data output by the partial detection function implemented in the virtual machine detection module; the extended process thread monitoring mechanism adds a new process or thread to the monitoring list; file data released by the target process in the virtual machine.

[0081] The host machine detection module is located in the virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in the guest machine implemented by the virtual machine; one host machine detection module corresponds to one or more virtual machine detection modules.

[0082] It can be seen that in the present example, the host detection module and the virtual machine detection module communicate through the virtualization privilege instruction triggering the virtual machine processor state switching, thereby enabling instant communication between the host detection module and the virtual machine detection module, thus facilitating data transmission between the two. In the function code of the virtual machine detection module, the register call number and the guest physical address are assigned and the VMCALL instruction is executed, so that the virtual machine processor unconditionally triggers the VMCALL reason VM-EXIT event to switch to the ROOT environment to execute the corresponding processing function in the host detection module, so that the host detection module obtains the call number and the guest physical address through the aforementioned assigned registers, and reads the data to be received from the guest physical memory according to the agreed protocol, thereby realizing the function of two-end instant communication.

[0083] Example two, monitoring function of memory access behavior

[0084] Step one: the virtual machine detection module is initialized and the pre-data information is collected, and the monitoring list is set according to the collection result.

[0085] When the virtual machine environment is started, the virtual machine detection module and the drive sub-module contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definition and member offset, key system data or object address, key system function address, and specific monitoring code block address, etc. Next, the virtual machine detection module determines the to-be-monitored object and its corresponding to-be-monitored address according to the operating system version and kernel module version information, for example, the address and size of the key system data or object, including: the Token member pointer of the system process associated object, the Token object of the system process associated object, the hardware abstraction layer (HAL) distribution function table, and the related kernel global variables indicating the user and kernel address space boundary. Finally, the monitoring list is generated according to the above information, which is used to store the to-be-monitored address corresponding to each to-be-monitored object in the above.

[0086] Step two: obtain the monitoring list set by the virtual machine detection module and the to-be-monitored address contained in the monitoring list, and determine the target memory page corresponding to the to-be-monitored address as the target memory page.

[0087] The host machine detection module obtains the monitoring list and the to-be-monitored addresses contained in the monitoring list set by the virtual machine detection module through instant communication function. The instant communication function is implemented by triggering the virtual machine to exit event, and the specific implementation manner will be described in detail below. In specific implementation, the host machine detection module initializes the monitoring address information array according to each to-be-monitored address in the delivered monitoring list, so as to store each to-be-monitored address in the form of array, thereby facilitating query. The to-be-monitored addresses in the monitoring list belong to the guest physical address (GPA). For each to-be-monitored address, the memory page where the to-be-monitored address is located is determined, and the memory page is determined as the target memory page.

[0088] Step three: set the read-write bits in the page table entry corresponding to the target memory page to zero to cancel the read-write access permission of the target memory page.

[0089] This step is implemented by the host machine detection module. In specific implementation, first, the to-be-monitored addresses and their corresponding target memory pages are determined according to the monitoring address information array mentioned above; then, the guest frame number (GFN) of the memory page where each guest physical address (GPA) is located is obtained, and the 4-level page table structure is parsed from the extended page table (EPT) associated with the current domain to locate and record the corresponding page table entry (PTE); finally, the read and write bits in each page table entry (PTE) stored in the previous step are set to zero, thereby canceling the read and write access permission of the corresponding guest memory page.

[0090] Step four: when the virtual machine exit event triggered by the access behavior of the target memory page is detected, switch to the root mode according to the virtual machine exit event.

[0091] Specifically, when there is a process or thread in the virtual machine operating system that attempts to access the target memory page, the access behavior corresponding to the process or thread will trigger a virtual machine exit event due to violation of the EPT. In response to the virtual machine exit event, the host machine detection module will switch from the non-root mode to the root mode. For example, when a thread of the guest operating system attempts to read or write the memory page of the inserted new instruction, since the read and write access permissions of the memory page have been canceled by the extended page table in the previous step, the access operation will make the logical processor trigger the VM-EXIT event of the EPT VIOLATION reason to return to the root mode (root mode) for execution.

[0092] Step five: monitor the access data information corresponding to the access behavior of the target memory page in the root mode.

[0093] Specifically, the values of the preset registers and the guest memory data are read to determine the execution environment information and the access state information corresponding to the access behavior. The execution environment information includes: the process or thread performing the access, the caller function of the access behavior, the stack backtracking sequence, the malicious code block, and / or the key register values; and the access state information includes: the read access of a non-system process to a member pointer of a system process associated object, the read access to the system process associated object, the write access to a hardware abstraction layer (HAL) dispatch function table, and / or the write access to a related kernel global variable indicating the user and kernel address space boundaries.

[0094] In a specific implementation, when the target address of the access belongs to the monitored data and object range, according to the monitoring policy, the processing function in the host detection module determines the execution environment information such as the process, thread, etc. performing the access according to the related virtual machine processor register values and the guest memory data, and determines whether the current read or write operation is in an abnormal state, and records and outputs the abnormal state and the execution environment information. The abnormal state includes but is not limited to: the read access of a non-system process to a Token member pointer of a system process associated object, the read access to the system process associated Token object, the write access to a hardware abstraction layer (HAL) dispatch function table, and the write access to a related kernel global variable indicating the user and kernel address space boundaries. The execution environment information includes: the process, thread, caller function, necessary stack backtracking sequence, suspicious malicious code block, and key register values performing the access.

[0095] In addition, considering that the target memory page may contain addresses other than the to-be-monitored addresses, in the root mode, the processing function in the host detection module further matches the access object of the access behavior with the to-be-monitored addresses contained in the monitoring list when monitoring the access data information corresponding to the access behavior of the target memory page. If the matching is successful, the access data information corresponding to the access behavior of the target memory page is monitored. If the matching is not successful, the root mode is exited and the guest context execution is returned. For example, the memory page where the key system data or object to be monitored is located may still contain other data or objects that are not monitored. When these data or objects are accessed, a VM-EXIT event is triggered. Therefore, in the processing function of the host detection module, the data object address and size stored in the previous step are matched with the target address of the current access. The access that does not belong to the monitored data and object range is ignored, and the logical processor returns to the guest context for continued execution.

[0096] It can be seen that the monitoring operation for the memory access behavior can be completed through the above steps. In addition, in order not to affect the normal execution of the access behavior, in the embodiment, after monitoring the access data information corresponding to the access behavior of the target memory page in the root mode, further comprising: setting the read-write bit in the page table entry corresponding to the target memory page to one to restore the read-write access permission of the target memory page, and setting the monitor trap flag bit for the virtual machine processor; wherein the monitor trap flag bit is used to trigger a virtual machine exit event corresponding to the monitor trap flag bit when the access operation of the access behavior is completed for the target memory page. Accordingly, the method further comprises: when detecting the virtual machine exit event corresponding to the monitor trap flag bit, canceling the monitor trap flag bit, and restoring the read-write bit of the page table entry to zero state.

[0097] For example, when the detection task for the memory access behavior is completed, the processing function sets the read and write bits in the page table entry of the previous step to one to restore the read and write access permissions; at the same time, the processing function sets the MTF control flag bit of the virtual machine processor. Accordingly, when the logical processor returns to the guest context execution, it will continue to execute the read and write access instructions for the target memory page, and the access instructions will be able to successfully execute the read and write access operations. Through the above operation, the access behavior for the target memory page is implemented normally. When the read and write access operations are completed, the logical processor will occur a VM-EXIT event of type MONITORTRAPFLAG due to the setting of the MTF control flag bit of the virtual machine processor. The processing function of the host detection module cancels the MTF control flag bit of the virtual machine processor at this time, and restores the zero state of the read and write bits of the page table entry of the previous step, and returns to the guest context for continuous execution.

[0098] It can be seen that the real-time monitoring effect of the memory access behavior can be achieved through the virtual machine exit event: once the access behavior is executed, the virtual machine exit event will be triggered at the first time, so that the memory access behavior can be monitored at the first time. This method can realize real-time monitoring of the read and write access behaviors of the specific key system data or object address of the guest operating system. The real-time monitoring function of the memory access is mainly realized based on the extended page table mechanism of the hardware virtualization technology. In addition, the real-time monitoring function of the memory access can be mainly implemented for the following processes to be monitored: the target process initially started, the process started by the target process and injected by the target process, and the process loading the file released by the target process.

[0099] Example three, abnormal event monitoring function of virtual machine operating system

[0100] Step one: initialization of the virtual machine detection module and collection of preposition data information.

[0101] When the virtual machine environment is started, the virtual machine detection module and the driver sub-module contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definition and member offset, key system data or object address, key system function address, and specific monitoring code block address, etc. In addition, the virtual machine detection module obtains the function address of the operating system kernel exception handling key function (i.e. exception handling function) according to the operating system version and kernel module version information.

[0102] Step two: through the first virtual machine exit event triggered by the virtual machine call instruction, the function address of the exception handling function provided by the virtual machine detection module is obtained.

[0103] Specifically, according to the two-end instant communication function, the virtual machine detection module and the host machine detection module can communicate instantaneously. Accordingly, the function address of the kernel exception handling key function determined in the previous step is passed to the host machine detection module. The host machine detection module sets the function address through the instrumentation operation to be monitored when executed.

[0104] Step three: inserting preset instrumentation code for the function address; wherein the preset instrumentation code is used to monitor when the exception handling function is executed.

[0105] The preset instrumentation code is used to monitor when the exception handling function is executed. The preset instrumentation code can be implemented in various forms, for example, it can be in the form of a probe. In addition, when the number of exception handling functions is multiple, the corresponding preset instrumentation code needs to be inserted for each function address of the exception handling function.

[0106] Step four: when the second virtual machine exit event triggered by the execution process of the exception handling function is detected, the root mode is switched according to the second virtual machine exit event.

[0107] Specifically, through the execution logic of the preset instrumentation code, the exception handling function can be executed, and the second virtual machine exit event can be triggered through the preset instrumentation code. Accordingly, the host machine detection module switches to the root mode according to the second virtual machine exit event, and in the root mode, the host machine detection module can obtain and change the register value and other state information of the virtual machine processor.

[0108] For example, when a blue screen type of abnormal event occurs inside the virtual machine operating system, according to the operating system kernel module code logic, the kernel collects the blue screen context information and calls the execution of the related abnormal processing function. When a thread of the guest operating system executes the instrumented new instruction, the logical processor triggers a VM-EXIT event corresponding to the cause to return to the root mode execution, enters the processing function of the host detection module, so as to monitor the abnormal event through the processing function of the host detection module.

[0109] Step five: obtaining event information of the abnormal event related to the abnormal processing function in the root mode.

[0110] Since the state information such as the register value of the virtual machine processor can be obtained and changed in the root mode, the host detection module can determine the event information of the abnormal event related to the abnormal processing function based on the obtained state information. The event information of the abnormal event related to the abnormal processing function includes the occurrence time of the abnormal event, the cause of the abnormal event, the execution environment information at the time of the abnormal event, and various types of information. For example, the processing function in the host detection module obtains the blue screen context information through the register value such as ESP / RSP and the guest memory data and records and outputs the same.

[0111] Therefore, the present example can monitor the blue screen event of the guest operating system (i.e. the virtual machine operating system) in real time. The abnormal monitoring function of the guest operating system instrumentally monitors the system function responsible for processing the operating system blue screen event. When the guest operating system occurs blue screen, the system kernel will call the aforementioned function to collect system abnormal information and process the abnormality.

[0112] As can be seen from the above, the method in the embodiment can realize multiple functions. The method at least has the following advantages:

[0113] (1) The host detection module is implemented based on the global virtual machine monitor, so that the core code of the detection engine is implemented in the global virtual machine monitor layer, which can simplify the function of the virtual machine detection module inside the virtual machine, isolate the core code of the detection engine and the virtual machine environment, so that the abnormal state of the virtual machine environment will not affect the normal execution of the detection function, and the influence of the detection engine on the virtual machine environment is minimized. Moreover, since the core code of the detection engine is located in the global virtual machine monitor layer rather than in the virtual machine detection module, malicious processes with environment exploration behavior cannot steal the key data and code of the detection engine.

[0114] (2) Through the processor-based virtualization technology, the scheme also realizes the hiding and protection function of the detection module's instrumentation trace, so that the malicious code located in the virtual machine will be more difficult to realize the detection operation of the instrumentation point of the detection module including the hook, and the modification of the virtual machine located in the malicious code to the instrumented function address will not affect the detection function of the detection module's instrumentation point, thereby ensuring the continuous effectiveness of the threat detection function.

[0115] (3) The clustered distributed threat detection system itself relies on a specific virtual machine management software to realize virtual machine management, scheduling, basic support and other services in the server host. The threat detection implementation scheme based on the virtual machine monitor organically combines the software intermediate layer of the virtual machine management software and the threat detection function module, simplifies the multi-level separation structure originally relying on the support of nested virtualization and other mechanisms, greatly improves the hardware performance consumption of the virtual machine environment and the host physical server environment. In addition, through the threat detection implementation scheme based on the global virtual machine monitor, the data transmission path during the middle and late stages of the task detection can be greatly shortened, and the parallel detection efficiency of the virtual machines in the sandbox cluster will also be significantly improved.

[0116] In summary, compared with the traditional virtual machine-based detection method, the advantages of the scheme are: based on the global virtual machine monitor component, the dynamic threat detection engine function is realized through the processor-based virtualization technology, which provides strong guarantee for the runtime threat behavior detection in terms of detection effect, detection performance and detection reliability. The virtual machine detection module performs the pre-information collection task inside the virtual machine, the host detection module communicates and interacts with the virtual machine detection module through the virtual machine monitor layer in the host kernel to obtain the pre-information, and performs the detection point instrumentation, memory monitoring, privileged instruction monitoring, and execution flow control and transfer functions in the virtual machine monitor layer. The detection core function is located in the host operating system kernel outside the virtual machine, realizing the mutual isolation of the detection engine core code and the virtual machine environment. Depending on the VM-EXIT mechanism and the extended page table mechanism based on the processor-based virtualization technology, the two-end instant communication, behavior monitoring based on instrumentation, instrumentation trace hiding and protection, real-time memory access monitoring and client operating system exception monitoring and other key functions can be realized.

[0117] Figure 3 A system structure diagram of an access request processing system based on instrumentation provided by another embodiment of the application is shown in FIG. 3. Figure 3 As shown in FIG. 3, the system includes a host detection module 31 and a virtual machine detection module 32; wherein the host detection module 31 further includes:

[0118] The mirroring unit 311 is adapted to determine a memory page corresponding to the address to be monitored as a target memory page, and copy the target memory page to obtain a mirror memory page.

[0119] The patching unit 312 is adapted to insert preset patching instructions corresponding to the address to be monitored into the target memory page, and cancel the access permission of the target memory page.

[0120] The processing unit 313 is adapted to replace the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request for the target memory page, and restore the access permission of the target memory page, so that the access request for the target memory page is processed according to the mirror memory page.

[0121] Optionally, the patching unit is specifically adapted to:

[0122] determine a page table entry corresponding to the target memory page, and set a read-write bit in the page table entry to zero to cancel the read-write access permission of the target memory page and reserve the execution permission of the target memory page.

[0123] Optionally, the processing unit is specifically adapted to:

[0124] find a page table entry of the target memory page pointed by the access request, set the read-write bit in the page table entry to one to restore the read-write access permission of the target memory page;

[0125] and write a page frame number value of the mirror memory page into the page table entry to activate the mirror memory page and make the mirror memory page process the access request instead of the target memory page.

[0126] Optionally, the processing unit is further adapted to:

[0127] set a monitor trap flag bit for a virtual machine processor; and

[0128] when the access request is processed, trigger a virtual machine exit event corresponding to the monitor trap flag bit to cancel the monitor trap flag bit; and

[0129] restore the read-write bit in the page table entry to zero, and restore the page frame number value of the mirror memory page written into the page table entry to a page frame number value of the target memory page.

[0130] Optionally, the preset instrumentation instructions include: virtual machine privilege instructions and / or interrupt instructions.

[0131] Optionally, the host detection module is located in the virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in the guest machine implemented through a virtual machine; wherein, one host detection module corresponds to one or more virtual machine detection modules.

[0132] The specific structure and working principle of the host detection module, virtual machine detection module and each unit mentioned above can be found in the description of the corresponding steps in the method embodiment, and will not be repeated here.

[0133] This application provides a non-volatile computer storage medium storing at least one executable instruction that can execute the instrumentation-based access request processing method in any of the above method embodiments.

[0134] Figure 4 The diagram shows a structural schematic of an electronic device according to an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the electronic device.

[0135] like Figure 4 As shown, the electronic device may include: a processor 402, a communications interface 404, a memory 406, and a communications bus 408.

[0136] in:

[0137] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.

[0138] Communication interface 404 is used to communicate with other network elements such as clients or other servers.

[0139] The processor 402 is used to execute program 410, specifically the relevant steps in the above-described memory address lookup method embodiment.

[0140] Specifically, program 410 may include program code that includes computer operation instructions.

[0141] The processor 402 can be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to perform the operations of an embodiment of the application. The one or more processors included in the electronic device can be of the same type or different types, such as one or more CPUs and one or more ASICs.

[0142] The memory 406 stores a program 410. The memory 406 can include a high-speed RAM memory and can also include a non-volatile memory, such as at least one disk memory.

[0143] The program 410 can specifically be configured to cause the processor 402 to perform the operations of the method embodiments described above.

[0144] The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will be apparent from the description above. In addition, the present application is not intended to be limited to any particular programming language. It will be appreciated that there are many programming languages that can be used to implement the teachings herein, and any such programming language can be used in connection with the various aspects of the application.

[0145] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order to not obscure the understanding of this description.

[0146] Similarly, it is to be understood that the above description is only illustrative of the principles of the application and various modifications and alterations are used in the implementation of the application will be apparent to those skilled in the art without departing from the spirit and scope of the application. It is intended that the scope of the application should be determined by the scope of the appended claims and that within the scope of the claims the application can admit of many modifications therefore.

[0147] Those skilled in the art will appreciate that the modules in the apparatuses in the embodiments can be adapted and placed in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and furthermore can be split into multiple sub-modules or sub-units or sub-components. Any combination of all the features disclosed in the specification (including the accompanying claims, abstract and drawings), and any method or process or device of any combination of the features disclosed in the specification (including the accompanying claims, abstract and drawings) can be taken, except that at least some of such features and / or processes or units are mutually exclusive, unless explicitly stated otherwise. Each feature disclosed in the specification (including the accompanying claims, abstract and drawings) can be replaced by alternative features providing the same, equivalent, or similar functions unless stated explicitly otherwise.

[0148] Furthermore, those skilled in the art will appreciate that different embodiments of the application have different features and that the features of one embodiment can not be incorporated into other embodiments. For example, in the following claims, any of the claims can be used to enable a single claim, multiple claims or single and multiple claims in combination. The following claims are therefore merely exemplary and are not intended to limit the application or scope of the application in any way.

[0149] The various component embodiments of the application can be implemented in hardware, or as software modules running in one or more processors, or in combinations thereof. Those skilled in the art will appreciate that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the patch-based access request processing apparatus according to the embodiments of the application. The application can also be implemented as a device or apparatus program (for example, a computer program and a computer program product) for performing part or all of the methods described herein. Such a program implementing the application can be stored on a computer readable medium, or can be in the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

[0150] It should be noted that the above-mentioned embodiments illustrate rather than limit the application, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of both hardware and software, and any combination thereof. In a unitary claim, several devices or means can be listed, comprising means which can be implemented by one and the same hardware item. The use of the word "a" or "an" does not exclude the presence of a plurality of such elements, nor does it imply that a single element is to be used.

Claims

1. A method of processing access requests based on instrumentation, wherein, The method comprises: The host detection module determines a memory page corresponding to the address to be monitored as a target memory page, and copies the target memory page to obtain a mirror memory page; The preset probe instruction corresponding to the address to be monitored is inserted into the target memory page, and the access permission of the target memory page is cancelled; The host detection module replaces the target memory page with the mirror memory page according to a virtual machine exit event triggered by an access request of the target memory page, and restores the access permission of the target memory page, so that the access request of the target memory page is processed according to the mirror memory page; The step of determining, by the host detection module, the memory page corresponding to the address to be monitored as the target memory page specifically comprises: The host detection module acquires a monitoring list containing the address to be monitored through a first virtual machine exit event triggered by a virtual machine call instruction, wherein the monitoring list is generated by a virtual machine detection module, and the monitoring list is generated according to a key system function address list and a preset monitoring code block address list, and the key system function at least includes a key function in a system service descriptor table, an exported function of a kernel module, and an unexported function which needs to be located through instruction matching calculation; The host detection module determines the memory page corresponding to the address to be monitored as the target memory page.

2. The method of claim 1, wherein, The step of cancelling the access permission of the target memory page comprises: The read-write bit in the page table entry corresponding to the target memory page is set to zero to cancel the read-write access permission of the target memory page, and the execution permission of the target memory page is retained.

3. The method of claim 1 or 2, wherein, The step of replacing the target memory page with the mirror memory page and restoring the access permission of the target memory page comprises: The read-write bit in the page table entry of the target memory page pointed by the access request is set to one to restore the read-write access permission of the target memory page; The page frame number value of the mirror memory page is written into the page table entry to activate the mirror memory page, so that the mirror memory page replaces the target memory page to process the access request.

4. The method of claim 3, wherein, After the mirror memory page is activated, a monitor trap flag bit is further set for a virtual machine processor; The method further comprises: when the access request is processed, triggering a virtual machine exit event corresponding to the monitor trap flag bit to cancel the monitor trap flag bit; And the read-write bit in the page table entry is set to zero to restore the page frame number value of the mirror memory page written into the page table entry to the page frame number value of the target memory page.

5. The method of claim 1, wherein, The access request is triggered by a thread or a process in a virtual machine operating system, and the virtual machine exit event triggered by the access request of the target memory page is a virtual machine exit event caused by an EPT-VIOLATION reason, which is used to switch to root mode execution.

6. The method of claim 1, wherein, The preset probe instruction comprises a virtual machine privilege instruction and / or an interrupt instruction.

7. The method of claim 1, wherein, The host machine detection module is located in a virtual machine monitor component of a host machine operating system kernel, and the virtual machine detection module is located in a guest machine implemented by a virtual machine; one host machine detection module corresponds to one or more virtual machine detection modules.

8. A stubbing-based access request processing system, wherein, The system comprises a host machine detection module and a virtual machine detection module; the host machine detection module further comprises: An image unit is adapted to determine a memory page corresponding to the address to be monitored as a target memory page, copy the target memory page to obtain an image memory page; A stub unit is adapted to insert a preset stub instruction corresponding to the address to be monitored into the target memory page, and cancel the access permission of the target memory page; A processing unit is adapted to replace the target memory page with the image memory page according to a virtual machine exit event triggered by an access request of the target memory page, and restore the access permission of the target memory page, so that the access request for the target memory page is processed according to the image memory page; The image unit is further adapted to obtain a monitoring list containing the address to be monitored generated by the virtual machine detection module through a first virtual machine exit event triggered by a virtual machine call instruction, wherein the monitoring list is generated by the virtual machine detection module according to a key system function address list and a preset monitoring code block address list, and the key system function at least includes a key function in a system service descriptor table, an exported function of a kernel module, and an unexported function that needs to be located through instruction matching calculation; and the memory page corresponding to the address to be monitored is determined as the target memory page.

9. The system of claim 8, wherein, The stub unit is specifically adapted to: Determine a page table entry corresponding to the target memory page, and set the read-write bit in the page table entry to zero to cancel the read-write access permission of the target memory page, and retain the execution permission of the target memory page.

10. The system of claim 8 or 9, wherein, The processing unit is specifically adapted to: Find the page table entry of the target memory page pointed to by the access request, set the read-write bit in the page table entry to one to restore the read-write access permission of the target memory page; And write the page frame number value of the image memory page into the page table entry to activate the image memory page, and make the image memory page replace the target memory page to process the access request.

11. The system of claim 10, wherein, The processing unit is further adapted to set a monitor trap flag bit for a virtual machine processor; And when the access request is processed, trigger a virtual machine exit event corresponding to the monitor trap flag bit to cancel the monitor trap flag bit; And restore the read-write bit in the page table entry to zero state, and restore the page frame number value of the image memory page written into the page table entry to the page frame number value of the target memory page.

12. The system of claim 8, wherein, The access request is triggered by a thread or a process in a virtual machine operating system, and the virtual machine exit event triggered by the access request of the target memory page is a virtual machine exit event caused by an EPT-VIOLATION reason, which is used to switch to root mode execution.

13. The system of claim 8, wherein, The preset instrumentation instruction includes a virtual machine privilege instruction and / or an interrupt instruction.

14. The system of any of claim 8, wherein, The host detection module is located in a virtual machine monitor component of a host operating system kernel, and the virtual machine detection module is located in a guest implemented by a virtual machine; one host detection module corresponds to one or more virtual machine detection modules.

15. An electronic device comprising: The processor, the memory, the communication interface and the communication bus complete communication among each other through the communication bus; The memory is used for storing at least one executable instruction, and the executable instruction makes the processor execute the operation corresponding to the instrumentation-based access request processing method in any one of claims 1-7.

16. A computer storage medium, the storage medium storing at least one executable instruction, and the executable instruction making a processor execute the operation corresponding to the instrumentation-based access request processing method in any one of claims 1-7.

Images