A method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment

Abstract

The application belongs to the technical field of network security, and discloses a method for effectively preventing malicious tampering of a virtual machine in a secret internal network environment, which comprises the following steps: obtaining an XML configuration file through a virtualization API interface, structurally analyzing the XML configuration file, and performing hash aggregation calculation to obtain a benchmark characteristic value data packet and embed a custom namespace; constructing an event listening hook, performing integrity detection on the XML configuration file of the virtual machine based on the event listening hook, obtaining a real-time benchmark characteristic value data packet, and performing multi-level comparison with the benchmark characteristic value data packet, and performing change legality verification according to the comparison result, and triggering automatic isolation and alarm response; and performing legal change management and characteristic value closed-loop updating, and a configuration recovery process of the isolated virtual machine; the application realizes real-time, intelligentization and automation of secret internal network virtual machine security protection, and significantly improves the accuracy and response efficiency of malicious tampering detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, more particularly, the present application relates to a method for effectively preventing malicious tampering of virtual machines in a secret internal network environment. BACKGROUND

[0002] With the large-scale deployment of virtualization platforms in the secret internal network environment, virtual machines, as the core components of modern information system infrastructure, carry more and more critical business applications and sensitive data processing tasks. Accurate monitoring and effective protection of virtual machine configuration integrity is an important foundation for ensuring the security of the secret internal network. However, the traditional virtual machine security protection mainly relies on external security products and manual inspection, which has the limitations of low detection accuracy, delayed response, complex management, etc., and is difficult to meet the strict requirements of real-time and accuracy of security protection in modern secret internal network environment.

[0003] The traditional virtual machine configuration integrity protection mainly has the following problems:

[0004] Firstly, the traditional virtual machine monitoring method lacks standardized feature extraction and benchmark establishment process; the configuration change record is incomplete in the monitoring process, the detection granularity is rough, which leads to the lack of accuracy of the obtained configuration state information, and it is difficult to be used for subsequent accurate tampering detection and risk assessment.

[0005] Secondly, the existing virtual machine security detection technology mainly adopts simple file integrity checking method, which lacks multi-dimensional and multi-level feature analysis capability, which leads to the detection result obtained cannot fully reflect the key information such as the structure feature, content feature and correlation feature of the virtual machine configuration, especially in the subtle difference identification under the complex configuration change scene.

[0006] Thirdly, the traditional virtual machine security management mainly relies on manual inspection and experience judgment, lacks objective quantitative abnormality identification and automatic disposal method; with the expansion of virtual machine scale and the complication of security threat, pure manual monitoring has been difficult to meet the large-scale and real-time virtual machine security protection demand.

[0007] Fourthly, the traditional virtual machine configuration management method lacks objective verification mechanism for change legality and system integrity; the configuration change lacks credibility evaluation and version tracing capability, which is easy to cause false alarm and missed detection, and affects the safe and stable operation of the whole secret internal network environment.

[0008] In view of this, the present application provides a method for effectively preventing malicious tampering of virtual machines in a secret internal network environment to solve the above problems. SUMMARY

[0009] In order to overcome the above-mentioned defects of the prior art, in order to achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0010] A method for effectively preventing malicious tampering of virtual machines in a secret internal network environment, comprising:

[0011] Step S1: Obtain the XML configuration file of the virtual machine, and perform structured parsing and node classification on the XML configuration file to obtain a hierarchical node configuration set; generate a reference feature value data packet based on the hierarchical node configuration set, encrypt the reference feature value data packet, and embed it in a pre-written custom namespace to obtain a reference feature value archive;

[0012] Step S2: Create an event listener hook for each virtual machine in the secret internal network and trigger integrity detection; after integrity detection is completed, obtain the real-time feature value data packet corresponding to the virtual machine, compare the real-time feature value data packet with the reference feature value data packet in multiple levels, and perform risk assessment based on the comparison result to obtain an integrity detection report;

[0013] Step S3: Perform risk level screening and change mode matching based on the integrity detection report, and determine whether the change process of the corresponding XML configuration file is a legal change based on the change mode matching result; if it is not a legal change, trigger an alarm notification and virtual machine isolation; if it is a legal change, obtain a legal change marker data;

[0014] Step S4: Perform change management and feature value closed loop update on the legal changed virtual machine based on the legal change marker data; and perform configuration recovery process on the isolated virtual machine.

[0015] Further, the reference feature value archive acquisition process comprises:

[0016] Obtain the XML configuration file of the virtual machine based on the virtualization API interface; and perform structured parsing on the collected XML configuration file, and construct the configuration content in the XML configuration file into a configuration node tree according to the node level relationship based on the structured parsing result;

[0017] According to the security sensitivity of each node in the configuration node tree, the nodes are classified and marked to obtain a hierarchical configuration node set; and the key configuration elements corresponding to each level in the hierarchical configuration node set are extracted;

[0018] Obtain the position identification code corresponding to the key configuration elements, and perform layer-by-layer hash aggregation operation from the leaf node to the root node of the configuration node tree based on the preset hash algorithm to obtain the reference feature value data packet;

[0019] Perform data encryption processing on the obtained reference feature value data packet to obtain an encrypted feature load, embed the encrypted feature load in a pre-written custom namespace, and insert a verification anchor point;

[0020] The embedded completed XML configuration file is subjected to syntax validity verification and structural integrity detection to obtain a benchmark characteristic value archive.

[0021] Further, the benchmark characteristic value data packet acquisition process comprises:

[0022] A preset hash algorithm is applied to each key configuration element to calculate a characteristic digest, thereby obtaining a node-level characteristic value; and a unique identifier is generated according to the path information of the key configuration element in the configuration node tree;

[0023] The node-level characteristic value and the location identifier code are spliced and combined in a predetermined format to obtain a node characteristic identifier with location information;

[0024] The configuration node tree is subjected to depth-first traversal to identify all leaf nodes, thereby obtaining a leaf node set; and the node characteristic identifier is extracted from the leaf node set as the zeroth layer hash input;

[0025] The node characteristic identifiers of all child nodes under the same parent node in the leaf node set are sequentially arranged, and the parent node hash value is calculated after splicing in a predetermined order, thereby obtaining the upper-level node hash;

[0026] The upper-level node hash is taken as a new input, and the parent node hash calculation process is repeated to aggregate layer by layer upwards until the root node; the final hash operation result of the root node is obtained as the global configuration characteristic value;

[0027] The global configuration characteristic value, the node-level characteristic values of each layer, the current timestamp and the unique identifier are structured and encapsulated to obtain the benchmark characteristic value data packet.

[0028] Further, the process of obtaining the integrity detection report comprises:

[0029] The virtual machines in the secret internal network are subjected to grouping management to obtain a monitoring priority queue, and independent event listening hooks are created for each virtual machine in the monitoring priority queue;

[0030] The current XML configuration file and the metadata area content in the corresponding virtual machine are read according to the event listening hook;

[0031] The check anchor point in the metadata area is subjected to integrity verification; if the verification fails, it is marked as a high-risk exception and the subsequent detection process is interrupted; if the verification passes, the encrypted characteristic value load is extracted from the metadata area and subjected to decryption operation to restore the benchmark characteristic value data packet;

[0032] The node-level characteristic value and the global configuration characteristic value of the configuration node tree are calculated in real time based on the current XML configuration file to obtain a real-time characteristic value data packet;

[0033] The real-time feature value data packet and the reference feature value data packet are compared in multiple levels, and a configuration difference node list is obtained by locating the changed configuration nodes according to the comparison result;

[0034] The nodes in the configuration difference node list are compared in front and back difference text, and a configuration change detail is obtained; and a risk score of a change item is obtained according to the configuration change detail, and a comprehensive risk score is obtained;

[0035] An integrity detection report is generated according to the comprehensive risk score.

[0036] Further, the process of obtaining the configuration difference node list comprises:

[0037] Global configuration feature values are extracted from the reference feature value data packet and the real-time feature value data packet, and byte-level accurate comparison is performed based thereon to obtain a global consistency determination result;

[0038] If the global consistency determination result is consistent, a tamper-free identification is generated and the comparison process is ended; if the global consistency determination result is inconsistent, node-level feature values of each level are extracted from the reference feature value data packet and the real-time feature value data packet;

[0039] The node-level feature values of each node are compared layer by layer from the root node to the leaf node according to the level order of the configuration node tree; the node path and level position information corresponding to the inconsistent feature value nodes are identified and recorded, and are integrated to obtain the configuration difference node list.

[0040] Further, the process of determining whether the change process of the corresponding XML configuration file is a legal change process comprises:

[0041] Based on the obtained integrity detection report, abnormal detection records are obtained by filtering according to risk levels; configuration change details are read from the abnormal detection record set; and the feature mode of the configuration change details is matched with a pre-stored legal change white list;

[0042] If the matching is successful, the corresponding abnormal detection record is marked as a legal change to obtain a legal change marking data; if the matching fails, it is determined as an unauthorized tampering behavior to obtain an unauthorized tampering record;

[0043] A differentiated abnormal handling strategy is generated according to the risk level of the unauthorized tampering record, including generating an alarm notification for a medium-risk level; and triggering a virtual machine isolation operation at the same time of sending the alarm notification for a high-risk level.

[0044] Further, the process of triggering the virtual machine isolation operation comprises:

[0045] modify the storage access permission of the tampered virtual machine to read-only mode, perform memory snapshot and disk snapshot operations on the virtual machine, store the snapshot files to an independent forensic storage area, and obtain a forensic data package; and add an isolation identifier to the tampered virtual machine to obtain an isolated state virtual machine;

[0046] detect configuration tampering of other virtual machines on the same host, and perform time correlation and feature similarity analysis based thereon to obtain a horizontal attack propagation feature; determine whether there is a propagating attack based on the horizontal attack propagation feature to obtain a propagating attack determination result;

[0047] If the propagating attack determination result is yes, perform synchronous isolation disposal on all virtual machines on the host, and report a security event to a superior security management center; synchronously generate an abnormal disposal log and write it into a preset audit log blockchain.

[0048] Further, the process of obtaining the propagating attack determination result includes:

[0049] Obtain the identification information of the host where the tampered virtual machine is located, and obtain a list of all virtual machines running on the corresponding host based thereon;

[0050] Obtain the abnormal time interval between adjacent virtual machines with unauthorized tampering behavior in the corresponding virtual machine list based on the integrity detection report, obtain an abnormal time distribution sequence; and perform time aggregation analysis to obtain a time aggregation feature; calculate the similarity between feature patterns in different virtual machine configuration change details to obtain a feature similarity matrix; integrate the time aggregation feature and the feature similarity matrix to generate a horizontal attack propagation feature and a propagating attack determination result.

[0051] Further, the process of performing change management and feature value closed-loop update includes:

[0052] Extract the change approval number and the approval person's identity information from the legal change mark data; perform secondary verification of the approval single validity and non-expiration through an intranet approval interface to obtain a change legality confirmation result;

[0053] If the change legality confirmation result is verified, read the changed virtual machine XML configuration file, perform the feature value generation process of step S1, and recalculate the node-level feature value and the global configuration feature value based on the new XML configuration file to obtain a new version feature value data package;

[0054] Extract the global configuration feature value of the previous historical version from the configuration file metadata as a parent version identifier; embed the parent version identifier into the new version feature value data package to establish a version chain relationship, and obtain a feature value data package with a version chain;

[0055] The eigenvalue data packet with the version chain is encrypted to obtain a new encrypted eigenvalue load; the original eigenvalue load is replaced by the new encrypted eigenvalue load, and a check anchor point is synchronously updated;

[0056] The time of the eigenvalue updating operation, an approval number, new and old eigenvalue comparison data and version chain information are recorded to an eigenvalue generation log library to form a change audit track;

[0057] Further, the process of performing the configuration recovery procedure on the isolated virtual machine comprises:

[0058] An XML configuration file backup corresponding to a last legal change process of the virtual machine is read from the benchmark eigenvalue archive;

[0059] If the XML configuration file backup exists and is not damaged, the backup configuration file is used to replace the tampered XML configuration file; if the backup does not exist or is damaged, the last trusted version is traced back through the eigenvalue version chain, and a legal configuration file is reversely reconstructed according to the configuration change history in the version chain;

[0060] The eigenvalue generation and embedding operation of step S1 is performed on the recovered configuration file again to obtain a recovered legal configuration state;

[0061] The isolation state of the virtual machine is released, network connection and storage access permission are restored, and an event listening hook corresponding to the virtual machine is reset.

[0062] The technical effects and advantages of the method for effectively preventing the virtual machine from being maliciously tampered with in the confidential intranet environment are as follows:

[0063] Through the benchmark establishment link, the standardized XML configuration file parsing process and the multi-level feature extraction mechanism overcome the drawbacks of the lack of accuracy of the traditional monitoring, the structured node tree construction adapts to different configuration scenarios, the hash aggregation and the comprehensive eigenvalue encapsulation ensure the accuracy and comprehensiveness of the benchmark data, and provide reliable basis for subsequent accurate detection; the multi-dimensional and multi-level feature analysis capability makes up for the deficiency of the traditional simple file checking, and can comprehensively reflect the key information such as the structural features, content features and association features of the configuration and the difference performance in different change scenarios;

[0064] In the monitoring and processing link, the real-time detection and multi-level comparison based on the event listening hook change the traditional passive protection mode depending on manual inspection, high-precision tampering identification is realized through objective and quantitative means, and the real-time security protection needs of a large-scale virtual machine environment are met. Meanwhile, the legal change white list matching mechanism, the propagation attack identification model and the risk level evaluation system not only help to deeply analyze the security situation of the virtual machine, but also objectively verify the change behavior, avoid false positives and missed detection, and improve the accuracy and reliability of the security protection.

[0065] In addition, the finally established closed-loop protection system realizes full-process automatic disposal from detection, alarm to automatic isolation and recovery, the eigenvalue embedded storage and version chain management mechanism facilitate tracing, auditing and management, and effectively promotes the intelligent development of the security protection of the secret internal network virtualization, so that the virtualization technology better serves the fields of secret business application and the like under the premise of security and controllability. BRIEF DESCRIPTION OF DRAWINGS

[0066] Figure 1 A method for effectively preventing a virtual machine from being maliciously tampered with in a secret internal network environment. DETAILED DESCRIPTION

[0067] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0068] Embodiment 1, please refer to Figure 1 The method for effectively preventing a virtual machine from being maliciously tampered with in a secret internal network environment described in the present embodiment comprises the following steps:

[0069] Step S1: An XML configuration file of a virtual machine is acquired, and the XML configuration file is subjected to structured parsing and node classification to obtain a hierarchical node configuration set; a baseline eigenvalue data packet is generated based on the hierarchical node configuration set, the baseline eigenvalue data packet is subjected to encryption processing and embedded into a pre-written custom namespace to obtain a baseline eigenvalue archive;

[0070] Step S2: An event listening hook is created for each virtual machine in the secret internal network and integrity detection is triggered; after the integrity detection is completed, a real-time eigenvalue data packet corresponding to the virtual machine is acquired, the real-time eigenvalue data packet is compared with the baseline eigenvalue data packet in multiple levels, and risk assessment is performed based on the comparison result to obtain an integrity detection report;

[0071] Step S3: Risk level screening and change mode matching are performed based on the integrity detection report, and whether the change process of the corresponding XML configuration file is a legal change is determined based on the change mode matching result; if it is not a legal change, an alarm notification and virtual machine isolation are triggered; if it is a legal change, legal change marker data is acquired;

[0072] Step S4: The virtual machine subjected to the legal change is subjected to change management and eigenvalue closed-loop update based on the legal change marker data; and a configuration recovery process is performed on the isolated virtual machine.

[0073] In the embodiment of the present application, the detailed implementation process of step S1 includes:

[0074] Based on the virtualization API interface, an XML configuration file of the virtual machine is acquired; and the acquired XML configuration file is structurally parsed, and based on the structural parsing result, the configuration content in the XML configuration file is constructed into a configuration node tree according to the node hierarchical relationship;

[0075] According to the security sensitivity of each node in the configuration node tree, the nodes are classified and marked to obtain a hierarchical configuration node set; and the key configuration elements corresponding to each hierarchical level in the hierarchical configuration node set are extracted;

[0076] The position identification code corresponding to the key configuration elements is acquired, and based on a preset hash algorithm, a layer-by-layer hash aggregation operation is performed from the leaf node to the root node of the configuration node tree to obtain a reference feature value data packet;

[0077] The obtained reference feature value data packet is subjected to data encryption processing to obtain an encrypted feature load, the encrypted feature load is embedded in a pre-written custom namespace, and a verification anchor point is inserted;

[0078] The embedded XML configuration file is subjected to syntax validity verification and structural integrity detection to obtain a reference feature value archive.

[0079] Specifically, a virtualization API interface is deployed in a confidential intranet, and based on the deployed virtual machine API interface, an XML configuration file in a target virtual machine is acquired, the XML configuration file including key information such as hardware configuration, network setting, and storage mapping of the corresponding virtual machine; the acquired XML configuration file is subjected to data preprocessing, the data preprocessing referring to creating a deep copy of the XML configuration file and removing a metadata node and all child nodes thereof from the deep copy to obtain a configuration main body to be processed; wherein the metadata node refers to a metadata node in the virtual machine XML, and the metadata node is a virtual machine XML metadata node. <metadata>Region, allowing users or platforms to write custom metadata tags; XML configuration files are files generated by virtualization platforms to describe virtual machine resources (CPU, memory, disk, network, etc.), usually in XML format.

[0080] Further, the acquired configuration file to be processed is parsed using an XML parser (such as libxml2, JAXP) to perform lexical analysis and syntax analysis, identify and extract document structure content such as tags, attributes, and text content in the XML configuration file, and construct a tree-shaped data structure according to parent-child relationships and sibling relationships to form a configuration node tree reflecting the configuration hierarchy; each node in the configuration node tree contains signature, attribute set, text value, path information, and other data; then each node in the configuration node tree is evaluated for security sensitivity, and according to known security policies and expert knowledge, the nodes are divided into core security nodes (such as CPU, memory, network interface configuration), important function nodes (such as storage, device configuration), and general information nodes (such as description information, annotations, etc.), and different security levels are assigned to nodes of different sensitivity, such as high sensitivity, medium sensitivity, and low sensitivity, to form a hierarchical configuration node set.

[0081] From the hierarchical configuration node set, key configuration elements at each level are extracted, such as CPU core number, memory size, disk path, network MAC address, etc. These elements are the core components of virtual machine configuration, and then a unique location identifier code is generated for each key configuration element, which includes absolute path information and relative position information of the node in the configuration node tree; a preset hash algorithm (which can be MD5, SHA256, or SM3) is used to calculate the feature value of the key configuration element, and a bottom-up calculation strategy is used, starting from the leaf node of the configuration node tree and performing hash aggregation operations layer by layer to the root node, the hash value of each layer is obtained by concatenating the hash values of all child nodes and then hashing again, and finally a reference feature value data packet containing feature values at each level and a global feature value is obtained, the reference feature value data packet is encrypted using symmetric encryption or asymmetric encryption to generate an encrypted feature load, ensuring the confidentiality and integrity of the feature value data, and a custom namespace is written in the metadata node in the XML configuration file to store digested (indicating that the resource has completed digest processing), digesting (indicating that the resource is in the process of digest processing), timestamp, and tag information, etc.

[0082] The encryption feature load is embedded into the custom namespace as a special attribute, a check anchor point such as a digital signature or a check code is inserted for verifying the integrity of the embedded data, finally, the embedded XML configuration file is subjected to syntax validity verification to ensure that the embedding operation does not destroy the standard format of the XML file, structural integrity detection is performed to verify the hierarchical relationship and reference integrity of the configuration node tree, a reference feature value archive is formed, which not only contains original configuration information, but also contains feature values for tamper detection, and a trusted baseline is provided for subsequent integrity monitoring; wherein, in the metadata node, in addition to the reference feature value data packet, basic information such as virtual machine name, creation time and modification time is additionally recorded, and compressed virtual machine configuration information is saved.

[0083] In the embodiment of the application, the acquisition process of the reference feature value data packet comprises:

[0084] A preset hash algorithm is applied to each key configuration element to calculate a feature digest, thereby obtaining a node-level feature value; and a unique identifier is generated according to the path information of the key configuration element in the configuration node tree;

[0085] The node-level feature value and the position identification code are spliced and combined in a predetermined format to obtain a node feature identifier with position information;

[0086] The configuration node tree is subjected to depth-first traversal to identify all leaf nodes, thereby obtaining a leaf node set; and the node feature identifier is extracted from the leaf node set as the zeroth layer hash input;

[0087] The node feature identifiers of all child nodes under the same parent node in the leaf node set are sequentially arranged according to the leaf node set, and the parent node hash value is calculated after splicing in a predetermined order, thereby obtaining the last level node hash;

[0088] The last level node hash is taken as a new input, and the parent node hash calculation process is repeatedly executed, and the aggregation is performed layer by layer upwards until the root node; the final hash operation result of the root node is obtained as the global configuration feature value.

[0089] The global configuration feature value, the node-level feature value of each layer, the current timestamp and the unique identifier are structured and packaged to obtain the reference feature value data packet.

[0090] First, for each key configuration element extracted from the hierarchical configuration node set, a preset hash algorithm is used to calculate a feature digest of its content, obtaining a corresponding node-level feature value; the node-level feature value and the location identifier code are spliced and combined according to a predetermined format to form a node feature identifier, which contains not only content information but also location information, providing a basis for subsequent accurate comparison, then performing a depth-first traversal (DFS) on the entire configuration node tree, traversing all nodes in the order of visiting child nodes first and then parent nodes, identifying all leaf nodes without child nodes, collecting these leaf nodes into a leaf node set, extracting the node feature identifier of each leaf node from the leaf node set, and taking the corresponding node feature identifier as the hash input of the zeroth layer (the bottom layer), providing the starting data for the bottom-up hash aggregation process, then performing a hash aggregation operation on the configuration node tree layer by layer upwards, identifying all child nodes under the same parent node, arranging the node feature identifiers of these child nodes in a predetermined order (such as alphabetical order, appearance order, etc.), ensuring that the same configuration produces the same hash result at different times, splicing the arranged child node feature identifiers into a string, and applying a hash algorithm to the spliced result to calculate the hash value of the parent node, i.e. the hash value of the previous layer node, taking the hash value of the previous layer node as the new input, repeating the same parent node hash calculation process, and aggregating layer by layer upwards until reaching the root node of the configuration node tree, obtaining the final hash operation result of the root node, which represents the global feature of the entire virtual machine configuration, referred to as the global configuration feature value, finally collecting the current timestamp information, organizing and packaging the global configuration feature value, the node-level feature values of each layer, the current timestamp, the virtual machine UUID, and the platform operation identifier according to a predetermined data structure to form a structured reference feature value data packet, which contains the complete feature information of the virtual machine configuration, including both global overall features and local detailed features, providing a comprehensive comparison reference for subsequent tamper detection; the platform operation identifier is used to mark whether the feature value is generated by a legal operation of the virtualization platform, including an operation type code and an operation session ID.

[0091] In the embodiment of the present application, the detailed implementation steps of step S2 include:

[0092] The virtual machines in the secret internal network are grouped and managed to obtain a monitoring priority queue, and independent event listening hooks are created for each virtual machine in the monitoring priority queue;

[0093] The current XML configuration file and the metadata area content in the corresponding virtual machine are read according to the event listening hook;

[0094] The integrity of the check anchor point in the metadata area is verified; if the verification fails, it is marked as a high-risk exception and the subsequent detection process is interrupted; if the verification is passed, the encrypted feature value load is extracted from the metadata area and the decryption operation is performed, and the reference feature value data packet is restored;

[0095] The node-level feature value and the global configuration feature value of the configuration node tree are calculated based on the current XML configuration file in real time to obtain a real-time feature value data packet;

[0096] The real-time feature value data packet is compared with the reference feature value data packet in multiple levels, and the changed configuration node is located according to the comparison result to obtain a configuration difference node list;

[0097] The nodes in the configuration difference node list are compared with the front and rear difference texts to obtain a configuration change detail; and the risk score of the change item is obtained according to the configuration change detail to obtain a comprehensive risk score;

[0098] An integrity detection report is generated according to the comprehensive risk score.

[0099] In this embodiment, first, an event listening hook is registered in the virtual machine management layer of the virtualization platform, and the event listening hook covers the key life cycle operation of the virtual machine, including the pre-startup verification hook, the pre-shutdown verification hook, the pre-restart verification hook, the pre-migration verification hook, the post-configuration modification verification hook and the timing running state verification hook; when any event listening hook is triggered or actively triggered, the virtual machine identifier and the operation type of the triggered hook are obtained, and the current XML configuration file of the virtual machine is read based on the virtualization API interface; first, the metadata node of the current XML configuration file is verified for integrity, the check anchor point in the metadata node attribute is read, and the integrity of the check anchor point is verified to determine whether it is tampered with;

[0100] If the metadata integrity verification fails, it is determined that the metadata layer is tampered with, a high-risk exception event record is immediately generated, the record includes the virtual machine identifier, the detection time, the exception type is that the check anchor point is tampered with, the risk level is high-risk, and the recommended disposal measures are immediate isolation and manual review; at the same time, the record is recorded and written into the security event database, real-time alarm notification is sent to the security administrator through the alarm channel, and the subsequent detection process of the virtual machine is interrupted, and the alarm mode includes multiple forms such as email, short message, management console pop-up window and the like;

[0101] If the verification is successful, the embedded encrypted feature value load is extracted from the metadata node, the decryption key is used for decryption operation, and the original reference feature value data packet is restored.

[0102] Then the generation process of the above-mentioned benchmark characteristic value data packet is re-executed for the current XML configuration file, the current configuration node tree is constructed, the node level characteristic value of each node and the global configuration characteristic value of the whole are calculated, the real-time characteristic value data packet is generated, the real-time characteristic value data packet is compared with the benchmark characteristic value data packet in multiple levels, the global configuration characteristic value is compared first, whether the overall configuration changes is judged, if the global characteristic value is consistent, the configuration is not changed, if it is inconsistent, the node level characteristic value of each level is compared layer by layer, the changed configuration node is accurately positioned, the changed node information (including node path, level position, change type, etc.) is summarized to form a configuration difference node list, the configuration difference node list is a list, each entry in the list contains the complete path of the difference node, node type, sensitivity level, benchmark characteristic value, real-time node characteristic value and other information;

[0103] Then the context content of each node in the configuration difference node list is compared, the specific change content is obtained, the extracted change content is analyzed, the analysis dimensions include: security influence analysis, whether the change affects the access control, network isolation, data protection and other security mechanisms of the virtual machine; function influence analysis, whether the change affects the normal operation of the virtual machine, resource availability and business continuity; compliance influence analysis, whether the change violates the security policy, configuration baseline standard or compliance requirements; the change content and the influence analysis result are integrated to form a configuration change detail, each change record in the configuration change detail contains change type (add, modify, delete), change path, pre-change value, post-change value and node belonging to configuration category and other fields.

[0104] For each change record in the configuration change details, the system queries the preset configuration item security level mapping table according to the configuration category to which the node belongs. The corresponding mapping table defines the security importance classification of various configuration items of the virtual machine. Configuration items are divided into three levels: critical security configuration, important business configuration, and general operation configuration. Critical security configuration includes boot path, disk device mapping, network bridging configuration, and privileged device passthrough. Important business configuration includes the number of CPU cores, memory capacity, network card type, and disk controller. General operation configuration includes display adapter, USB controller, and power management parameters. A risk weight coefficient is set for each security level. For example, the weight coefficient for critical security configuration is 10, the weight coefficient for important business configuration is 5, and the weight coefficient for general operation configuration is 1. The risk score for configuration differences is calculated by iterating through the detailed list of configuration differences and accumulating the security level weight coefficients for each change record. If multiple modifications occur to the same node, the counts are added together to obtain a comprehensive risk score. Finally, an integrity detection report is generated based on the comprehensive risk score. The integrity detection report adopts a structured document format and includes a trigger hook type, a detection summary section listing the virtual machine identifier, detection time, risk level, and comprehensive score; a change details section listing all configuration difference nodes and change details; and a recommended action section providing corresponding handling suggestions based on the risk level. After the report is generated, it is stored in the detection history database, and whether to trigger an alarm notification depends on the risk level. The report includes information such as detection time, virtual machine identifier, change summary, risk score, and recommended handling measures.

[0105] In this embodiment of the invention, the process of obtaining the configuration difference node list includes:

[0106] Global configuration feature values ​​are extracted from the baseline feature value data packet and the real-time feature value data packet, and byte-level precise comparison is performed based on them to obtain the global consistency judgment result;

[0107] If the global consistency determination result is consistent, an untampered identifier is generated and the comparison process ends; if the global consistency determination result is inconsistent, node-level feature values ​​of each level are extracted from the baseline feature value data packet and the real-time feature value data packet.

[0108] Following the hierarchical order of the configuration node tree, the node-level feature values ​​of each node are compared layer by layer from the root node to the leaf node; the node paths and hierarchical position information corresponding to nodes with inconsistent feature values ​​are identified and recorded, and then summarized and integrated to obtain a list of configuration difference nodes.

[0109] In this embodiment, first, the global configuration feature value is extracted from the reference feature value data packet, and the global configuration feature value calculated at the current time is extracted from the real-time feature value data packet. The byte-level accurate comparison is performed based on the corresponding global configuration feature value string to ensure the absolute accuracy of the comparison, and any slight difference is not allowed to be ignored. The global consistency determination result is obtained. If the global consistency determination result is consistent, it indicates that the overall configuration of the virtual machine has not changed, and all configuration elements remain in the reference state. The tamper-free identifier is generated to mark that the virtual machine is currently in a safe and untampered state, and the comparison process is ended without the need for subsequent detailed analysis. If the global consistency determination result is inconsistent, the platform operation identifier in the metadata node is read to determine whether its operation session ID matches the active session of the current virtualization platform. If the platform operation identifier shows that the feature value is generated by a legal operation within the platform, and the current session ID matches, but the configuration is still modified, it is determined that it is a violation of the operation of directly modifying the configuration file outside the platform. A high-risk alarm event is generated, and the alarm type is recorded as "illegal configuration modification beyond the platform". If the platform operation identifier does not match or is empty, the node-level feature values of each level are extracted from the reference feature value data packet and the real-time feature value data packet respectively. The node-level feature values are organized according to the hierarchical structure of the configuration node tree. Starting from the root node level to the leaf node level, the node-level feature values are compared layer by layer from the root node to the leaf node in the order of the hierarchical structure of the configuration node tree. The high-level nodes are compared first, and then the low-level nodes. This hierarchical comparison method can quickly narrow down the change range and improve the comparison efficiency. For each node in each level, the reference feature value is accurately compared with the real-time feature value. If the feature values are consistent, it indicates that the node and its subtree have not changed. If the feature values are inconsistent, it indicates that the node or its subtree has changed, and further in-depth comparison is needed. All nodes with inconsistent feature values are identified and recorded. The complete path information of these nodes in the configuration node tree is obtained. The hierarchical position information of the nodes in the tree structure is recorded. The path information and hierarchical position information of all identified change nodes are integrated and sorted according to the hierarchical order or importance order to form a structured configuration difference node list.

[0110] In the embodiment of the present application, the detailed implementation steps of step S3 include:

[0111] Based on the obtained integrity detection report, the abnormal detection record is obtained by screening according to the risk level. The configuration change details are read from the abnormal detection record set. The feature mode of the configuration change details is matched with the pre-stored legal change white list.

[0112] If the matching is successful, the corresponding anomaly detection record is marked as a legal change, and legal change marking data is obtained; if the matching fails, it is determined as an unauthorized tampering behavior, and unauthorized tampering record is obtained;

[0113] According to the risk level of the unauthorized tampering record, a differentiated anomaly handling strategy is generated, including generating an alarm notification for a medium-risk level; and triggering a virtual machine isolation operation for a high-risk level while sending the alarm notification.

[0114] In the embodiment, first, the generated integrity detection report is analyzed and processed, the comprehensive risk score is compared with the preset risk threshold, and the risk level is set according to the comparison result, including low risk, medium risk and high risk; the integrity detection report of medium risk or above is extracted and marked as an anomaly detection record; for each anomaly detection record, the configuration change details corresponding to each record are extracted from the anomaly detection record set, including detailed information such as changed configuration node, change content, change time and change amplitude, the feature mode of the configuration change details is analyzed, including change type (addition / deletion / modification), change position (core configuration / function configuration / description information), change scale (single node / multiple nodes / batch change), etc., the extracted feature mode is matched with the pre-stored legal change white list, the legal change white list contains known normal configuration change modes, including system patch update, security policy adjustment, resource expansion, etc., the white list entry contains change mode description, matching rule, authorized source and other information, and mode matching (such as regular expression matching) is used to judge whether the current change conforms to any legal mode in the white list.

[0115] Then, according to the matching result, the classification processing is performed, if the feature mode of the configuration change details successfully matches a certain entry in the legal change white list, it indicates that the corresponding change process is an authorized normal operation process, the corresponding anomaly detection record is marked as a legal change, and legal change marking data is generated, including change confirmation identifier, matched white list entry, approval information, etc.; if the matching fails, it indicates that the change does not conform to the known legal mode, and it may be an unauthorized tampering behavior, and an unauthorized tampering record is generated, recording detailed information and possible threat level of the tampering;

[0116] Then, according to the risk level of the unauthorized tampering record, a differentiated anomaly handling strategy is implemented, including generating an alarm notification for a medium-risk level tampering, and notifying a security administrator through a security management platform, an email, a short message and the like, and the alarm content includes tampered virtual machine, tampering details, risk assessment, suggested handling measures and the like; for a high-risk level tampering, in addition to sending an emergency alarm notification, a virtual machine isolation operation is also triggered synchronously to prevent the tampering from affecting the spread or malicious behavior from continuing to execute.

[0117] In the embodiment of the application, the detailed implementation steps of triggering the virtual machine isolation operation include:

[0118] modify the storage access permission of the tampered virtual machine to read-only mode, perform memory snapshot and disk snapshot operations on the virtual machine, store the snapshot files to an independent forensic storage area, obtain a forensic data package; and add an isolation identifier to the tampered virtual machine to obtain an isolated state virtual machine;

[0119] detect the tampering of other virtual machines on the same host, perform time correlation and feature similarity analysis to obtain a horizontal attack propagation feature; determine whether there is a propagating attack according to the horizontal attack propagation feature to obtain a propagating attack determination result;

[0120] If the propagating attack determination result is yes, perform synchronous isolation disposal on all virtual machines on the host, and report a security event to the superior security management center; synchronously generate an abnormal disposal log and write it into a preset audit log blockchain.

[0121] In this embodiment, first, the virtual machine that detects unauthorized tampering behavior immediately starts the isolation disposal process, modifies the storage access permission configuration of the tampered virtual machine through the virtualization API interface, changes the access mode of the virtual disk from read-write mode to read-only mode to prevent further modification operations on the virtual machine disk data and prevent the tampering behavior from continuing to execute or the evidence from being destroyed; modify the network interface configuration of the virtual machine, disable the network connection or switch it to an isolated network segment to block possible horizontal movement paths, perform real-time memory snapshot operations on the virtual machine, use the snapshot function of the virtualization platform to capture the current memory state of the virtual machine to obtain a memory snapshot, and the memory snapshot contains runtime process information, network connection state, loaded drivers and other key forensic data; perform virtual machine disk snapshot operations to create a complete copy of all virtual disks of the virtual machine, and the disk snapshot saves complete information such as file system state, installed software, and user data.

[0122] Store the generated memory snapshot file and disk snapshot file uniformly to a pre-established independent forensic storage area, the independent forensic storage area is physically isolated from the production storage, has strict access control and data protection mechanisms, performs hash verification and digital signature on the snapshot file to ensure the integrity and non-tamperability of the forensic data, generates a forensic data package containing information such as snapshot file path, file size, verification value, and creation time, adds an isolation identifier to the configuration information of the virtual machine, and updates the state field in the virtual machine management database to mark the virtual machine as an isolated state, to obtain an isolated state virtual machine. The virtual machine will display a special isolation icon in the management interface, and the administrator can clearly identify its security state.

[0123] Then, the identification information of the host machine where the tampered virtual machine is located is obtained through the virtualization management interface, including the physical server ID, host name, IP address and other unique identifiers of the host machine. Based on the host machine identification information, the resource list of the virtualization management system is queried to obtain a list of all virtual machines currently running on the host machine, which includes virtual machine ID, name, running status, resource allocation and other basic information. These virtual machines may face the risk of horizontal attack propagation because they share the same physical host machine. Then, all virtual machine records with unauthorized tampering behavior in the virtual machine list are filtered out from the historical integrity detection report. The abnormal discovery timestamp of each tampered virtual machine is extracted, and these timestamps are arranged in chronological order. The time interval between adjacent abnormal events is calculated to form an abnormal time distribution sequence, which is used to reflect the time distribution pattern of abnormal events on the same host machine. Statistical analysis is performed on the abnormal time distribution sequence to calculate the mean, standard deviation, coefficient of variation and other statistical characteristics of the time interval. The K-means clustering algorithm is used to identify the clustering pattern in time to analyze whether there is a concentrated outbreak in a short period of time. Time aggregation indicators such as abnormal density per unit time and event concentration in a time window are calculated to obtain time aggregation characteristics, which quantify the correlation of abnormal events in the time dimension. Then, the configuration change details of different virtual machines are extracted, and the feature pattern of each change is analyzed, including change type, change location, change content, change size, etc. The similarity between different virtual machine change patterns is calculated by cosine similarity, and a feature similarity matrix is constructed based on it. The matrix elements in the similarity matrix represent the change similarity between corresponding virtual machine pairs. High similarity may indicate the use of the same attack tools or techniques. Finally, the time aggregation characteristics and the feature similarity matrix are fused to construct a comprehensive horizontal attack propagation feature vector. This vector contains both time correlation information and technical similarity information. A propagation attack judgment threshold is set, such as when the time aggregation degree exceeds the threshold and the feature similarity exceeds the threshold, it is determined that there is a propagating attack. According to the comparison between the horizontal attack propagation feature vector and the judgment threshold, a propagating attack judgment result is generated, such as "there is a risk of propagating attack" or "there is no evidence of propagating attack", which provides a basis for decision-making for subsequent security response. This comprehensive analysis method based on time and technical features can effectively identify horizontal movement attacks and timely detect and prevent further spread of attacks.

[0124] Finally, according to the judgment result of the propagation attack, corresponding emergency response measures are performed, if the judgment result of the propagation attack is "there is a propagation attack", it indicates that the attack has spread in the host range, more stringent prevention and control measures need to be taken, synchronous isolation treatment is performed on all virtual machines on the host, including normally running virtual machines and virtual machines that have been detected to be abnormal, the storage access permission of all virtual machines is uniformly modified to read-only mode, the network connection of all virtual machines is disconnected, the network port of the host is set to disabled state or switched to isolated VLAN, the attack is prevented from spreading to other hosts, the running of all virtual machines is suspended or they are switched to a safe frozen state, the current state is kept unchanged for subsequent investigation;

[0125] Meanwhile, an isolation identifier is set for the host in the virtualization management platform, to prevent new virtual machines from being scheduled to run on the host, a detailed security event report is sent to the upper-level security management center through a reporting interface of the security management system, the report content includes key information such as event occurrence time, influence range, attack characteristics, measures taken, and suggested subsequent actions, an encrypted communication protocol is used to ensure the security of the report data during transmission, a detailed abnormality treatment log is generated synchronously, recording each step of the isolation operation, execution time, operation result, related personnel and other information, the abnormality treatment log is written into a preset audit log blockchain through a block link interface, to ensure the integrity and credibility of the log data, each audit log record contains a timestamp, a digital signature, a previous block hash and other blockchain elements, forming an unalterable audit trail.

[0126] In the embodiment of the application, the detailed implementation steps of change management and feature value closed-loop updating include:

[0127] The change approval number and the approval person identity information are extracted from the legal change mark data; the change legality confirmation result is obtained through secondary verification of the approval single validity and non-expiration through an intranet approval interface;

[0128] If the change legality confirmation result is verified, the changed virtual machine XML configuration file is read, the feature value generation process of step S1 is performed, the node-level feature value and the global configuration feature value are recalculated based on the new XML configuration file, and the new version feature value data packet is obtained;

[0129] The global configuration feature value of the last historical version is extracted from the metadata node as a parent version identifier; the parent version identifier is embedded into the new version feature value data packet to establish a version chain relationship, and the feature value data packet with the version chain is obtained;

[0130] The feature value data packet with the version chain is encrypted to obtain a new encrypted feature value payload; the original encrypted feature value payload is replaced with the new encrypted feature value payload, and the check anchor point is updated synchronously;

[0131] The time of the feature value updating operation, the approval number, the comparison data of the new and old feature values, and the version chain information are recorded to the feature value change log library to form a change audit track.

[0132] In the embodiment, first, the record marked as a legal change is subjected to further verification processing, and the associated change approval number and the approval person identity information are extracted from the legal change marking data. These information should be derived from the change management process in the enterprise, and the approval sheet is subjected to secondary verification through the intranet approval interface (such as a workflow management interface) to check the validity (such as whether the approval number exists and whether the approval process is complete) and timeliness (such as whether the approval is within the effective period and whether it has been revoked) of the approval sheet, and verify the authenticity and the authority range of the approval person identity information, to ensure that the change operation has indeed gone through a proper authorization process, and a change legality confirmation result is obtained. If the change legality confirmation result is verification passed, it indicates that the configuration change is a legal operation through proper authorization, and the baseline feature value needs to be updated to reflect the new legal configuration state. The virtual machine XML configuration file after the change is re-read, the file contains the latest configuration information after the legal change, the same feature value generation process as in step S1 is executed, the new XML configuration file is subjected to structured parsing, a configuration node tree is constructed, the node level feature values of each level and the global configuration feature value of the whole are calculated, a new version feature value data packet is generated, then the global configuration feature value of the last historical version is extracted from the metadata area of the current XML configuration file and is taken as a parent version identifier, the parent version identifier is embedded into the new version feature value data packet, a version chain relationship is established, a feature value data packet with a version chain is formed, the version chain mechanism enables the system to trace the configuration change history, supports configuration rollback and audit analysis, then the same encryption algorithm and key as in step S1 are used to encrypt the feature value data packet with the version chain, a new encrypted feature value payload is generated to ensure the confidentiality and integrity of the new baseline data, the original encrypted feature value payload in the metadata area of the XML configuration file is replaced with the new encrypted feature value payload, and the check anchor point is recalculated and updated to ensure the integrity and verification ability of the newly embedded data, finally, the detailed information of the feature value updating operation is recorded to the feature value change log library, the recording content includes the update time, the approval number, the operator, the comparison data of the new and old feature values, the version chain information, the change reason, and the like, to form a complete change audit track.

[0133] In the embodiment of the application, the detailed implementation steps of the configuration recovery process performed on the isolated virtual machine include:

[0134] The XML configuration file backup corresponding to the last legal change process of the virtual machine is read from the baseline feature value archive;

[0135] If the XML configuration file backup exists and is not damaged, the backup configuration file is used to replace the tampered XML configuration file; if the backup does not exist or is damaged, the last trusted version is traced back through the feature value version chain, and a legal configuration file is reversely reconstructed according to the configuration change history in the version chain;

[0136] The feature value generation and embedding operation of step S1 is performed again on the restored configuration file to establish a new reference feature value, and a legal configuration state after restoration is obtained.

[0137] The isolation state of the virtual machine is released, network connection and storage access permission are restored, and the cumulative abnormal counter of the event listening hook corresponding to the virtual machine is reset.

[0138] In the embodiment, first, for the isolated virtual machine, a configuration recovery process is started to restore it to a safe legal configuration state, the XML configuration file backup of the virtual machine last time confirmed by legal change is found from the reference feature value archive, the XML configuration file backup contains complete virtual machine configuration information and corresponding feature value data, the existence and integrity of the XML configuration file backup are checked, and it is verified whether the XML configuration file backup is complete and not damaged.

[0139] If the XML configuration file backup exists and the integrity verification is passed, the backup configuration file is directly used to replace the current tampered XML configuration file, the configuration file replacement operation is performed through the virtualization management interface, and it is ensured that the virtual machine is restored to the last legal configuration state; if the backup configuration file does not exist or the integrity verification fails, a version chain tracing recovery mechanism is started, the version chain information of the virtual machine is read from the feature value change log library, and the last trusted configuration version is traced back, the version chain records the feature value change and configuration content of each legal change;

[0140] According to the configuration change history recorded in the version chain, a legal configuration file is reconstructed by using a reverse engineering method, that is, the historical change operation is reversely applied from the current configuration state to back up to the last trusted configuration state, and the reconstructed legal configuration file is generated.

[0141] Then, the recovered XML configuration file is structurally parsed using the method of step S1, a new configuration node tree is constructed, the node level feature values and the global configuration feature values of each level are calculated, a new baseline feature value data packet is generated, the new baseline feature value data packet is encrypted and embedded into the metadata area of the configuration file, the verification anchor point is updated, a new security monitoring baseline is established, the legal configuration state after recovery is obtained, and then after confirming that the configuration recovery operation is successfully completed, the isolation state of the virtual machine is gradually released, the network connection of the virtual machine is recovered first, including the virtual network interface, VLAN setting, firewall rule, etc., then the storage access permission is recovered, including virtual disk mounting, file system permission, data access control, etc., and finally the normal running state of the virtual machine is recovered, including starting services, application programs, etc., the cumulative abnormal counter in the event listening hook corresponding to the virtual machine is reset, the previous abnormal record is cleared, the monitoring frequency is restored to the normal level, and the detailed information of the recovery operation is recorded into the operation log, including the recovery time, recovery method, operator, recovery result, etc., which provides a basis for subsequent security analysis and audit, and through such a systematic configuration recovery process, the tampered virtual machine can be safely and reliably restored to the legal configuration state, while the monitoring capability of the system and the effectiveness of the security baseline are maintained.

[0142] The above merely provides preferred embodiments of the present application but should not be used to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can modify the technical solutions described in the foregoing embodiments or equivalently replace some technical features thereof. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of protection of the present application.

[0143] The formulas in the present specification are dimensionless values calculated, the formulas are obtained by collecting a large amount of data to simulate a formula of the most recent real situation, and the preset parameters and threshold values in the formulas are set by those skilled in the art according to actual conditions.

[0144] Although the embodiments of the present application have been shown and described, those skilled in the art can understand that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the claims and their equivalents.< / metadata>

Claims

1. A method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment, characterized in that, Comprise: Step S1: Obtain the XML configuration file of the virtual machine, and perform structured parsing and node classification on the XML configuration file to obtain a hierarchical node configuration set; Generate a benchmark characteristic value data packet based on the hierarchical node configuration set, encrypt the benchmark characteristic value data packet, and embed it in a pre-written custom namespace to obtain a benchmark characteristic value archive; Step S2: Create an event listener hook for each virtual machine in the confidential intranet and trigger integrity detection; After the integrity detection is completed, obtain the real-time characteristic value data packet corresponding to the virtual machine, compare the real-time characteristic value data packet with the benchmark characteristic value data packet in multiple levels, and perform risk assessment based on the comparison result to obtain an integrity detection report; Step S3: Based on the integrity detection report, perform risk level screening and change mode matching, and determine whether the change process of the corresponding XML configuration file is a legal change based on the change mode matching result. If it is not a legal change, trigger an alarm notification and virtual machine isolation; If it is a legal change, obtain a legal change marker data; Step S4: Based on the legal change marker data, perform change management and characteristic value closed loop update on the legal changed virtual machine; And perform configuration recovery process on the isolated virtual machine.

2. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 1, characterized in that, The acquisition process of the benchmark characteristic value archive comprises: Obtain the XML configuration file of the virtual machine based on the virtualization API interface; and perform structured parsing on the collected XML configuration file, and construct the configuration content in the XML configuration file into a configuration node tree according to the structured parsing result; According to the security sensitivity of each node in the configuration node tree, the node classification mark is obtained, and the hierarchical configuration node set is obtained; and the key configuration elements corresponding to each level in the hierarchical configuration node set are extracted; Obtain the position identification code corresponding to the key configuration elements, and perform hierarchical hash aggregation operation from the leaf node to the root node of the configuration node tree based on the preset hash algorithm, to obtain the benchmark characteristic value data packet; Perform data encryption processing on the obtained benchmark characteristic value data packet to obtain an encrypted characteristic load, embed the encrypted characteristic load in a pre-written custom namespace, and insert a verification anchor point; Perform syntax validity verification and structure integrity detection on the embedded XML configuration file to obtain the benchmark characteristic value archive.

3. The method of claim 2, wherein the method further comprises: The acquisition process of the benchmark characteristic value data packet comprises: Apply a preset hash algorithm to each key configuration element to calculate a feature digest, to obtain a node-level characteristic value; and generate a unique identifier according to the path information of the key configuration element in the configuration node tree; Splice and combine the node-level characteristic value and the position identification code according to a predetermined format to obtain a node characteristic identifier with position information; Perform depth-first traversal on the configuration node tree to identify all leaf nodes to obtain a leaf node set; and extract the node characteristic identifier from the leaf node set as the zeroth layer hash input; According to the leaf node set, arrange the node characteristic identifiers of all child nodes under the same parent node in order, splice them in a preset order, and calculate the parent node hash value to obtain the upper level node hash; The parent node hash is taken as a new input, and the parent node hash calculation process is repeatedly performed, and is aggregated layer by layer upwards until the root node; and a final hash operation result of the root node is obtained as a global configuration feature value; The global configuration feature value, the node level feature value of each layer, the current timestamp and the unique identifier are structured and packaged to obtain a benchmark feature value data packet.

4. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 2, characterized in that, The process of obtaining the integrity detection report includes: Group management is performed on the virtual machines in the secret internal network to obtain a monitoring priority queue, and an independent event listening hook is created for each virtual machine in the monitoring priority queue; The current XML configuration file and the metadata area content in the corresponding virtual machine are read according to the event listening hook; The check anchor point in the metadata area is verified for integrity; if the verification fails, it is marked as a high-risk exception and the subsequent detection process is interrupted; if the verification passes, the encrypted feature value payload is extracted from the metadata area and decrypted to restore the benchmark feature value data packet; The node level feature value of the configuration node tree and the global configuration feature value are calculated based on the current XML configuration file in real time to obtain a real-time feature value data packet; The real-time feature value data packet and the benchmark feature value data packet are compared in multiple levels, and the changed configuration node is located according to the comparison result to obtain a configuration difference node list; The nodes in the configuration difference node list are compared for differences in front and back texts to obtain a configuration change detail; and a risk score of the change item is obtained according to the configuration change detail to obtain a comprehensive risk score; An integrity detection report is generated according to the comprehensive risk score.

5. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 4, characterized in that, The process of obtaining the configuration difference node list includes: The global configuration feature values are extracted from the benchmark feature value data packet and the real-time feature value data packet respectively, and are compared at the byte level to obtain a global consistency determination result; If the global consistency determination result is consistent, a non-tampering identifier is generated and the comparison process is ended; if the global consistency determination result is inconsistent, the node level feature values of each layer are extracted from the benchmark feature value data packet and the real-time feature value data packet; The node level feature values of each node are compared layer by layer from the root node to the leaf node according to the layer order of the configuration node tree; the node path and the layer position information corresponding to the feature value inconsistent node are identified and recorded, and are integrated to obtain a configuration difference node list.

6. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 4, characterized in that, The process of determining whether the change process of the corresponding XML configuration file is a legal change includes: The abnormal detection records are obtained by screening according to the risk level based on the obtained integrity detection report; the configuration change detail is read from the abnormal detection record set; and the feature mode of the configuration change detail is matched with the pre-stored legal change white list; If the matching is successful, the corresponding abnormal detection record is marked as a legal change to obtain a legal change marker data; if the matching fails, it is determined as an unauthorized tampering behavior to obtain an unauthorized tampering record; A differentiated abnormal handling strategy is generated according to the risk level of the unauthorized tampering record, including generating an alarm notification for the medium risk level; and triggering a virtual machine isolation operation for the high risk level while sending the alarm notification.

7. The method of claim 6, wherein the method is effective to prevent the virtual machine from being maliciously tampered with in the secret network environment, characterized in that, The process of triggering the virtual machine isolation operation includes: modify the storage access permission of the tampered virtual machine to read-only mode, perform memory snapshot and disk snapshot operations on the virtual machine, store the snapshot files to an independent forensic storage area, and obtain a forensic data package; and add an isolation identifier to the tampered virtual machine to obtain an isolated state virtual machine; detect configuration tampering of other virtual machines on the same host, and perform time correlation and feature similarity analysis based thereon to obtain a horizontal attack propagation feature; determine whether there is a propagating attack based on the horizontal attack propagation feature to obtain a propagating attack determination result; if the propagating attack determination result is yes, perform synchronous isolation disposal on all virtual machines on the host, and report a security event to a higher-level security management center; synchronously generate an abnormal disposal log and write it into a preset audit log blockchain.

8. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 7, characterized in that, The process of obtaining the propagating attack determination result includes: obtaining the identifier information of the host where the tampered virtual machine is located, and obtaining a list of all virtual machines running on the corresponding host based thereon; obtain the abnormal time interval between adjacent virtual machines with unauthorized tampering behavior in the corresponding virtual machine list based on the integrity detection report to obtain an abnormal time distribution sequence; and perform time aggregation analysis to obtain a time aggregation feature; calculate the similarity between feature patterns in different virtual machine configuration change details to obtain a feature similarity matrix; integrate the time aggregation feature and the feature similarity matrix to generate a horizontal attack propagation feature and a propagating attack determination result.

9. The method of claim 6, wherein the method further comprises: determining whether the virtual machine is running on a trusted platform; and if the virtual machine is not running on a trusted platform, then preventing the virtual machine from running. The process of performing change management and feature value closed-loop update includes: extract the change approval number and the approval person's identity information from the legal change mark data; perform secondary verification of the approval single validity and non-expiration through the intranet approval interface to obtain a change legality confirmation result; if the change legality confirmation result is verified, read the changed virtual machine XML configuration file, perform the feature value generation process of step S1, and recalculate the node-level feature value and the global configuration feature value based on the new XML configuration file to obtain a new version feature value data package; extract the global configuration feature value of the last historical version from the configuration file metadata as a parent version identifier; embed the parent version identifier into the new version feature value data package to establish a version chain relationship to obtain a feature value data package with a version chain; encrypt the feature value data package with a version chain to obtain a new encrypted feature value payload; replace the original loading feature value payload with the new encrypted feature value payload, and update the verification anchor point synchronously; record the time, approval number, new and old feature value comparison data, and version chain information of the feature value update operation to the feature value generation log library to form a change audit track.

10. The method for effectively preventing a virtual machine from being maliciously tampered with in a secret network environment according to claim 6, characterized in that, The process of performing configuration recovery process on the isolated virtual machine includes: read the XML configuration file backup corresponding to the last legal change process of the virtual machine from the baseline feature value archive; if the XML configuration file backup exists and is not damaged, replace the tampered XML configuration file with the backup configuration file; if the backup does not exist or is damaged, trace back to the last trusted version through the feature value version chain, and reversely reconstruct the legal configuration file according to the configuration change history in the version chain; The eigenvalue generation and embedding operation of step S1 is re-executed on the restored configuration file, to obtain a restored legal configuration state; The isolation state of the virtual machine is released, the network connection and the storage access permission are restored, and the event listening hook corresponding to the virtual machine is reset.

Images