A non-mounted virtual machine vmdk file content deep inspection method

Abstract

The application discloses a non-mounted virtual machine vmdk file content deep inspection method, comprising the following steps: decomposing a vmdk file into a plurality of document file sets; traversing the plurality of decomposed document files to find windows registry file document files and picture files; obtaining USB usage trace information through the windows registry file, and completing deep inspection of the USB according to the USB usage trace information; and analyzing the found document files and picture files, and completing deep inspection of the document files and picture files by finding specified keywords. The application can realize content analysis in a virtual machine stored in a vmdk file through a non-mounted vmdk file mode, complete deep inspection, improve inspection efficiency, and reduce complexity and inspection cost.

Description

Technical Field

[0001] The present invention relates to the technical field of information system security, and in particular to a non-mounted virtual machine vmdk file content depth inspection method. Background Art

[0002] In confidential units, using confidentiality inspection tools to conduct routine or daily inspections of confidential information systems, as well as timely inspections and evidence collection for leaks, are critical to protecting the security of confidential information.

[0003] One of the tasks of the confidentiality check tool is to conduct an in-depth inspection of all virtual machines contained in the host machine (that is, the computer that contains the virtual machine software). The in-depth inspection content includes USB usage traces, browser usage traces, and whether there are specified confidential keywords in document files (including pictures).

[0004] vmdk is a virtual hard disk format generated by the virtual machine software VMware. VMware can create a virtual operating system after reading the vmdk file. All user data on the operating system and configuration information about the virtual server are stored in the vmdk file.

[0005] Currently, a common method for performing deep inspections on virtual machines is to launch VMware software on the host machine, mount the corresponding virtual machines one by one, install a security check tool in the system created by each virtual machine, and then perform a deep inspection on each virtual machine. This method is likely to host a large number of virtual machines. Performing a unified deep inspection on all hosts is cumbersome and requires limited automation by manually launching and mounting virtual machines and then importing the security check tool into them. Automating this process on the host machine is desirable.

[0006] Glossary

[0007] Vmdk: A virtual disk format file.

[0008] SDK: A toolkit provided by the open source software Winimage, which can be used for secondary development.

[0009] API: The interface provided by the software for third-party calls. Summary of the Invention

[0010] The purpose of the present invention is to provide a non-mounted virtual machine vmdk file content deep inspection method to achieve deep inspection of virtual machine content, improve inspection efficiency, reduce complexity and inspection cost. The technical solution adopted by the present invention is as follows.

[0011] In one aspect, the present invention provides a method for deep content inspection of a non-mounted virtual machine vmdk file, comprising:

[0012] Decompose the vmdk file into a collection of multiple files;

[0013] Traverse the decomposed multiple files and search for Windows registry files, document files and image files;

[0014] Obtain USB usage trace information through the found Windows registry file, and complete in-depth inspection of the USB based on the USB usage trace information;

[0015] Analyze the found document files and image files, and complete in-depth inspection of the document files and image files by searching for pre-specified keywords.

[0016] Optionally, the document file after the vmdk file is decomposed also includes a browser record file;

[0017] The method also includes: searching for browser record files from the decomposed multiple document files; obtaining browser version number information through the found Windows registry file, distinguishing versions of the found browser files based on the browser version number information, and parsing the content of the browser record files to obtain browser usage traces, thereby completing a deep inspection of the browser.

[0018] Optionally, obtaining the browser version number information through the found Windows registry file includes: analyzing fields in the registry item "HKEY_LOCAL_MACHINE\Software\Microso ft\Internet Explorer" to obtain the browser version number information.

[0019] Optionally, performing version differentiation on the found browser record file according to the browser version number information includes:

[0020] The index.dat file is classified as a browser file for versions earlier than IE10, and the WebCacheV01.dat file is classified as a browser file for versions IE10 and later.

[0021] Optionally, decomposing the vmdk file into a collection of multiple files includes parsing the vmdk binary file using an SDK interface provided by the open source software winimage to extract all non-fragmented files therein. The SDK provided by Winimage can export all files in the virtual machine stored in the vmdk file and traverse the file directory and all files under the directory in a tree structure.

[0022] Optionally, the Windows registry file is a file with a suffix of .hive;

[0023] The method of obtaining USB usage trace information by searching the Windows registry file includes analyzing key registry entries including "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClass es\" for USB usage records, obtaining USB usage traces, and completing a deep inspection of the USB.

[0024] Optionally, obtaining USB usage trace information through the found Windows registry file includes: performing full-text matching retrieval on the binary code of the Windows registry file, searching for USB-related registry entries based on unique characteristic values ​​of the binary codes of the USB registry entries, and obtaining USB usage trace information.

[0025] Specifically, the full-text matching retrieval of the binary code of the Windows registry file and the search for USB-related registry entries based on the unique characteristic value of the binary code of the USB registry entry include:

[0026] Convert binary registry files to hexadecimal files;

[0027] Check whether there are two consecutive bytes of 0x6B6E. If so, determine whether the 74th to 85th bytes after these two bytes are the specified values. If the corresponding bytes are the corresponding specified values, the corresponding bytes are recorded as a USB usage trace.

[0028] The values ​​corresponding to bytes 74 to 85 are: 0x233F2323 for bytes 74 to 77, 0x23425355 for bytes 78 to 81, and 0x5F646956 or 0x5F444956 for bytes 82 to 85.

[0029] The two bytes 0x6B6E and the subsequent 1-85 bytes form a structure _CM_KEY_NODE of a registry entry. The method further includes: parsing the structure to obtain specific content used by the USB.

[0030] Optionally, analyzing the found document files and image files includes:

[0031] For document files in doc, xls, pdf, and txt formats, the SDK tool provided by the poi open source software is used to analyze them and search for specified keywords. For image files in jpg, png, and gif formats, OCR technology is used to perform text recognition and search for specified keywords.

[0032] In a second aspect, the present invention provides a storage medium comprising computer-executable instructions, which, when executed by a computer, implement the method for deep content inspection of a non-mounted virtual machine vmdk file as described in the first aspect.

[0033] Beneficial effects

[0034] The present invention performs a deep inspection on the contents of the virtual machine stored in the vmdk file by parsing it without mounting the vmdk file. Since it bypasses the restoration and parsing of the vmdk file, it directly extracts the file through open source software tools to inspect USB traces, browser traces, and document file contents. Compared with the method of mounting the virtual machine in sequence and then installing the confidentiality inspection tool for inspection, the present invention can not only complete the task of deep inspection, but also greatly improve the inspection efficiency, reduce the complexity of labor, and reduce the cost of parsing. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 FIG2 is a schematic diagram showing the principle of an embodiment of a method for deep content inspection of a non-mounted virtual machine vmdk file according to the present invention. DETAILED DESCRIPTION

[0036] The following is a further description with reference to the accompanying drawings and specific embodiments.

[0037] The technical concept of the present invention is: to propose a non-mounted vmdk file deep inspection method, to parse the vmdk file through the software tools provided by open source software, to traverse the file directory, to extract the registry file and all document files, and to use the tools provided by the open source software to detect keywords in the files and pictures; to obtain USB usage traces based on the registry file information, and at the same time to determine the browser version through the analysis results of the vmdk file, to find the corresponding browser record file according to the browser version, and to parse the browser record file to obtain the browser usage traces, thereby completing the deep inspection.

[0038] Example 1

[0039] refer to Figure 1 This embodiment introduces a method for deep content inspection of a non-mounted virtual machine vmdk file, which includes:

[0040] Decompose the vmdk file into a collection of multiple files;

[0041] Traverse the decomposed files and search for Windows registry files, browser record files, document files and image files;

[0042] Obtain USB usage trace information and browser version information through the found Windows registry file, and complete a deep inspection of the USB based on the USB usage trace information;

[0043] Analyze the found document files and image files and complete in-depth inspection of the document files and image files by searching for pre-specified keywords;

[0044] The browser files found are differentiated according to the browser version number information, and the file content is parsed to obtain the browser usage traces and complete the in-depth inspection of the browser.

[0045] When applied, a confidentiality security check can be performed manually or by computer based on the USB usage trace information, browser usage trace information, and keyword search results of document files and image files obtained through the in-depth check of this embodiment.

[0046] This example uses the SDK provided by the open-source WinImage software to parse the VMDK file, traverse the file directory, and extract registry files and all other non-fragmented files. Windows registry files are characterized by the suffix .hive. By analyzing the fields in the registry key "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer," the browser version number can be obtained. By analyzing key registry entries for USB usage records, such as "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClass es\," USB usage trace information can be obtained, thus completing a deep inspection of the USB.

[0047] Of course, the open source software used for vmdk parsing is not limited to winimage, but also includes all software that has the function of extracting files in the vmdk format. Its characteristics are that it can parse the vmdk format and extract all the file contents therein.

[0048] This embodiment analyzes the document files and image files found, including: using the SDK tool provided by the poi open source software to analyze document files in formats such as doc, xls, pdf and txt to check whether they contain specified keywords; using OCR technology to perform text recognition on image files in formats such as jpg, png and gif to check whether they contain specified keywords.

[0049] Of course, keyword extraction from files is not limited to poi software, and image extraction is not limited to OCR software, but also includes all other software that can extract text and images.

[0050] The operating system involved in this embodiment only includes the Windows operating system.

[0051] Example 2

[0052] This embodiment also introduces a non-mounted virtual machine vmdk file content deep inspection method. Considering that Example 1 obtains USB usage trace information and browser version number information by parsing the registry, which will consume a lot of resources and has certain difficulties, this embodiment proposes an implementation method that skips parsing the Windows registry file to obtain USB usage trace information and browser version number information.

[0053] In this embodiment, the process of obtaining USB usage trace information includes performing a full-text match search on the binary code of the Windows registry file, searching for USB-related registry entries based on the unique characteristic values ​​of the binary codes of the USB registry entries, and obtaining the USB usage trace information. In other words, this embodiment obtains USB usage trace information through a brute-force search method, avoiding the significant resource overhead associated with parsing the Windows registry file.

[0054] Specifically, a full-text matching search is performed on the binary code of the Windows registry file, and USB-related registry entries are searched based on the unique characteristic value of the binary code of the USB registry entry, including:

[0055] Convert binary registry files to hexadecimal files;

[0056] Check whether there are two consecutive bytes of 0x6B6E. If so, determine whether the 74th to 85th bytes after these two bytes are the specified values. If the corresponding bytes are the corresponding specified values, the corresponding bytes are recorded as a USB usage trace.

[0057] The values ​​corresponding to bytes 74 to 85 are: 0x233F2323 for bytes 74 to 77, 0x23425355 for bytes 78 to 81, and 0x5F646956 or 0x5F444956 for bytes 82 to 85.

[0058] The two bytes 0x6B6E and the subsequent 1-85 bytes form a structure _CM_KEY_NODE of a registry entry. The method further includes: parsing the structure to obtain specific content used by the USB.

[0059] The above can realize brute force search of USB usage traces, so as to skip the step of parsing .hive files and further reduce costs.

[0060] This embodiment distinguishes the versions of the found browser files according to the browser version information, including distinguishing the index.dat file as a browser file of a version before IE10, and distinguishing the WebCacheV01.dat file as a browser file of IE10 and later versions.

[0061] Because the number of different types of file names corresponding to browser versions is limited, this embodiment compares all possible file names when comparing file names, thereby skipping the process of parsing the browser version through the registry .hive file.

[0062] Example 3

[0063] This embodiment introduces a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer, the method for deep content inspection of a non-mounted virtual machine vmdk file as described in Example 1 is implemented.

[0064] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0066] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0067] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0068] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which are all protected by the present invention.

Claims

1. A non-mounted virtual machine vmdk file content deep inspection method, characterized by: include: Use the SDK interface provided by the open source software winimage to parse the vmdk binary file and extract all non-fragmented files to decompose the vmdk file into a collection of multiple files; Traverse the decomposed files and search for Windows registry files, document files, image files and browser record files; Obtain USB usage trace information through the found Windows registry file, and complete in-depth inspection of the USB based on the USB usage trace information; Analyze the found document and image files. For document files in doc, xls, pdf, and txt formats, use the SDK tools provided by the poi open source software to analyze them and check for specified keywords. For image files in jpg, png, and gif formats, use OCR technology to perform text recognition and check for specified keywords to complete an in-depth inspection of document and image files. Obtain browser version information from the found Windows registry file, perform version differentiation on the found browser log files based on the browser version information, and parse the contents of the browser log files to obtain browser usage traces, completing a deep inspection of the browser; The USB usage trace information is obtained by searching the Windows registry file, including: performing full-text matching search on the binary code of the Windows registry file, and searching for USB-related registry entries based on the unique characteristic value of the binary code of the USB registry entry, specifically including: Convert binary registry files to hexadecimal files; Check whether there are two consecutive bytes of 0x6B6E. If so, determine whether the 74th to 85th bytes after these two bytes are the specified values. If the corresponding bytes are the corresponding specified values, the record corresponding to the corresponding bytes is a USB usage trace; The values ​​corresponding to bytes 74 to 85 are: 0x233F2323 for bytes 74 to 77, 0x23425355 for bytes 78 to 81, and 0x5F646956 or 0x5F444956 for bytes 82 to 85. The two bytes 0x6B6E and the following 1-85 bytes form a registry key structure _CM_KEY_NODE, and the specific content used by USB is obtained by parsing the structure.

2. The method according to claim 1, wherein: The method of obtaining the browser version number information by searching the Windows registry file includes analyzing the fields in the registry key "HKEY_LOCAL_MACHINE\Software\Microso ft\Internet Explorer" to obtain the browser version number information.

3. The method according to claim 1 or 2, wherein: The found browser record files are differentiated according to the browser version number information, including: differentiating the index.dat file as a browser record file of a version before IE10, and differentiating the WebCacheV01.dat file as a browser record file of IE10 and later versions.

4. The method according to claim 1, wherein: The Windows registry file is a file with the suffix .hive.

5. A storage medium containing computer-executable instructions, characterized in that: When the computer-executable instructions are executed by a computer, the method for deep content inspection of a non-mounted virtual machine vmdk file according to any one of claims 1 to 4 is implemented.

Images