基于虚拟化技术的在线取证系统

发布时间：2018-01-04 02:30

本文关键词：基于虚拟化技术的在线取证系统　出处：《上海交通大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着计算机科学与技术的飞速发展，无形之中也滋生了惊人规模的计算机犯罪活动，这些计算机犯罪活动每年都会给全世界带来巨大的经济损失。电子证据的获取是侦破计算机犯罪活动的关键，所以近年来计算机取证领域已经成为科研工作者们重点关注的热门领域。如何安全而有效地进行计算机取证工作，是目前该领域亟需解决的问题之一。计算机取证的方式主要分为静态取证和在线取证两种方式。其中静态取证侧重于存储在持久化硬件设备中的电子证据，获取电子证据之前需要停止被取证计算机系统的运行。而在线取证则突破了静态取证的这一限制，并且把电子证据的采集范围扩大到了系统动态信息。但是在线取证依然面临着取证工具自身的安全性受到威胁和某些情况下需要中断被取证计算机系统运行的问题。本论文提出了基于硬件辅助虚拟化技术的VAIL在线取证系统，主要创新点有：1）提出了一种静默安装虚拟机监视器的方法，取证系统载入过程中并不会影响到被取证计算机系统的正常运行。2）使用半穿透驱动技术让整个虚拟机监视器的体积尽可能地小，降低了虚拟机监视器本身出现安全漏洞的概率。3）取证内容覆盖了整个计算机系统的各项活动，包括CPU取证、内存取证和I/O取证。其中CPU取证是利用Intel VT-x技术在发生虚拟机退出事件时把处理器相关寄存器的值都保存在VMCS结构体中，内存取证则是通过EPT页异常处理函数实现，I/O取证又细分为编程式端口访问、内存映射和直接内存访问三种方式分别取证。最后本文通过一系列的实验证明，VAIL系统确实能够安全有效地针对被取证计算机系统的各项活动进行在线取证工作。性能测试方面的代价和原裸机环境相比非常小，在CPU密集型程序的测试当中平均性能损耗为4.21%，网络带宽速率测试中的带宽损失为0.29%～1.52%，，真实网络应用的吞吐量降低为0.22%。
[Abstract]:With the rapid development of computer science and technology, there is also an astonishing scale of computer crime. These computer criminal activities will bring huge economic losses to the world every year. The acquisition of electronic evidence is the key to detect computer criminal activities. So in recent years, the field of computer forensics has become a hot area that researchers focus on. How to carry out computer forensics safely and effectively is one of the problems that need to be solved in this field. The methods of computer forensics are mainly divided into static forensics and online forensics, in which static forensics focuses on electronic evidence stored in persistent hardware devices. It is necessary to stop the computer system before obtaining electronic evidence, and online forensics breaks through this limitation of static forensics. But online forensics still faces the problem that the security of the forensics tool itself is threatened and in some cases the computer system needs to be interrupted. Title. This paper presents a VAIL online forensics system based on hardware aided virtualization technology. The main innovation is: 1) A method of silently installing virtual machine monitor is proposed. Forensics system loading process will not affect the normal operation of the forensics computer system. 2) the use of semi-penetrating drive technology to make the entire virtual machine monitor as small as possible. It reduces the probability of security holes in the virtual machine monitor itself. 3) Forensics covers all activities of the whole computer system, including CPU forensics, memory forensics and I / O forensics. CPU forensics is the use of Intel VT-x technology in the virtual machine exit event when the processor related registers are stored in the VMCS structure. Memory forensics is realized by EPT page exception handling function. It is subdivided into programming port access, memory mapping and direct memory access respectively. Finally, this paper through a series of experiments to prove. The VAIL system can safely and effectively conduct online forensics against the various activities of the forensic computer system. The cost of performance testing is very small compared with the original bare metal environment. The average performance loss in the CPU intensive program test was 4.21, and the bandwidth loss in the network bandwidth rate test was 0.29%. The throughput of real network applications is reduced to 0.22.
【学位授予单位】：上海交通大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：D918;TP391.9

【共引文献】