Dynamic measurement method for collaborative monitoring of kernel data and process behaviors of virtual machine

Abstract

The invention discloses a dynamic measurement method for collaborative monitoring of kernel data and process behaviors of a virtual machine, which combines static measurement and dynamic measurement, and performs static measurement of a system trusted root in a starting stage of the virtual machine and dynamic measurement in a running stage of the virtual machine. Full-life-cycle integrity protection from system starting to running is achieved, and the scene that the measurement coverage range is expanded from single-kernel static data to'kernel + process' is achieved. Secondly, a hierarchical response strategy of four-dimensional risk assessment is provided, and the resource utilization efficiency is optimized while the security is ensured through a dynamic allocation strategy. The problems that a source allocation strategy of a traditional scheme is not refined enough, and efficiency and safety are difficult to consider at the same time are solved. In order to improve the process behavior detection accuracy, a Transform-BiLSTM enhanced detection model is constructed, and the detection precision and generalization ability of complex attack behaviors are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of system security, in particular to a dynamic measurement method for virtual machine kernel data and process behavior cooperative monitoring. BACKGROUND

[0002] With the acceleration of global digital transformation, virtual machines have become the core carriers of cloud computing and virtualization environments due to their high resource utilization and flexible deployment advantages. Therefore, virtual machine system security has become a concern. However, virtual machines (VMs) are subject to security threats such as kernel Rootkit tampering and process injection. Trusted computing technology provides a basic protection framework for virtual machine security, and integrity measurement technology, as the core pillar of trusted computing, is the underlying support for ensuring the integrity of the system from startup to running.

[0003] Traditional static integrity measurement (such as hash verification of firmware and images during boot-up) can only cover the system initialization link and is difficult to deal with dynamic threats during runtime. APT attacks can hijack process behavior without modifying disk files through dynamic injection of memory horses and kernel hook tampering, easily bypassing static verification. In order to protect the system security of virtual machines during runtime, scholars have proposed dynamic measurement. However, traditional dynamic measurement also relies on periodic scanning mechanisms, which may result in "delayed detection due to long periods or increased system overhead due to short periods". Attackers may bypass the detection period and cannot effectively avoid TOC-TOU security risks, making it difficult to meet the performance requirements of high-concurrency virtualization environments.

[0004] Another traditional dynamic measurement method is behavior-triggered dynamic measurement (local on-demand monitoring), which can reduce overhead through suspicious rules, but the triggering conditions relying on manual features are difficult to cover the timing correlation of complex attacks, with low accuracy. More importantly, in industrial control and other special scenarios, malicious code can implement attacks by disguising as normal operation instructions (such as mimicking legal device control sequences), with the core feature of "not tampering with file bodies but destroying runtime integrity", which further exposes the blind spot of traditional file verification-based measurement methods. Behavior-based dynamic measurement collects system runtime behavior data (such as process call sequences, system call frequencies, and memory access patterns) to determine the trustworthiness of components. However, single security measurement based on behavior can identify unknown threats through normal behavior baselines but will result in significant performance overhead. Moreover, most behavior-based trust measurement methods cannot directly locate the specific objects or code fragments that have been tampered with. In addition, current behavior-based trust measurement methods mostly use traditional machine learning methods (such as SVM, random forest, and logistic regression), which have three major limitations (insufficient complex behavior modeling capability, feature engineering relying on manual work, and weak generalization ability) in complex attack scenarios, making it difficult to meet high security requirements.

[0005] As a powerful anomaly detection technology, deep learning has made significant progress in intrusion detection in recent years. It can effectively identify new and unknown attack behaviors by automatically learning potential patterns from data. Deep learning can learn the behavior patterns of normal operation by analyzing historical behavior data and use the learned patterns for anomaly detection. Therefore, deep learning technology provides a technical path to break through the above-mentioned traditional mechanical learning bottleneck.

[0006] The traditional measurement scheme has the following shortcomings in the integrity protection of the virtual machine system: (1) The measurement coverage is not complete, and it is difficult to form a full-cycle protection closed loop: the traditional static measurement only performs static measurement at the startup stage, and cannot prevent runtime kernel Rootkit attacks and process injection attacks that tamper with kernel data. Although some dynamic measurement research focuses on dynamic scenarios such as user behavior and program behavior, it ignores the construction of trusted roots in the startup stage, resulting in security risks from the initial stage. The existing dynamic and static combined measurement scheme ignores the integrity of the kernel key data during operation, resulting in security risks such as failure of security tools and abnormal system operation.

[0007] (2) Weak behavior anomaly detection capability, limited detection accuracy and generalization ability: most behavior-based measurement schemes rely on manual feature selection and rule setting, which is time-consuming and labor-intensive, and is difficult to adapt to complex and changing attack patterns and dynamic environments, resulting in low detection accuracy. Although deep learning has shown great potential in behavior anomaly detection, it faces technical bottlenecks such as insufficient temporal modeling, gradient explosion or gradient disappearance in process behavior anomaly detection, and cannot be directly and efficiently integrated into the measurement framework, making it difficult to achieve accurate identification and rapid response to complex attack behaviors.

[0008] (3) The source allocation strategy is not refined enough, making it difficult to balance efficiency and security: traditional dynamic measurement schemes mostly use fixed periodic scanning mechanisms, which can easily lead to attack detection delays if the period is too long, or excessive consumption of system resources if the period is too short, making it difficult to adapt to the performance requirements of high-concurrency virtualization environments. In addition, this single resource allocation mode cannot dynamically adjust the measurement intensity according to the threat level, resulting in unnecessary resource overhead when the system is faced with low-risk events, and possible protection failure due to resource insufficiency when it is faced with high-risk attacks, forming a dilemma of "efficiency sacrificing security" or "security dragging efficiency". SUMMARY In view of the problems existing in the prior art, the present application discloses a dynamic measurement method for cooperative monitoring of virtual machine kernel data and process behavior, which performs static measurement at the startup stage of the virtual machine to ensure the establishment of a trusted root of the virtual machine system and ensure that the virtual machine running environment has not been tampered with. The technical solution adopted comprises the following steps: Step A: environment initialization and data acquisition, static measurement is performed in the virtual machine startup stage to establish a system trusted root, and through the monitoring hook of the security agent deployed in the system kernel, kernel static data is collected in real time and system call sequence data of process runtime is collected through eBPF technology; wherein the security agent also includes a control hook, the control hook is used to execute the detection result output by the measurement module, and the monitoring hook is mainly responsible for acquiring the data of the measured object (i.e. kernel static data or process behavior information) and sending it to the security detection mechanism; Step B: pre-process measurement, integrity measurement of kernel critical data and Mamba-Transformer-BiLSTM model is performed by the measurement module; Step C: real-time detection and hierarchical response according to the detection result after the process is loaded, a security monitoring mechanism is established, process behavior analysis is performed, call logs are read, data modeling is performed based on the system call sequences generated by normal processes in the call logs, an abnormal detection framework of the Mamba-Transformer-BiLSTM model is constructed, which is used to depict the behavior profile of normal processes, and the Mamba-Transformer-BiLSTM model is used for abnormal detection, the abnormal degree of the process is calculated by loading the abnormal detection model, and the abnormal process information and specific abnormal short sequence detected are output to the detection log; Step D: comprehensive scoring, based on the result of the abnormal detection, the comprehensive scoring module combines the risk assessment indexes of multiple dimensions such as context perception, historical trajectory dynamic characteristics and threat mode recognition to calculate a comprehensive risk score; Step E: hierarchical response, the hierarchical response module triggers a differentiated response strategy corresponding to the threat level according to the comprehensive risk score, and the response strategy gradually enhances from only recording logs to triggering integrity measurement or even terminating the process; Step F: updating the baseline library, including the static baseline library and the dynamic baseline library.

[0009] As a preferred technical solution of the present application, step A further comprises the following steps: Step A1: performing static measurement on the initial state of the system in the virtual machine startup stage to establish an initial security baseline; Step A2: monitoring and collecting data through the monitoring hook, the kernel static data includes data information of the kernel code segment.text, the system call table and the interrupt descriptor table (IDT) into the measurement module; Step A3: transparently collecting system call data of process creation and running stage through eBPF technology, synchronously storing to the call log, and realizing full-link behavior recording and tracing.

[0010] As a preferred technical solution of the present application, step B further comprises the following steps: Step B1: integrity measurement is performed on the kernel critical region data using the SM3 hash algorithm, the kernel code segment is located by kallsyms_lookup_name() to obtain the boundary of the _stext and _etext symbols, and the SM3 hash is calculated in a sliding window manner; Step B2: the interrupt descriptor table (IDT) base address is obtained by reading the VBAR_EL1 register and the first 128 bytes of content are read, the sys_call_table address is located through the symbol table, and all system call entrances are traversed in 8-byte table items, and MMU control bits and other data are encapsulated into the Mem_Critical_Data structure and a single SM3 hash value is calculated; Step B3: the program segment length of the PT_LOAD type with the PF_X flag is obtained by ELF header parsing, and the SM3 hash is calculated page by page in page granularity; Step B4: integrity measurement is performed on the Mamba-Transformer-BiLSTM model.

[0011] As a preferred technical solution of the present application, the process of constructing the Mamba-Transformer-BiLSTM model in step C and implementing anomaly detection further comprises: C1: data preprocessing and enhancement, the system call sequence is parsed from the data set, normal behavior and multiple types of attack behavior are collected respectively, and they are unified and regularized into fixed-length subsequences, the data diversity is expanded by adding Gaussian noise and time step disturbance strategy, a statistical feature enhancement module is introduced, the local mean and standard deviation are calculated, and a three-dimensional input tensor is constructed; C2: the original input features are first mapped to a specified dimension embedding space through linear transformation by a linear embedding layer (Embedding Layer); C3: a state space module (SSM) is introduced, which models the input sequence by introducing an additional state transition matrix and an output matrix, and helps to capture long-term dependencies, the SSM module updates the hidden state step by step through a loop, generates the output at the current time, and helps the model to retain context information when capturing time series patterns; the SSM consists of the following parameters: State transition matrix Used to control the dynamics of state update, can capture long-term dependencies in the sequence, the matrix A performs linear transformation on the historical state through matrix multiplication, and decides to retain or forget information; Input matrix The input features x tmapping to a hidden state space; in that it controls how much the current input contributes to the state update; output matrix The matrix C maps the hidden state h t to the output space to get the output y t at the current time step t; in that it decides how to extract useful features from the hidden state for downstream tasks; The state space model (SSM) module is updated by the following equation: h t t+1 t-1 = tanh(h t t y t t t where d h is the dimension of the hidden state, d x is the dimension of the input feature, d y is the dimension of the output, h t-1 is the hidden state of the previous time step, h t is the hidden state of the current time step, x t is the input feature of the current time step, tanh is the activation function, and y t is the output of the current time step t; C4: output the SSM state space to the multi-head attention module, which can learn the relationship between different time steps and automatically assign different weights to each time step; the multi-head attention mechanism calculates multiple single-head attentions in parallel, and each single-head attention uses the dot product of the query matrix Q and the key matrix V divided by the scaling factor to avoid the gradient vanishing caused by the large dot product value, and then uses the Softmax activation function to normalize the dot product result to calculate the attention weight, and then multiplies the calculated attention weight with the value matrix to get the single-head attention result, and then concatenates the output of each single-head together and then linearly transforms it to get the final output; the specific calculation process is as follows: Multi-Head Attention = Concat(Attention1,...,Attention h )W O where Q: query matrix, where n is the sequence length, d k is the dimension of the query vector; K: key matrix, V: value matrix, where n is the sequence length, d v is the query vector dimension; WO: linear transformation matrix of each head and output, d x is the input dimension; C5: bidirectional long short-term memory network module, which uses multi-layer Bi-LSTM and uses dropout regularization technology to prevent overfitting, thereby improving the generalization ability and robustness of the model; each LSTM unit itself is composed of four key steps, which are input gate, forget gate, candidate cell state and output gate; the input gate i t regulates the flow of information into the storage unit, and the output gate o t determines the degree of influence of the memory unit state on the network output at the current time step; in addition, the forget gate f t is used to control the retention time of existing information; at each time step t, the value of the memory unit C t is filtered by the forget gate to obtain the value at the previous moment (f t *C t-1 ) and the new candidate information is obtained through the input gate When the memory unit is updated, the current hidden layer h t is determined according to the current output gate o t , and the above process is updated according to the following calculation formula: i t =σ(W i ·[h t-1 ,x t ]+b i ) f t =σ(W f ·[h t-1 ,x t ]+b f ) o t =σ(W o ·[h t-1 ,x t ]+b o ) h t =o t *tanh(C t ) where σ is a sigmoid activation function, tanh is also an activation function, W is a weight, and b is a bias parameter; C6: The full connection layer adopts the ReLU activation function to realize the nonlinear mapping, and maps the features to the final classification space to distinguish the process behavior belonging to the attack or normal two categories; the output is converted into a probability distribution through the Softmax function, and the confidence of different category prediction is intuitively presented; the whole model realizes the process behavior anomaly detection relying on the cooperative operation of multiple modules; the input data is processed layer by layer through the embedding layer, the SSM module, the attention mechanism, the LSTM layer and the full connection layer, and feature extraction and classification prediction are gradually completed; in the model training stage, the focal loss function is adopted to improve the learning ability of difficult samples, and the AdamW optimizer and the ReduceLROnPlateau learning rate scheduler are matched to dynamically adjust the learning rate, ensure the stability and efficiency of the model convergence, at the same time, the mixed precision training (AMP) combined with the gradient scaling strategy is introduced to reduce the memory occupation and significantly speed up the model training process, and the balance optimization of performance and resource consumption is realized.

[0012] As a preferred technical solution of the present application, the step D further comprises the following steps: D1: The comprehensive risk assessment mechanism is a multi-dimensional threat assessment framework, which obtains a comprehensive assessment score through calculation of anomaly detection results, historical trajectory dynamic characteristics, context awareness and threat pattern recognition; the comprehensive risk score calculation formula is: Wherein, w i ={w base ,w context ,w trend ,w pattern} is a weight vector; r i ={r base ,r context ,r trend ,r pattern} is a risk component vector; D2: By introducing the historical trajectory dynamic characteristic dimension, the historical behavior trajectory change trend of the target object is analyzed, the corresponding weight coefficient of the dimension is given, the historical risk trajectory passes through the historical evaluation buffer to record the past risk evaluation results, the change trend of the risk score in the last 5 times is analyzed to detect whether the threat is continuously upgraded, so as to provide an early warning signal, and the historical trajectory dynamic characteristic component calculation formula is: Wherein, n is the historical window size, which is set to 5 here, R i is a historical risk score sequence, and beta=0.05 is a single step increment weight; is a historical evaluation buffer; is the number of evaluation records in the buffer; D3: By combining the context awareness dimension, adjusting the weight distribution based on the system environment where the target object is located, the evaluation result is adapted to the security requirements in different scenarios. The component calculation formula is as follows: Wherein, C j ={U cpu , U mem , U conn} are CPU usage, memory usage, and network connection number respectively; is an indicator function, returns 1 when the condition is true, otherwise returns 0; α is the context weight, τ is the threshold vector; D4: By integrating threat pattern recognition dimension, by matching the preset known threat pattern library, higher weight is given to the risk characteristics with high matching degree, the sensitivity to known threats is strengthened, and the calculation formula is as follows: The matching function definition formula is: f(m p )=min(0.2,m p ×0.05) Wherein, m p is the number of index matching, w p is the weight of each threat pattern; D5: By event response priority sorting, ensure that serious threats get immediate attention, and consider detection confidence in the decisive scene, the event response priority calculation formula is: Wherein, Θ={θ crit ,θ high ,θ med ,θ low}={0.85,0.65,0.4,0.2}, P∈[0,100].

[0013] As a preferred technical solution of the application, the step E further comprises the following steps: E1: Trigger log recording when the comprehensive score is low, log entry captures time metadata, risk score and feature importance vector, for forensic analysis and model refinement; E2: Trigger lightweight detection when the comprehensive score is medium, start fast reconnaissance for risk events, check key indicators, including process enumeration, resource utilization analysis and network connection audit; The lightweight check calculates the secondary risk score according to four indicators: N proc : is the total number of processes N hcpu : high CPU occupation process number N conn : network connection number U mem : memory usage detection γ = {0.2, 0.3, 0.2, 0.3} δ = {200, 3, 100, 80} When r lc exceeds the threshold value ε esc = 0.7, the system automatically promotes the response to the third level of response, realizing a dynamic upgrade mechanism; the implementation formula is as follows: E3: when the comprehensive score is high, triggering integrity measurement, using SM3 to calculate the hash of the code segment of the high-risk process and the loaded executable file, and checking with the baseline established in the baseline library; if the integrity is found to be damaged, a signal is sent to the security agent, the control hook in the security agent performs blocking or termination on the process, and the security audit is repaired to restore the trusted state; E4: when the comprehensive score is high, an emergency control signal is directly sent to the security agent, the security agent calls the preset control hook to perform blocking or termination operation on the target process, and quickly contains the threat spread.

[0014] As a preferred technical solution of the application, the static baseline library storage system in step F stores initial configuration, global parameters, fixed data of known safe version and deep learning model.

[0015] As a preferred technical solution of the application, the dynamic baseline library in step F adopts a writable storage mode, and only authorized users or processes are allowed to modify through a specific security interface, which adopts encryption communication and identity verification means.

[0016] As a preferred technical solution of the application, the security detection mechanism in step C further includes a process behavior anomaly analysis module, a comprehensive scoring module and a hierarchical response module; the process behavior anomaly analysis module performs anomaly detection based on process call logs; the comprehensive scoring module performs weighted operation on the risk values of each dimension based on preset weight rules to generate a comprehensive score reflecting the current process security state; the hierarchical response module divides the process security threat into different levels according to the comprehensive score output by the comprehensive scoring module, and configures differentiated response strategies for different levels of threats.

[0017] As a preferred technical solution of the application, the hierarchical response module further includes a measurement module and a security audit module, and the measurement process of the measurement module can be divided into two categories: The first type of measurement: such measurement is mainly aimed at the kernel module in the system, the kernel key data, the shared library, the Mamba-Transformer-BiLSTM model, and the integrity verification during the module loading and the library loading; the loaded kernel module and the shared library are calculated by using the SM3 hash algorithm, and the calculation result is compared with the expected value in the baseline library, so that whether tampering behavior exists is judged; The second type of measurement: when the security detection mechanism identifies a high-risk threat, the measurement module will receive a signal, trigger the integrity measurement of the process code segment, the loaded executable file, the configuration file and the like, and compare the measurement result with the benchmark value previously established in the baseline library, if the integrity of the system is damaged, the system will be repaired to the trusted state through the security audit function; through the two types of measurement mechanisms, the measurement model can actively monitor and prevent potential tampering behavior; In the case that the system integrity is severely tampered, the security audit module can record all security events in detail, and trace the history state of the system, help to restore the integrity of the system; through the deep analysis of the measurement data and the log, the security audit module can trace the root cause of the abnormal behavior, identify the attack path and the vulnerability, and provide an important basis for the subsequent defense mechanism design and vulnerability repair.

[0018] The beneficial effects of the present application: realize the whole cycle, multi-dimensional protection closed loop, break through the traditional protection coverage blind area: the present application innovatively integrates the static measurement in the starting period and the dynamic measurement in the running period, and constructs the whole period protection chain of "starting root building-verification before loading-monitoring during running": the initial configuration and the core file of the system are verified by the static measurement in the starting stage, and the trusted root is established; the kernel key data (.text section, system call table and the like) and the Mamba-Transformer-BiLSTM model itself are measured by the SM3 hash algorithm before the application loading, so as to prevent the tampering risk in the loading link; the process behavior is collected in real time by the eBPF technology in the running period, and the cooperative monitoring of the kernel data and the process behavior is realized. The design solves the defects of the traditional scheme "only covering the starting stage", "ignoring the kernel key data in the running period" or "single protection dimension", forms the whole-dimensional protection from the system initialization to the whole process of running, from the kernel layer to the application layer, effectively resists the dynamic attacks such as Rootkit tampering, process injection and memory horse, and can adapt to the special scene of "not tampering the file body but damaging the running integrity".

[0019] Improve anomaly detection accuracy and generalization ability, accurately identify complex unknown attacks: the Mamba-Transformer-BiLSTM model proposed in the application realizes the deep extraction of time sequence characteristics through multi-module cooperation: SSM (Mamba structure) is used to capture the long-term dependence of long sequence behavior, solve the problem of insufficient traditional LSTM modeling; accurately describe local sudden anomalies through BiLSTM; focus on key time step features with the help of the multi-head attention mechanism of Transformer, reduce redundant interference; at the same time, sample enhancement, Focal Loss loss function and weight decay are used to solve the small sample attack detection bias and overfitting problem. The model replaces the traditional detection method relying on artificial features, realizes automatic feature learning, and achieves 96.05% detection accuracy, 95.83% recall rate and 95.03% F1 score on ADFA-LD dataset, which is significantly better than J48, SVM, traditional CNN+LSTM and other models. Compared with the traditional scheme "complex attack time sequence modeling is insufficient, and the generalization ability is weak", this model can accurately identify unknown attacks and multiple types of complex attacks (such as privilege escalation, process injection, etc.), and adapt to dynamically changing attack modes.

[0020] Optimize resource scheduling efficiency, balance security protection and system performance: The application realizes on-demand allocation of resources through a multi-dimensional risk assessment driven hierarchical response mechanism: based on the four-dimensional index calculation of "abnormal confidence-context risk-trend risk-threat mode", the comprehensive score is calculated, and the threat is divided into low, medium, high and serious four levels, and the differential response strategy of log recording, lightweight detection, integrity measurement and process blocking is corresponding. Low-risk scenarios only retain logs and do not occupy additional computing resources; medium-risk scenarios avoid misjudgment and performance loss through lightweight detection, and support risk upgrade mechanism (automatic promotion of response level when secondary risk score exceeds threshold); high-risk and serious-risk scenarios concentrate resources to perform integrity verification and blocking operations. Experimental data shows that the traditional fixed cycle measurement scheme (cycle set to 5s) and the proposed framework detect the same kernel key data and process code segment. Compared with the traditional fixed cycle measurement scheme, the average detection delay of the scheme in this paper is reduced from 1606.5ms to 1186.148ms, the average memory usage is reduced from 8% to 6.12%, which significantly optimizes the resource consumption and response efficiency while ensuring the effectiveness of detection. The measurement coverage is expanded from single kernel static data to "kernel + process" scenario, solving the problem that the traditional scheme source deployment strategy is not refined enough, and the efficiency and safety are difficult to balance. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 For in-depth defense dynamic measurement architecture diagram;

[0022] Figure 2 Process behavior anomaly detection architecture diagram;

[0023] Figure 3 Figure 1 is a Mamba-Transformer-BiLSTM model diagram;

[0024] Figure 4 Figure 2 is a schematic diagram of a kernel key data measurement function experiment;

[0025] Figure 5 Figure 3 is a schematic diagram of a security detection mechanism function experiment Figure 1 ;

[0026] Figure 6 Figure 4 is a schematic diagram of a security detection mechanism function experiment Figure 2 .

[0027] Figure 7 Figure 5 is a schematic diagram of a key data single measurement average time consumption. DETAILED DESCRIPTION

[0028] Embodiment 1

[0029] As shown in Figures 1 to 3 , the present application discloses a dynamic measurement method for virtual machine kernel data and process behavior cooperative monitoring, and the technical scheme adopted is as follows: Step A: environment initialization and data collection, static measurement is performed in the virtual machine startup phase to establish a system trusted root, and through the monitoring hook of the security agent deployed in the system kernel, kernel static data is collected in real time and system call sequence data of process runtime is collected through eBPF technology; wherein the security agent further includes a control hook, the control hook is used to execute the detection results output by the measurement module, and the control hook controls: according to the output results of the measurement module, the kernel is prevented or the suspicious process is blocked, and operations such as rejecting to load suspicious modules; for example, when the measurement module finds that the kernel module is maliciously tampered, it rejects to load the untrusted kernel module; the monitoring hook is mainly responsible for acquiring the data of the measured object, and sending it to the security detection mechanism; the monitoring hook: real-time collection of data of the measured object, such as kernel code segment, page table, IDT, system call table information, and sending to the subsequent security detection mechanism and key area monitoring module; Step A further includes the following steps: Step A1: in the virtual machine startup phase, static measurement is performed on the initial state of the system to establish an initial security baseline; Step A2: monitoring and collecting data through the monitoring hook, the kernel static data includes data information of the kernel code segment.text, the system call table, and the interrupt descriptor table (IDT) transmitted into the measurement module; Step A3: Collecting system call data of process creation and running stage transparently through eBPF technology, synchronously storing to call log, realizing full-link behavior record and trace; Step B: Measuring before process loading, integrity measuring kernel critical data and Mamba-Transformer-BiLSTM model by measuring module;

[0030] Step B further comprises the following steps: Step B1: Integrity measuring kernel critical region data by SM3 hash algorithm, kernel code segment obtains boundary through kallsyms_lookup_name() locating _stext and _etext symbol, and SM3 hash is calculated by sliding window method; for critical data structure, IDT (Interrupt Descriptor Table) base address is obtained by reading VBAR_EL1 register, and the first 128 bytes of content are read, sys_call_table address is located by symbol table, and all system call entrances are traversed by 8-byte table item, and MMU control bit and other data are encapsulated into Mem_Critical_Data structure and a single SM3 hash value is calculated; Figure 2 Step B2: IDT base address is obtained by reading VBAR_EL1 register, and the first 128 bytes of content are read, sys_call_table address is located by symbol table, and all system call entrances are traversed by 8-byte table item, and MMU control bit and other data are encapsulated into Mem_Critical_Data structure and a single SM3 hash value is calculated; Step B3: Program segment length of PT_LOAD type and PF_X flag is obtained by ELF header analysis, and SM3 hash is calculated by page granularity; Step B4: Integrity measuring Mamba-Transformer-BiLSTM model; Step C: Real-time detecting by security detection mechanism after process loading and responding according to detection result, establishing security monitoring mechanism, analyzing process behavior, reading call log, modeling data based on system call sequence generated by normal process in call log, constructing abnormal detection framework of Mamba-Transformer-BiLSTM model, using Mamba-Transformer-BiLSTM model to depict behavior profile of normal process, and using constructed Mamba-Transformer-BiLSTM model to detect anomaly, calculating anomaly degree of process by loading abnormal detection model, and outputting abnormal process information and specific abnormal short sequence to detection log;

[0031] The process of constructing Mamba-Transformer-BiLSTM model and realizing abnormal detection in step C further comprises: ​C1: Data Preprocessing and Augmentation. The system call sequence is parsed from the dataset, and normal behavior and various types of attack behavior are collected separately and uniformly organized into fixed-length subsequences (length 50). To address the problem of insufficient attack samples in the original data, an attack sample augmentation mechanism based on perturbation and time-series transformation is designed. By adding Gaussian noise and time step perturbation strategies, the diversity of data is expanded. To improve the expressive power of the sequence, a statistical feature enhancement module is introduced to calculate the local mean and standard deviation, construct a three-dimensional input tensor, and enhance the modeling ability of local behavior patterns. C2: The original input features are first mapped to an embedding space of a specified dimension (64) through a linear transformation using a linear embedding layer to improve the representation capability of the features; C3: Introduces the State-Space Module (SSM). This module models the input sequence by introducing additional state transition and output matrices, and helps capture long-term dependencies. The SSM module iteratively updates the hidden states in a loop, generating the output for the current time step, helping the model retain contextual information when capturing time-series patterns. The SSM consists of the following parameters: State transition matrix The dynamics used to control state updates can capture long-term dependencies in the sequence. Matrix A performs a linear transformation on the historical state through matrix multiplication, determining whether to retain or forget information. Input matrix Input feature x t Mapping to the hidden state space; it controls the degree to which the current input contributes to the state update; Output matrix Matrix C will hide state h t Mapping to the output space yields the output y of the current time step. t The key lies in deciding how to extract useful features from the hidden state for downstream tasks. The State-Space Model (SSM) module is updated using the following formula: h t =tanh(h) t-1 A+x t B) y t =Ch t Where, d h To hide the state dimension, d x Let d be the input feature dimension. y h is the output dimension. t-1 It is the hidden state of the previous time step, and the hidden state of the current time step is h. t The input feature x at the current time step t, tanh is the activation function, y t is the output of the current time step t; C4: The SSM state space outputs to the multi-head attention module. This module can learn the relationship between different time steps and automatically assign different weights to each time step. The multi-head attention mechanism calculates multiple single-head attentions in parallel. Single-head attention uses a calculation operation to divide the dot product result of the query matrix Q and the key matrix V by a scaling factor to avoid the gradient vanishing caused by the large dot product value. The dot product result is normalized by the Softmax activation function to calculate the attention weight. Then, the calculated attention weight is multiplied by the value matrix to obtain the single-head attention result. After that, the outputs of each single-head are concatenated together, and the final output is obtained through linear transformation. The specific calculation process is as follows: Multi-Head Attention=Concat(Attention1,...,Attention h )W O where Q: Query matrix, where n is the sequence length, and dk is the query vector dimension; K: Key matrix, V: Value matrix, where n is the sequence length, and dv is the query vector dimension; WO: Linear transformation matrix of each head and output, dx is the input dimension; C5: Bidirectional long short-term memory network module, which uses multiple layers of Bi-LSTM, each containing 128 hidden units, and uses dropout regularization technology to prevent overfitting, thereby improving the model's generalization ability and robustness. Each LSTM unit itself consists of four key steps: input gate i t regulates the flow of information into the storage unit, and the output gate o t determines the degree of influence of the memory cell state on the current time step network output; in addition, the forget gate f t is used to control the retention time of existing information; at each time step t, the value of the memory cell C t is filtered by the forget gate to obtain the value of the previous time step (f t *C t-1 ) and the new candidate information through the input gate When the memory cell is updated, the current hidden layer h t is updated according to the current output gate ot To determine, the above process is updated according to the bidirectional long short-term memory network module calculation formula, and the above process is updated according to the following calculation formula: i t = sigma (W i * [h t-1 , x t ] + b i ) f t = sigma (W f * [h t-1 , x t ] + b f ) o t = sigma (W o * [h t-1 , x t ] + b o ) h t = o t * tanh (C t ) Wherein, sigma is sigmoid activation function, tanh is also an activation function, W is weight, and b is bias parameter; C6: The full connection layer adopts ReLU activation function to realize nonlinear mapping, maps the features to the final classification space, distinguishes the process behavior belonging to attack or normal two categories, converts the output into probability distribution through Softmax function, intuitively presents the confidence of different category prediction, and realizes process behavior anomaly detection relying on the cooperative operation of the whole model. The input data is processed layer by layer through embedding layer, SSM module, attention mechanism, LSTM layer and full connection layer, and feature extraction and classification prediction are gradually completed; in the model training stage, the focal loss function is adopted to improve the learning ability of difficult samples, and the AdamW optimizer and ReduceLROnPlateau learning rate scheduler are matched, the learning rate is dynamically adjusted, the stability and efficiency of model convergence are ensured, at the same time, the mixed precision training (AMP) combined with gradient scaling strategy is introduced, the memory occupation is reduced, the model training process is significantly accelerated, and the balance optimization of performance and resource consumption is realized; The security detection mechanism further includes a process behavior anomaly analysis module, a comprehensive scoring module and a hierarchical response module; The process behavior anomaly analysis module performs anomaly detection based on process call logs; the system call logs are generated by a lightweight behavior collection system based on eBPF technology, and the logs are used as the core analysis basis for anomaly detection; the process behavior analysis model reads the audit logs, constructs the behavior profile based on the normal process system call sequence, calculates the anomaly degree of the real-time process behavior through the Transformer-BiLSTM model, and outputs the detected abnormal process information and specific abnormal short sequence to the detection log; The comprehensive score module performs weighted operation on the risk values of each dimension based on the preset weight rules to generate a comprehensive score that can reflect the current process security state; the core dimensions of risk assessment are determined, including the context awareness dimension (i.e., combining the context information such as the system environment and associated processes of the process running), the trend risk dimension (i.e., analyzing the trend characteristics such as the duration and frequency of abnormal activities), and the threat pattern recognition dimension (i.e., matching the known malicious behavior pattern library); The output comprehensive score result is used as the decision basis for the hierarchical response module to determine the execution direction of the subsequent security response; The hierarchical response module divides the process security threats into different levels according to the comprehensive score output by the comprehensive score module, and configures differentiated response strategies for different levels of threats; Low-risk level: For this level of threat, only log recording operation is triggered, and there is no intervention to the normal running of the process, and only risk event data is retained for subsequent tracing; Medium-risk level: For this level of threat, a lightweight deep detection process is triggered to further collect process-related data to confirm the risk level and avoid the impact of false positives on system performance; High-risk level: For this level of threat, the integrity measurement module is sent a complete integrity measurement trigger signal, and the module performs integrity verification on the process key files and memory areas to confirm whether there are malicious behaviors such as file tampering or memory injection; Severe risk level: For this level of threat, an emergency control signal is directly sent to the security agent, and the agent calls the preset control hook to perform blocking or termination operations on the target process to quickly contain the threat spread; The security detection mechanism realizes flexible and accurate response to different types of security threats while ensuring that the system performance is not significantly affected through the multi-level technical architecture of "anomaly analysis-comprehensive scoring-hierarchical response", thereby improving the overall security protection capability of the system; The hierarchical response module also includes a measurement module and a security audit module, and the measurement process of the measurement module can be divided into two categories: The first type of measurement: this type of measurement is mainly aimed at the kernel modules in the system, kernel key data, shared libraries, Mamba-Transformer-BiLSTM model, and involves integrity verification during module loading and library loading; by using the SM3 hash algorithm to calculate the hash of the loaded kernel modules and shared libraries, and comparing the calculation result with the expected value in the baseline library, it is judged whether there is tampering behavior; this method can effectively ensure that the content of the kernel module and the shared library is not illegally modified; in addition, for kernel key area data such as.text segment, SELinux configuration, system call table and IDT, the system uses periodic measurement to regularly check the integrity of these key areas to ensure that they are always in a safe state; The second type of measurement: when the security detection mechanism identifies a high-risk threat, the measurement module will receive a signal, triggering integrity measurement of process code segments, loaded executable files, configuration files, etc., and comparing the measurement results with the baseline values pre-established in the baseline library. If the integrity of the system is compromised, the system will repair it through the security audit function to restore the system to a trusted state; through these two types of measurement mechanisms, the measurement model can actively monitor and prevent potential tampering behavior, and can respond and repair in time when the system integrity is threatened, thereby enhancing the security and reliability of the system; In the case of serious tampering with system integrity, the security audit module can record all security events in detail and perform trace analysis on the historical state of the system to help restore the integrity of the system; through in-depth analysis of the measurement data and logs, the security audit module can trace the root cause of abnormal behavior, identify attack paths and vulnerabilities, and provide important basis for subsequent defense mechanism design and vulnerability repair; Step D: comprehensive scoring, based on the results of the anomaly detection, the comprehensive scoring module combines the context awareness, historical trajectory dynamic characteristics and threat pattern recognition to calculate a comprehensive risk score;

[0032] Step D further comprises the following steps: D1: The comprehensive risk assessment mechanism is a multi-dimensional threat assessment framework that calculates a comprehensive assessment score by calculating the anomaly detection result, historical trajectory dynamic characteristics, context awareness, and threat pattern recognition; the comprehensive risk score calculation formula is: where w i ={w base ,w context ,w trend ,w pattern} is the weight vector; r i ={r base ,r contextr trend r pattern} is a risk component vector; D2: By introducing the historical trajectory dynamic characteristic dimension, the historical behavior trajectory change trend of the target object is analyzed, the corresponding weight coefficient of the dimension is given, the historical risk trajectory passes through the historical evaluation buffer to record the past risk evaluation results, the change trend of the risk score in the last five times is analyzed to detect whether the threat is continuously upgraded, so as to provide an early warning signal, and the historical trajectory dynamic characteristic component calculation formula is: Wherein, n is the historical window size, which is set to 5 here, R i is a historical risk score sequence, and β=0.05 is a single step increment weight; is a historical evaluation buffer; is the number of evaluation records in the buffer; D3: By combining the context perception dimension, the weight distribution is adjusted based on the system environment where the target object is located, so that the evaluation result adapts to the security requirements in different scenes. The component calculation formula is as follows: Wherein, C j ={U cpu , U mem , U conn} are respectively, CPU usage, memory usage, and network connection number; is an indicator function, which returns 1 when the condition is true, otherwise returns 0; α is the context weight, and τ is the threshold vector; D4: By integrating the threat pattern recognition dimension, by matching the preset known threat pattern library, higher weight is given to the risk characteristics with high matching degree, and the sensitivity to known threats is strengthened. The calculation formula is as follows: The matching function definition formula is: f(m p )=min(0.2,m p ×0.05) Wherein, m p is the number of index matching, and w p is the weight of each threat mode; D5: By event response priority sorting, it is ensured that serious threats obtain immediate attention, and the detection confidence is considered in the decisive scene. The event response priority calculation formula is: Wherein, Θ={θ crit , θhigh ,θ med ,θ low}={0.85,0.65,0.4,0.2},P∈[0,100]; Step E: Hierarchical response, the hierarchical response module triggers the differentiated response strategy corresponding to the threat level according to the comprehensive risk score, and the response strategy gradually enhances from only recording logs to triggering integrity measurement or even terminating the process;

[0033] The step E further comprises the following steps: E1: Triggering log recording when the comprehensive score is low, and the log entry captures time metadata, risk score and feature importance vector for forensic analysis and model refinement; E2: Triggering lightweight detection when the comprehensive score is medium, and the risk event starts rapid reconnaissance, checking key indicators including process enumeration, resource utilization analysis and network connection audit; the lightweight check calculates the secondary risk score according to four indicators: N proc : total number of processes N hcpu : number of high CPU occupation processes N conn : number of network connections U mem : memory usage detection γ ={0.2,0.3,0.2,0.3} δ ={200,3,100,80} When r lc exceeds the threshold value ε esc =0.7, the system automatically upgrades the response to the third level of response, realizing a dynamic escalation mechanism; the implementation formula is as follows: E3: Triggering integrity measurement when the comprehensive score is high, using SM3 to calculate the hash of the code segment of the high-risk process and the loaded executable file, and checking with the baseline established in the baseline library; if the integrity is found to be damaged, a signal is sent to the security agent, and the control hook in the security agent performs blocking or termination on the process and is repaired through security audit to restore the trusted state; E4: When the comprehensive score is high, an emergency control signal is directly sent to the security agent, the security agent calls the preset control hook to perform blocking or termination operation on the target process to quickly contain the threat spread; then the system is restored to a trusted state through security audit repair; Step F: update the baseline library, including static baseline library and dynamic baseline library, the static baseline library stores the initial configuration of the system, global parameters, fixed data of known security version and deep learning model; the dynamic baseline library uses writable storage method, only allows authorized users or processes to modify through specific security interface, the interface uses encryption communication and identity verification means to further prevent the intrusion of malicious users or processes, thereby ensuring the security of data.

[0034] The practical results are as follows:

[0035] Kernel critical data measurement function experiment

[0036] This part selects the kernel-level Rootkit of LKM type Rootkit to evaluate the effectiveness of the system in measuring the integrity of kernel data before process loading;

[0037] Using the Inline Hook technology of LKM type Rootkit can redirect the execution flow of the target function to the function predefined by the attacker by modifying the prologue of the target function, thereby achieving malicious purposes; for example, when the execution flow of the kernel function proc_root_readdir is redirected, it can be used to hide some malicious processes; it should be noted that the prologue of the kernel function is located in the.text segment of the Linux kernel, therefore, performing integrity check on this segment can effectively defend against such attacks, as shown in Figure 4 ;

[0038] Mamba-Transformer-BiLSTM model detection effect comparison experiment

[0039] 1): The dataset ADFA-LD (Australian Defence Force Academy Linux Dataset) is a classic host-level intrusion detection benchmark dataset released in 2013 developed by the Australian Defence Academy; it contains system call sequences used to simulate normal and attack behaviors, including brute force attacks, Meterpreter payloads, adding superusers and web shells, etc. attack types; the dataset is small in size: 833 normal sequences in the training set, 4372 normal sequences in the validation set, and 746 sequences (across 6 attack types) in the attack set;

[0040] 2): Experimental results and analysis

[0041] The performance of the model used herein on the ADFA-LD dataset reaches the following indicators: accuracy of 96.05%, precision of 94.24%, recall of 95.83%, and F1_score of 95.03%. Compared with the detection indicators of other models, the model is higher in accuracy, and in F1_score, it is only second to PCA and MLP. As shown in Table I;

[0042] Table I:

[0043] Security detection mechanism function experiment function experiment

[0044] This part simulates several typical Linux systems such as attack privilege escalation attack, backdoor creation attack (Backdoor Creation), process injection attack (Process Injection), etc. to evaluate the effectiveness of the model prediction and hierarchical response strategy after the process is loaded.

[0045] When the model prediction has been comprehensively evaluated according to the estimated score, different response strategies are triggered

[0046] Comprehensive Inspection Score<0.4, log is recorded,

[0047] 0.4≤Comprehensive Inspection Score<0.65, light detection is performed; as Figure 5 shown.

[0048] 0.65≤Comprehensive Inspection Score<0.85, integrity measurement is performed. As Figure 6 shown.

[0049] Efficiency experiment

[0050] 1) For kernel.text segment, system call table, page table, and other key areas. Perform integrity measurement 10 times in succession, and count the average time of single measurement, total running time, and memory usage. The test results show that the total measurement time of the key areas is about 1076.369ms, the overall memory usage of the kernel key data measurement is 1.1%, and the resource occupation is stable. The average time of single measurement of part of the key data is as Figure 7 shown. The total time of Kernel Text is about 1039.859ms (dominant proportion) with high calculation complexity but still acceptable. In summary, the system detection delay is low, the processing efficiency is high, which proves that the task division and scheduling optimization are reasonable, and the low memory usage further verifies that the resource management mechanism is effective.

[0051] This part of the system test hierarchical response strategy performance, respectively, trigger low, medium, high risk response strategy, each strategy repeated 30 times, statistics average delay, CPU usage and memory occupancy, verify the resource consumption characteristics of different response levels. For ease of analysis, the response mechanism is divided into Tier1-Tier3 three levels. Tier contains abnormal detection and calculation of comprehensive score and different execution strategy (log record, lightweight detection, trigger metrics), respectively, compare the performance of its core process, as shown in Table II:

[0052] Tier1 (first level response): abnormal detection, calculation of comprehensive score, log record;

[0053] Tier2 (second level response): abnormal detection, calculation of comprehensive score, lightweight detection;

[0054] Tier3 (third level response): abnormal detection, calculation of comprehensive score, trigger integrity metrics to verify suspicious processes in depth.

[0055] Table II:

[0056] The traditional fixed cycle measurement scheme (period set to 5s) and the proposed framework are used to detect the same kernel key data and process code segment. The results are shown in Table III. The average CPU usage of the scheme in this paper is higher than that of the traditional periodic measurement scheme, but the comprehensive core indicators are better, the average detection delay is lower, the memory occupancy is less, and the measurement coverage is expanded from single kernel static data to kernel and process full scene. At the same time, through hierarchical response, resources are allocated on demand, and the overall efficiency and protection efficiency are significantly better than the traditional scheme. The high CPU usage does not affect the overall practical efficiency.

[0057] Table III: Measurement performance comparison table

[0058] Although the specific embodiments of the present application have been described in detail above, the present application is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present application, and modifications or deformations without creative labor are still within the protection scope of the present application.

Claims

1. A dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior, characterized in that, Includes the following steps: Step A: Environment initialization and data acquisition. Static measurements are performed during the virtual machine startup phase to establish a system root of trust. Real-time static kernel data is collected via monitoring hooks in a security agent deployed in the system kernel, and system call sequence data during process runtime is collected using eBPF technology. The security agent also includes control hooks, which execute the detection results output by the measurement module. The monitoring hooks are primarily responsible for acquiring data from the measured object and sending it to the security detection mechanism. Step B: Measurement before process loading, the measurement module performs integrity measurement on critical kernel data and the Mamba-Transformer-BiLSTM model; Step C: After the process is loaded, a security detection mechanism is used to detect in real time and respond in a graded manner according to the detection results. A security monitoring mechanism is established to analyze process behavior, read the call log, and use the system call sequence generated by normal processes in the call log to model data. An anomaly detection framework based on the Mamba-Transformer-BiLSTM model is constructed to characterize the behavioral profile of normal processes. The constructed Mamba-Transformer-BiLSTM model is used to detect anomalies. The degree of abnormality of the process is calculated by loading the anomaly detection model, and the detected abnormal process information and specific abnormal short sequences are output to the detection log. Step D: Comprehensive scoring. Based on the results of the anomaly detection, the comprehensive scoring module combines risk assessment indicators from multiple dimensions, including context awareness, historical trajectory dynamic characteristics, and threat pattern recognition, to calculate a comprehensive risk score. Step E: Tiered response. The tiered response module triggers differentiated response strategies corresponding to the threat level based on the comprehensive risk score. The response strategies are progressively enhanced, from simply logging to triggering integrity measurements and even terminating the process. Step F: Update the baseline library, including the static baseline library and the dynamic baseline library.

2. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: Step A also includes the following steps: Step A1: During the virtual machine startup phase, perform static measurements on the initial system state to establish an initial security baseline; Step A2: Monitor and collect data through monitoring hooks. The kernel static data, including kernel code segment .text, system call table, and interrupt descriptor table (IDT) data information, is passed to the measurement module. Step A3: Transparently collect system call data during the process creation and operation phases using eBPF technology, and synchronously store it in the call log to achieve end-to-end behavior recording and traceability.

3. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: Step B also includes the following steps: Step B1: The SM3 hash algorithm is used to perform integrity measurement on the data in the critical kernel region. The kernel code segment uses kallsyms_lookup_name() to locate the _stext and _etext symbols to obtain the boundary, and uses a sliding window method to calculate the SM3 hash in segments. Step B2: Obtain the base address of the Interrupt Descriptor Table (IDT) by reading the VBAR_EL1 register and read the first 128 bytes of content. After locating the address of sys_call_table through the symbol table, traverse all system call entry points by 8-byte table entries, encapsulate them with data such as MMU control bits into the Mem_Critical_Data structure, and calculate a single SM3 hash value. Step B3: Locate the program segment of type PT_LOAD with the PF_X flag by parsing the ELF header, obtain the length of the file code region, and calculate the SM3 hash page by page at the page granularity; Step B4: Perform an integrity metric on the Mamba-Transformer-BiLSTM model.

4. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: Step C, which involves constructing and implementing the Mamba-Transformer-BiLSTM model for anomaly detection, also includes: C1: Data preprocessing and augmentation, the system call sequence is parsed from the dataset, normal behavior and various types of attack behavior are collected separately, and they are uniformly regularized into fixed-length subsequences. The data diversity is expanded by adding Gaussian noise and time step perturbation strategies. A statistical feature enhancement module is introduced to calculate the local mean and standard deviation and construct a three-dimensional input tensor. C2: The original input features are first mapped to an embedding space of a specified dimension through a linear transformation using a linear embedding layer; C3: Introduces the State-Space Module (SSM). This module models the input sequence by introducing additional state transition and output matrices, and helps capture long-term dependencies. The SSM module iteratively updates the hidden states in a loop, generating the output for the current time step, helping the model retain contextual information when capturing time-series patterns. The SSM consists of the following parameters: State transition matrix The dynamics used to control state updates can capture long-term dependencies in the sequence. Matrix A performs a linear transformation on the historical state through matrix multiplication, determining whether to retain or forget information. Input matrix Input feature x t Mapping to the hidden state space; it controls the degree to which the current input contributes to the state update; Output matrix Matrix C will hide state h t Mapping to the output space yields the output y of the current time step. t The key lies in deciding how to extract useful features from the hidden state for downstream tasks. The State-Space Model (SSM) module is updated using the following formula: h t = tanh(h t-1 A+x t B) y t =C.h t Where, d h To hide the state dimension, d x Let d be the input feature dimension. y h is the output dimension. t-1 It is the hidden state of the previous time step, and the hidden state of the current time step is h. t The input feature x at the current time step t tanh is the activation function, y t This is the output for the current time step t; C4: Outputs the SSM state space to the multi-head attention module. This module can learn the relationships between different time steps and automatically assign different weights to each time step. The multi-head attention mechanism computes multiple single-head attentions in parallel. The single-head attention utilizes the computational operation of dividing the dot product of the query matrix Q and the key matrix V by a scaling factor. To avoid gradient vanishing due to excessively large dot product values, the dot product result is normalized using the Softmax activation function to calculate the attention weights. These calculated attention weights are then multiplied by the value matrix to obtain the single-head attention result. The outputs of each single head are then concatenated, and a linear transformation is applied to obtain the final output. The specific calculation process is as follows: Multi-Head Attention=Concat(Attention1,...,Attention h )W O Where Q: Query matrix, Where n is the sequence length, d k For query vector dimensions; K: Key matrix V: Value matrix Where n is the sequence length, d v For query vector dimensions; WO: Linear transformation matrix for each header and output. d x For input dimensions; C5: A bidirectional long short-term memory network module that uses a multi-layer Bi-LSTM and dropout regularization to prevent overfitting, thereby improving the model's generalization ability and robustness. Each LSTM unit consists of four key steps: input gate, forget gate, candidate cell state, and output gate. The input gate i... t Adjusting the information flow entering the storage unit, output gate o t This determines the degree to which the state of the memory unit affects the network output at the current time step; in addition, the forget gate f t Used to control the retention duration of existing information; at each time step t, memory unit C... t The value will be filtered through the forget gate to match the value from the previous time step (f). t *C t-1 ) and obtain new candidate information through the input gate. Once the memory unit is updated, the current hidden layer h t Based on the current output gate o t To determine this, the above process is updated based on the following calculation formula: i t =σ(W i ·[h t-1 ,x t ]+b i ) f t =σ(W f ·[h t-1 ,x t ]+b f ) the t =σ(W o ·[h t-1 ,x t ]+b o ) h t = no t *fish(C) t ) Where σ is the sigmoid activation function, tanh is also an activation function, W is the weight, and b is the bias parameter; C6: The fully connected layer uses the ReLU activation function to achieve non-linear mapping, mapping features to the final classification space to distinguish between attack and normal process behavior; the output is transformed into a probability distribution through the Softmax function, intuitively presenting the confidence of different categories of prediction; the entire model relies on the collaborative operation of multiple modules to achieve abnormal process behavior detection; the input data is processed layer by layer through the embedding layer, SSM module, attention mechanism, LSTM layer and fully connected layer, gradually completing feature extraction and classification prediction; during the model training stage, the focus loss function is used to improve the learning ability of hard samples, and the AdamW optimizer and ReduceLROnPlateau learning rate scheduler are used to dynamically adjust the learning rate to ensure the stability and efficiency of model convergence. At the same time, mixed precision training (AMP) combined with gradient scaling strategy is introduced to significantly accelerate the model training process while reducing memory usage, achieving a balance between performance and resource consumption.

5. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: Step D further includes the following steps: D1: The comprehensive risk assessment mechanism is a multi-dimensional threat assessment framework. It calculates a comprehensive assessment score by analyzing anomaly detection results, historical trajectory dynamics, context awareness, and threat pattern recognition. The formula for calculating the comprehensive risk score is: Among them, w i ={w base ,w context ,w trend ,w pattern } is a weight vector that reflects the relative importance of each component and can be set according to different scenarios; r i ={r base ,r context ,r trend ,r pattern } represents the risk component vector; D2: By introducing the dynamic characteristics dimension of historical trajectory, the changing trends of the target object's historical behavioral trajectory are analyzed. This dimension is assigned corresponding weight coefficients. Historical risk trajectories are used to record past risk assessment results through a historical assessment buffer. The changing trends of the most recent five risk scores are analyzed to detect whether the threat is continuously escalating, thus providing early warning signals. The formula for calculating the dynamic characteristics component of historical trajectory is: Where n is the size of the history window, which we set to 5 here, R i The sequence represents the historical risk score, with β = 0.05 representing the single-step incremental weight. This serves as a buffer for historical evaluation. This represents the number of evaluation records in the buffer. D3: By combining the context-aware dimension, the weight allocation is adjusted based on the system environment in which the target object exists, so that the evaluation results are adapted to the security requirements of different scenarios. The calculation formula for this component is as follows: Among them, C j ={U cpu U mem U conn These are, respectively, CPU utilization, memory utilization, and network connections; This is an indicator function that returns 1 if the condition is true and 0 otherwise; α is the context weight, and τ is the threshold vector. D4: By incorporating a threat pattern recognition dimension and matching against a pre-defined library of known threat patterns, higher weights are assigned to risk features with high matching rates, thereby enhancing sensitivity to known threats. The calculation formula is as follows: The matching function is defined as follows: f(m p )=min(0.2,m p ×0.05) Where, m p w represents the number of metric matches. p Weights for each threat pattern; D5: Prioritize event responses to ensure critical threats receive immediate attention, while also considering detection confidence in decisive scenarios. The event response priority calculation formula is as follows: Where, Θ={θ crit ,i high ,i med ,i low }={0.85,0.65,0.4,0.2}, P∈[0,100].

6. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: Step E further includes the following steps: E1: Log recording is triggered when the overall score is low. The log entry captures time metadata, risk score and feature importance vector for evidence analysis and model refinement. E2: When the overall score is medium, a lightweight detection is triggered. Rapid reconnaissance is initiated upon a risk event, checking key indicators including process enumeration, resource utilization analysis, and network connectivity audit. The lightweight check calculates a secondary risk score based on these four indicators: in: When r lc Exceeding the threshold ε esc When the response level is 0.7, the system automatically upgrades the response to Level 3, implementing a dynamic escalation mechanism; the formula is as follows: E3: When the overall score is high, an integrity measurement is triggered. SM3 is used to perform hash calculations on the code segments and loaded executables of high-risk processes and to verify them against the baselines established in the baseline library. If integrity is found to be compromised, a signal is sent to the security agent. The control hooks in the security agent block or terminate the process and restore it to a trusted state through security audit. E4: When the overall score is high-severity risk, an emergency control signal is sent directly to the security agent. The security agent invokes preset control hooks to block or terminate the target process, quickly curbing the spread of the threat.

7. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: The static baseline library in step F stores the initial configuration of the storage system, global parameters, fixed data of known security versions, and deep learning models.

8. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: The dynamic baseline library in step F uses a writable storage method, which only allows authorized users or processes to modify it through a specific secure interface that uses encrypted communication and authentication methods.

9. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: The security detection mechanism in step C also includes a process behavior anomaly analysis module, a comprehensive scoring module, and a graded response module. The process behavior anomaly analysis module performs anomaly detection based on process call logs. The comprehensive scoring module performs weighted calculations on risk values ​​of each dimension based on preset weight rules to generate a comprehensive score that reflects the current security status of the process. The graded response module classifies process security threats into different levels based on the comprehensive score output by the comprehensive scoring module and configures differentiated response strategies for different levels of threats.

10. The dynamic measurement method for collaborative monitoring of virtual machine kernel data and process behavior according to claim 1, characterized in that: The hierarchical response module also includes a measurement module and a security audit module. The measurement process of the measurement module can be divided into two categories: The first type of metric: This type of metric mainly targets kernel modules, critical kernel data, shared libraries, and the Mamba-Transformer-BiLSTM model in the system, involving integrity verification during module loading and library loading; by using the SM3 hash algorithm to perform hash calculations on the loaded kernel modules and shared libraries, and comparing the calculation results with the expected values ​​in the baseline library, it can be determined whether there has been any tampering. The second type of measurement: When the security detection mechanism identifies a high-risk threat, the measurement module will receive a signal and trigger an integrity measurement of the process code segment, loaded executable files, configuration files, etc., and compare the measurement results with the baseline values ​​pre-established in the baseline library. If the integrity of the system is compromised, the system will repair it through the security audit function and restore the system to a trusted state. Through these two types of measurement mechanisms, the measurement model can proactively monitor and prevent potential tampering. In the event of severe tampering with system integrity, the security audit module can record all security events in detail and perform source analysis on the system's historical state to help restore system integrity. Through in-depth analysis of measurement data and logs, the security audit module can trace the root cause of abnormal behavior, identify attack paths and vulnerabilities, and provide important basis for subsequent defense mechanism design and vulnerability remediation.

Images