基于系统调用重定向的虚拟机自省技术

发布时间：2018-02-15 22:28

本文关键词： 虚拟机自省技术虚拟机系统安全　出处：《南京大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着云计算的普及,越来越多的服务器使用了虚拟化技术。云平台服务商的数据中心通过使用虚拟化技术实现了弹性计算,不同的用户或者任务可以共享物理资源,如CPU和硬盘。许多企业也将服务迁移到了服务商提供的云平台上。这使得云平台的安全得到了广泛的关注。作为云平台的基石之一,虚拟化也为安全领域带来了新的机遇与挑战。为了解决如何在云平台上对客户机进行监控与进行安全防护的需要,研究人员提出了虚拟机自省技术。虚拟机自省技术可以帮助自省工具从客户机外部来监控客户机的状态,并做出安全决策。实现虚拟机自省技术的一个主要问题是如何解决语义鸿沟问题。语义鸿沟是指如何将虚拟机监控器能够访问的客户机底层信息,如内存数据,转化为安全工具所需的高层语义信息,如进程控制块。安全工具需要高层的语义信息来进行安全决策,如遍历客户机中的进程来检测异常进程。虚拟机自省技术可以应用于云平台相关的安全领域中的许多问题,如恶意软件分析和内存取证等等。目前已有的虚拟机自省技术有着比较高的性能开销,并且要求用户为不同的客户机操作系统版本定制出不同的自省工具。这样的虚拟机自省技术缺乏通用性和实用性。本文提出了一种新的虚拟机自省技术,ShadowContexto ShadowContext是一种接近实时的,无需人工干预的自省技术。ShadowContext能够满足将自省技术进行实际运用的三个重要条件：低性能开销,通用性与自动化。而目前的虚拟机自省技术都无法在这三个条件上完全满足要求。相对于其他已有的自省技术,ShadowContext有两个主要优势：(1) ShadowContext有着明显较低的性能开销。因此,ShadowContext能够实现接近实时的自省技术。(2)通过允许一个自省工具对多个不同的客户机操作系统版本进行监控,ShadowContext能够大大地提高自省工具的实用性。这些优势都来自于一个新的概念,“影子上下文”。在影子上下文中,自省工具能够复用客户机中的系统调用代码来解决语义鸿沟问题。客户机中的系统调用代码会自动地将底层信息转化为有用的高层语义信息。除此之外,ShadowContext具有良好的安全性,能够防御许多实际存在的恶意攻击。我们设计,并且实现了一个ShadowContext的原型系统。我们也对ShadowContext进行了系统的评估。实验数据表明,ShadowContext平均带来的性能开销为75%,并且其初始化空壳进程的时间的中位数为0.117毫秒。并且在ShadowContext上运行的自省工具可以同时对多个客户机进行监控。ShadowContext对于自省工具和客户机来说是完全透明的。
[Abstract]:With the popularity of cloud computing, more and more servers are using virtualization technology. Cloud platform service providers' data centers use virtualization technology to achieve flexible computing, and different users or tasks can share physical resources. For example, CPU and hard disk. Many enterprises have also migrated their services to the cloud platform provided by service providers. This has made the security of cloud platform receive wide attention. As one of the cornerstones of cloud platform, Virtualization also brings new opportunities and challenges to the security field. Researchers have proposed virtual machine introspection, which can help introspection tools monitor client state from outside. One of the main problems in realizing virtual machine introspection technology is how to solve the semantic gap problem. Semantic divide refers to how to access the client underlying information, such as memory data, which the virtual machine monitor can access. Security tools need high-level semantic information, such as process control blocks. Security tools need high-level semantic information to make security decisions. Such as traversing processes in the client to detect abnormal processes. Virtual machine introspection can be applied to many problems in the cloud platform-related security realm, Such as malware analysis and memory forensics, etc. The existing virtual machine introspection technology has a relatively high performance overhead, And users are required to customize different introspection tools for different client operating system versions. This kind of virtual machine introspection technology lacks versatility and practicability. In this paper, a new virtual machine introspection technology, Shadow Contexto ShadowContext, is proposed, which is nearly real-time. The introspection technique. ShadowContext, which does not require human intervention, can satisfy three important conditions for the practical use of the introspection technique: low performance overhead, Generality and automation. The current introspection technology of virtual machine can not fully meet the requirements of these three conditions. Compared with other existing introspection technology, ShadowContext has two main advantages: 1) ShadowContext has significantly lower performance overhead. So ShadowContext can achieve near-real-time introspection technology. 2) by allowing a single introspection tool to monitor multiple versions of the client operating system, ShadowContext can greatly improve the utility of the introspection tool. In a new concept, "shadow context." in shadow context, The introspection tool can reuse the system call code in the client to solve the semantic gap problem. The system call code in the client automatically converts the underlying information into useful high-level semantic information. Can defend against many actual malicious attacks. We design, A prototype system of ShadowContext is implemented. We also evaluate ShadowContext systematically. The experimental data show that the average performance cost of ShadowContext is 755.The median time to initialize the empty shell process is 0.117 milliseconds. The introspection tool running on ShadowContext can monitor multiple clients simultaneously. ShadowContext is completely transparent to both the introspection tool and the client.
【学位授予单位】：南京大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP302

【相似文献】