VMI技术在软件行为分析中的应用研究

发布时间：2018-08-03 12:55

【摘要】：虚拟机自省(virtual machine introspection,VMI)技术充分利用虚拟机管理器的较高权限,可以实现在单独的虚拟机中部署安全工具对目标虚拟机进行监测,为进行各种安全研究工作提供了很好的解决途径,进而随着虚拟化技术的发展,VMI技术逐渐成为一种应用趋势。利用VMI技术监测虚拟机获得的系统状态信息数据可以作为软件行为分析的数据来源,软件行为分析研究工作结合VMI技术,可以充分利用虚拟化平台的高隔离性、有限资源的充分利用等优势。本文采用VMI技术在Xen虚拟化平台上对虚拟机进行监测,获得进行软件行为分析所需要的数据,研究软件行为的描述方法、分析方法,建立能够描述软件行为的指标体系,并对该体系进行量化,从而分析软件的行为。本文工作主要有以下几方面：1.为了更深入的理解和应用VMI技术,本文对VMI技术进行了分析研究。概括出了VMI的概念,论述其实现原理和实现方式,详细地介绍了VMI技术在不同领域的研究进展,探索VMI技术应用于软件行为分析研究的方法和途径。2.使用XenAccess自省库提供的接口函数,获得被监测虚拟机的运行状态信息数据,为分析软件行为提供信息来源。3.对软件行为分析的相关技术进行研究,包括描述软件行为的建模方法,研究软件行为的分析方法,建立描述软件行为的指标体系并对该指标体系进行量化。4.使用量化的指标体系对获得的数据进行分析,分析软件的行为。
[Abstract]:Virtual machine introspection (VMI) technology makes full use of the higher authority of the virtual machine manager, and can deploy security tools in a single virtual machine to monitor the target virtual machine, which provides a good solution for all kinds of security research work. With the development of virtualization technology, VMI technology has become a trend of application. Using VMI technology to monitor the data of system state information obtained by virtual machine can be used as the data source of software behavior analysis. The research of software behavior analysis combined with VMI technology can make full use of the high isolation of virtualization platform. The full use of limited resources and other advantages. In this paper, we use VMI technology to monitor virtual machine on Xen virtualization platform, obtain the data needed for software behavior analysis, study the description method of software behavior, analysis method, and establish the index system which can describe software behavior. The system is quantified to analyze the behavior of the software. The main work of this paper is as follows: 1. In order to understand and apply VMI technology more deeply, the VMI technology is analyzed and studied in this paper. This paper summarizes the concept of VMI, discusses its realization principle and implementation method, introduces in detail the research progress of VMI technology in different fields, and explores the methods and approaches of applying VMI technology to the research of software behavior analysis. Using the interface function provided by the XenAccess introspection library, the running state information data of the monitored virtual machine are obtained, which provides the information source for analyzing the software behavior. The related technology of software behavior analysis is studied, including modeling method of describing software behavior, analyzing method of software behavior, establishing index system of describing software behavior and quantifying the index system. The quantitative index system is used to analyze the acquired data and analyze the behavior of the software.
【学位授予单位】：西安工业大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：TP302

【共引文献】