A method for identifying and monitoring malicious traffic based on virtual machines

Abstract

The present invention discloses a method for identifying and monitoring malicious traffic based on a virtual machine, comprising: the virtual machine obtaining data packet information sent to a client in a network in real time; wherein the virtual machine runs on a host machine and provides a virtualized hardware environment for the client; the virtual machine analyzes data packets based on the data packet information, and when the analysis result shows that the data packet is the first target data packet received, obtains the arrival time of the first target data packet; uses the arrival time as the start time of a preset time window, and begins recording the number of target data packets obtained within the preset window time; when the number of recorded target data packets does not reach a preset threshold, the virtual machine updates the start time of the preset window time to the current time and restarts recording; when the number of recorded target data packets reaches a preset threshold, the virtual machine discards the target data packets that exceed the preset threshold. The present invention realizes the identification and protection of flooding traffic in a virtualized hardware environment.

Description

Technical Field

[0001] The present invention belongs to the technical field of virtualization security, and in particular relates to a method for identifying and monitoring malicious traffic based on a virtual machine. Background Art

[0002] Virtualization technology is a widely used technology in computer science. For example, it is widely used in cloud products. The security and reliability of virtualization technology are a hot topic of research.

[0003] The virtualized network is a crucial component of virtual machine technology. It serves as the medium for data exchange between virtual machines and the outside world, and is essential for achieving the full functionality of virtual machines. As the facilitator of data communication within virtual machine systems, the virtualized network must be highly secure and robust to provide a reliable network communication environment.

[0004] In the network, the most common malicious traffic is flood traffic. This malicious traffic refers to the attacker sending a large number of meaningless flood messages to the attacked party in a short period of time, causing the attacked party to be busy dealing with useless messages and exhausting its software and hardware resources, resulting in its network service paralysis. Flood traffic is a type of DDos attack (denial of service attack). DDos attacks use various means to paralyze the attacked host network, causing it to no longer be able to provide normal services to the outside world. This type of attack is extremely harmful, especially in cloud environments, such as the attached Figure 1 As shown in the figure, since various services are deployed in virtual machines in the cloud, and virtual machines are located in a virtualized network environment, traditional firewalls and intrusion detection tools, deployed outside the virtual network environment, can only monitor and block malicious traffic originating from outside the virtual network boundary, but have difficulty monitoring malicious traffic between virtual machine instances. If a malicious user uses the identity of a cloud tenant to send malicious traffic to other tenants in the same virtual network environment, a flood attack becomes difficult to prevent. Therefore, ensuring the security of virtual machine network environments is a key issue for both virtualization technology and cloud computing.

[0005] Traditional intrusion detection tools are deployed in the client operating system. Due to the large number of virtual machines in cloud computing, deploying intrusion detection tools in each client is a time-consuming and labor-intensive task, and it also affects the overall performance of the cloud platform. Currently, no relevant technology has been developed to address this issue. Summary of the Invention

[0006] In order to solve the above problems existing in the related art, the present invention provides a method for identifying and monitoring malicious traffic based on a virtual machine. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0007] The present invention provides a method for identifying and monitoring malicious traffic based on a virtual machine, comprising:

[0008] The virtual machine obtains data packet information sent to the client in the network in real time; wherein, the virtual machine runs on the host machine and provides a virtualized hardware environment for the client;

[0009] The virtual machine analyzes the data packet according to the data packet information, and when the analysis result shows that the data packet is the first target data packet received, obtains the arrival time of the first target data packet;

[0010] Taking the arrival time as the start time of a preset time window, and starting to record the number of the target data packets acquired within the preset window time;

[0011] When the number of the recorded target data packets does not reach a preset threshold, the virtual machine updates the start time of the preset window time to the current time and restarts recording;

[0012] When the number of the recorded target data packets reaches the preset threshold, the virtual machine discards the target data packets that exceed the preset threshold.

[0013] In some embodiments, the data packet information includes: a protocol type of the data packet and a source IP address of the data packet; and the virtual machine analyzes the data packet according to the data packet information, including:

[0014] The virtual machine determines whether the protocol type and source IP address of the obtained data packet are the same as the protocol type and source IP address of the data packet received historically, and when the protocol type and source IP address are different and the protocol type is the target protocol, the data packet is regarded as the first target data packet received as the analysis result.

[0015] In some embodiments, the method further comprises:

[0016] When the number of the recorded target data packets reaches the preset threshold, the virtual machine generates an alarm message; the alarm message includes: the source IP address of the target data packet, the protocol type of the target data packet, and the arrival time of the first target data packet;

[0017] The alarm information is displayed on the current display interface of the host machine.

[0018] In some embodiments, the starting to record the number of the target data packets received within the preset window time includes:

[0019] A counter is set, and each time a target data packet is obtained, the count of the counter is increased by 1 until the preset window time ends, and the count value of the counter is used as the number of the target data packets received within the preset window time.

[0020] In some embodiments, obtaining the arrival time of the first target data packet includes:

[0021] The arrival time of the first target data packet is obtained through the get_ms_time function in the Linux system.

[0022] In some embodiments, the target protocol comprises the ICMP protocol.

[0023] In some embodiments, the virtual machine is a QEMU virtual machine, and the virtual machine is configured in a bridged network mode.

[0024] The present invention has the following beneficial technical effects: since the malicious traffic identification and monitoring method is executed by a virtual machine, it is transparent to the upper-layer client, and the client can run on a more secure virtual machine without any modification, making the virtualized network data packet sending and receiving process safer and more efficient than traditional defense methods; since the function of the virtualized network is expanded without introducing new threads, no additional performance overhead will be caused; since the malicious traffic identification and monitoring method is executed by a virtual machine (that is, implemented at the virtualized hardware level), the method works outside the host machine's operating system, so it is difficult to be detected, destroyed or bypassed by malicious programs running in the host machine's operating system, thereby realizing a technology for identifying and resisting flooding traffic in a virtualized hardware environment, and the usability is high.

[0025] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A virtualized network topology diagram between multiple virtual machines in an exemplary cloud environment provided by an embodiment of the present invention;

[0027] Figure 2 A flowchart of a method for identifying and monitoring malicious traffic based on a virtual machine provided by an embodiment of the present invention;

[0028] Figure 3 An exemplary QEMU bridge mode virtualized network model topology diagram provided by an embodiment of the present invention;

[0029] Figure 4 Another flow chart of the method for identifying and monitoring malicious traffic based on a virtual machine provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0031] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0032] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0033] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0034] The inventors have discovered that a better solution is to insert a malicious traffic identification and monitoring module into the virtual machine source code to identify and block malicious traffic from the virtualization hardware level. This solution will have higher execution efficiency and be transparent to the operating system. More importantly, this solution can implement different traffic detection and monitoring mechanisms based on the different security domains in which the virtual machine is located. QEMU (Quick Emulator), as an open source virtual machine software, has high research and application value. It is widely used in cloud computing. However, in the virtualized network data packet sending and receiving process implemented by QEMU, there is still a lack of a traffic monitoring module and a data packet security verification mechanism, and its network communication link has certain security risks. If the QEMU source code is modified and a customized traffic identification and monitoring module is inserted, its network security barriers in the cloud environment can be strengthened, and the overall security of the virtual network can be improved.

[0035] Figure 2 This is a flow chart of a method for identifying and monitoring malicious traffic based on a virtual machine provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps:

[0036] S101. A virtual machine obtains data packet information sent to a client from a network in real time. The virtual machine runs on a host machine and provides a virtualized hardware environment for the client.

[0037] In an embodiment of the present invention, the client is an operating system running in a hardware environment virtualized by a virtual machine, the virtual machine being a QEMU virtual machine, and the QEMU virtual machine configured in bridged network mode. QEMU offers two mainstream network modes. One is slirp mode, also known as NAT (Network Address Translation) mode. This mode requires the virtual machine software to implement a network protocol stack to translate the client IP address to the host IP address. slirp mode has relatively low performance and is relatively complex to implement. The other network mode is bridged mode. This requires first creating a tap device on the host machine and then configuring the tap device's IP address and the client's IP address to be on the same network segment. This allows the host and client to ping each other. A tap device is a virtual network card device provided by Linux that is used for communication between the Linux kernel and user space programs. However, a tap device alone can only enable communication between the host and client. To enable the client to access an external network, a bridge device (a virtual bridge device provided by Linux) must also be created on the host machine. The host's physical network card and the tap device must then be added to the bridge, establishing a connection between the three. The client can communicate with the host kernel through the tap device, and then connect to the host's physical network card with the help of the bridge device, and then communicate with the external network. For example, the network topology diagram of the bridge network mode after configuration is completed is as follows: Figure 3 As shown, the virtual network card device can be a virtual network card e1000, the arrow represents the flow direction of the data packet, and as Figure 3 As shown, the data packet sent by the virtual bridge to the client is the data packet sent by the virtual bridge to the virtual network card e1000.

[0038] S102: The virtual machine analyzes the data packet according to the data packet information, and when the analysis result shows that the data packet is the first target data packet received, obtains the arrival time of the first target data packet.

[0039] Here, the packet information includes the packet's protocol type and source IP address. The virtual machine can determine whether the protocol type and source IP address of the acquired packet are the same as those of previously received packets. If the protocol type and source IP address are different and the protocol type is the target protocol, the acquired packet is considered the first received target packet as the analysis result, and the arrival time of the first target packet is obtained.

[0040] Exemplarily, the virtual machine may obtain the arrival time of the first target data packet through the get_ms_time function in the Linux system.

[0041] Here, the target protocol may be any protocol, for example, Internet Control Message Protocol (ICMP), and is not limited thereto.

[0042] S103: The arrival time is used as the start time of the preset time window, and the number of target data packets acquired within the preset window time is started to be recorded.

[0043] Here, the virtual machine can use the arrival time as the starting time of the current preset time window, set a counter, and add 1 to the counter each time a target data packet is received until the current preset window time ends, and use the count value of the counter as the number of target data packets received within the current preset window time.

[0044] Here, the preset time window can be set arbitrarily according to actual needs, for example, it can be 1 second, 2 seconds, etc., and the embodiment of the present invention does not limit this.

[0045] S104: When the number of recorded target data packets does not reach the preset threshold, the virtual machine updates the start time of the preset window time to the current time and restarts recording.

[0046] Here, when the number of target data packets received within the current preset window time does not reach the preset threshold, it means that there is no malicious attack within the current preset window time. At this time, the end time of the current preset window time is used as the start time of the next preset time window, and the counter is reset, and the number of target data packets in the next preset time window is continued to be recorded through the counter.

[0047] Here, the preset threshold value can be arbitrarily set according to actual needs, for example, it can be 10, 15, etc., and the embodiment of the present invention does not limit this.

[0048] S105 : When the number of recorded target data packets reaches a preset threshold, the virtual machine discards the target data packets exceeding the preset threshold.

[0049] Here, when the number of target data packets received within the current preset window time reaches a preset threshold, it indicates that a malicious attack has occurred within the current preset window time. At this time, the subsequently received target data packets may be discarded.

[0050] In some embodiments, as Figure 4 As shown, the above method also includes:

[0051] S106. When the number of recorded target data packets reaches a preset threshold, the virtual machine generates an alarm message; the alarm message includes: the source IP address of the target data packet, the protocol type of the target data packet, and the arrival time of the first target data packet.

[0052] Here, the alarm information may be some alarm text information, or an alarm log file stored in a preset location of the client or host, and there is no limitation on this.

[0053] S107: Display the alarm information on the current display interface of the host machine.

[0054] In some embodiments, the alarm information may also be displayed on the current display interface of the client.

[0055] In an embodiment of the present invention, the above-mentioned malicious traffic identification and monitoring method based on a virtual machine can be implemented by running a traffic identification and monitoring software module, and the software module can be added to the virtual network card packet receiving and sending function in the source code of the virtual machine.

[0056] The above method is illustrated below by a specific embodiment.

[0057] Step 1: Get the received data packet information (the data packet is in the form of Ethernet frame) in the virtual network card receiving data packet function e1000_receive_iov of the QEMU source code, obtain the source IP address of the data packet and the protocol type of the data packet, such as ICMP protocol; record the time when the first ICMP data packet arrives, and use this time as the starting time of the time window (1 second). The time is obtained using the get_ms_time function in the Linux system;

[0058] Step 2: Set a counter. Within 1 second, every time an ICMP packet from the source IP in step 1 is received, the counter count is increased by 1. In this way, the number of ICMP packets is monitored in real time.

[0059] Step 3: Determine whether the number of ICMP packets received from the source IP in step 1 within this 1 second exceeds 10; if so, it is determined to be an ICMP flood attack; if not, reset the counter to 0, and continue to record the number of ICMP packets received from the source IP in step 1 within the next 1 second, starting from the current time;

[0060] Step 4: If it is determined in step 3 that an ICMP flood attack has occurred, the ICMP data packets exceeding the threshold are discarded, thereby blocking the malicious traffic from entering the client system and printing an alarm message.

[0061] Through this example, the embodiment of the present application realizes the identification and blocking of malicious traffic of ICMP flood attacks (ICMP flood attacks refer to the attacker generating a large number of meaningless ICMP data packets and sending them to the target host, causing the target host to be busy responding to ICMP flood messages and consuming its software and hardware resources, making it unable to provide services normally) at the QEMU virtual machine level.

[0062] The present invention has the following beneficial effects:

[0063] Transparent to the client system: The traffic identification and monitoring software module inserted in the QEMU virtual machine is transparent to the upper-level client operating system. The client operating system does not need to worry about the identification and blocking of malicious data packets. The client operating system can run on a more secure virtual machine without any modification; Simple implementation: The packet receiving function of the QEMU source code is directly modified to further customize the security policy of the virtual machine network; High execution efficiency: The functions of the virtualized network are expanded without introducing new threads, which will not cause additional performance overhead; Stronger security: Since the above-mentioned monitoring method works outside the host operating system, it is difficult to be detected and damaged by malicious programs running in the host operating system.

[0064] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for identifying and monitoring malicious traffic based on a virtual machine, characterized in that: include: The virtual machine obtains data packet information sent to the client in the network in real time; wherein, the virtual machine runs on the host machine and provides a virtualized hardware environment for the client; The virtual machine analyzes the data packet according to the data packet information, and when the analysis result shows that the data packet is the first target data packet received, obtains the arrival time of the first target data packet; the data packet information includes: the protocol type of the data packet and the source IP address of the data packet; the virtual machine analyzes the data packet according to the data packet information, including: The virtual machine determines whether the protocol type and source IP address of the acquired data packet are the same as the protocol type and source IP address of the data packet received in the past, and when the protocol type and source IP address are different and the protocol type is the target protocol, the data packet is regarded as the first target data packet received as the analysis result; obtaining the arrival time of the first target data packet includes: Obtain the arrival time of the first target data packet through the get_ms_time function in the Linux system; The arrival time is used as the starting time of the preset time window, and the number of the target data packets obtained within the preset window time is recorded; When the number of the recorded target data packets does not reach a preset threshold, the virtual machine updates the start time of the preset window time to the current time and restarts recording; When the number of the recorded target data packets reaches the preset threshold, the virtual machine discards the target data packets that exceed the preset threshold.

2. The method for identifying and monitoring malicious traffic based on a virtual machine according to claim 1, wherein: The method further comprises: When the number of the recorded target data packets reaches the preset threshold, the virtual machine generates an alarm message; the alarm message includes: the source IP address of the target data packet, the protocol type of the target data packet, and the arrival time of the first target data packet; The alarm information is displayed on the current display interface of the host machine.

3. The method for identifying and monitoring malicious traffic based on a virtual machine according to claim 1, wherein: The starting to record the number of the target data packets received within the preset window time includes: A counter is set, and each time a target data packet is obtained, the count of the counter is increased by 1 until the preset window time ends, and the count value of the counter is used as the number of the target data packets received within the preset window time.

4. The method for identifying and monitoring malicious traffic based on a virtual machine according to claim 1, wherein: The target protocol includes the ICMP protocol.

5. The method for identifying and monitoring malicious traffic based on a virtual machine according to claim 1, wherein: The virtual machine is a QEMU virtual machine, and the virtual machine is configured in a bridge network mode.

Images