Patents
Literature
1 results about "Virtual machine introspection" patented technology
Efficacy Topic
Property
Owner
Technical Advancement
Application Domain
Technology Topic
Technology Field Word
Patent Country/Region
Patent Type
Patent Status
Application Year
Inventor
In computing, virtual machine introspection (VMI) is a technique "for monitoring the runtime state of a system-level virtual machine (VM)", which is helpful for debugging or forensic analysis. The term introspection in application to the virtual machines was introduced by Garfinkel and Rosenblum. They invented an approach for "protecting a security application from attack by malicious software" and called it VMI. Now VMI is a common term for different virtual machine forensics and analysis methods. VMI-based approaches are widely used for security applications, software debugging, and systems management.
A cloud host security baseline checking method and system based on virtual machine introspection
ActiveCN121881360BPlatform integrity maintainanceSoftware simulation/interpretation/emulationVirtualizationDirty page
The present application belongs to the technical field of computer information security, and particularly relates to a cloud host security baseline checking method and system based on virtual machine introspection, which comprises the following steps: accessing a target virtual machine through a host virtualization management program layer and dividing physical memory pages, obtaining physical memory dirty page states and system I / O load; according to the dirty page states of the physical memory pages in a historical observation window and a physical neighborhood set, obtaining an activity accumulation index and a spatial neighborhood linkage index at the current time, respectively; obtaining a checking trigger score according to the activity accumulation index, the spatial neighborhood linkage index and the system I / O load, and realizing security baseline checking based on the threshold relationship of the checking trigger score. The present application can identify normal business hotspots and abnormal tampering behaviors, and reduce the checking frequency when the system is under high load, thereby realizing low-overhead agentless security baseline checking.
Owner:WUHAN MINGJIAXIN TECHNOLOGY CO LTD