Method and system for monitoring memory access behavior

Abstract

The present invention discloses a method and system for monitoring memory access behavior. The method includes: obtaining a monitoring list set by a virtual machine detection module and an address to be monitored contained in the monitoring list, determining the memory page corresponding to the address to be monitored as a target memory page; setting the read-write bit position in the page table item corresponding to the target memory page to zero to cancel the read-write access rights of the target memory page; when a virtual machine exit event triggered by the access behavior of the target memory page is detected, switching to root mode according to the virtual machine exit event; and monitoring the access data information corresponding to the access behavior of the target memory page in the root mode. The main monitoring operation of this method is completed by the host detection module, so that the impact caused by the abnormal virtual machine environment can be minimized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for monitoring memory access behavior. Background Art

[0002] A virtual machine (VM) is a complete computer system that runs in a completely isolated environment and has complete hardware system functions, which is simulated by software. In the prior art, virtual machines can be used to detect malicious behaviors and thus detect threat sources. For example, a sandbox environment can be built through virtual machine technology to perform security testing in the sandbox environment. In addition, during the security testing process, it is usually necessary to perform a plug-in operation on a specific instruction to monitor the execution process of the instruction.

[0003] However, the inventors found in the process of implementing the present invention that the above-mentioned methods in the prior art have at least the following defects: In the behavior monitoring method based on the virtual machine, the behavior monitoring function can only be realized through the security detection module set inside the virtual machine. Once the virtual machine environment is abnormal due to various external reasons, the security detection module will not be able to operate normally, thereby affecting the behavior monitoring function. In addition, the existing behavior monitoring method is usually unable to effectively monitor memory access behavior. Summary of the invention

[0004] In view of the above problems, the present invention is proposed to provide a method and system for monitoring memory access behavior that overcomes the above problems or at least partially solves the above problems.

[0005] According to one aspect of the present invention, a method for monitoring memory access behavior is provided. The method is executed by a host detection module and includes:

[0006] Obtaining a monitoring list set by a virtual machine detection module and an address to be monitored contained in the monitoring list, and determining a memory page corresponding to the address to be monitored as a target memory page;

[0007] Setting the read / write bit position in the page table entry corresponding to the target memory page to zero to cancel the read / write access rights of the target memory page;

[0008] When a virtual machine exit event triggered by an access behavior of a target memory page is detected, switching to the root mode according to the virtual machine exit event;

[0009] Access data information corresponding to the access behavior of the target memory page is monitored in the root mode.

[0010] According to another aspect of the present invention, a system for monitoring memory access behavior is provided, comprising:

[0011] A host detection module and a virtual machine detection module; wherein the host detection module further includes:

[0012] an acquisition unit, adapted to acquire a monitoring list set by a virtual machine detection module and an address to be monitored contained in the monitoring list, and determine a memory page corresponding to the address to be monitored as a target memory page;

[0013] a permission canceling unit, adapted to set the read / write bit position in the page table entry corresponding to the target memory page to zero, so as to cancel the read / write access rights of the target memory page;

[0014] a switching unit, adapted to, when a virtual machine exit event triggered by an access behavior of a target memory page is detected, switch to a root mode according to the virtual machine exit event;

[0015] The monitoring unit is adapted to monitor access data information corresponding to the access behavior of the target memory page in the root mode.

[0016] According to another aspect of the present invention, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0017] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the above-mentioned memory access behavior monitoring method.

[0018] According to another aspect of the present invention, a computer storage medium is provided, in which at least one executable instruction is stored, and the executable instruction enables a processor to execute operations corresponding to the above-mentioned method for monitoring memory access behavior.

[0019] According to the memory access behavior monitoring method and system disclosed in the present invention, first, the memory page corresponding to the address to be monitored is determined as the target memory page; then, the read-write bit position in the page table entry corresponding to the target memory page is set to zero to cancel the read-write access rights of the target memory page; finally, when a virtual machine exit event triggered by the access behavior of the target memory page is detected, the root mode is switched according to the virtual machine exit event, so as to monitor the access data information corresponding to the access behavior of the target memory page in the root mode. It can be seen that this method can trigger the virtual machine exit event for the access behavior of the target memory page by canceling the read-write access rights of the target memory page in advance, so that the host detection module can obtain the access data information in the root mode, thereby achieving the real-time monitoring effect of the memory access behavior. In addition, the main monitoring operation of this method is completed by the host detection module, so that the impact caused by the abnormal virtual machine environment can be minimized.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0022] Figure 1 A schematic diagram showing a flow chart of a method for monitoring memory access behavior according to an embodiment of the present invention;

[0023] Figure 2 A schematic flow chart showing a method for monitoring memory access behavior according to another embodiment of the present invention;

[0024] Figure 3 A system structure diagram of a memory access behavior monitoring system provided by another embodiment of the present invention is shown;

[0025] Figure 4 A schematic structural diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0026] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0027] Figure 1 FIG. 1 is a flow chart showing a method for monitoring memory access behavior according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0028] Step S110: obtaining a monitoring list set by the virtual machine detection module and an address to be monitored contained in the monitoring list, and determining a memory page corresponding to the address to be monitored as a target memory page.

[0029] Among them, this step is performed by the host detection module. The host detection module obtains the monitoring list set by the virtual machine detection module and the addresses to be monitored contained in the monitoring list through the instant messaging function. Among them, the monitoring list usually contains multiple addresses to be monitored, and each address to be monitored can be monitored by various methods such as plugging. Accordingly, in this step, the memory page corresponding to each address to be monitored is determined as the target memory page.

[0030] Step S120: setting the read / write bit in the page table entry corresponding to the target memory page to zero to cancel the read / write access rights of the target memory page.

[0031] Specifically, it is necessary to locate the page table entry corresponding to the target memory page according to the page frame number and other information of the target memory page, so as to set the read and write bit position in the page table entry to zero. In this way, the read and write access rights of the target memory page can be cancelled. When the read and write access rights of the target memory page are cancelled, the access behavior to the target memory page will trigger a virtual machine exit event due to violation of the EPT regulations.

[0032] Step S130: when a virtual machine exit event triggered by access to the target memory page is detected, switching to the root mode according to the virtual machine exit event.

[0033] Specifically, when there is a process or thread in the virtual machine operating system that attempts to access the target memory page, the access behavior corresponding to the process or thread will trigger a virtual machine exit event due to violation of the EPT regulations. In response to the virtual machine exit event, the host machine detection module will switch from non-root mode to root mode.

[0034] Step S140: monitoring access data information corresponding to the access behavior of the target memory page in the root mode.

[0035] Since the host detection module can obtain and change the state information such as the register value of the virtual machine processor in the root mode, it can monitor the access data information corresponding to the access behavior of the target memory page based on the obtained state information. Among them, the access data information includes: various types of information such as execution environment information and execution state information related to the access behavior.

[0036] It can be seen that this method can make the access behavior to the target memory page trigger the virtual machine exit event by canceling the read and write access rights of the target memory page in advance, so that the host detection module can obtain the access data information in the root mode, thereby achieving the real-time monitoring effect of memory access behavior. In addition, the main monitoring operation of this method is completed by the host detection module, so as to minimize the impact caused by the abnormal virtual machine environment.

[0037] For ease of understanding, the specific implementation details of the above method in the present invention are described in detail below with a specific example as an example. Among them, the method in the present invention runs in a distributed cluster server sandbox, and is used to perform advanced threat real-time detection tasks for target sample files. Specifically, the present invention is based on the virtual machine monitor (VMM, Hypervisor) of the full virtualization mode virtual machine management software in the host operating system (Host OS, Dom-0, Linux) kernel located on the server side. Among them, the server host runs in a virtual machine sandbox isolation environment to perform the target sample file task. At the same time, the client driver module (belonging to the virtual machine detection module) loaded in the virtual machine operating system (also called the client operating system, Guest OS, Dom-U, Windows) kernel and the global detection module (belonging to the host detection module) loaded in the host operating system (Dom-0) kernel are coordinated and linked to realize real-time monitoring of the activity behavior of the target task process, and to realize the real-time collection and recording of task activity behavior and abnormal events. Among them, the threat detection in the present invention includes but is not limited to tasks with sensitive and abnormal behaviors such as vulnerability exploitation, kernel privilege escalation, highly suspicious environmental damage, information theft, persistence, concealment, propagation and infection. The method in this embodiment is mainly implemented by a global detection module located in the host operating system kernel and a client driver module located in the virtual machine operating system kernel, wherein the global detection module is also called the host detection module, which is usually one; the client driver module is also called the virtual machine detection module, which is usually multiple (respectively located in different virtual machines), thereby realizing a "one-to-many" management relationship.

[0038] Among them, the global detection module is implemented based on the virtual machine monitor component of the virtual machine management software in the full virtualization mode in the host operating system kernel. The code of the global detection module is integrated in the source code of the virtual machine management software. The modified and recompiled virtual machine management software module is installed in the server-side Linux operating system, and is synchronously loaded and initialized with the host operating system kernel when the server is turned on. When the startup initialization is completed, the global detection module will reside in the host operating system kernel and will not be affected by operations such as virtual machine instance creation, startup, shutdown and destruction. By hooking up the virtual machine physical memory management and responding to the virtual machine control interface, when the virtual machine management software starts and shuts down the virtual machine, the global detection module initializes the detection point data structure and object associated with the specific virtual machine. The global detection module implements the detection function based on the pre-information data provided by the client driver module, and the pre-information data is collected by the client driver module in the client operating system. In addition, there are auxiliary modules such as log processing module, virtual machine scheduling module, task control module, etc. in the host operating system environment to assist the global detection module in realizing the detection function.

[0039] The client driver module is located in the kernel of the virtual machine operating system and is a kernel-mode driver loaded in the kernel of the target client operating system. The client driver module is loaded and initialized after the client operating system is started, and its life cycle ends when the virtual machine operating system is shut down. When loading and initialization are completed, the client driver module collects the pre-information data in the client operating system according to the configuration information provided by the auxiliary component, including but not limited to the operating system version information, key data structure definitions and member offsets, key system data or object addresses, key system function addresses, specific monitoring code block addresses, etc. In addition, the virtual machine detection module can also perform some detection functions that cannot be implemented in the external virtual machine manager component, including but not limited to various system event notifications, filter drivers, etc. The detection function implemented inside the virtual machine realizes the output of detection information through instant communication between the global detection module and the client driver module.

[0040] Figure 2 FIG. 1 is a schematic diagram showing a method for monitoring memory access behavior provided by another embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0041] Step S200: The virtual machine detection module is initialized and collects pre-data information, and sets a monitoring list according to the collection results.

[0042] When the virtual machine environment is started, the virtual machine detection module and the driver submodule contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definition and member offset, key system data or object address, key system function address, and specific monitoring code block address, etc. Next, the virtual machine detection module determines the monitored object and its corresponding monitored address according to the operating system version and kernel module version information, for example, the address and size of the key system data or object, specifically including: the Token member pointer of the system process associated object, the Token object of the system process associated object, the hardware abstraction layer (HAL) distribution function table, and the relevant kernel global variables indicating the boundaries of the user and kernel address spaces. Finally, a monitoring list is generated based on the above information, and the monitoring list is used to store the monitored addresses corresponding to the above-mentioned objects to be monitored.

[0043] Step S210: obtaining a monitoring list set by the virtual machine detection module and an address to be monitored contained in the monitoring list, and determining a memory page corresponding to the address to be monitored as a target memory page.

[0044] The host detection module obtains the monitoring list set by the virtual machine detection module and the addresses to be monitored contained in the monitoring list through the instant messaging function. Among them, the instant messaging function is implemented by triggering the virtual machine exit event, and the specific implementation method will be described in detail later. During the specific implementation, the host detection module allocates and initializes the monitoring address information array according to each address to be monitored in the transmitted monitoring list, so as to store each address to be monitored in the form of an array, which is convenient for query. The addresses to be monitored in the monitoring list belong to the client physical address (GPA). For each address to be monitored, determine the memory page where the address to be monitored is located, and determine the memory page as the target memory page.

[0045] Step S220: setting the read / write bit in the page table entry corresponding to the target memory page to zero to cancel the read / write access rights of the target memory page.

[0046] This step is implemented by the host detection module. In the specific implementation, first, determine each address to be monitored and its corresponding target memory page according to the monitoring address information array mentioned above; then, obtain the client page frame number (GFN) of the memory page where each client physical address (GPA) is located, and parse the 4-level page table structure from the extended page table (EPT) associated with the current domain, locate and record the corresponding page table entry (PTE); finally, set the read and write bits in each page table entry (PTE) stored in the previous step to zero, thereby canceling the read and write access rights of the corresponding client memory page.

[0047] Step S230: when a virtual machine exit event triggered by the access behavior of the target memory page is detected, switching to the root mode according to the virtual machine exit event.

[0048] Specifically, when there is a process or thread in the virtual machine operating system that attempts to access the target memory page, the access behavior corresponding to the process or thread will trigger a virtual machine exit event due to violation of the EPT regulations. In response to the virtual machine exit event, the host detection module will switch from non-root mode to root mode. For example, when a thread of the client operating system attempts to read or write access to a memory page with a new instruction inserted, since the previous step has cancelled the read and write access rights of the memory page through the extended page table, the access operation will cause the logical processor to trigger a VM-EXIT event with the EPT VIOLATION reason and return to root mode (root mode) for execution.

[0049] Step S240: monitoring access data information corresponding to the access behavior of the target memory page in the root mode.

[0050] Specifically, the value of the preset register and the client memory data are read to determine the execution environment information and access status information corresponding to the access behavior. The execution environment information includes: the process or thread that performs the access, the caller function of the access behavior, the stack backtrace sequence, the malicious code block, and / or the key register value; the access status information includes: the read access of the member pointer of the system process associated object by the non-system process, the read access of the system process associated object, the write access of the hardware abstraction layer distribution function table, and / or the write access of the relevant kernel global variable indicating the boundary of the user and kernel address space.

[0051] In specific implementation, when the target address of the access belongs to the range of monitored data and objects, according to the monitoring strategy, the processing function in the host detection module determines the process, thread and other environmental information of the execution access according to the relevant virtual machine processor register value and client memory data, and determines whether the current read and write operation is in an abnormal state, and records and outputs the abnormal state and execution environment information. Abnormal state includes but is not limited to: non-system process read access to the Token member pointer of the system process associated object, read access to the system process associated Token object, write access to the hardware abstraction layer (HAL) distribution function table, and write access to the relevant kernel global variables indicating the boundary of the user and kernel address space. The execution environment information includes: the process, thread, caller function of the execution access, the necessary stack backtrace sequence, the suspicious malicious code block, and the key register value.

[0052] In addition, considering that the target memory page may contain other addresses that do not need to be monitored in addition to the addresses to be monitored, therefore, in this embodiment, when monitoring the access data information corresponding to the access behavior of the target memory page in the root mode, the access object of the access behavior is further matched with the address to be monitored contained in the monitoring list; if the match is successful, the access data information corresponding to the access behavior of the target memory page is monitored; if the match is unsuccessful, the root mode is exited and the client context is returned to execute. For example, since other unmonitored data or objects may still exist in the memory page where the monitored key system data or objects are located, these data or objects will also trigger a VM-EXIT event when they are accessed. Therefore, in the processing function of the host detection module, the data object address and size stored in the previous step are matched with the target address currently accessed, and the access that does not belong to the monitored data and object range is ignored, and the logical processor returns to the client context to continue execution.

[0053] It can be seen that the monitoring operation for memory access behavior can be completed through the above steps. In addition, in order not to affect the normal execution of the access behavior, optionally, in this embodiment, after monitoring the access data information corresponding to the access behavior of the target memory page in the root mode, it further includes: setting the read-write bit in the page table entry corresponding to the target memory page to restore the read-write access rights of the target memory page, and setting the monitor trap flag for the virtual machine processor; wherein the monitor trap flag is used to trigger a virtual machine exit event corresponding to the monitor trap flag when the access operation of the access behavior to the target memory page is completed. Accordingly, the method further includes: when a virtual machine exit event corresponding to the monitor trap flag is detected, the monitor trap flag is canceled, and the read-write bit position of the page table entry is restored to the zero state.

[0054] For example, when the detection task for memory access behavior is completed, the processing function sets the read and write bits in the page table entry of the previous step to restore the read and write access rights; at the same time, the processing function sets the MTF control flag of the virtual machine processor. Accordingly, when the logical processor returns to the client context for execution, it will continue to execute the read and write access instructions for the target memory page, and the access instructions will be able to successfully perform the read and write access operations. Through the above operations, the access behavior for the target memory page can be implemented normally. When the read and write access operations are completed, since the virtual machine processor sets the MTF control flag, the logical processor will generate a VM-EXIT event of type MONITORTRAPFLAG. At this time, the processing function of the host detection module cancels the MTF control flag of the virtual machine processor, and at the same time restores the read and write bits of the page table entry of the previous step to the zero state, and returns to the client context to continue execution.

[0055] It can be seen that this method can achieve the real-time monitoring effect of memory access behavior through the virtual machine exit event: once the access behavior is executed, the virtual machine exit event will be triggered immediately, so that the memory access behavior can be monitored immediately. This method can monitor the read and write access behavior of specific key system data or object addresses of the client operating system in real time. The real-time monitoring function of memory access is mainly implemented based on the extended page table mechanism of hardware virtualization technology. In addition, the real-time monitoring function of memory access can be implemented mainly for the following processes to be monitored: the target process that is initially started, the process started by the target process and injected by the target process, and the process that loads the file released by the target process.

[0056] In addition, the monitoring method of the present invention can also realize the following four functions: instant communication function between two ends, behavior monitoring function based on plugging, access request processing function based on plugging, and abnormal event monitoring function of virtual machine operating system. The following four examples are used to introduce the above four functions in detail:

[0057] Example 1: Instant messaging between two terminals

[0058] Step 1: The virtual machine detection module is initialized and pre-data information is collected.

[0059] When the virtual machine environment is started, the virtual machine detection module and the driver submodule contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definitions and member offsets, key system data or object addresses, key system function addresses, and specific monitoring code block addresses.

[0060] Step 2: The virtual machine detection module encapsulates the data information related to the threat detection process obtained in the virtual machine environment into serialized data.

[0061] Among them, the data information related to the threat detection process includes: the above-mentioned collected pre-data information, and / or the threat data information related to the threat source obtained by the virtual machine detection module. In order to comply with the communication specifications between the virtual machine and the host machine, in the present invention, the data information related to the threat detection process is encapsulated into serialized data in an agreed serialization protocol and format, and parsed according to the serialization protocol. Among them, the serialization protocol and format stipulate the authentication string, data type, size of the header structure, member fields, and the length of the appended data.

[0062] Step 3: Cache the serialized data into a preset memory space, and store the space address of the preset memory space in a preset register.

[0063] Specifically, the preset memory space includes one or more continuous memory pages, and accordingly, the serialized data is cached in a preset buffer, and the preset buffer is located in the above memory page, and the linear address of the preset buffer contained in the above memory page is stored in the preset register. Among them, the memory pages contained in the preset memory space can be multiple memory pages that are continuous in a linear address view.

[0064] Step 4: The virtual machine detection module triggers a virtual machine exit event through a virtual machine call instruction.

[0065] Wherein, the virtual machine detection module determines the call number corresponding to the data type according to the data type of the serialized data, and triggers the virtual machine exit event through the virtual machine call instruction corresponding to the call number. Correspondingly, the preset register further includes a plurality of general registers corresponding to different call numbers. Wherein, the data type of the serialized data can be determined in combination with the client context. It can be seen that by presetting a plurality of call numbers corresponding to different data types, and presetting the corresponding relationship between each register and the call number, it is possible to flexibly transmit various types of information. In specific implementation, the call number and the linear address of the preset buffer are assigned to the preset general registers such as EAX / RAX, EBX / RBX, and the VMCALL instruction is executed. Wherein, when the VMCALL instruction is executed, the virtual machine processor unconditionally triggers the VM-EXIT event of the VMCALL reason, and the processor control right temporarily returns to the ROOT environment, so that the VM-EXIT processing function in the host detection module can be executed.

[0066] Step 5: The host machine detection module queries a preset register according to the virtual machine exit event to obtain and process the serialized data stored in the preset memory space.

[0067] Specifically, the virtual machine exit processing function (i.e., VM-EXIT processing function) contained in the host detection module obtains the linear address stored in the preset register, and converts the linear address into the virtual machine physical address; according to the mapping relationship between the virtual machine physical address and the host physical address, the virtual machine physical address is converted into the host physical address; according to the host physical address, the serialized data stored in the preset memory space is obtained and processed. Among them, when the serialized data stored in the preset memory space is obtained and processed according to the host physical address, the physical page of the host physical address is mapped to the host operating system kernel address space to obtain the host linear address; the serialized data is read from the memory page mapped to the host operating system kernel address space. In addition, the host detection module also needs to obtain the call number of the virtual machine call instruction corresponding to the virtual machine exit event, query the general register corresponding to the obtained call number, and obtain and process the serialized data stored in the preset memory space according to the general register.

[0068] In specific implementation, the VM-EXIT processing function in the host detection module obtains the call number (Call ID) and the client linear address (GLA) of the transmitted data buffer according to the aforementioned assigned general register. The processing function converts the client linear address into the client physical address (GPA), and then converts the client physical address into the host physical address (HPA) according to the mapping relationship between the client physical address and the host physical address. Then, the processing function maps the physical page of the converted host physical address (HPA) in the host operating system kernel address space to obtain the host linear address (HLA, virtual address). Finally, the processing function reads the buffer data from the memory page mapped to the host operating system kernel address space, and parses the serialized data in the agreed protocol and format to obtain the information content of the current communication transmission, and uses the obtained information according to the strategy.

[0069] In addition, further optionally, when the detection task is performed, the virtual machine detection module also needs to send detection logs and other information to the host detection module. Similarly, the log data is serialized and encapsulated through the call number (Call ID) and protocol format corresponding to the log type that are separately agreed upon, and the VMCALL instruction is executed to unconditionally trigger the VM-EXIT event of the VMCALL reason, so that the processing function of the host detection module can parse and process the corresponding serialized data. Among them, the situation where the virtual machine detection module sends data information to the host detection module includes but is not limited to: detection log data output by some detection functions implemented in the virtual machine detection module; the extended thread monitoring mechanism adds new processes or threads to the monitoring list; file data released by the target process inside the virtual machine.

[0070] The host detection module is located in the virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in the client implemented by the virtual machine; wherein one host detection module corresponds to one or more virtual machine detection modules.

[0071] It can be seen that in this example, the host detection module and the virtual machine detection module communicate with each other by triggering the state switching of the virtual machine processor through the virtualization privileged instruction, thereby realizing the instant communication function between the host detection module and the virtual machine detection module, thereby facilitating the data transmission between the two. Among them, in the function code of the virtual machine detection module, by assigning the specified register call number and the client physical address and executing the VMCALL instruction, the virtual machine processor unconditionally triggers the VM-EXIT event of the VMCALL reason to switch to the ROOT environment to execute the corresponding processing function in the host detection module, so that the host detection module obtains the call number and the client physical address through the aforementioned assigned register, and reads the data to be received from the client physical memory according to the agreed protocol, thereby realizing the function of two-end instant communication.

[0072] Example 2: Behavior monitoring based on instrumentation

[0073] Step 1: The virtual machine detection module obtains a key system function address list and a preset monitoring code block address list, and generates a monitoring list according to the key system function address list and the preset monitoring code block address list.

[0074] Specifically, when the virtual machine environment is started, the virtual machine detection module is loaded and initialized. The virtual machine detection module is responsible for operations such as pre-data information collection. According to the operating system version and kernel module version information, a key system function address list and a specific monitoring code block address list are obtained. Key system functions include but are not limited to: key functions in the system service descriptor table (SSDT), important export functions of the kernel module, and important unexported functions that need to be located by instruction matching calculation. Specific monitoring code blocks refer to: code blocks with historical vulnerabilities in the system module. When the instruction is executed, monitoring and conditional determination are performed according to the register and memory context, and the corresponding use behavior for historical vulnerabilities can be accurately identified. Correspondingly, a monitoring list is generated according to the key system function address list and the preset monitoring code block address list. In addition, the virtual machine detection module can further determine the target process that is initially started, the process started by the target process or injected by the target process, and the process that loads the file released by the target process as the process to be monitored, thereby adding the process to be monitored to the monitoring list. In addition, the monitoring list can also be dynamically updated, and the updated monitoring list is transmitted to the host detection module through the instant messaging function.

[0075] In addition, the virtual machine detection module can also store instructions at the location of each address in the key system function address list and the specific monitoring code block address list according to the preset strategy and initialize the springboard interval, and the springboard interval (i.e., the jump interval) is used to jump back to the original function execution. Of course, the operation of initializing the springboard interval can also be implemented by the host machine detection module, and the present invention does not limit this.

[0076] Step 2: The host machine detection module obtains a monitoring list generated by the virtual machine detection module through a first virtual machine exit event triggered by a virtual machine call instruction.

[0077] Specifically, after the virtual machine detection module generates the monitoring list, it triggers the first virtual machine exit event by executing the virtual machine call instruction, and accordingly, the host machine detection module switches to the root mode, so that the state information such as the register value of the virtual machine processor can be obtained and changed, and then the monitoring list generated by the virtual machine detection module is obtained. Among them, the instant communication function between the virtual machine detection module and the host machine detection module is realized by triggering the virtual machine exit event. The specific implementation details of the instant communication function will be described in detail later, and will not be repeated here.

[0078] The host detection module is located in the virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in the client implemented by the virtual machine; wherein one host detection module corresponds to one or more virtual machine detection modules.

[0079] Step 3: For each address to be monitored included in the monitoring list, determine the memory location corresponding to the address to be monitored, and insert a preset stub instruction into the memory location.

[0080] Specifically, for each address to be monitored included in the monitoring list, the memory page where the address to be monitored is located is determined as the target memory page, the offset position corresponding to the address to be monitored is determined in the target memory page, and the offset position is determined as the memory position corresponding to the address to be monitored. In addition, in order to facilitate data recovery, when inserting a preset plug-in instruction into the memory position, the original instruction corresponding to the memory position is further determined, and the original instruction is associated with the memory position and stored; wherein, when the monitoring operation is completed, data recovery is performed according to the original instruction.

[0081] During specific implementation, the host detection module allocates an initialized monitoring address information array according to the address list of the addresses to be monitored in the monitoring list. The initialized monitoring address information array is used to store each address to be monitored in the form of an array. Among them, each address to be monitored can be a client linear address (GLA). The host detection module inserts a specific instruction, such as a virtualization-related privileged instruction or an interrupt instruction, at the offset position corresponding to the memory page where each client linear address in the monitoring address information array is located according to a preset strategy. In addition, the original instruction that is overwritten before the new instruction is inserted is used to restore data when the monitoring function is turned off.

[0082] Step 4: When the host machine detection module detects a second virtual machine exit event triggered by the execution process of the preset instrumentation instruction, data information related to the execution process of the preset instrumentation instruction is queried according to the second virtual machine exit event.

[0083] Specifically, when a thread or process of the client operating system executes a new plugged instruction, the logical processor immediately triggers a VM-EXIT event of the corresponding reason to return to the ROOT mode. Correspondingly, the processing function for processing the VM-EXIT event in the host detection module obtains information related to the execution environment at that time according to the reason for triggering VM-EXIT and the value of the instruction pointer register, searches for the node of the corresponding address in the monitoring address information array, and then determines the data information related to the execution process of the preset plugged instruction.

[0084] Step 5: Execute detection tasks based on the queried data information to achieve behavior monitoring.

[0085] Specifically, based on the queried data information and the preset processing strategy, it is determined whether the detection task is completed by the virtual machine detection module; if so, the detection task is executed by the virtual machine detection module, and after the detection task is completed, it jumps to the preset springboard interval address; if not, the detection task is executed by the host machine detection module, and after the detection task is completed, it jumps to the preset springboard interval address.

[0086] In specific implementation, according to the pre-set strategy, the processing function for handling VM-EXIT events in the host detection module determines whether the current trigger event processing method needs to return to the client context to execute the detection task: if so, the processing function modifies the instruction pointer register of the virtual machine processor to the client context processing function address (GLA) corresponding to the current called address, and returns to the client context to resume execution. In addition, according to the number and type of parameters, return value type and other information specified and stored in advance, the processing function executes the detection task in the virtual machine detection module. When the detection task is completed, the processing function calls or jumps to the corresponding springboard interval address to continue executing the original function. If not, according to the number and type of parameters, return value type and other information specified and stored in advance, the processing function executes the detection task in the host detection module. When the detection task is completed, the processing function modifies the instruction pointer register of the virtual machine processor to the springboard interval address (GLA) corresponding to the current called address, and returns to the client context to resume execution.

[0087] In addition, after executing the detection task according to the queried data information, the detection log is further output according to the detection result. Specifically, the processing function that executes the detection task determines whether the current execution context belongs to the monitored process and thread, whether the current thread is in a recordable state, and determines whether to output the detection log according to the judgment result. Specifically, the processing function parses the parameter data according to the parameter type of the current calling function and generates the detection log.

[0088] It can be seen that in this example, the behavior monitoring based on the plug-in includes monitoring of the calling behavior of the specified key system function, context determination when executing the specific monitoring code block instruction, and other detection functions. The behavior monitoring function based on the plug-in is realized by inserting specific instructions at the specified position. This method realizes the state switching of the virtual machine processor during execution by inserting virtualization-related privileged instructions or interrupt instructions at the specified memory address, thereby realizing behavior monitoring. According to the pre-set strategy, the behavior monitoring function based on the plug-in can be executed in the processing function of the host detection module of the host context, or it can be executed in the processing function of the virtual machine detection module that is directed back to the client context. In addition, in this embodiment, the number of addresses to be monitored contained in the monitoring list generated by the virtual machine detection module can be dynamically updated, and accordingly, the updated monitoring list is synchronized to the host detection module through the instant messaging function, so that the monitoring list updated by the host detection module performs plug-in and behavior monitoring operations.

[0089] Example 3: Access request processing function based on instrumentation

[0090] Step 1: The virtual machine detection module obtains a key system function address list and a preset monitoring code block address list, and generates a monitoring list according to the key system function address list and the preset monitoring code block address list.

[0091] The specific details of this step can be referred to Example 2 and will not be repeated here.

[0092] Step 2: The host machine detection module obtains a monitoring list including addresses to be monitored, which is generated by the virtual machine detection module, through a first virtual machine exit event triggered by a virtual machine call instruction.

[0093] The specific details of this step can be referred to Example 2 and will not be repeated here.

[0094] Step 3: The host machine detection module determines the memory page corresponding to the address to be monitored as the target memory page, and copies the target memory page to obtain a mirror memory page.

[0095] Among them, the address to be monitored mainly refers to the address included in the monitoring list, and of course it can also be an address obtained by other means. This step needs to be operated separately for each address to be monitored. In the specific implementation, before the instrumentation operation is performed based on the instrumentation behavior monitoring function, the host detection module allocates and copies a mirror memory page for the memory page where each client linear address (GLA) in the monitoring address information array is located. The data in the mirror memory page is the same as the original memory page, serving as the initial backup of the original memory page. In the inactive state, the mirror memory page does not exist in the extended page table (EPT) of the client. Among them, the monitoring address information array is an array used to store each address to be monitored.

[0096] Step 4: Insert a preset stub instruction corresponding to the address to be monitored into the target memory page, and cancel the access permission of the target memory page.

[0097] Specifically, canceling the access rights of the target memory page can be achieved by determining the page table entry corresponding to the target memory page, setting the read and write bits in the page table entry to zero to cancel the read and write access rights of the target memory page, and retaining the execution rights of the target memory page.

[0098] In specific implementation, the host detection module parses the 4-level page table structure from the extended page table (EPT) associated with the current domain according to the client page frame number (GFN) of the original memory page (i.e., the target memory page), locates and records the page table entry (PTE) corresponding to the original memory page. When the virtual machine detection module notifies the host detection module to enable the monitoring function, the host detection module traverses each node in the monitoring address information array, and sets the read and write bits in each page table entry (PTE) stored in the previous step to zero, thereby canceling the read and write access rights of the corresponding client memory page, and only retaining the execution permission.

[0099] Step 5: The host detection module replaces the target memory page with the mirror memory page according to the virtual machine exit event triggered by the access request of the target memory page, and restores the access rights of the target memory page so that the access request for the target memory page is processed according to the mirror memory page.

[0100] Among them, the access request is triggered by a thread or process in the virtual machine operating system. Since the access rights of the target memory page have been revoked, the access request for the target memory page will trigger the second virtual machine exit event caused by EPT-VIOLATION due to violation of the EPT regulations, thereby switching the host detection module to root mode. In root mode, the host detection module has the authority to obtain and change the status information such as the register value of the virtual machine processor, so that the target memory page can be replaced with the mirror memory page in ROOT mode, and the access rights of the target memory page can be restored. Specifically, the page table entry of the target memory page pointed to by the access request is searched, and the read and write bits in the page table entry are set to restore the read and write access rights of the target memory page; and the page frame number value of the mirror memory page is written into the page table entry to activate the mirror memory page, and the mirror memory page is used to process the access request instead of the target memory page.

[0101] In specific implementation, when a thread of the client operating system attempts to read or write access to the memory page (i.e., the target memory page) where the new instruction is inserted, since the previous step has cancelled the read and write access rights of the memory page through the extended page table (EPT), the access operation will cause the logical processor to trigger the VM-EXIT event of the EPTVIOLATION reason and return to the ROOT mode for execution. The processing function for processing the VM-EXIT event in the host detection module obtains the relevant information of the execution environment at that time according to the reason for triggering VM-EXIT and the accessed client physical address (GPA), and searches for the node of the corresponding address in the monitoring address information array. Then, the processing function sets the read and write bits of the page table entry (PTE) of the monitoring address information node to restore the read and write access rights; at the same time, the host physical page frame number (HFN) value of the mirror memory page created above is written to the page frame number value position of the page table entry (PTE) to activate the mirror memory page, thereby replacing the accessed memory page in the client with the mirror memory page.

[0102] It can be seen that when the logical processor returns to the client context for execution, it will continue to execute the read and write access instructions for the target memory page. The access instruction will be able to successfully perform the read and write access operations, but the actual target object of the read and write access operations is the mirror memory page, thereby ensuring that the new instructions inserted in the original memory page will not be read or overwritten. In other words, although the access instruction points to the target memory page, since this embodiment switches to the ROOT mode after receiving the access instruction, the target memory page is replaced by the mirror memory page, so that the actual access object of this access instruction is the mirror memory page.

[0103] In addition, further optionally, in order to enable the mirror memory page to be restored to the target memory page again after the access request is processed, so as to ensure the execution of the plug-in instruction. After activating the mirror memory page, it further includes: setting a monitor trap flag (i.e., MTF control flag) for the virtual machine processor. Wherein, by setting the monitor trap flag, the processor triggers a virtual machine exit event due to an exception each time the instruction is executed. Accordingly, the method in this embodiment further includes: when the access request is processed, triggering a virtual machine exit event corresponding to the monitor trap flag to cancel the monitor trap flag; and restoring the read and write bit position zero state of the page table entry, and restoring the page frame number value of the mirror memory page written to the page table entry to the page frame number value of the target memory page. It can be seen that the virtual machine exit event triggered by the monitor trap flag can enable the host detection module to monitor the event (or opportunity) of the completion of the access request processing, and then cancel the monitor trap flag at the first time at the time point when the access request is processed, so as to restore the target memory page to the state before the access request is triggered. In specific implementation, when the read and write access operations are completed, the logical processor will generate a VM-EXIT event of type MONITORTRAPFLAG because the virtual machine processor sets the MTF control flag. The processing function of the host detection module cancels the MTF control flag of the virtual machine processor at this time, restores the read and write bits of the page table entry (PTE) in the previous step to zero, and rewrites the host physical page frame number (HFN) of the original memory page to the page frame number value position of the page table entry (PTE), and returns to the client context to continue execution.

[0104] It can be seen that in this example, the traces of the instrumentation are hidden and protected, and the traces of modification of the instrumented memory address in the virtual machine environment can be hidden for the process or thread inside the virtual machine. As a result, the instrumented memory address is protected, so that the memory block of the instrumented new instruction will not be read or overwritten by any process or thread inside the virtual machine. The hiding and protection function of the instrumentation traces in this example is mainly implemented based on the extended page table mechanism of hardware virtualization technology. The goal of hiding and protecting is the set of instrumentation points described in the behavior monitoring function based on instrumentation.

[0105] In addition, this example can be combined with Example 2 to further implement the behavior monitoring function based on instrumentation. Accordingly, at the end of this example, steps 3 to 5 in Example 2 can be further added.

[0106] Example 4: Abnormal event monitoring function of virtual machine operating system

[0107] Step 1: The virtual machine detection module is initialized and pre-data information is collected.

[0108] When the virtual machine environment is started, the virtual machine detection module and the driver submodule contained therein are loaded and initialized. The virtual machine detection module collects pre-data information, including but not limited to: operating system version information, key data structure definitions and member offsets, key system data or object addresses, key system function addresses, and specific monitoring code block addresses. In addition, the virtual machine detection module obtains the function address of the key function of the operating system kernel exception handling (i.e., the exception handling function) based on the operating system version and kernel module version information.

[0109] Step 2: Obtain the function address of the exception handling function provided by the virtual machine detection module through the first virtual machine exit event triggered by the virtual machine call instruction.

[0110] Specifically, according to the instant communication function of both ends, the virtual machine detection module and the host detection module can perform instant communication. Accordingly, the function address of the key function of the kernel exception handling determined in the previous step is passed to the host detection module. The host detection module sets the function address as execution-time monitoring through the plugging operation.

[0111] Step three: inserting a preset stub code into the function address; wherein the preset stub code is used to monitor when the exception handling function is executed.

[0112] The preset plug-in code is used to monitor when the exception handling function is executed. The preset plug-in code can be implemented in various forms, for example, in the form of a probe. In addition, when there are multiple exception handling functions, it is necessary to insert the corresponding preset plug-in code into the function address of each exception handling function.

[0113] Step 4: When a second virtual machine exit event triggered by the execution of the exception handling function is detected, switch to the root mode according to the second virtual machine exit event.

[0114] Specifically, by setting the execution logic with the preset plug-in code, when the exception handling function is executed, the preset plug-in code can trigger the second virtual machine exit event. Accordingly, the host machine detection module switches to the root mode according to the second virtual machine exit event. In the root mode, the host machine detection module can obtain and change the state information such as the register value of the virtual machine processor.

[0115] For example, when a blue screen exception occurs inside the virtual machine operating system, the kernel collects blue screen context information and calls the relevant exception handling function according to the operating system kernel module code logic. When a thread of the client operating system executes a new instruction inserted, the logical processor immediately triggers the VM-EXIT event of the corresponding reason to return to the root mode execution and enter the processing function of the host detection module, so as to monitor the exception event through the processing function of the host detection module.

[0116] Step 5: Get event information of exception events related to the exception handling function in root mode.

[0117] Since the state information such as the register value of the virtual machine processor can be obtained and changed in the root mode, the host detection module can determine the event information of the abnormal event related to the exception handling function based on the obtained state information. Among them, the event information of the abnormal event related to the exception handling function includes: the occurrence time of the abnormal event, the cause of the abnormal event, the execution environment information when the abnormal event occurs, and other types of information. For example, the processing function in the host detection module obtains the blue screen context information through the register values ​​such as ESP / RSP and the client memory data and records and outputs it.

[0118] It can be seen that this example can monitor the blue screen event of the client operating system (i.e., the virtual machine operating system) in real time. The exception monitoring function of the client operating system performs instrumentation monitoring on the system function responsible for handling the blue screen event of the operating system. When a blue screen occurs in the client operating system, the system kernel will call the aforementioned function to collect system exception information and handle the exception.

[0119] In summary, the above method in this embodiment can achieve multiple functions, and this method has at least the following advantages:

[0120] (1) The host detection module is implemented based on the global virtual machine monitor, so that the core code of the detection engine is implemented at the global virtual machine monitor layer, which can simplify the functions of the virtual machine detection module located inside the virtual machine, isolate the core code of the detection engine and the virtual machine environment from each other, and the abnormal state of the virtual machine environment will no longer affect the normal execution of the detection function, and minimize the impact of the detection engine on the virtual machine environment. In addition, since the core code of the detection engine is located at the global virtual machine monitor layer rather than in the virtual machine detection module, malicious processes with environmental detection behaviors will not be able to steal the key data and code of the detection engine.

[0121] (2) Through processor-based virtualization technology, this solution also realizes the function of hiding and protecting the traces of the detection module's plug-in, making it more difficult for malicious code inside the virtual machine to detect the plug-in points deployed by the detection module, including hooks. At the same time, the modification of the address of the plugged function by the malicious code inside the virtual machine will not affect the detection function of the detection module's own plug-in points, thereby ensuring the continued effectiveness of the threat detection function.

[0122] (3) The clustered distributed threat detection system itself relies on specific virtual machine management software to implement virtual machine management, scheduling, basic support and other services in the server host. The threat detection implementation based on the virtual machine monitor organically combines the software middle layer of the virtual machine management software and the threat detection function module, simplifies the multi-level separation structure that originally relied on the support of mechanisms such as nested virtualization, and greatly improves the hardware performance consumption of the virtual machine environment and the host physical server environment. In addition, through the threat detection implementation based on the global virtual machine monitor, the data transmission path in the middle and late stages during the task detection can be greatly shortened, and the parallel detection efficiency of virtual machines in the sandbox cluster will also be significantly improved.

[0123] In summary, compared with the traditional virtual machine-based detection method, the advantages of this solution are: based on the global virtual machine monitor component, the dynamic threat detection engine function is realized through the processor-based virtualization technology, which provides a strong guarantee for the detection of threat behaviors at runtime in terms of detection effect, detection performance, and detection reliability. The virtual machine detection module performs the pre-information collection task inside the virtual machine, and the host detection module obtains pre-information by communicating and interacting with the virtual machine detection module at the virtual machine monitor layer located in the host kernel, and performs detection point plugging, memory monitoring, privileged instruction monitoring, and execution flow control and transfer functions at the virtual machine monitor layer. The detection core function is located in the host operating system kernel outside the virtual machine, realizing the mutual isolation of the detection engine core code and the virtual machine environment. Relying on the VM-EXIT mechanism and extended page table mechanism based on processor virtualization technology, it can realize key functions such as instant communication between both ends, behavior monitoring based on plugging, hidden protection of plugging traces, real-time monitoring of memory access, and abnormal monitoring of the client operating system.

[0124] Figure 3 FIG. 4 shows a system structure diagram of a memory access behavior monitoring system provided by another embodiment of the present invention. Figure 3 As shown, the system includes: a host machine detection module 31 and a virtual machine detection module 32; wherein the host machine detection module 31 further includes:

[0125] The acquisition unit 311 is adapted to acquire a monitoring list set by the virtual machine detection module and an address to be monitored contained in the monitoring list, and determine a memory page corresponding to the address to be monitored as a target memory page;

[0126] a permission canceling unit 312, adapted to set the read / write bit position in the page table entry corresponding to the target memory page to zero, so as to cancel the read / write access rights of the target memory page;

[0127] The switching unit 313 is adapted to switch to the root mode according to the virtual machine exit event when a virtual machine exit event triggered by the access behavior of the target memory page is detected;

[0128] The monitoring unit 314 is adapted to monitor access data information corresponding to the access behavior of the target memory page in the root mode.

[0129] Optionally, after the monitoring unit monitors the access data information corresponding to the access behavior of the target memory page in the root mode, it is further adapted to:

[0130] Setting the read / write bit in the page table entry corresponding to the target memory page to restore the read / write access rights of the target memory page, and setting a monitor trap flag for the virtual machine processor;

[0131] The monitor trap flag is used to trigger a virtual machine exit event corresponding to the monitor trap flag when the access operation of the access behavior to the target memory page is completed.

[0132] Optionally, the monitoring unit is further adapted to: upon detecting a virtual machine exit event corresponding to a monitor trap flag, cancel the monitor trap flag and restore the read / write bit position of the page table entry to a zero state.

[0133] Optionally, the monitoring unit is specifically adapted to:

[0134] The value of the preset register and the client memory data are read to determine the execution environment information and access status information corresponding to the access behavior.

[0135] Optionally, the execution environment information includes: the process or thread that executes the access, the caller function of the access behavior, the stack backtrace sequence, the malicious code block, and / or the critical register value; the access status information includes: read access of a non-system process to a member pointer of an object associated with a system process, read access to an object associated with a system process, write access to a hardware abstraction layer distribution function table, and / or write access to related kernel global variables indicating the boundary of the user and kernel address spaces.

[0136] Optionally, the monitoring unit is specifically adapted to:

[0137] Matching the access object of the access behavior with the address to be monitored contained in the monitoring list;

[0138] If the match is successful, monitoring the access data information corresponding to the access behavior of the target memory page;

[0139] If the match is unsuccessful, exit the root mode and return to the client context execution.

[0140] Optionally, the host detection module is located in a virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in a client implemented by a virtual machine; wherein one host detection module corresponds to one or more virtual machine detection modules.

[0141] The specific structures and working principles of the above-mentioned host detection module, virtual machine detection module and each unit can refer to the description of the corresponding steps in the method embodiment, which will not be repeated here.

[0142] An embodiment of the present application provides a non-volatile computer storage medium, which stores at least one executable instruction. The computer executable instruction can execute the method for monitoring memory access behavior in any of the above method embodiments.

[0143] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the electronic device.

[0144] like Figure 4 As shown, the electronic device may include: a processor (processor) 402 , a communication interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

[0145] in:

[0146] The processor 402 , the communication interface 404 , and the memory 406 communicate with each other via a communication bus 408 .

[0147] The communication interface 404 is used to communicate with other devices such as clients or other servers.

[0148] The processor 402 is used to execute the program 410, and specifically can execute the relevant steps in the above-mentioned memory address query method embodiment.

[0149] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0150] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the electronic device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0151] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0152] The program 410 may be specifically used to enable the processor 402 to perform various operations in the above method embodiment.

[0153] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0154] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0155] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0156] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0157] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0158] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the monitoring device for memory access behavior according to an embodiment of the present invention. The present invention may also be implemented as a device or device program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0159] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A method for monitoring memory access behavior, wherein: The method is executed by a host detection module and includes: Obtaining a monitoring list set by a virtual machine detection module and an address to be monitored contained in the monitoring list, and determining a memory page corresponding to the address to be monitored as a target memory page; Setting the read / write bit position in the page table entry corresponding to the target memory page to zero to cancel the read / write access rights of the target memory page, wherein the page table entry corresponding to the target memory page is located according to the page frame number information of the target memory page, thereby setting the read / write bit position in the page table entry to zero. In this way, the read / write access rights of the target memory page are canceled. When the read / write access rights of the target memory page are canceled, the access behavior to the target memory page will trigger a virtual machine exit event due to violation of EPT regulations; When a virtual machine exit event triggered by an access behavior of a target memory page is detected, switching to the root mode according to the virtual machine exit event; Monitoring access data information corresponding to access behavior of the target memory page in the root mode; The monitoring of access data information corresponding to the access behavior of the target memory page in the root mode includes: reading a value of a preset register and client memory data to determine execution environment information and access status information corresponding to the access behavior.

2. The method according to claim 1, wherein: After monitoring the access data information corresponding to the access behavior of the target memory page in the root mode, further comprising: Setting the read / write bit in the page table entry corresponding to the target memory page to restore the read / write access rights of the target memory page, and setting a monitor trap flag for the virtual machine processor; The monitor trap flag is used to trigger a virtual machine exit event corresponding to the monitor trap flag when the access operation of the access behavior to the target memory page is completed.

3. The method according to claim 2, wherein: The method further comprises: when a virtual machine exit event corresponding to a monitor trap flag is detected, canceling the monitor trap flag and restoring the read-write bit position zero state of the page table entry.

4. The method according to claim 1, wherein: The execution environment information includes: the process or thread that executes the access, the caller function of the access behavior, the stack backtrace sequence, the malicious code block, and / or the key register value; the access status information includes: the read access of the member pointer of the system process associated object by the non-system process, the read access to the system process associated object, the write access to the hardware abstraction layer distribution function table, and / or the write access to the relevant kernel global variable indicating the boundary of the user and kernel address space.

5. The method according to any one of claims 1 to 4, wherein: The monitoring of access data information corresponding to the access behavior of the target memory page in the root mode includes: Matching the access object of the access behavior with the address to be monitored contained in the monitoring list; If the match is successful, monitoring the access data information corresponding to the access behavior of the target memory page; If the match is unsuccessful, exit the root mode and return to the client context execution.

6. The method according to claim 1, wherein: The host detection module is located in a virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in a client implemented by a virtual machine; wherein one host detection module corresponds to one or more virtual machine detection modules.

7. A memory access behavior monitoring system, wherein: The system includes: a host machine detection module and a virtual machine detection module; wherein the host machine detection module further includes: an acquisition unit, adapted to acquire a monitoring list set by the virtual machine detection module and an address to be monitored contained in the monitoring list, and determine a memory page corresponding to the address to be monitored as a target memory page; a permission canceling unit, adapted to set the read-write bit position in the page table entry corresponding to the target memory page to zero, so as to cancel the read-write access right of the target memory page, wherein the page table entry corresponding to the target memory page is located according to the page frame number information of the target memory page, so as to set the read-write bit position in the page table entry to zero, and in this way, the read-write access right of the target memory page is canceled. When the read-write access right of the target memory page is canceled, the access behavior to the target memory page will trigger a virtual machine exit event due to violation of the EPT provision; a switching unit, adapted to, when a virtual machine exit event triggered by an access behavior of a target memory page is detected, switch to a root mode according to the virtual machine exit event; The monitoring unit is adapted to monitor the access data information corresponding to the access behavior of the target memory page in the root mode; read the value of the preset register and the client memory data to determine the execution environment information and access status information corresponding to the access behavior.

8. The system according to claim 7, wherein: After the monitoring unit monitors the access data information corresponding to the access behavior of the target memory page in the root mode, it is further adapted to: Setting the read / write bit in the page table entry corresponding to the target memory page to restore the read / write access rights of the target memory page, and setting a monitor trap flag for the virtual machine processor; The monitor trap flag is used to trigger a virtual machine exit event corresponding to the monitor trap flag when the access operation of the access behavior to the target memory page is completed.

9. The system according to claim 8, wherein: The monitoring unit is further adapted to: when a virtual machine exit event corresponding to a monitor trap flag is detected, cancel the monitor trap flag and restore the read / write bit position of the page table entry to a zero state.

10. The system according to any one of claims 7 to 9, wherein: The monitoring unit is specifically suitable for: The value of the preset register and the client memory data are read to determine the execution environment information and access status information corresponding to the access behavior.

11. The system according to claim 10, wherein: The execution environment information includes: the process or thread that executes the access, the caller function of the access behavior, the stack backtrace sequence, the malicious code block, and / or the key register value; the access status information includes: the read access of the member pointer of the system process associated object by the non-system process, the read access to the system process associated object, the write access to the hardware abstraction layer distribution function table, and / or the write access to the relevant kernel global variable indicating the boundary of the user and kernel address space.

12. The system according to claim 11, wherein: The monitoring unit is specifically suitable for: Matching the access object of the access behavior with the address to be monitored contained in the monitoring list; If the match is successful, monitoring the access data information corresponding to the access behavior of the target memory page; If the match is unsuccessful, exit the root mode and return to the client context execution.

13. The system according to claim 7, wherein: The host detection module is located in a virtual machine monitor component of the host operating system kernel, and the virtual machine detection module is located in a client implemented by a virtual machine; wherein one host detection module corresponds to one or more virtual machine detection modules.

14. An electronic device, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the method for monitoring memory access behavior as described in any one of claims 1-7.

15. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute an operation corresponding to the method for monitoring memory access behavior as described in any one of claims 1-6.

Images