虚拟机监控器的隐藏对象检测系统的设计与实现

发布时间：2018-06-06 09:51

本文选题：虚拟机 + Rootkit　；参考：《北京工业大学》2016年硕士论文

【摘要】：Rootkit是互联网世界中存在的一种黑客软件,该软件可控制网络上的主机,对网络安全造成严重威胁。如何使互联网免于遭受Rootkit的控制和侵害,保障网络主机的信息安全是当前亟待解决的问题,而虚拟化技术是有效解决该问题的首选方案。本文将基于虚拟监控器研究隐藏对象检测系统的设计问题,以实现可靠、主动、具有良好语义信息的检测功能,为客户虚拟机提供更安全的运行环境。论文的主要研究工作如下:对操作系统对象的隐藏手段进行研究,并分析了传统的基于操作系统内部实现的检测技术及基于辅助硬件实现的检测技术的原理与不足。然后,详细的介绍虚拟机监控器检测技术,深入的分析硬件虚拟化技术,特别是Intel VT的VT-x技术及其数据结构,充分了解虚拟机监控器的特点并掌握其优势。针对当前隐藏对象系统存在的问题,研究了VMDetector检测技术理论,分析和讨论VMDetector的实际需求、VMDetector中两种对象的隐藏检测理论模型以及VMDetector系统的虚拟机性能问题,结合VMDetector的设计原则,给出系统核心流程以及整体架构,并完成了VMDetector中主要模块的概要设计工作。在VMDetector隐藏检测系统概要设计的基础上,对其关键技术进行系统研究。重点分析了VMM-level进程视图以及Kernel-level进程视图的维护机制、设计及相关算法,探讨了利用虚拟机监控器对客户机设置VM-Exit,在不同的VM-Exit条件下维护不同的进程视图。进而,对进程的语义信息转换机制、进程与端口映射信息获取机制及算法实现进行深入研究,并给出系统核心功能的详细设计。对VMDetector隐藏检测系统的隐藏进程检测和隐藏网络连接检测进行功能测试,获得了较满意的实验结果,验证了系统设计的正确性,并重点展示了VMM状态管理模块、核心控制器模块、可信网络视图提取模块等模块及整体系统的实现过程。本文设计的基于虚拟监控器的隐藏对象检测系统不仅很好地完成了隐藏对象的检测功能,还将虚拟机性能影响的开销控制在一定范围内,对解决网络上存在的安全问题、保障信息安全具有很重要的实际意义。
[Abstract]:Rootkit is a kind of hacker software that exists in the Internet world. This software can control the host computer on the network and pose a serious threat to the network security. How to prevent the Internet from being controlled and infringed by Rootkit and how to ensure the information security of the network host is an urgent problem to be solved. Virtualization is the first choice to solve this problem effectively. In this paper, we will study the design of hidden object detection system based on virtual monitor, so as to realize reliable, active and good semantic information detection function, and provide a more secure running environment for customer virtual machine. The main research work of this paper is as follows: the hiding method of operating system object is studied, and the principle and deficiency of traditional detection technology based on internal operating system and hardware realization are analyzed. Then, the virtual machine monitor detection technology is introduced in detail, and the hardware virtualization technology, especially the VT-x technology of Intel VT and its data structure are analyzed in depth, and the characteristics and advantages of virtual machine monitor are fully understood. Aiming at the problems existing in the current hidden object system, this paper studies the theory of VMDetector detection technology, analyzes and discusses the theoretical model of two objects hidden detection in VMDetector and the performance of the virtual machine of VMDetector system, and combines the design principle of VMDetector. The system core flow and the whole architecture are given, and the outline design of the main modules in VMDetector is completed. Based on the outline design of VMDetector hidden detection system, the key technologies are systematically studied. The maintenance mechanism, design and related algorithms of VMM-level process view and Kernel-level process view are analyzed, and the use of virtual machine monitor to set VM-Exit to maintain different process views under different VM-Exit conditions is discussed. Furthermore, the semantic information conversion mechanism of the process, the information acquisition mechanism of process and port mapping and the implementation of the algorithm are deeply studied, and the detailed design of the core functions of the system is given. The functions of the hidden process detection and the hidden network connection detection of the VMDetector hidden detection system are tested. The satisfactory experimental results are obtained, and the correctness of the system design is verified. The VMM state management module and the core controller module are emphasized. The implementation process of trusted network view extraction module and the whole system. The hidden object detection system based on virtual monitor in this paper not only completes the detection function of hidden object, but also controls the cost of virtual machine performance influence in a certain range to solve the security problems existing in the network. It is of great practical significance to ensure information security.
【学位授予单位】：北京工业大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP311.52;TP309

【相似文献】