Method for detecting platform exceptions in virtualization based on hardware performance counters
By employing a hardware performance counter-based method for detecting anomalies in virtualization platforms, this approach utilizes the Perf toolset of KVM and Linux systems to collect hardware event counts. Combining a random forest classification model with grid search optimization, a virtualization platform anomaly detection model is constructed. This solves the problems of kernel-level attacks and performance overhead in virtualization platform detection, achieving efficient and accurate identification of malicious programs.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANKAI UNIV
- Filing Date
- 2023-09-04
- Publication Date
- 2026-05-29
AI Technical Summary
In cloud computing environments, existing technologies for detecting malicious code on virtualization platforms are easily bypassed by kernel-level attacks and suffer from disadvantages such as high performance overhead and difficulty in resisting obfuscation and encryption, making them unable to effectively detect unknown types of malicious programs.
A virtualization platform anomaly detection method based on hardware performance counters is adopted. Hardware event counts are collected using the Perf toolkit of the KVM virtualization platform and Linux system. Feature selection and model training are combined with a random forest classification model to construct a virtualization platform anomaly detection model. Hyperparameters are optimized through grid search to improve detection accuracy and speed.
It achieves efficient and accurate detection of virtualization platforms, can identify unknown types of malicious programs, reduces the threat of kernel-level attacks, improves the accuracy and speed of the detection model, and ensures data security.
Smart Images
Figure CN117093993B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer technology, and specifically designs a method for detecting anomalies in a virtualization platform based on a hardware performance counter. Background Technology
[0002] In recent years, with the widespread application of cloud computing technology, users can enjoy more convenient and diverse computing services. However, at the same time, virtualization, as a key core technology of cloud computing, has also seen an increasing number of malicious code attacks and vulnerability exploits targeting virtualization platforms. Vulnerability attacks and virus intrusions against virtualization platforms inevitably lead to abnormal behavior, which shares some common characteristics. By collecting and analyzing numerous examples of attacks affecting platforms, researchers can discover the behavioral patterns and deeper impacts of these malicious attacks.
[0003] Currently, malware detection in cloud environments primarily employs in-band or out-of-band detection techniques. However, these methods heavily rely on kernel data protection; kernel-level attacks at the same privilege level could potentially bypass these detection mechanisms, posing a threat of data leakage and tampering. Furthermore, these traditional detection methods suffer from significant performance overhead and are vulnerable to countermeasures such as obfuscation and encryption.
[0004] Hardware events are a set of registers used to store counts of hardware-related activities and are a component of the performance monitoring unit of a modern microprocessor. After specifying certain events, the hardware works in conjunction with an event selector and counters used for sampling after the event occurs. Originally designed for performance debugging of complex software systems, it has gradually entered the field of computer security and achieved some success. Given the diverse types of hardware events, how to minimize the combinations of hardware events used while ensuring accuracy in detecting malicious programs is a pressing issue. Summary of the Invention
[0005] To address the aforementioned problems, the present invention aims to provide a method for detecting anomalies in virtualization platforms based on hardware performance counters.
[0006] To achieve the above objectives, the present invention adopts the following technical solution:
[0007] The method for detecting anomalies in virtualization platforms based on hardware performance counters includes the following steps:
[0008] 1) The sample is deployed using the KVM virtualization platform. The Perf toolkit provided by the Linux system is called from the host to collect the hardware event count of the portion of computer resources occupied by the client during the sample operation, so as to obtain the number of each hardware event triggered within a specified time. The data is preprocessed into CSV format data text and then dumped to the host.
[0009] 2) Using the random forest classification model as the machine learning model, after reading the data text stored on the host in step 1), the training set and validation set are divided and input into the random forest classification model for training. The feature importance of different hardware events is calculated according to the feature importance. The importance of each event feature to the decision of the random forest classification model is analyzed and compared to select the appropriate hardware event combination as the event to be collected.
[0010] 3) Based on the hardware events selected in step 2), perform data collection in step 1) again, train the final random forest classification model, and use grid search and K-fold partitioning methods to optimize hyperparameters during the process to obtain the virtualization platform anomaly detection model.
[0011] 4) The above-mentioned virtualization platform anomaly detection model is used to detect whether the target program will have an abnormal impact during operation in the virtualization platform, thereby determining whether the program is malicious.
[0012] A further optimization of this technical solution is as follows: In step 1), the method for collecting hardware event counts of the client's portion of computer resources during sample execution by calling the Perf toolset provided by the Linux system from the host is as follows:
[0013] 1.1) Set up the hardware events to be collected in the data acquisition script and specify the data storage path;
[0014] 1.2) Call the perf kvm method under the Perf tool, add the event and file path fields, and then execute the command to collect data;
[0015] 1.3) Obtain the process information of the command in 1.2), and after a specified time, issue a command to close the process.
[0016] A further optimization of this technical solution is that, in step 2), the method for calculating the feature importance of different hardware events based on feature importance and analyzing and comparing the importance of each event feature to the model decision for feature selection is as follows:
[0017] 2.1) Design a random forest classification model and input the data collected in step 1) into the random forest classification model;
[0018] 2.2) During the training of the random forest classification model, the importance score is calculated for each hardware event;
[0019] 2.3) Select the top 8 hardware events from high to low importance scores as the feature selection results.
[0020] 4. The virtualization platform anomaly detection method based on hardware performance counters as described in claim 1, wherein step 3) specifically includes the following steps:
[0021] 3.1) The virtualization platform anomaly detection model is a modified and optimized random forest binary classifier. Malicious programs are labeled as 1, and benign programs are labeled as 0. Specifically, it is an ensemble learning model based on several decision trees generated using the Gini index minimization strategy. After each decision tree model is trained, they are combined into a classifier. When the classification data is input, each decision tree will output 1 or 0 to indicate the judgment result. The soft label is obtained according to the proportion of decision trees with different outputs, and the hard label is obtained according to the decision tree with the most outputs of the same result.
[0022] 3.2) The grid search part seeks the best parameters from five aspects: number of trees, maximum number of features, maximum search depth, minimum number of nodes, and minimum number of branches. Specifically, several candidate parameters are selected from each of these five aspects and combined. The dataset is divided into several folded crossovers for training and validation. The set of hyperparameters with the smallest variance from the actual results is obtained based on the soft labels output by the random forest classification model and used as the model parameters.
[0023] 3.3) After the model hyperparameters are determined, they are re-inputted into the training set for training to obtain the virtualization platform anomaly detection model.
[0024] In a further optimization of this technical solution, step 4) specifically involves inputting the program sample to be detected into the virtualization platform anomaly detection model that has been trained above, performing detection and judgment on the program to be detected, and the model returning a judgment on whether the program to be detected is a malicious program.
[0025] This technical solution is further optimized by calculating the importance score J for each hardware event x. x its approximate value The calculation formula is:
[0026]
[0027] Where M is the number of decision trees in the random forest, and T m Let m be a decision tree, and let r be the importance of event x in a single decision tree. x its approximate value The calculation method is as follows:
[0028]
[0029] Where L represents the number of leaf nodes in the tree, and L-1 represents the number of non-leaf nodes in the tree. n v refers to the reduction in mean squared error (MSE) when splitting at a non-leaf node n.n The features associated with node n.
[0030] Unlike existing technologies, the above technical solution has the following beneficial effects:
[0031] 1) This detection method is immune to threats to the kernel data of the virtualization platform, such as kernel-level attacks, thus ensuring data security.
[0032] 2) Feature filtering can streamline the combination of hardware events used, improve the accuracy and speed of the detection model, and reduce performance overhead.
[0033] 3) The model can detect abnormal behavior caused by unknown types of malicious programs, thus improving the ability to identify malicious programs. Attached Figure Description
[0034] Figure 1 This is a flowchart of an anomaly detection method for virtualization platforms based on hardware performance counters. Detailed Implementation
[0035] To explain in detail the technical content, structural features, objectives, and effects of the technical solution, the following description is provided in conjunction with specific embodiments and accompanying drawings.
[0036] like Figure 1 The diagram shows a flowchart of a virtualization platform anomaly detection method based on hardware performance counters. This detection method includes the following steps performed in sequence:
[0037] 1) The sample is deployed using the KVM virtualization platform. The Perf toolset provided by the Linux system is called from the host to collect the hardware event count of the portion of computer resources occupied by the client during the sample operation, so as to obtain the number of each hardware event triggered within a specified time. After preprocessing these data into CSV format data text, they are dumped to the host.
[0038] 1.1) Start the data acquisition script written in Python from the command line of the host computer. The data acquisition script sets the hardware events to be acquired and specifies the data storage path.
[0039] 1.2) The script uses the Popen() method under the subprocess module to create a subprocess class, thereby starting a subprocess, calling the perf kvm method under the Perf tool, adding event and path fields, and then executing commands to collect data;
[0040] 1.3) Use the stdout.read() method of the class created in 1.2) to get the process information of the perf kvm method in 1.2). After a specified time, the script uses the kill() method under the os module to issue a command to the process and close it.
[0041] 2) Using the random forest classification model as the machine learning model, after reading the data text stored on the host in step 1), the training set and validation set are divided and input into the random forest classification model for training. The feature importance of different hardware events is calculated according to the feature importance. The importance of each event feature to the decision of the random forest classification model is analyzed and compared to select the appropriate hardware event combination as the event to be collected.
[0042] 2.1) Design a random forest classification model using the RandomForestClassifier class in the sklearn library of Python. Read the data collected in step 1), divide it into training and test sets using the train_test_split() function, and then put it into the random forest classification model.
[0043] 2.2) In the random forest classification model, the importance score J is calculated for each hardware event x. x its approximate value The calculation formula is Where M is the number of decision trees in the random forest, and T m Let m be a decision tree, and let r be the importance of event X in a single decision tree. x its approximate value The calculation method is as follows: Where L represents the number of leaf nodes in the tree, and L-1 represents the number of non-leaf nodes in the tree. n v refers to the reduction in mean squared error (MSE) when splitting at a non-leaf node n. n To obtain the hardware time score for each feature associated with node n, read the feature_importances_ element under the random forest subclass;
[0044] 2.3) Select the top 8 events from high to low weight as the feature selection results.
[0045] 3) Based on the hardware events selected in step 2), perform data collection in step 1) again, train the final random forest classification model, and use grid search and K-fold partitioning methods to optimize hyperparameters during the process to obtain the virtualization platform anomaly detection model.
[0046] 3.1) The anomaly detection model for the virtualization platform is a modified and optimized random forest binary classifier. Malicious programs are labeled 1, and benign programs are labeled 0. Specifically, it is an ensemble learning model based on several decision trees generated using a Gini index minimization strategy. After each decision tree model is trained, they are combined into a classifier. When classification data is input, each decision tree outputs either 1 or 0 to indicate the judgment result. Soft labels are obtained based on the proportion of decision trees with different outputs. The specific calculation method is t = n / N, where N is the number of decision trees in the random forest, and n is the number of decision trees that output label 1. Hard labels are obtained based on the decision tree that outputs the most of the same result; that is, when the number of trees with the most output labels of 1 is the largest, the random forest classification model outputs a hard label T = 1 for that sample, and so on.
[0047] 3.2) The grid search part seeks optimal parameters from five aspects: number of trees, maximum number of features, maximum search depth, minimum number of nodes, and minimum number of branches. Specifically, several candidate parameters are selected from each of these five aspects and combined. The dataset is divided into several folded crossovers for training and validation. The set of hyperparameters with the smallest variance between the model's output soft labels and the actual results is used as the model parameters. The calculation method is as follows: Where s is the number of samples, T i Let i be the actual label of the i-th sample. This is the soft label that the model determines for the i-th sample.
[0048] 3.3) After the model hyperparameters are determined, they are re-inputted into the training set for training to obtain the virtualization platform anomaly detection model.
[0049] 4) The above-mentioned virtualization platform anomaly detection model is used to detect whether the target program will have an abnormal impact during operation in the virtualization platform, thereby determining whether the program is malicious.
[0050] 4.1) Input the program sample to be detected into the virtualization platform anomaly detection model trained above. The model will detect and judge the program to be detected, and return the judgment of whether the program to be detected is malicious. Using the virus database of VirusTotal's official website (details: www.virustotal.com) and commonly used normal software collected from the Internet, 208 malicious programs and 208 benign programs were selected. Hardware event counts were collected for each program 5 times, resulting in a total of 1040 hardware event counts for malicious programs and 1040 for benign programs. The samples were divided into training set and test set at a ratio of 8:2, and the ratio of malicious programs to benign programs in the training set and test set was maintained at 1:1. Initially, 20 hardware events were selected for model training. After feature selection, the top 8 hardware events with the highest importance were selected and the same sample collection and division were performed again. Finally, the accuracy of the virtualization platform anomaly detection model based on hardware performance counters reached 95.38%.
[0051] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Unless otherwise specified, an element defined by the phrase "comprising..." or "including..." does not exclude the presence of additional elements in the process, method, article, or terminal device that includes said element. Additionally, in this document, "greater than," "less than," "exceeding," etc., are understood to exclude the stated number; "above," "below," "within," etc., are understood to include the stated number.
[0052] Although the above embodiments have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the above descriptions are merely embodiments of the present invention and do not limit the scope of patent protection of the present invention. Any equivalent structural or procedural transformations made using the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.
Claims
1. A method for detecting anomalies in a virtualization platform based on hardware performance counters, characterized in that, Includes the following steps: 1) The sample is deployed using the KVM virtualization platform. The Perf toolkit provided by the Linux system is called from the host to collect the hardware event count of the portion of computer resources occupied by the client during the sample operation, so as to obtain the number of each hardware event triggered within a specified time. The data is preprocessed into CSV format data text and then dumped to the host. 2) Using the random forest classification model as the machine learning model, after reading the data text stored on the host in step 1), the training set and validation set are divided and input into the random forest classification model for training. The feature importance of different hardware events is calculated according to the feature importance. The importance of each event feature to the decision of the random forest classification model is analyzed and compared to select appropriate hardware event combinations as events to be collected. In step 2), the method for calculating the feature importance of different hardware events based on feature importance, and analyzing and comparing the importance of each event feature to the model decision for feature selection is as follows: 2.1) Design a random forest classification model and input the data collected in step 1) into the random forest classification model; 2.2) During the training of the random forest classification model, the importance score is calculated for each hardware event; 2.3) Select the top 8 hardware events from highest to lowest importance score as the feature selection results; The importance score is calculated for each hardware event x. Its approximate value The calculation formula is: Where M is the number of decision trees in the random forest. Let m be a decision tree, and let x be the importance of event x in a single decision tree. Its approximate value The calculation method is as follows: Where L represents the number of leaf nodes in the tree, and L-1 represents the number of non-leaf nodes in the tree. This refers to the reduction in mean squared error (MSE) when splitting at a non-leaf node n. The features associated with node n; 3) Based on the hardware events selected in step 2), perform data collection in step 1) again, train the final random forest classification model, and use grid search and K-fold partitioning methods to optimize hyperparameters during the process to obtain the virtualization platform anomaly detection model; 4) The above-mentioned virtualization platform anomaly detection model is used to detect whether the target program will have an abnormal impact during operation in the virtualization platform, thereby determining whether the program is malicious.
2. The virtualization platform anomaly detection method based on hardware performance counters as described in claim 1, characterized in that, In step 1), the method for collecting hardware event counts of the client's portion of computer resources during sample execution by calling the Perf toolset provided by the Linux system from the host is as follows: 1.1) Set up the hardware events to be collected in the data acquisition script and specify the data storage path; 1.2) Call the perf kvm method under the Perf tool, add the event and file path fields, and then execute the command to collect data; 1.3) Obtain the process information of the command in 1.2), and after a specified time, issue a command to close the process.
3. The virtualization platform anomaly detection method based on hardware performance counters as described in claim 1, characterized in that, Step 3) specifically includes the following steps: 3.1) The virtualization platform anomaly detection model is a modified and optimized random forest binary classifier. Malicious programs are labeled as 1, and benign programs are labeled as 0. It is an ensemble learning model based on several decision trees generated using the Gini index minimization strategy. After each decision tree model is trained, they are combined into a classifier. When the classification data is input, each decision tree will output 1 or 0 to indicate the judgment result. The soft label is obtained according to the proportion of decision trees with different outputs, and the hard label is obtained according to the decision tree with the most outputs of the same result. 3.2) The grid search part seeks the best parameters from five aspects: number of trees, maximum number of features, maximum search depth, minimum number of nodes, and minimum number of branches. Several candidate parameters are selected from each of these five aspects and combined. The dataset is divided into several folded crossovers for training and validation. The set of hyperparameters with the smallest variance from the actual results is obtained based on the soft labels output by the random forest classification model as the model parameters. 3.3) After the model hyperparameters are determined, they are re-inputted into the training set for training to obtain the virtualization platform anomaly detection model.
4. The virtualization platform anomaly detection method based on hardware performance counters as described in claim 1, characterized in that, Step 4) specifically involves inputting the program sample to be detected into the virtualization platform anomaly detection model that has been trained above, performing detection and judgment on the program to be detected, and the model returning a judgment on whether the program to be detected is a malicious program.