Method for effectively preventing virtual machine from being maliciously tampered in secret-related intranet environment

Abstract

The invention belongs to the technical field of network security, and discloses a method for effectively preventing a virtual machine from being maliciously tampered in a secret-related intranet environment, which comprises the following steps of: acquiring an XML (Extensible Markup Language) configuration file through a virtualized API (Application Program Interface), carrying out structured analysis on the XML configuration file, carrying out Hash aggregation calculation to obtain a reference characteristic value data packet, and embedding the reference characteristic value data packet into a user-defined namespace; constructing an event monitoring hook, performing integrity detection on the XML configuration file of the virtual machine based on the event monitoring hook to obtain a real-time reference feature value data packet, performing multi-level comparison with the reference feature value data packet, performing change legality verification according to a comparison result, and triggering automatic isolation and alarm response; legal change management and characteristic value closed-loop updating are executed, and the configuration recovery process of the virtual machine is isolated; according to the method, the real-time, intelligent and automatic security protection of the secret-related intranet virtual machine is realized, and the accuracy and response efficiency of malicious tampering detection are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, more particularly, the present application relates to a method for effectively preventing malicious tampering of virtual machines in a secret internal network environment. BACKGROUND

[0002] With the large-scale deployment of virtualization platforms in the secret internal network environment, virtual machines, as the core components of modern information system infrastructure, carry more and more critical business applications and sensitive data processing tasks. Accurate monitoring and effective protection of virtual machine configuration integrity is an important foundation for ensuring the security of the secret internal network. However, the traditional virtual machine security protection mainly relies on external security products and manual inspection, which has the limitations of low detection accuracy, delayed response, complex management, etc., and is difficult to meet the strict requirements of real-time and accuracy of modern secret internal network environment for security protection.

[0003] The traditional virtual machine configuration integrity protection mainly has the following problems: Firstly, the traditional virtual machine monitoring method lacks standardized feature extraction and benchmark establishment process; the configuration change record is incomplete in the monitoring process, the detection granularity is rough, which leads to the lack of accuracy of the obtained configuration state information, and it is difficult to be used for subsequent accurate tampering detection and risk assessment.

[0004] Secondly, the existing virtual machine security detection technology mainly adopts simple file integrity checking method, which lacks multi-dimensional and multi-level feature analysis capability, which leads to the detection result obtained cannot fully reflect the key information such as the structure feature, content feature and correlation feature of the virtual machine configuration, especially in the subtle difference identification under the complex configuration change scene.

[0005] Thirdly, the traditional virtual machine security management mainly relies on manual inspection and experience judgment, lacks objective quantitative abnormality identification and automatic disposal method; with the expansion of virtual machine scale and the complication of security threat, pure manual monitoring has been difficult to meet the large-scale and real-time virtual machine security protection demand.

[0006] Fourthly, the traditional virtual machine configuration management method lacks objective verification mechanism for change legality and system integrity; the configuration change lacks credibility evaluation and version tracing capability, which is easy to cause false alarm and missed detection, and affects the safe and stable operation of the whole secret internal network environment.

[0007] In view of this, the present application provides a method for effectively preventing malicious tampering of virtual machines in a secret internal network environment to solve the above problems. SUMMARY

[0008] In order to overcome the above-mentioned defects of the prior art, in order to achieve the above-mentioned purpose, the present application provides the following technical scheme: A method for effectively preventing malicious tampering of a virtual machine in a secret internal network environment, comprising: Step S1: Obtain the XML configuration file of the virtual machine, and perform structured parsing and node classification on the XML configuration file to obtain a hierarchical node configuration set; generate a baseline feature value data packet based on the hierarchical node configuration set, encrypt the baseline feature value data packet, and embed it in a pre-written custom namespace to obtain a baseline feature value archive; Step S2: Create an event listener hook for each virtual machine in the secret internal network and trigger integrity detection; after integrity detection is completed, obtain the real-time feature value data packet corresponding to the virtual machine, compare the real-time feature value data packet with the baseline feature value data packet in multiple levels, and perform risk assessment based on the comparison result to obtain an integrity detection report; Step S3: Perform risk level screening and change mode matching based on the integrity detection report, and determine whether the change process of the corresponding XML configuration file is a legal change based on the change mode matching result; if it is not a legal change, trigger an alarm notification and virtual machine isolation; if it is a legal change, obtain a legal change marker data; Step S4: Perform change management and feature value closed loop update on the legal changed virtual machine based on the legal change marker data; and perform configuration recovery process on the isolated virtual machine.

[0009] Further, the baseline feature value archive acquisition process comprises: Obtain the XML configuration file of the virtual machine based on the virtualization API interface; and perform structured parsing on the collected XML configuration file, and construct the configuration content in the XML configuration file into a configuration node tree based on the structured parsing result according to the node level relationship; According to the security sensitivity of each node in the configuration node tree, the node is classified and marked to obtain a hierarchical configuration node set; and the key configuration elements corresponding to each level in the hierarchical configuration node set are extracted; Obtain the position identification code corresponding to the key configuration elements, and perform layer-by-layer hash aggregation operation based on the preset hash algorithm from the leaf node to the root node of the configuration node tree in order to obtain the baseline feature value data packet; Perform data encryption processing on the obtained baseline feature value data packet to obtain an encrypted feature load, embed the encrypted feature load in a pre-written custom namespace, and insert a verification anchor point; Perform syntax validity verification and structural integrity detection on the embedded XML configuration file to obtain the baseline feature value archive.

[0010] Further, the baseline feature value data packet acquisition process comprises: A preset hash algorithm is applied to each key configuration element to calculate a feature digest, obtaining a node-level feature value; a unique identifier is generated according to the path information of the key configuration element in the configuration node tree; The node-level feature value and the location identifier are spliced and combined in a predetermined format to obtain a node feature identifier with location information; The configuration node tree is traversed in depth-first manner to identify all leaf nodes, obtaining a leaf node set; and the node feature identifier is extracted from the leaf node set as the zeroth layer hash input; The node feature identifiers of all child nodes under the same parent node in the leaf node set are arranged in order, and the parent node hash value is calculated after splicing in a predetermined order, obtaining the upper level node hash; The upper level node hash is taken as a new input, and the parent node hash calculation process is repeated, aggregating layer by layer upwards until the root node; the final hash operation result of the root node is obtained as the global configuration feature value; The global configuration feature value, the node-level feature value of each layer, the current timestamp and the unique identifier are structured and packaged to obtain the reference feature value data packet.

[0011] Further, the process of obtaining the integrity detection report includes: The virtual machines in the secret internal network are grouped and managed to obtain a monitoring priority queue, and an independent event listener hook is created for each virtual machine in the monitoring priority queue; The current XML configuration file and metadata area content in the corresponding virtual machine are read according to the event listener hook; The check anchor point in the metadata area is verified for integrity; if the verification fails, it is marked as a high-risk exception and the subsequent detection process is interrupted; if the verification passes, the encrypted feature value payload is extracted from the metadata area and decrypted to restore the reference feature value data packet; The node-level feature value and the global configuration feature value of the configuration node tree are calculated based on the current XML configuration file in real time, obtaining a real-time feature value data packet; The real-time feature value data packet and the reference feature value data packet are compared at multiple levels, and the configuration difference node list is obtained by locating the changed configuration node according to the comparison result; The nodes in the configuration difference node list are compared for differences in the front and back text to obtain a configuration change detail; and the risk score of the change item is obtained according to the configuration change detail, obtaining a comprehensive risk score; The integrity detection report is generated according to the comprehensive risk score.

[0012] Further, the process of obtaining the configuration difference node list includes: The global configuration feature values are extracted from the reference feature value data packet and the real-time feature value data packet respectively, and byte-level accurate comparison is performed based on the global configuration feature values, to obtain a global consistency determination result; If the global consistency determination result is consistent, a tamper-free identifier is generated and the comparison process is ended; if the global consistency determination result is inconsistent, node-level feature values of each level are extracted from the reference feature value data packet and the real-time feature value data packet; According to the level order of the configuration node tree, the node-level feature values of each node are compared layer by layer from the root node to the leaf node; the node path and level position information corresponding to the inconsistent feature value nodes are identified and recorded, and are integrated to obtain a configuration difference node list.

[0013] Further, the determination of whether the change process of the corresponding XML configuration file is a legal change process includes: Based on the obtained integrity detection report, abnormal detection records are obtained by screening according to risk levels; configuration change details are read from the abnormal detection record set; the feature mode of the configuration change details is matched with the pre-stored legal change whitelist; If the matching is successful, the corresponding abnormal detection record is marked as a legal change, to obtain a legal change mark data; if the matching fails, it is determined as an unauthorized tampering behavior, to obtain an unauthorized tampering record; According to the risk level of the unauthorized tampering record, a differential abnormal handling strategy is generated, including generating an alarm notification for the medium-risk level; for the high-risk level, the alarm notification is sent while triggering a virtual machine isolation operation.

[0014] Further, the process of triggering the virtual machine isolation operation includes: The storage access permission of the tampered virtual machine is modified to read-only mode, and memory snapshot and disk snapshot operations are performed on the virtual machine, and the snapshot file is stored to an independent forensic storage area to obtain a forensic data packet; and an isolation identifier is added to the tampered virtual machine to obtain an isolated state virtual machine; The configuration tampering of other virtual machines on the same host is detected, and time correlation and feature similarity analysis are performed based thereon to obtain a horizontal attack propagation feature; whether there is a propagating attack is judged according to the horizontal attack propagation feature, to obtain a propagating attack determination result; If the propagating attack determination result is yes, synchronous isolation handling is performed on all virtual machines on the host, and a security event is reported to the upper-level security management center; an abnormal handling log is generated synchronously and is written into a pre-set audit log blockchain.

[0015] Further, the process of obtaining the propagating attack determination result includes: The identifier information of the host where the tampered virtual machine is located is obtained, and based thereon, a list of all virtual machines running on the corresponding host is obtained; Based on the integrity detection report, an abnormal time interval between adjacent virtual machines with unauthorized tampering behavior in the corresponding virtual machine list is obtained, an abnormal time distribution sequence is obtained, time clustering analysis is performed, time clustering characteristics are obtained, similarity between feature modes in different virtual machine configuration change details is calculated, a feature similarity matrix is obtained, and the time clustering characteristics and the feature similarity matrix are integrated to generate a horizontal attack propagation feature and a propagation attack determination result.

[0016] Further, the process of change management and feature value closed-loop update includes: The change approval number and the approval person identity information are extracted from the legal change mark data, and the change legality confirmation result is obtained by performing secondary verification of the approval single validity and non-expiration through the intranet approval interface. If the change legality confirmation result is verified, the changed virtual machine XML configuration file is read, the feature value generation process of step S1 is executed, the node-level feature value and the global configuration feature value are recalculated based on the new XML configuration file, and the new version feature value data packet is obtained. The global configuration feature value of the last historical version is extracted from the configuration file metadata as a parent version identifier, the parent version identifier is embedded into the new version feature value data packet, the version chain relationship is established, and the feature value data packet with version chain is obtained. The feature value data packet with version chain is encrypted to obtain a new encrypted feature value load, the original load feature value load is replaced with the new encrypted feature value load, and the check anchor point is updated synchronously. The time of the feature value update operation, the approval number, the new and old feature value comparison data, and the version chain information are recorded to the feature value generation log library to form a change audit track. Further, the process of performing a configuration recovery process on the isolated virtual machine includes: The XML configuration file backup corresponding to the last legal change process of the virtual machine is read from the reference feature value archive. If the XML configuration file backup exists and is not damaged, the backup configuration file is used to replace the tampered XML configuration file; if the backup does not exist or is damaged, the last trusted version is traced back through the feature value version chain, and the legal configuration file is reconstructed in reverse according to the configuration change history in the version chain. The feature value generation and embedding operation of step S1 is performed on the recovered configuration file to obtain the recovered legal configuration state. The isolation state of the virtual machine is released, the network connection and the storage access permission are restored, and the event listening hook corresponding to the virtual machine is reset.

[0017] The technical effect and advantages of the method for effectively preventing a virtual machine from being maliciously tampered with in a secret internal network environment are as follows: By establishing a benchmark, a standardized XML configuration file parsing process, and a multi-level feature extraction mechanism, the drawbacks of the lack of accuracy of traditional monitoring are overcome, a structured node tree is constructed to adapt to different configuration scenarios, hash aggregation and comprehensive feature value encapsulation ensure the accuracy and comprehensiveness of the benchmark data, and reliable basis is provided for subsequent accurate detection; multi-dimensional and multi-level feature analysis capabilities make up for the shortcomings of traditional simple file checking, and can comprehensively reflect key information such as configuration structure features, content features, and association features and their different performances in different change scenarios. In the monitoring and processing link, real-time detection and multi-level comparison based on event listening hooks change the traditional passive protection mode relying on manual inspection, high-precision tampering identification is achieved through objective and quantitative means, and the real-time security protection needs of large-scale virtual machine environments are met. At the same time, the construction of a legal change whitelist matching mechanism, a propagation attack identification model, and a risk level evaluation system not only helps to analyze the security situation of virtual machines in depth, but also objectively verifies the change behavior, avoids false positives and omissions, and improves the accuracy and reliability of security protection; In addition, the finally established closed-loop protection system realizes the whole-process automatic disposal from detection, alarm to automatic isolation and recovery, the feature value embedded storage and version chain management mechanism facilitate traceability, auditing and management, and effectively promote the intelligent development of secret internal network virtualization security protection, so that virtualization technology better serves fields such as secret business application under the premise of safety and controllability. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A method for effectively preventing a virtual machine from being maliciously tampered with in a secret internal network environment. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0020] Embodiment 1, please refer to Figure 1 The method for effectively preventing a virtual machine from being maliciously tampered with in a secret internal network environment described in the embodiment includes the following steps: Step S1: Obtain the XML configuration file of the virtual machine, and perform structured parsing and node classification on the XML configuration file to obtain a hierarchical node configuration set; generate a baseline characteristic value data packet based on the hierarchical node configuration set, encrypt the baseline characteristic value data packet, and embed it in a pre-written custom namespace to obtain a baseline characteristic value archive; Step S2: Create an event listening hook for each virtual machine in the confidential internal network and trigger integrity detection; after the integrity detection is completed, obtain the real-time characteristic value data packet corresponding to the virtual machine, compare the real-time characteristic value data packet with the baseline characteristic value data packet in multiple levels, and perform risk assessment based on the comparison result to obtain an integrity detection report; Step S3: Perform risk level screening and change mode matching based on the integrity detection report, and determine whether the change process of the corresponding XML configuration file is a legal change based on the change mode matching result; if it is not a legal change, an alarm notification and virtual machine isolation are triggered; if it is a legal change, a legal change marker data is obtained; Step S4: Perform change management and characteristic value closed loop update on the legal changed virtual machine based on the legal change marker data; and perform configuration recovery process on the isolated virtual machine.

[0021] In the embodiment of the application, the detailed implementation process of step S1 includes: The XML configuration file of the virtual machine is obtained based on the virtualization API interface; and the collected XML configuration file is subjected to structured parsing, and the configuration contents in the XML configuration file are constructed into a configuration node tree according to the node hierarchical relationship based on the structured parsing result; Each node in the configuration node tree is classified and marked according to the security sensitivity, to obtain a hierarchical configuration node set; and the key configuration elements corresponding to each level in the hierarchical configuration node set are extracted; The position identification code corresponding to the key configuration elements is obtained, and the hash aggregation operation is performed layer by layer from the leaf node to the root node of the configuration node tree based on the preset hash algorithm, to obtain a baseline characteristic value data packet; The obtained baseline characteristic value data packet is subjected to data encryption processing to obtain an encrypted characteristic load, the encrypted characteristic load is embedded in a pre-written custom namespace, and a verification anchor point is inserted; The embedded XML configuration file is subjected to syntax validity verification and structure integrity detection to obtain a baseline characteristic value archive.

[0022] Specifically, the virtualization API interface is deployed in the secret internal network, and an XML configuration file in a target virtual machine is obtained based on the deployed virtual machine API interface, the XML configuration file including key information such as a hardware configuration, a network setting, and a storage mapping of the corresponding virtual machine; data preprocessing is performed on the collected XML configuration file, the data preprocessing referring to creating a deep copy of the XML configuration file and removing a metadata node and all child nodes thereof from the deep copy to obtain a configuration main body to be processed; wherein the metadata node refers to a metadata node in the virtual machine XML <metadata>Region, allowing users or platforms to write custom metadata tags; XML configuration files are files generated by virtualization platforms to describe virtual machine resources (CPU, memory, disk, network, etc.), usually in XML format.

[0023] Further, the acquired configuration file to be processed is parsed using an XML parser (such as libxml2, JAXP) for lexical analysis and syntax analysis, and the tags, attributes, text content, and other document structure contents in the XML configuration file are identified and extracted, and a tree-shaped data structure is constructed according to the parent-child relationship and sibling relationship to form a configuration node tree reflecting the configuration hierarchy; and each node in the configuration node tree contains signature, attribute set, text value, path information, and other data; then each node in the configuration node tree is evaluated for security sensitivity, and according to known security policies and expert knowledge, the nodes are divided into core security nodes (such as CPU, memory, network interface configuration), important function nodes (such as storage, device configuration), and general information nodes (such as description information, annotations, etc.), and different security levels are assigned to nodes of different sensitivity, such as high sensitivity, medium sensitivity, and low sensitivity, to form a hierarchical configuration node set.

[0024] From the hierarchical configuration node set, key configuration elements of each level are extracted, such as CPU core number, memory size, disk path, network MAC address, etc., which are the core components of virtual machine configuration, and then a unique location identification code is generated for each key configuration element, which includes the absolute path information and relative position information of the node in the configuration node tree; a preset hash algorithm (which can be MD5, SHA256, or SM3) is used to calculate the feature value of the key configuration element, and a bottom-up calculation strategy is used, starting from the leaf node of the configuration node tree and performing hash aggregation operation layer by layer to the root node, the hash value of each layer is obtained by concatenating the hash values of all child nodes and then hashing again, and finally a reference feature value data packet containing feature values of each level and global feature values is obtained, which is encrypted using symmetric encryption or asymmetric encryption to generate an encrypted feature load, ensuring the confidentiality and integrity of the feature value data, and writing a custom namespace in the metadata node in the XML configuration file for storing digested (indicating that the resource has completed digest processing), digesting (indicating that the resource is in the process of digest processing), timestamp, tag information, etc. The encryption feature load is embedded into the custom namespace as a special attribute, a check anchor such as a digital signature or a check code is inserted for verifying the integrity of the embedded data, finally, the embedded XML configuration file is subjected to syntax validity verification to ensure that the embedding operation does not destroy the standard format of the XML file, structural integrity detection is performed to verify the hierarchical relationship and reference integrity of the configuration node tree, a reference feature value archive is formed, which not only contains original configuration information, but also contains feature values for tamper detection, and a trusted baseline is provided for subsequent integrity monitoring; wherein, in the metadata node, in addition to the reference feature value data packet, basic information such as virtual machine name, creation time and modification time is additionally recorded, and compressed virtual machine configuration information is saved.

[0025] In the embodiment of the application, the acquisition process of the reference feature value data packet comprises: A preset hash algorithm is applied to each key configuration element to calculate a feature digest, thereby obtaining a node-level feature value; and a unique identifier is generated according to the path information of the key configuration element in the configuration node tree; The node-level feature value and the position identification code are spliced and combined in a predetermined format to obtain a node feature identifier with position information; The configuration node tree is subjected to depth-first traversal to identify all leaf nodes, thereby obtaining a leaf node set; and the node feature identifier is extracted from the leaf node set as the zeroth layer hash input; The node feature identifiers of all child nodes under the same parent node in the leaf node set are sequentially arranged according to the leaf node set, and the parent node hash value is calculated after splicing in a predetermined order, thereby obtaining the last level node hash; The last level node hash is taken as a new input, and the parent node hash calculation process is repeatedly executed, thereby aggregating layer by layer upwards until the root node; the final hash operation result of the root node is obtained as the global configuration feature value.

[0026] The global configuration feature value, the node-level feature value of each layer, the current timestamp and the unique identifier are structured and packaged to obtain the reference feature value data packet.

[0027] First, for each key configuration element extracted from the hierarchical configuration node set, a preset hash algorithm is used to calculate a feature digest of its content to obtain a corresponding node-level feature value; the node-level feature value and the location identifier code are spliced and combined according to a predetermined format to form a node feature identifier, which contains not only content information but also location information, providing a basis for subsequent accurate comparison, then a depth-first traversal (DFS) is performed on the entire configuration node tree, all nodes are traversed in the order of visiting child nodes first and then parent nodes, all leaf nodes without child nodes are identified, these leaf nodes are collected into a leaf node set, the node feature identifier of each leaf node in the leaf node set is extracted, and the corresponding node feature identifier is taken as the hash input of the zeroth layer (the bottom layer) to provide starting data for the bottom-up hash aggregation process, then a hash aggregation operation is performed on the configuration node tree layer by layer upwards, all child nodes under the same parent node are identified, the node feature identifiers of these child nodes are arranged in a predetermined order (such as alphabetical order, appearance order, etc.) to ensure that the same configuration produces the same hash result at different times, the arranged child node feature identifiers are spliced into a string, and a hash algorithm is applied to the spliced result to calculate the hash value of the parent node, that is, the hash value of the previous layer node, which is taken as the new input to repeat the same parent node hash calculation process, and the aggregation is performed layer by layer upwards until the root node of the configuration node tree is reached, and the final hash operation result of the root node is obtained, which represents the global feature of the entire virtual machine configuration, referred to as a global configuration feature value, finally, the global configuration feature value, the node-level feature values of each layer, the current timestamp, the virtual machine UUID and the platform operation identifier are organized and packaged according to a predetermined data structure to form a structured reference feature value data packet, which contains complete feature information of the virtual machine configuration, including global overall features and local detailed features, providing a comprehensive comparison reference for subsequent tamper detection; the platform operation identifier is used to mark whether the feature value is generated by a legal operation of the virtualization platform, including an operation type code and an operation session ID.

[0028] In the embodiment of the application, the detailed implementation steps of step S2 include: The virtual machines in the secret internal network are grouped and managed to obtain a monitoring priority queue, and independent event listening hooks are created for each virtual machine in the monitoring priority queue; The current XML configuration file and the metadata area content in the corresponding virtual machine are read according to the event listening hook; The check anchor point in the metadata area is subjected to integrity verification; if the verification fails, it is marked as a high-risk anomaly and the subsequent detection process is interrupted; if the verification passes, the encrypted feature value payload is extracted from the metadata area and subjected to decryption operation to restore the reference feature value data packet; Real-time feature value data packet is obtained by calculating node-level feature values and global configuration feature values of the configuration node tree based on the current XML configuration file; The real-time feature value data packet is compared with the benchmark feature value data packet in multiple levels, and the changed configuration node is located according to the comparison result to obtain a configuration difference node list; The nodes in the configuration difference node list are compared with the previous and subsequent difference texts to obtain a configuration change detail, and a risk score of a change item is obtained according to the configuration change detail to obtain a comprehensive risk score; An integrity detection report is generated according to the comprehensive risk score.

[0029] In this embodiment, first, an event listening hook is registered in the virtual machine management layer of the virtualization platform, the event listening hook covers the key life cycle operation of the virtual machine, including the pre-startup verification hook, the pre-shutdown verification hook, the pre-restart verification hook, the pre-migration verification hook, the post-configuration modification verification hook and the timing running state verification hook; when any event listening hook is triggered or actively triggered, the virtual machine identifier and the operation type of the triggered hook are obtained, and the current XML configuration file of the virtual machine is read based on the virtualization API interface; first, the metadata node of the current XML configuration file is verified for integrity, the verification anchor point in the metadata node attribute is read, and the verification anchor point is verified for integrity to verify whether it is tampered with; If the metadata integrity verification fails, it is determined that the metadata layer is tampered with, a high-risk abnormal event record is immediately generated, the record contains the virtual machine identifier, the detection time, the abnormal type is that the verification anchor point is tampered with, the risk level is high risk, and the recommended disposal measure is immediate isolation and manual review; at the same time, the record is recorded and written into the security event database, real-time alarm notification is sent to the security administrator through the alarm channel, and the subsequent detection process of the virtual machine is interrupted, and the alarm mode includes multiple forms such as email, short message, management console pop-up window and the like; If the verification is successful, the embedded encrypted feature value load is extracted from the metadata node, a decryption operation is performed using the corresponding decryption key, and the original benchmark feature value data packet is restored.

[0030] Then the generation process of the above-mentioned benchmark characteristic value data packet is re-executed for the current XML configuration file, the current configuration node tree is constructed, the node level characteristic value of each node and the global configuration characteristic value of the whole are calculated, the real-time characteristic value data packet is generated, the real-time characteristic value data packet is compared with the benchmark characteristic value data packet in multiple levels, the global configuration characteristic value is compared first, whether the overall configuration changes is judged, if the global characteristic value is consistent, the configuration is not changed, if it is inconsistent, the node level characteristic value of each level is compared layer by layer, the changed configuration node is accurately positioned, the changed node information (including node path, level position, change type, etc.) is summarized to form a configuration difference node list, the configuration difference node list is a list, each entry in the list contains the complete path of the difference node, node type, sensitivity level, benchmark characteristic value, real-time node characteristic value and other information; Then the context content of each node in the configuration difference node list is compared, the specific change content is obtained, the influence analysis of the extracted change content is carried out, the analysis dimensions include: security influence analysis, whether the change affects the access control, network isolation, data protection and other security mechanisms of the virtual machine; function influence analysis, whether the change affects the normal operation of the virtual machine, resource availability, business continuity; compliance influence analysis, whether the change violates the security policy, configuration baseline standard or compliance requirement; the change content and the influence analysis result are integrated to form a configuration change detail, each change record in the configuration change detail contains change type (add, modify, delete), change path, pre-change value, post-change value and node belonging to configuration category and other fields.

[0031] For each change record in the configuration change details, the preset configuration item security level mapping table is queried according to the configuration category to which the node belongs, and the corresponding mapping table defines the security importance classification of various configuration items of the virtual machine; the configuration items are divided into three levels of key security configuration, important business configuration and general operation configuration, wherein the key security configuration includes startup boot path, disk device mapping, network bridge configuration and privileged device pass-through, the important business configuration includes CPU core number, memory capacity, network card type and disk controller, and the general operation configuration includes display adapter, USB controller and power management parameter; a risk weight coefficient is set for each security level; for example, the weight coefficient of the key security configuration is 10, the weight coefficient of the important business configuration is 5, and the weight coefficient of the general operation configuration is 1; the risk score of the configuration difference is calculated, the security level weight coefficients of each change record are accumulated, and if multiple modifications occur in the same node, the count is added, and the comprehensive risk score is obtained; finally, the integrity detection report is generated according to the comprehensive risk score, the integrity detection report adopts a structured document format, includes a trigger hook type, a detection abstract part, lists virtual machine identification, detection time, risk level, comprehensive score, a change detail part, lists all configuration difference nodes and change details, and a suggestion measure part, gives corresponding disposal suggestions according to the risk level; after the report is generated, it is stored in the detection history database, and whether to trigger an alarm notification is decided according to the risk level; the report contains detection time, virtual machine identification, change abstract, risk score, suggested disposal measures and other information.

[0032] In the embodiment of the application, the configuration difference node list acquisition process comprises: Global configuration feature values are extracted from the reference feature value data packet and the real-time feature value data packet respectively, and byte-level accurate comparison is carried out based thereon to obtain a global consistency determination result; If the global consistency determination result is consistent, a tamper-free identifier is generated and the comparison process is ended; if the global consistency determination result is inconsistent, node-level feature values of each level are extracted from the reference feature value data packet and the real-time feature value data packet; According to the hierarchical order of the configuration node tree, the node-level feature values of each node are compared layer by layer from the root node to the leaf node; the node path and hierarchical position information corresponding to the inconsistent feature value nodes are identified and recorded, and are integrated to obtain the configuration difference node list.

[0033] In this embodiment, first, the global configuration feature value is extracted from the reference feature value data packet, and the global configuration feature value calculated at the current time is extracted from the real-time feature value data packet. The strings based on the corresponding global configuration feature values are accurately compared at the byte level to ensure the absolute accuracy of the comparison, and any minor differences are not allowed to be ignored. The global consistency determination result is obtained. If the global consistency determination result is consistent, it means that the overall configuration of the virtual machine has not changed, and all configuration elements remain in the reference state. A tamper-free identifier is generated to mark that the virtual machine is currently in a safe and untampered state, and the comparison process is ended without the need for subsequent detailed analysis. If the global consistency determination result is inconsistent, the platform operation identifier in the metadata node is read to determine whether its operation session ID matches the active session of the current virtualization platform. If the platform operation identifier shows that the feature value is generated by a legal operation within the platform, and the current session ID matches, but the configuration is still modified, it is determined that it is a violation of the operation of directly modifying the configuration file outside the platform. A high-risk alarm event is generated, and the alarm type is recorded as "illegal configuration modification beyond the platform". If the platform operation identifier does not match or is empty, the node-level feature values of each level are extracted from the reference feature value data packet and the real-time feature value data packet respectively. The node-level feature values are organized according to the hierarchical structure of the configuration node tree. Starting from the root node level to the leaf node level, the node-level feature values are compared layer by layer from the root node to the leaf node in the order of the hierarchical structure of the configuration node tree. The high-level nodes are compared first, and then the low-level nodes. This hierarchical comparison method can quickly narrow down the change range and improve the comparison efficiency. For each node in each level, the reference feature value is accurately compared with the real-time feature value. If the feature values are consistent, it means that the node and its subtree have not changed. If the feature values are inconsistent, it means that the node or its subtree has changed, and further in-depth comparison is needed. Identify and record all nodes with inconsistent feature values. Obtain the complete path information of these nodes in the configuration node tree. Record the hierarchical position information of the nodes in the tree structure. The path information and hierarchical position information of all identified change nodes are integrated, duplicates are removed, and sorted according to the hierarchical order or importance order to form a structured configuration difference node list.

[0034] In the embodiment of the application, the detailed implementation steps of step S3 include: Based on the obtained integrity detection report, the abnormal detection record is obtained by screening according to the risk level; the configuration change details are read from the abnormal detection record set; the feature mode of the configuration change details is matched with the pre-stored legal change whitelist; If the matching is successful, the corresponding abnormal detection record is marked as a legal change, and the legal change marking data is obtained; if the matching fails, it is determined as an unauthorized tampering behavior, and the unauthorized tampering record is obtained; According to the risk level of the unauthorized tampering record, a differentiated abnormal handling strategy is generated, including generating an alarm notification for a medium risk level; and triggering a virtual machine isolation operation while sending an alarm notification for a high risk level.

[0035] In this embodiment, first, the generated integrity detection report is analyzed and processed, the comprehensive risk score is compared with the preset risk threshold, and the risk level is set according to the comparison result, including low risk, medium risk and high risk; the integrity detection report above the medium risk is extracted and marked as an abnormal detection record; for each abnormal detection record, the configuration change details corresponding to each record are extracted from the abnormal detection record set, including the changed configuration node, the change content, the change time, the change amplitude and other detailed information, the feature mode of the configuration change details is analyzed, including the change type (addition / deletion / modification), the change position (core configuration / function configuration / description information), the change scale (single node / multiple nodes / batch change), etc., the extracted feature mode is matched with the pre-stored legal change white list, the legal change white list contains known normal configuration change modes, including system patch update, security policy adjustment, resource expansion, etc., the white list entry contains change mode description, matching rule, authorized source and other information, and mode matching (such as regular expression matching) is used to judge whether the current change conforms to any legal mode in the white list.

[0036] Then, according to the matching result, the classification processing is performed, if the feature mode of the configuration change details is successfully matched with a certain entry in the legal change white list, it indicates that the corresponding change process is an authorized normal operation process, the corresponding abnormal detection record is marked as a legal change, and the legal change marking data is generated, including the change confirmation identifier, the matched white list entry, the approval information, etc.; if the matching fails, it indicates that the change does not conform to the known legal mode, and it may be an unauthorized tampering behavior, and an unauthorized tampering record is generated, recording the detailed information of the tampering and the possible threat level; Then, according to the risk level of the unauthorized tampering record, a differentiated abnormal handling strategy is implemented, including generating an alarm notification for a medium risk level, and notifying the security administrator through a security management platform, an email, a short message and the like, and the alarm content includes tampering of a virtual machine, tampering details, risk assessment, suggested handling measures and the like; for a high risk level tampering, in addition to sending an emergency alarm notification, a virtual machine isolation operation is also triggered synchronously to prevent the tampering from affecting the spread or malicious behavior from continuing to execute.

[0037] In the embodiment of the application, the detailed implementation steps of triggering the virtual machine isolation operation include: The storage access permission of the tampered virtual machine is modified to a read-only mode, memory snapshot and disk snapshot operations are performed on the virtual machine, snapshot files are stored to an independent forensic storage area to obtain a forensic data package; and an isolation identifier is added to the tampered virtual machine to obtain an isolated state virtual machine; detecting a configuration tampering of other virtual machines on the same host computer, performing time correlation and feature similarity analysis to obtain a lateral attack propagation feature; determining whether there is a propagating attack according to the lateral attack propagation feature to obtain a propagating attack determination result; If the propagating attack determination result is yes, performing synchronous isolation treatment on all virtual machines on the host computer, and reporting a security event to a superior security management center; synchronously generating an abnormal treatment log and writing it into a preset audit log blockchain.

[0038] In this embodiment, first, the virtual machine that detects unauthorized tampering behavior immediately starts the isolation treatment process, modifies the storage access permission configuration of the tampered virtual machine through the virtualization API interface, changes the access mode of the virtual disk from read-write mode to read-only mode to prevent further modification operations on the virtual machine disk data and prevent the tampering behavior from continuing to execute or the evidence from being destroyed; modify the network interface configuration of the virtual machine, disable the network connection or switch it to an isolated network segment, block the possible lateral movement path, perform real-time memory snapshot operation on the virtual machine, use the snapshot function of the virtualization platform to capture the current memory state of the virtual machine to obtain the memory snapshot, and the memory snapshot contains runtime process information, network connection state, loaded driver and other key forensic data; perform virtual machine disk snapshot operation to create a complete copy of all virtual disks of the virtual machine, and the disk snapshot saves the complete information of the file system state, installed software, user data, etc.

[0039] The generated memory snapshot file and disk snapshot file are stored in a pre-established independent forensic storage area, the independent forensic storage area is physically isolated from the production storage, has strict access control and data protection mechanisms, the snapshot file is subjected to hash verification and digital signature to ensure the integrity and non-tamperability of the forensic data, a forensic data packet containing the snapshot file path, file size, verification value, creation time and other information is generated, an isolation identifier is added to the configuration information of the virtual machine, and the state field in the virtual machine management database is updated to mark the virtual machine as an isolated state, obtaining an isolated state virtual machine, which will display a special isolation icon in the management interface, and the administrator can clearly identify its security state.

[0040] Then, the identification information of the host machine where the tampered virtual machine is located is obtained through the virtualization management interface, including the physical server ID, host name, IP address and other unique identifiers of the host machine. Based on the host machine identification information, the resource list of the virtualization management system is queried to obtain a list of all virtual machines currently running on the host machine, which includes virtual machine ID, name, running status, resource allocation and other basic information. These virtual machines may face the risk of horizontal attack propagation because they share the same physical host machine. Then, all virtual machine records with unauthorized tampering behavior in the virtual machine list are filtered out from the historical integrity detection report. The abnormal discovery timestamp of each tampered virtual machine is extracted, and these timestamps are arranged in chronological order. The time interval between adjacent abnormal events is calculated to form an abnormal time distribution sequence, which is used to reflect the time distribution pattern of abnormal events on the same host machine. Statistical analysis is performed on the abnormal time distribution sequence to calculate the mean, standard deviation, coefficient of variation and other statistical characteristics of the time interval. The K-means clustering algorithm is used to identify the clustering pattern in time to analyze whether there is a concentrated outbreak in a short period of time. Time aggregation indicators such as abnormal density per unit time and event concentration in a time window are calculated to obtain time aggregation characteristics, which quantify the correlation of abnormal events in the time dimension. Then, the configuration change details of different virtual machines are extracted, and the feature pattern of each change is analyzed, including change type, change location, change content, change size, etc. The similarity between different virtual machine change patterns is calculated by cosine similarity, and a feature similarity matrix is constructed based on it. The matrix elements in the similarity matrix represent the change similarity between corresponding virtual machine pairs. High similarity may indicate the use of the same attack tools or techniques. Finally, the time aggregation characteristics and the feature similarity matrix are fused to construct a comprehensive horizontal attack propagation feature vector. This vector contains both time correlation information and technical similarity information. A propagation attack judgment threshold is set, such as when the time aggregation degree exceeds the threshold and the feature similarity exceeds the threshold, it is determined that there is a propagating attack. According to the comparison between the horizontal attack propagation feature vector and the judgment threshold, a propagating attack judgment result is generated, such as "there is a risk of propagating attack" or "there is no evidence of propagating attack", which provides a basis for decision-making for subsequent security response. This comprehensive analysis method based on time and technical features can effectively identify horizontal movement attacks and timely detect and prevent further spread of attacks.

[0041] Finally, according to the propagation attack judgment result, corresponding emergency response measures are performed, if the propagation attack judgment result is "there is a propagation attack", it indicates that the attack has spread in the host range, more strict prevention and control measures need to be taken, synchronous isolation treatment is performed on all virtual machines on the host, including normally running virtual machines and virtual machines that have been detected to be abnormal, the storage access permission of all virtual machines is uniformly modified to read-only mode, the network connection of all virtual machines is disconnected, the network port of the host is set to disabled state or switched to isolation VLAN, the attack is prevented from spreading to other hosts, the running of all virtual machines is suspended or they are switched to a safe frozen state, the current state is kept unchanged for subsequent investigation; At the same time, an isolation identifier is set for the host in the virtualization management platform, to prevent new virtual machines from being scheduled to run on the host, a detailed security event report is sent to the upper-level security management center through the reporting interface of the security management system, the report content includes key information such as event occurrence time, influence range, attack characteristics, measures taken, and suggested subsequent actions, an encrypted communication protocol is used to ensure the security of the report data during transmission, a detailed abnormality treatment log is generated synchronously, recording each step of the isolation operation, execution time, operation result, related personnel and other information, the abnormality treatment log is written into the preset audit log blockchain through the block link interface, to ensure the integrity and credibility of the log data, each audit log record contains time stamp, digital signature, previous block hash and other blockchain elements, forming an unalterable audit trail.

[0042] In the embodiment of the application, the detailed implementation steps of change management and feature value closed-loop updating include: The change approval number and the approval person identity information are extracted from the legal change mark data; the validity and non-expiry of the approval sheet are verified again through the intranet approval interface, and a change legality confirmation result is obtained; If the change legality confirmation result is verified, the changed virtual machine XML configuration file is read, the feature value generation process of step S1 is performed, the node-level feature value and the global configuration feature value are recalculated based on the new XML configuration file, and a new version feature value data packet is obtained; The global configuration feature value of the last historical version is extracted from the metadata node as a parent version identifier; the parent version identifier is embedded into the new version feature value data packet to establish a version chain relationship, and a feature value data packet with a version chain is obtained; The feature value data packet with the version chain is encrypted to obtain a new encrypted feature value payload; the original encrypted feature value payload is replaced with the new encrypted feature value payload, and the check anchor point is updated synchronously; The time of the feature value updating operation, the approval number, the new and old feature value comparison data and the version chain information are recorded to the feature value change log library to form a change audit trail.

[0043] In this embodiment, first, the record marked as a legal change is further verified, the associated change approval number and the approval person identity information are extracted from the legal change marking data, which should come from the change management process in the enterprise, the approval sheet is verified again through the intranet approval interface (such as the workflow management interface), the validity (such as whether the approval number exists, whether the approval process is complete) and timeliness (such as whether the approval is within the valid period, whether it has been revoked) of the approval sheet are checked, the authenticity and the authority range of the approval person identity information are verified, it is ensured that the change operation is indeed through a proper authorization process, a change legality confirmation result is obtained, if the change legality confirmation result is verified, it is indicated that the configuration change is a legal operation through proper authorization, the baseline feature value needs to be updated to reflect the new legal configuration state, the changed virtual machine XML configuration file is re-read, the file contains the latest configuration information after the legal change, the same feature value generation process as step S1 is performed, the new XML configuration file is structurally parsed, the configuration node tree is constructed, the node level feature value of each level and the global configuration feature value of the whole are calculated, the new version feature value data packet is generated, then, the global configuration feature value of the last historical version is extracted from the metadata area of the current XML configuration file and used as a parent version identifier, the parent version identifier is embedded into the new version feature value data packet, the version chain relationship is established, the feature value data packet with the version chain is formed, the version chain mechanism enables the system to trace the configuration change history, supports configuration rollback and audit analysis, then, the same encryption algorithm and key as step S1 are used to encrypt the feature value data packet with the version chain, a new encrypted feature value payload is generated, the confidentiality and integrity of the new baseline data are ensured, the original encrypted feature value payload in the metadata area of the XML configuration file is replaced with the new encrypted feature value payload, the check anchor point is recalculated and updated, the integrity and verification ability of the newly embedded data are ensured, finally, the detailed information of the feature value update operation is recorded into the feature value change log library, the recording content includes the update time, the approval number, the operator, the comparison data of the new and old feature values, the version chain information, the change reason and the like, a complete change audit track is formed.

[0044] In the embodiment of the application, the detailed implementation steps of the configuration recovery process performed on the isolated virtual machine include: reading the XML configuration file backup corresponding to the last legal change process of the virtual machine from the baseline feature value archive; if the XML configuration file backup exists and is not damaged, the backup configuration file is used to replace the tampered XML configuration file, if the backup does not exist or is damaged, the last trusted version is traced back through the feature value version chain, and the legal configuration file is reconstructed in reverse according to the configuration change history in the version chain; The eigenvalue generation and embedding operation of step S1 is re-executed on the restored configuration file to establish a new benchmark eigenvalue, and a legal configuration state after restoration is obtained; The isolation state of the virtual machine is released, network connection and storage access permission are restored, and the cumulative abnormal counter of the event listening hook corresponding to the virtual machine is reset.

[0045] In this embodiment, first, for the isolated virtual machine, a configuration recovery process is started to restore it to a safe legal configuration state, the XML configuration file backup of the virtual machine last time confirmed by legal change is found from the benchmark eigenvalue archive, the XML configuration file backup contains complete virtual machine configuration information and corresponding eigenvalue data, the existence and integrity of the XML configuration file backup are checked, and it is verified whether the XML configuration file backup is complete and not damaged; If the XML configuration file backup exists and the integrity verification passes, the backup configuration file is directly used to replace the current tampered XML configuration file, the configuration file replacement operation is performed through the virtualization management interface, and it is ensured that the virtual machine is restored to the last legal configuration state; if the backup configuration file does not exist or the integrity verification fails, a version chain tracing recovery mechanism is started, version chain information of the virtual machine is read from the eigenvalue change log library, and the last trusted configuration version is traced back; the version chain records the eigenvalue change and configuration content of each legal change; According to the configuration change history recorded in the version chain, a reverse engineering method is used to reconstruct the legal configuration file, that is, the historical change operation is reversely applied from the current configuration state to back up to the last trusted configuration state, and the reconstructed legal configuration file is generated; Then, the recovered XML configuration file is structurally parsed using the method of step S1, a new configuration node tree is constructed, the node level feature values and the global configuration feature values of each level are calculated, a new baseline feature value data packet is generated, the new baseline feature value data packet is encrypted and embedded into the metadata area of the configuration file, the verification anchor point is updated, a new security monitoring baseline is established, the legal configuration state after recovery is obtained, and then after confirming that the configuration recovery operation is successfully completed, the isolation state of the virtual machine is gradually released, the network connection of the virtual machine is recovered first, including the virtual network interface, VLAN setting, firewall rule, etc., then the storage access permission is recovered, including virtual disk mounting, file system permission, data access control, etc., and finally the normal running state of the virtual machine is recovered, including starting services, application programs, etc., the cumulative abnormal counter in the event listening hook corresponding to the virtual machine is reset, the previous abnormal record is cleared, the monitoring frequency is restored to the normal level, and the detailed information of the recovery operation is recorded into the operation log, including the recovery time, recovery method, operator, recovery result, etc., providing a basis for subsequent security analysis and audit, and through such a systematic configuration recovery process, the tampered virtual machine can be safely and reliably restored to the legal configuration state, while maintaining the monitoring ability of the system and the effectiveness of the security baseline.

[0046] The above merely describes preferred embodiments of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art will appreciate that modifications, substitutions and changes can be made to the technical solutions described in the foregoing embodiments or some of the technical features thereof, without departing from the spirit and principles of the present application. Any modifications, substitutions, changes and the like made within the spirit and principles of the present application shall fall within the scope of the present application.

[0047] The formulas in the present specification are dimensionless values calculated, the formulas are obtained by collecting a large amount of data to simulate a formula of the most recent real situation, and the preset parameters and threshold values in the formulas are set by those skilled in the art according to actual conditions.

[0048] Although the embodiments of the present application have been shown and described, those skilled in the art can understand that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the claims and their equivalents.< / metadata>

Claims

1. A method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment, characterized in that, Comprise: Step S1: Obtain the XML configuration file of the virtual machine, and perform structured parsing and node classification on the XML configuration file to obtain a hierarchical node configuration set; Generate a benchmark characteristic value data packet based on the hierarchical node configuration set, encrypt the benchmark characteristic value data packet, and embed it in a pre-written custom namespace to obtain a benchmark characteristic value archive; Step S2: Create an event listener hook for each virtual machine in the confidential intranet and trigger integrity detection; After the integrity detection is completed, obtain the real-time characteristic value data packet corresponding to the virtual machine, compare the real-time characteristic value data packet with the benchmark characteristic value data packet in multiple levels, and perform risk assessment based on the comparison result to obtain an integrity detection report; Step S3: Based on the integrity detection report, perform risk level screening and change mode matching, and determine whether the change process of the corresponding XML configuration file is a legal change based on the change mode matching result. If it is not a legal change, trigger an alarm notification and virtual machine isolation; If it is a legal change, obtain a legal change marker data; Step S4: Based on the legal change marker data, perform change management and characteristic value closed loop update on the legal changed virtual machine; And perform configuration recovery process on the isolated virtual machine.

2. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 1, characterized in that, The acquisition process of the benchmark characteristic value archive comprises: Obtain the XML configuration file of the virtual machine based on the virtualization API interface; and perform structured parsing on the collected XML configuration file, and construct the configuration content in the XML configuration file into a configuration node tree according to the structured parsing result; According to the security sensitivity of each node in the configuration node tree, the node classification mark is obtained, and the hierarchical configuration node set is obtained; and the key configuration elements corresponding to each level in the hierarchical configuration node set are extracted; Obtain the position identification code corresponding to the key configuration elements, and perform hierarchical hash aggregation operation from the leaf node to the root node of the configuration node tree based on the preset hash algorithm, to obtain the benchmark characteristic value data packet; Perform data encryption processing on the obtained benchmark characteristic value data packet to obtain an encrypted characteristic load, embed the encrypted characteristic load in a pre-written custom namespace, and insert a verification anchor point; Perform syntax validity verification and structure integrity detection on the embedded XML configuration file to obtain the benchmark characteristic value archive.

3. The method of claim 2, wherein the method further comprises: The acquisition process of the benchmark characteristic value data packet comprises: Apply a preset hash algorithm to each key configuration element to calculate a feature digest, to obtain a node-level characteristic value; and generate a unique identifier according to the path information of the key configuration element in the configuration node tree; Splice and combine the node-level characteristic value and the position identification code according to a predetermined format to obtain a node characteristic identifier with position information; Perform depth-first traversal on the configuration node tree to identify all leaf nodes to obtain a leaf node set; and extract the node characteristic identifier from the leaf node set as the zeroth layer hash input; According to the leaf node set, arrange the node characteristic identifiers of all child nodes under the same parent node in order, splice them in a preset order, and calculate the parent node hash value to obtain the upper level node hash; The parent node hash is taken as a new input, and the parent node hash calculation process is repeatedly performed, and is aggregated layer by layer upwards until the root node; and a final hash operation result of the root node is obtained as a global configuration feature value; The global configuration feature value, the node level feature value of each layer, the current timestamp and the unique identifier are structured and packaged to obtain a benchmark feature value data packet.

4. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 2, characterized in that, The process of obtaining the integrity detection report includes: Group management is performed on the virtual machines in the secret internal network to obtain a monitoring priority queue, and an independent event listening hook is created for each virtual machine in the monitoring priority queue; The current XML configuration file and the metadata area content in the corresponding virtual machine are read according to the event listening hook; The check anchor point in the metadata area is verified for integrity; if the verification fails, it is marked as a high-risk exception and the subsequent detection process is interrupted; if the verification passes, the encrypted feature value payload is extracted from the metadata area and decrypted to restore the benchmark feature value data packet; The node level feature value of the configuration node tree and the global configuration feature value are calculated based on the current XML configuration file in real time to obtain a real-time feature value data packet; The real-time feature value data packet and the benchmark feature value data packet are compared in multiple levels, and the changed configuration node is located according to the comparison result to obtain a configuration difference node list; The nodes in the configuration difference node list are compared for differences in front and back texts to obtain a configuration change detail; and a risk score of the change item is obtained according to the configuration change detail to obtain a comprehensive risk score; An integrity detection report is generated according to the comprehensive risk score.

5. The method for effectively preventing the malicious tampering of the virtual machine in the secret network environment according to claim 4, characterized in that, The process of obtaining the configuration difference node list includes: The global configuration feature values are extracted from the benchmark feature value data packet and the real-time feature value data packet respectively, and are compared at the byte level to obtain a global consistency determination result; If the global consistency determination result is consistent, a non-tampering identifier is generated and the comparison process is ended; if the global consistency determination result is inconsistent, the node level feature values of each layer are extracted from the benchmark feature value data packet and the real-time feature value data packet; The node level feature values of each node are compared layer by layer from the root node to the leaf node according to the layer order of the configuration node tree; the node path and the layer position information corresponding to the feature value inconsistent node are identified and recorded, and are integrated to obtain a configuration difference node list.

6. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 4, characterized in that, The process of determining whether the change process of the corresponding XML configuration file is a legal change includes: The abnormal detection records are obtained by screening according to the risk level based on the obtained integrity detection report; the configuration change detail is read from the abnormal detection record set; and the feature mode of the configuration change detail is matched with the pre-stored legal change white list; If the matching is successful, the corresponding abnormal detection record is marked as a legal change to obtain a legal change marker data; if the matching fails, it is determined as an unauthorized tampering behavior to obtain an unauthorized tampering record; A differentiated abnormal handling strategy is generated according to the risk level of the unauthorized tampering record, including generating an alarm notification for the medium risk level; and triggering a virtual machine isolation operation for the high risk level while sending the alarm notification.

7. The method of claim 6, wherein the method is effective to prevent the virtual machine from being maliciously tampered with in the secret network environment, characterized in that, The process of triggering the virtual machine isolation operation includes: modify the storage access permission of the tampered virtual machine to read-only mode, perform memory snapshot and disk snapshot operations on the virtual machine, store the snapshot files to an independent forensic storage area, and obtain a forensic data package; and add an isolation identifier to the tampered virtual machine to obtain an isolated state virtual machine; detect configuration tampering of other virtual machines on the same host, and perform time correlation and feature similarity analysis based thereon to obtain a horizontal attack propagation feature; determine whether there is a propagating attack based on the horizontal attack propagation feature to obtain a propagating attack determination result; if the propagating attack determination result is yes, perform synchronous isolation disposal on all virtual machines on the host, and report a security event to a higher-level security management center; synchronously generate an abnormal disposal log and write it into a preset audit log blockchain.

8. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 7, characterized in that, The process of obtaining the propagating attack determination result includes: obtaining the identifier information of the host where the tampered virtual machine is located, and obtaining a list of all virtual machines running on the corresponding host based thereon; obtain the abnormal time interval between adjacent virtual machines with unauthorized tampering behavior in the corresponding virtual machine list based on the integrity detection report to obtain an abnormal time distribution sequence; and perform time aggregation analysis to obtain a time aggregation feature; calculate the similarity between feature patterns in different virtual machine configuration change details to obtain a feature similarity matrix; integrate the time aggregation feature and the feature similarity matrix to generate a horizontal attack propagation feature and a propagating attack determination result.

9. The method of claim 6, wherein the method further comprises: determining whether the virtual machine is running on a trusted platform; and if the virtual machine is not running on a trusted platform, then preventing the virtual machine from running. The process of performing change management and feature value closed-loop update includes: extract the change approval number and the approval person's identity information from the legal change mark data; perform secondary verification of the approval single validity and non-expiration through the intranet approval interface to obtain a change legality confirmation result; if the change legality confirmation result is verified, read the changed virtual machine XML configuration file, perform the feature value generation process of step S1, and recalculate the node-level feature value and the global configuration feature value based on the new XML configuration file to obtain a new version feature value data package; extract the global configuration feature value of the last historical version from the configuration file metadata as a parent version identifier; embed the parent version identifier into the new version feature value data package to establish a version chain relationship to obtain a feature value data package with a version chain; encrypt the feature value data package with a version chain to obtain a new encrypted feature value payload; replace the original loading feature value payload with the new encrypted feature value payload, and update the verification anchor point synchronously; record the time, approval number, new and old feature value comparison data, and version chain information of the feature value update operation to the feature value generation log library to form a change audit track.

10. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 6, characterized in that, The process of performing configuration recovery process on the isolated virtual machine includes: read the XML configuration file backup corresponding to the last legal change process of the virtual machine from the baseline feature value archive; if the XML configuration file backup exists and is not damaged, replace the tampered XML configuration file with the backup configuration file; if the backup does not exist or is damaged, trace back to the last trusted version through the feature value version chain, and reversely reconstruct the legal configuration file according to the configuration change history in the version chain; The eigenvalue generation and embedding operation of step S1 is re-executed on the restored configuration file, to obtain a restored legal configuration state; The isolation state of the virtual machine is released, the network connection and the storage access permission are restored, and the event listening hook corresponding to the virtual machine is reset.

Images