A virtual machine file integrity monitoring method and system using a hierarchical hash tree

Abstract

An efficient virtual machine file integrity monitoring method and system utilizing hierarchical hash trees is disclosed. The method is based on hardware-assisted virtualization, capturing key file system call events of the Guest OS at the Hypervisor layer. It obtains file paths, metadata, and content summaries based on adaptive segmented sampling through memory parsing, constructing a hierarchical hash tree as a unified representation of the integrity baseline and runtime state. When file changes are detected, the system performs only local incremental updates to the hash tree, reducing computational complexity to O(log n). Threat determination is performed by combining multi-dimensional features such as change frequency and file type concentration within a sliding time window, triggering a tiered response. When the threat level reaches a preset threshold, the system physically pauses the virtual machine and quickly locates the target set of changed files by performing a top-down difference traversal by comparing the current hash tree with the baseline hash tree. This invention achieves strong external isolation monitoring, effectively defending against ransomware and internal threats, and combines high real-time performance with low performance overhead.

Description

Technical Field

[0001] This invention belongs to the field of network security and file integrity monitoring technology, specifically relating to a virtual machine file integrity monitoring method and system using a hierarchical hash tree, applicable to cloud computing and industrial control virtualization environments for preventing ransomware and insider threats. Background Technology

[0002] With the widespread adoption of cloud computing and virtualization technologies, virtual machines (VMs) have become core components in data centers, industrial control systems (ICS / SCADA), and enterprise environments. However, virtualized environments face serious cybersecurity threats, including ransomware that encrypts user files in bulk, insider threats that tamper with critical configurations, and kernel-level rootkits that bypass traditional security mechanisms. These threats can lead to data loss, system crashes, or physical device damage, causing significant economic losses. According to industry reports, ransomware attacks are experiencing a surge in annual growth rates in virtualized environments, while traditional security tools suffer from high detection latency and false positive rates.

[0003] File Integrity Monitoring (FIM) is a classic security technology used to detect file tampering or alteration. It establishes a baseline by calculating file hash values ​​and metadata, and compares changes periodically or in real-time. However, in virtualized environments, traditional solutions face the following serious drawbacks: Insufficient isolation, easily bypassed: Traditional FIM systems are mostly deployed inside virtual machines (Guest OS), and the monitoring agent is easily tampered with or disabled by kernel-level rootkits or ransomware.

[0004] The semantic gap is a prominent issue: Although external monitoring solutions based on Virtual Machine Introspection (VMI) have strong isolation, the Hypervisor layer can only access physical memory, making it difficult to efficiently and accurately extract and parse high-level semantics of the file system, resulting in limited real-time performance.

[0005] Real-time performance and performance are difficult to balance: Existing FIMs mostly use linear hash comparisons. When batch changes occur (such as ransomware outbreaks), the computational overhead and comparison latency increase by O(n), which cannot meet the requirements for rapid response.

[0006] Inefficient location and response mechanisms: When changes to overall integrity are detected, it is impossible to quickly locate the specific damaged files, and there is a lack of a multi-dimensional judgment mechanism that combines malicious behavior characteristics, which easily leads to false alarms. Summary of the Invention

[0007] To overcome the shortcomings of the existing technologies, the present invention aims to provide a virtual machine file integrity monitoring method and system using a hierarchical hash tree. The hierarchical hash tree serves as a unified representation structure for file system integrity. Through a two-tree comparison architecture of a baseline hash tree (representing the desired state) and the current hash tree (representing the actual state), efficient updating and accurate location of file changes are achieved. This invention addresses the problems of high performance overhead, susceptibility to bypass, and difficulty in quickly locating abnormal files in existing file integrity monitoring methods within virtualization environments. The present invention proposes a virtual machine file integrity monitoring system and method based on a hierarchical hash tree.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A method for monitoring virtual machine file integrity using a hierarchical hash tree includes the following steps: S1. The host machine, based on hardware-assisted virtualization, triggers virtual machine trapping (VM-Exit) through exception injection, capturing system call events in the target operating system for predefined critical file paths; S2. Load the memory parsing configuration that matches the target virtual machine operating system kernel version, and parse and obtain the target file path and file metadata that triggered the system call event based on the register context information of the system call event; S3. For the target virtual machine operating system file path and file metadata, extract the file content digest using a segmented sampling strategy based on the file size, and calculate the content hash value of the digest; concatenate the target file path, file metadata, and content hash value, and apply a hash function to calculate the leaf node hash value; S4. In the trusted environment during the initialization phase of the target virtual machine operating system, construct a baseline hash tree and store the baseline hash tree in an isolated storage space on the host side. S5. On the host machine side, initialize another hierarchical hash tree with the same structure as the baseline hash tree as the current hash tree; its initial state is completely consistent with the baseline hash tree. S6. During the operation of the target virtual machine operating system, based on the system call events captured in real time by the host machine, the leaf node hash value of the affected file is recalculated according to the method in S3, and incremental updates are performed from bottom to top along the path from the leaf node to the root node, updating only the corresponding node in the current hash tree; the base hash tree remains unchanged. S7. Capture system call events in real time using a sliding time window, calculate the file change frequency and batch operation coefficient per unit time, set weighting coefficients and classification thresholds, and calculate a real-time threat score; trigger corresponding strategies based on the score: Low risk level: Log and issue an alert; Medium risk level: Creating a virtual machine snapshot; High risk level: Triggers a physical halt to virtual machine operation; S8. After the virtual machine is suspended due to a high-risk threat, extract the current hash tree and the base hash tree, and perform a top-down recursive comparison starting from the root node to determine the target file that has been modified.

[0009] The system call events described in S1 are for the Windows operating system, and the monitored system calls include the file write operation NtWriteFile and the file information modification operation NtSetInformationFile.

[0010] The document content summary described in S3 is calculated using a segmented sampling method, including: Full sampling branch: When the size S of the file to be monitored satisfies S <L min When the file size is less than the minimum configurable empirical parameter, the entire contents of the file are read and a hash value is calculated on the entire contents. Three-stage sampling branch: When the size S of the file to be monitored satisfies L min ≤S≤L max At that time, the header data block, middle data block and tail data block of the file are read respectively, and the hash value of the data after concatenating the three data blocks is calculated. Two-ended sampling branch: When the size S of the file to be monitored satisfies S>L max At that time, only the header and tail data blocks of the file are read separately, and the hash value is calculated on the data concatenated from these two data blocks; L min and L max These are preset empirical parameter values.

[0011] The leaf node hash value described in S3 is calculated as follows: in, To standardize the path, Including file size, file last modified time, Sample the hash value of the file content.

[0012] The construction and storage of the baseline hash tree described in S4 specifically includes: During the initialization phase of the target operating system, in a trusted clean virtual machine image environment, traverse all predefined critical files, and generate all leaf node hash values according to the methods of S1 to S3; pair and aggregate the leaf node hash values in pairs, recursively repeat, and construct a hierarchical hash tree bottom-up as the reference hash tree, and solidify and store this reference hash tree in the isolated storage space on the host side; keep it read-only and do not make any updates during subsequent monitoring.

[0013] The incremental update described in S6 includes: According to the number and parameters of the system call, the situation is as follows: When the host captures a system call event for a file write operation, read the data to be written from the memory buffer, and calculate the content hash using a segmented sampling method according to the length W_len of the data to be written: If W_len < L_min, calculate the hash value for all the content of the data to be written; If L_min ≤ W_len ≤ L_max, sample and calculate the hash values for the fixed-size data blocks at the head, middle, and tail of the data to be written; If W_len > L_max, only sample and calculate the hash values for the fixed-size data blocks at the head and tail of the data to be written; Among them, L_min and L_max are preset empirical thresholds, which are the same as or independently configured with the thresholds set for the file size in S3; When the host captures a system call event for file deletion, retain the original leaf node position and replace its hash value with a preset identification value; When the target operating system captures a system call event for file renaming, keep the node position unchanged, update the file meta-information and path information in the leaf node, and recalculate the hash value.

[0014] The top-down differential traversal process described in S8 includes: Starting from the root node, recursively compare the nodes of the current hash tree with the corresponding nodes in the reference hash tree; when the hash values of the nodes at a certain layer of the current hash tree are inconsistent with the hash values of the corresponding nodes in the reference hash tree, continue to traverse the child nodes downward until the leaf node where the hash value changes is located, and output the file path corresponding to this leaf node as the set of changed files.

[0015] An efficient virtual machine file integrity monitoring system using a hierarchical hash tree includes: Guest OS monitoring target layer: Runs in the virtual machine and contains high-risk critical files that may be tampered with, generating file system change events through system calls; Hypervisor core monitoring layer: Runs hardware-assisted virtualization-based components, triggers VM-Exit traps by injecting illegal instruction exceptions (UD Trap), intercepts target system calls in real time, implements transparent external strong isolation monitoring, and passes events to the lower layer; this layer is used by S1 to capture system call events in the target operating system targeting predefined critical file paths; File State Processing Layer: Used in S1 to S6, it receives change events, bridges semantic gaps, and performs state verification and threat assessment. Storage and Response Module: Deployed in a protected memory area outside the virtual machine, securely storing the baseline hash tree and the current hash tree; performs tiered responses based on S7 threat assessment results: logs and alarms are recorded at low risk levels, snapshots of the virtual machine are taken at medium risk levels, and physical pause of the virtual machine's running state is triggered at high risk levels; and is used by S8 to extract the current hash tree and perform a top-down difference traversal between the baseline hash tree and the current hash tree when the virtual machine is paused, locate the leaf nodes where the hash values ​​have shifted, and output the set of changed target files.

[0016] The file status processing layer includes the following core sub-modules: File information extraction module: Transparently extracts file path, size, modification time, content sampling data, and related process information from the Guest kernel data structure; used by S2 to load memory parsing configuration matching the target operating system kernel version, and to parse and obtain the target file path and file metadata that triggered the system call event based on the register context information of the system call event described in S1. The hierarchical hash tree construction and storage module is used in S3 to S6 to extract a file content digest based on the file size using a segmented sampling strategy and calculate the content hash value of the digest; it concatenates the target file path, file metadata, and content hash value, and applies a hash function to the concatenation result to calculate the hash value of the leaf nodes; it is used in S4 and S5 to construct and store the baseline hash tree and the current hash tree; and it performs incremental path updates in S6 to maintain the consistency of the current hash tree. Real-time monitoring and detection module: Based on the system call events captured by S1, perform multi-dimensional threat assessment of the current behavior.

[0017] Compared with the prior art, the present invention has the following beneficial effects: (1) Reduce the computational complexity of integrity detection By introducing a hierarchical hash tree structure, the time complexity of file state updates is reduced from O(n) for linear scanning to O(log n) for path updates, significantly reducing computational overhead in large-scale file scenarios.

[0018] (2) Avoid performance loss caused by tree structure reconstruction By keeping the leaf node topology unchanged in file deletion and renaming scenarios and only updating the node content, the rebalancing overhead of traditional tree structures when nodes change is avoided, thus improving system stability.

[0019] (3) Achieve efficient anomaly localization capability By utilizing the hierarchical structure of a layered hash tree, when an integrity anomaly occurs, the affected file can be quickly located through top-down difference traversal without recalculating the hash of all files.

[0020] (4) Balancing detection accuracy and performance overhead By calculating the file content summary through segmented sampling, the processing overhead of large files is reduced while ensuring the validity of file features, making it suitable for resource-constrained environments.

[0021] (5) Supports forensic analysis based on frozen status After detecting the anomaly, by freezing the virtual machine and comparing the current hash tree with the baseline hash tree, the range of damaged files can be accurately recovered, providing a basis for subsequent recovery and evidence collection. Attached Figure Description

[0022] Figure 1 This is a diagram of the overall system architecture of the present invention; Figure 2 This is a flowchart of the document integrity monitoring method of the present invention; Figure 3 This is a schematic diagram of a hierarchical hash tree structure and incremental update positioning. Detailed Implementation

[0023] The invention will now be further described with reference to the accompanying drawings.

[0024] 1. System Overall Architecture (see...) Figure 1 ) The overall system architecture of this invention mainly includes the following components: 1) Guest OS monitoring target layer: running in a virtual machine, containing high-risk critical files that may be tampered with, and generating file system change events through system calls; 2) Hypervisor Core Monitoring Layer: Runs hardware-assisted virtualization-based components, triggers VM-Exit traps by injecting illegal instruction exceptions (UD Trap), intercepts target system calls in real time, implements transparent external strong isolation monitoring, and passes events to the lower layer; this layer is used by S1 to capture system call events in the target operating system targeting predefined critical file paths; 3) File State Processing Layer: Used in S1 to S6, it receives change events, bridges semantic gaps, and performs state verification and threat assessment; it includes the following core sub-modules: File information extraction module: Transparently extracts file path, size, modification time, content sampling data, and related process information from the Guest kernel data structure; used by S2 to load memory parsing configuration matching the target operating system kernel version, and to parse and obtain the target file path and file metadata that triggered the system call event based on the register context information of the system call event described in S1. The hierarchical hash tree construction and storage module is used in S3 to S6 to extract the file content digest according to the file size using a segmented sampling strategy and calculate the content hash value of the digest; it concatenates the target file path, file metadata, and content hash value, and applies a hash function to the concatenation result to calculate the hash value of the leaf nodes; it is used in S4 and S5 to construct and store the current hash tree and the baseline hash tree; and it performs incremental path updates in S6 to maintain the consistency of the current hash tree. Real-time monitoring and detection module: performs multi-dimensional threat assessment of current behavior based on system call events captured by S1; 4) Storage and Response Module: Deployed in a protected memory area outside the virtual machine, securely storing the baseline hash tree and the current hash tree; performs tiered responses based on the S7 threat assessment results: logs are recorded and alarms are issued when the threat level is low, snapshots of the virtual machine are taken when the threat level is medium, and physical pause of the virtual machine's running state is triggered when the threat level is high; and is used by S8 to extract the current hash tree and perform a top-down difference traversal of the baseline hash tree when the virtual machine is paused, locate the leaf nodes where the hash values ​​have shifted, and output the set of target files that have been tampered with or destroyed.

[0025] 2. Workflow of this invention (see...) Figure 2 ) S1. Based on the hardware-assisted virtualization mechanism, a virtual machine trap (VM-Exit) is triggered through exception injection to capture system call events in the target operating system targeting predefined critical file paths; the system call events mentioned in S1 are for the Windows operating system, and the monitored system calls include the file write operation NtWriteFile and the file information modification operation NtSetInformationFile.

[0026] S2. Load the memory parsing configuration that matches the target operating system kernel version, i.e., a static database containing data structure offsets and symbol addresses for a specific Guest OS kernel version; based on the register context information of the system call event described in S1, parse and obtain the target file path and file metadata that triggered the event; S3. For the target virtual machine operating system file path and file metadata, extract the file content digest using a segmented sampling strategy based on the file size, and calculate the content hash value of the digest; concatenate the target file path, file metadata, and content hash value, and apply a hash function to calculate the leaf node hash value; the file content digest in S3 is calculated using a segmented sampling method, including: Full sampling branch: When the size S of the file to be monitored satisfies S <L min When the file size is less than the minimum configurable empirical parameter, the entire contents of the file are read and a hash value is calculated on the entire contents. Three-stage sampling branch: When the size S of the file to be monitored satisfies L min ≤S≤L max At that time, the header data block, middle data block and tail data block of the file are read respectively, and the hash value of the data after concatenating the three data blocks is calculated. Two-ended sampling branch: When the size S of the file to be monitored satisfies S>L max At that time, only the header and tail data blocks of the file are read separately, and the hash value is calculated on the data concatenated from these two data blocks; L min and L max These are preset empirical parameter values.

[0027] The leaf node hash value is calculated as follows: in, To standardize the path, Including file size, file last modified time, Sample the hash value of the file content.

[0028] S4. (Constructing a baseline hash tree) In the trusted environment during the initialization phase of the target virtual machine operating system, traverse all predefined critical files and generate all leaf node hash values ​​according to the methods described in S1 to S3; pair and aggregate the leaf node hash values ​​in pairs and recursively repeat them to construct a hierarchical hash tree from bottom to top as the baseline hash tree; and store the baseline hash tree in an isolated storage space on the host machine side, keeping it read-only and not updating it during subsequent monitoring; as a reference benchmark for subsequent integrity comparison.

[0029] In S4, the specific implementation method of "pairing and aggregating leaf node hash values ​​in pairs, recursively repeating, and constructing a hierarchical hash tree from bottom to top" is as follows: First, sort all leaf nodes in lexicographical order of file paths to ensure that the tree structure is consistent each time it is built; Then, pair up the sorted nodes two by two. If the number of nodes at the current level is odd, duplicate the last node and pair it with itself; Concatenate the hash values of each pair of nodes as a string and calculate the SHA-256 hash value of the concatenated string as the hash value of the parent node; Use the parent node as a new layer of nodes and repeat the above pairwise pairing and aggregation process, calculating layer by layer from bottom to top until a unique root node hash value is obtained; S5. (Construct the current hash tree) On the host side, initialize another hierarchical hash tree with the same structure as the reference hash tree as the current hash tree; its initial state is exactly the same as that of the reference hash tree; S6. (Runtime incremental update) During the operation of the target virtual machine operating system, based on the system call events captured in real time by the host, recalculate the hash values of the leaf nodes of the affected files according to the method in S3, and perform incremental updates from bottom to top along the path from the leaf node to the root node, only updating the corresponding nodes in the current hash tree; the reference hash tree remains unchanged; The incremental update includes: According to the number and parameters of the system call, the situation is divided as follows: When the host captures a system call event for a file write operation, read the data to be written from the memory buffer and calculate the content hash by using a segmented sampling method according to the length W_len of the data to be written: If W_len < L_min, calculate the hash value for all the content of the data to be written; If L_min ≤ W_len ≤ L_max, sample and calculate the hash values of the fixed-size data blocks at the head, middle, and tail of the data to be written; If W_len > L_max, only sample and calculate the hash values of the fixed-size data blocks at the head and tail of the data to be written; Where, L_min and L_max are preset empirical thresholds, which are the same as or independently configured with the thresholds set for the file size in S3; When the host captures a system call event for file deletion, retain the original leaf node position and replace its hash value with a preset identification value; When the target operating system captures a system call event for file renaming, keep the node position unchanged, update the file meta-information and path information in the leaf node, and recalculate the hash value.

[0030] S7. Real-time capture system call events through a sliding time window, calculate the file change frequency and batch operation coefficient per unit time, set weight coefficients and grading thresholds, and calculate the real-time threat score; trigger corresponding policies according to the score: Low risk level: Log and issue an alert; Medium risk level: Creating a virtual machine snapshot; High risk level: Triggers a physical halt to virtual machine operation; S8. After the virtual machine is paused due to a high-risk threat, extract the current hash tree and the base hash tree, and perform a top-down recursive comparison starting from the root node; determine the modified target file; the top-down difference traversal process includes: Starting from the root node, recursively compare the current hash tree node with the corresponding node in the base hash tree. If the hash value of a node at a certain level of the current hash tree is inconsistent with the hash value of the corresponding node in the base hash tree, continue traversing the child nodes downwards until the leaf node whose hash value has changed is located, and output the file path corresponding to the leaf node as the set of changed files.

[0031] In the initial trusted state of the system, a predefined set of key files is selected in the trusted virtual machine environment. For each file, its path, metadata, and content digest are extracted, and the corresponding leaf node hash value is calculated. All leaf nodes are sorted lexicographically by file path. Then, from bottom to top, the hash values ​​of every two adjacent nodes (binary trees) are concatenated and hashed again to generate a parent node. This process is repeated until a unique root node is obtained. The tree structure remains unchanged after initialization, ensuring that the baseline hash tree and the current hash tree have identical structures, providing a basis for subsequent differential traversal. The generated baseline hash tree is stored in an isolated storage area outside the virtual machine.

[0032] The system continuously acquires file change events during operation. When a file operation is detected: First, the target file path and related metadata are parsed to obtain them; When file metadata changes, the file content is further sampled and a content digest is calculated, with its hash value determined according to the formula. Calculated; in the summary of calculation content hour In the content summary calculation process, a segmented sampling strategy is adopted: File size smaller than the minimum configurable empirical parameter (typically 64KB): Full content hash calculation; File size is between the minimum and maximum configurable empirical parameters (e.g., 64KB to 10MB): sample header, middle and tail data in fixed-size blocks; File size greater than the maximum configurable empirical parameter (typically 10MB): Sample header and tail data in fixed-size blocks.

[0033] When a file changes, only the hash values ​​of the corresponding leaf nodes and their paths to the root node are updated.

[0034] The leaf node hash value is recalculated based on the updated file information.

[0035] Status verification When a file is modified, the system directly locates the corresponding leaf node based on the obtained file path, and completes the hash update along the path from that leaf node to the root node, without traversing the entire hash tree.

[0036] Furthermore, it performs multi-dimensional calculations to quantify the threat level, specifically: The system maintains a first-in-first-out sliding time window (default 60 seconds) and calculates the following characteristics based on captured system call events: Time dimension: Changes per minute (CPM) and Batch Change Count (BCC) within the statistics window. BCC refers to the number of batches formed when adjacent events are less than 0.1 seconds apart and involve operations on different files.

[0037] Spatial dimension: File type concentration (FTD) of modified files within the calculation window, which is the maximum proportion of files with the same extension out of the total number of modified files.

[0038] Content dimension: For files whose content changes within the window, calculate the Shannon entropy (HCE) by taking the content sample hash value, which measures the degree of randomness of the hash change.

[0039] After normalizing the above features, a weighted sum is obtained to obtain the overall threat level (0~1). A tiered response is then executed based on the threat level: low risk (<0.3) logs and issues an alert; medium risk (0.3~0.7) creates a virtual machine snapshot; high risk (≥0.7) triggers a physical pause of the virtual machine.

[0040] By combining the quantitative indicators of time, space, and content dimensions mentioned above, a dynamic overall threat level is output.

[0041] Decision and Response Based on the detected abnormal files and their change characteristics, a comprehensive judgment is made on the current behavior: When the threat level is low-risk, only relevant logs are recorded; When the threat level is medium or high, take a snapshot of the virtual machine or pause it. When the multi-dimensional threat assessment module outputs a high-risk level and the overall system integrity is abnormal, the virtual machine is immediately suspended at the physical level. While the virtual machine is suspended, the current hierarchical hash tree is extracted and compared with the pre-stored baseline hash tree using a top-down binary difference traversal.

[0042] The mechanism of this invention is as follows: (1) Event-triggered file monitoring mechanism File change events are acquired through external monitoring methods outside the virtual machine, and runtime behavior is used as the trigger condition to monitor target files on demand. Compared with periodic full scans, this mechanism avoids repeated traversal of the file system, reduces system overhead, and improves responsiveness to high-frequency file operations.

[0043] (2) Hierarchical hash tree modeling method for file sets The protected file set is mapped to a hierarchical hash tree structure, where leaf nodes represent the state of individual files and parent nodes represent the aggregate state of their child nodes, thus achieving a structured representation of the overall file system state. This structure allows system integrity to be represented by a single root node hash, thereby reducing the complexity of state storage and comparison.

[0044] (3) Leaf node hash construction method with multiple factors For a single file, a leaf node hash value is generated by combining its path information, file metadata, and content digest. This method avoids the false positives caused by relying solely on the hash of a single content, improves the ability to identify operations such as file renaming and attribute modification, and thus enhances the robustness of integrity detection.

[0045] (4) Adaptive segmented sampling mechanism based on file size The content sampling strategy is dynamically selected based on file size. Small files undergo full hash calculation, while medium to large files only extract data from key locations for sampling and calculation. This effectively reduces I / O overhead during large file processing and improves overall system performance while ensuring the representativeness of content features.

[0046] (5) Path-constrained incremental update mechanism for hash trees When a file changes, only the corresponding leaf nodes and nodes along the path to the root node are updated, without needing to reconstruct the entire hash tree. This mechanism reduces the update complexity from full computation to a local update related to the tree height, improving the system's processing efficiency in scenarios with frequent file modifications.

[0047] (6) Anomaly file location method based on difference traversal In the event of system integrity anomalies, this method compares the current hash tree with the baseline hash tree from top to bottom, prunes subtrees with consistent hashes, and recursively traverses only the branches with discrepancies until a specific leaf node is located. This method can quickly determine the set of affected files without requiring a full comparison.

[0048] (7) Maintaining tree topology stability and incremental update mechanism To address common ransomware behaviors such as "generating ciphertext and then deleting the original file" and "mass renaming file extensions," this invention proposes an incremental state update mechanism. Under this mechanism, when a file deletion operation occurs, the corresponding leaf node is not removed; instead, its hash value is replaced with a preset hash tag. When a file renaming operation occurs, only the path metadata in the leaf node is updated in situ, and the hash value is recalculated.

[0049] The above processing method does not cause any additions or deletions to the physical structure of the hash tree during various file state changes, thus maintaining the stability of the tree topology. Compared to traditional methods that require tree structure rebalancing when nodes change, this invention effectively avoids the additional computational overhead. At the same time, this mechanism ensures the structural consistency between the baseline hash tree and the current hash tree, providing a reliable data structure foundation for subsequent fast location based on difference traversal.

Claims

1. A method for monitoring the integrity of virtual machine files using a hierarchical hash tree, characterized in that, Includes the following steps: S1. The host machine, based on hardware-assisted virtualization, triggers virtual machine trapping (VM-Exit) through exception injection, capturing system call events in the target operating system for predefined critical file paths; S2. Load the memory parsing configuration that matches the target virtual machine operating system kernel version, and parse and obtain the target file path and file metadata that triggered the system call event based on the register context information of the system call event; S3. For the target virtual machine operating system file path and file metadata, extract the file content digest using a segmented sampling strategy based on the file size, and calculate the content hash value of the digest; The target file path, file metadata, and content hash value are concatenated, and a hash function is applied to calculate the leaf node hash value. S4. In the trusted environment during the initialization phase of the target virtual machine operating system, construct a baseline hash tree and store the baseline hash tree in an isolated storage space on the host side. S5. On the host machine side, initialize another hierarchical hash tree with the same structure as the baseline hash tree as the current hash tree; Its initial state is completely consistent with the baseline hash tree; S6. During the operation of the target virtual machine operating system, based on the system call events captured in real time by the host machine, recalculate the leaf node hash value of the affected file according to the method in S3, and perform bottom-up incremental updates along the path from the leaf node to the root node, updating only the corresponding node in the current hash tree. The baseline hash tree remains unchanged; S7. Capture system call events in real time using a sliding time window, calculate the file change frequency and batch operation coefficient per unit time, set weighting coefficients and classification thresholds, and calculate a real-time threat score; trigger corresponding strategies based on the score: Low risk level: Log and issue an alert; Medium risk level: Creating a virtual machine snapshot; High risk level: Triggers a physical halt to virtual machine operation; S8. After the virtual machine is suspended due to a high-risk threat, extract the current hash tree and the base hash tree, and perform a top-down recursive comparison starting from the root node to determine the target file that has been modified.

2. The method according to claim 1, characterized in that, The system call events described in S1 are for the Windows operating system, and the monitored system calls include the file write operation NtWriteFile and the file information modification operation NtSetInformationFile.

3. The method according to claim 1, characterized in that, The document content summary described in S3 is calculated using a segmented sampling method, including: Full sampling branch: When the size S of the file to be monitored satisfies S <L min When the file size is less than the minimum configurable empirical parameter, the entire contents of the file are read and a hash value is calculated on the entire contents. Three-stage sampling branch: When the size S of the file to be monitored satisfies L min ≤S≤L max At that time, the header data block, middle data block and tail data block of the file are read respectively, and the hash value of the data after concatenating the three data blocks is calculated. Two-ended sampling branch: When the size S of the file to be monitored satisfies S>L max At that time, only the header and tail data blocks of the file are read separately, and the hash value is calculated on the data concatenated from these two data blocks; L min and L max These are preset empirical parameter values.

4. The method according to claim 1, characterized in that, The leaf node hash value described in S3 is calculated as follows: in, To standardize the path, Including file size, file last modified time, Sample the hash value of the file content.

5. The method according to claim 1, characterized in that, The construction and storage of the baseline hash tree described in S4 specifically includes: During the target operating system initialization phase, in a trusted clean virtual machine image environment, all predefined critical files are traversed, and all leaf node hash values ​​are generated according to the methods described in S1 to S3. The leaf node hash values ​​are paired and aggregated in pairs and recursively repeated to build a hierarchical hash tree from bottom to top, which serves as the base hash tree. This base hash tree is then stored in an isolated storage space on the host machine side. During subsequent monitoring, it remains read-only and is not updated in any way.

6. The method according to claim 1, characterized in that, The incremental updates described in S6 include: According to the system call number and parameters, the situations are as follows: When the host captures a system call event for a file write operation, it reads the data to be written from the memory buffer and calculates the content hash using a segmented sampling method based on the length W_len of the data to be written: If W_len < L_min, calculate the hash value for all the content of the data to be written; If L_min ≤ W_len ≤ L_max, sample fixed-size data blocks at the head, middle, and tail of the data to be written and then calculate the hash value; If W_len > L_max, only sample fixed-size data blocks at the head and tail of the data to be written and then calculate the hash value; Among them, L_min and L_max are preset empirical thresholds, which are the same as or independently configured with the thresholds set for the file size in S3; When the host captures a system call event for file deletion, retain the original leaf node position and replace its hash value with a preset identification value; When the target operating system captures a system call event for file renaming, keep the node position unchanged, update the file meta-information and path information in the leaf node, and recalculate the hash value.

7. The method according to claim 1, characterized in that, The top-down differential traversal process described in S8 includes: Starting from the root node, recursively compare the nodes of the current hash tree with the corresponding nodes in the reference hash tree; when the hash values of the nodes at a certain layer of the current hash tree are inconsistent with the hash values of the corresponding nodes in the reference hash tree, continue to traverse the child nodes downward until the leaf node where the hash value changes is located, and output the file path corresponding to this leaf node as the set of changed files.

8. A high-efficiency virtual machine file integrity monitoring system utilizing a hierarchical hash tree, used to implement the virtual machine file integrity monitoring method utilizing a hierarchical hash tree as described in any one of claims 1-8, characterized in that, Include: Guest OS monitoring target layer: Runs in the virtual machine and contains high-risk critical files that may be tampered with inside. It generates file system change events through system calls; Hypervisor core monitoring layer: Runs components based on hardware-assisted virtualization. Triggers VM-Exit traps by injecting illegal instruction exceptions (UD Trap), intercepts target system calls in real time, implements transparent external strong isolation monitoring, and passes the events to the lower layer; this layer is used in S1 to capture system call events for predefined critical file paths in the target operating system; File status processing layer: Used in S1 to S6, receives change events, bridges the semantic gap, and performs status verification and threat judgment; Storage and response module: Deployed in the protected memory area outside the virtual machine, securely stores the reference hash tree and the current hash tree; Execute hierarchical responses based on the threat determination results in S7: Record logs and issue alarms at the low-risk level, take snapshots of the virtual machine at the medium-risk level, and trigger a physical pause of the virtual machine running state at the high-risk level; and is used in S8 to extract the current hash tree and the reference hash tree for top-down differential traversal in the paused state of the virtual machine, locate the leaf nodes where the hash values deviate, and output the set of target files with changes.

9. A high-efficiency virtual machine file integrity monitoring system utilizing a hierarchical hash tree as described in claim 8, characterized in that, The file status processing layer includes the following sub-modules: File information extraction module: Transparently extracts file path, size, modification time, content sampling data, and related process information from the Guest kernel data structure; used by S2 to load memory parsing configuration matching the target operating system kernel version, and to parse and obtain the target file path and file metadata that triggered the system call event based on the register context information of the system call event described in S1. Hierarchical hash tree construction and storage module: Used in S3 to S6, it extracts the file content summary according to the file size using a segmented sampling strategy and calculates the content hash value of the summary; it concatenates the target file path, file metadata and content hash value, and applies a hash function to the concatenation result to calculate the hash value of the leaf node; Used to build and store the baseline hash tree and the current hash tree in S4 and S5; Perform incremental path updates in S6 to maintain the consistency of the current hash tree; Real-time monitoring and detection module: Based on the statistical analysis of system call events captured by S1, including file modification frequency, operation type distribution, and file content change characteristics within a preset time window, threat assessment is performed.

Images