基于硬件架构和虚拟化扩展机制的虚拟机自省机制研究

发布时间：2018-06-26 21:31

本文选题：虚拟机 + 自省　；参考：《四川大学学报(工程科学版)》2015年01期

【摘要】：针对现有虚拟机自省技术利用不可信被监控操作系统的内核数据结构在内存中的期望布局及内核函数构建被监控系统语义、无法抵抗直接内核数据结构操纵攻击的问题,对虚拟机自省机制的能力进行全面分析,并对利用虚拟机自省机制可应对的恶意攻击进行分类,提出更具健壮性的基于硬件体系架构和虚拟化扩展机制的虚拟机自省技术,通过硬件体系结构提供的虚拟机自省特性被动地观察与收集被监控系统信息,并利用虚拟硬件扩展机制主动地截获客户虚拟机内部的事件和指令,达到主动监控的目的。描述了基于硬件的虚拟机自省机制在系统调用序列收集与监控上的应用,并进行了效率测试分析。
[Abstract]:The existing virtual machine introspection technology can not resist the direct kernel data structure manipulation attack by using the expected layout of the kernel data structure of the untrusted monitored operating system in memory and the kernel function to build the semantics of the monitored system. This paper analyzes the ability of virtual machine introspection mechanism, classifies malicious attacks which can be dealt with by virtual machine introspection mechanism, and proposes a more robust virtual machine introspection technology based on hardware architecture and virtualization extension mechanism. Based on the introspection of virtual machine provided by hardware architecture, the information of the monitored system is observed and collected passively, and the events and instructions inside the client virtual machine are actively intercepted by the virtual hardware extension mechanism to achieve the purpose of active monitoring. This paper describes the application of hardware based virtual machine introspection mechanism in system call sequence collection and monitoring, and analyzes the efficiency test.
【作者单位】：武汉大学计算机学院;空天信息安全与可信计算教育部重点实验室(武汉大学);湖北源辉科技有限公司;
【基金】：国家自然科学基金重点项目资助(61332019) 国家重点基础研究发展计划资助项目(2014CB340600)
【分类号】：TP302

【相似文献】