The invention belongs to the technical field of
network security, and discloses a method for effectively preventing a
virtual machine from being maliciously tampered in a secret-related
intranet environment, which comprises the following steps of: acquiring an
XML (
Extensible Markup Language) configuration file through a virtualized API (Application Program Interface), carrying out
structured analysis on the
XML configuration file, carrying out Hash aggregation calculation to obtain a reference characteristic value data packet, and embedding the reference characteristic value data packet into a user-defined
namespace; constructing an
event monitoring hook, performing integrity detection on the
XML configuration file of the
virtual machine based on the
event monitoring hook to obtain a real-time reference feature value data packet, performing multi-level comparison with the reference feature value data packet, performing change legality
verification according to a comparison result, and triggering automatic isolation and
alarm response; legal
change management and characteristic value closed-loop updating are executed, and the configuration
recovery process of the
virtual machine is isolated; according to the method, the real-time, intelligent and automatic security protection of the secret-related
intranet virtual
machine is realized, and the accuracy and response efficiency of malicious tampering detection are remarkably improved.