CN106909509B - A kind of virtual machine process code without acting on behalf of paging type gauging system and method - Google Patents

A kind of virtual machine process code without acting on behalf of paging type gauging system and method Download PDF

Info

Publication number
CN106909509B
CN106909509B CN201710116432.2A CN201710116432A CN106909509B CN 106909509 B CN106909509 B CN 106909509B CN 201710116432 A CN201710116432 A CN 201710116432A CN 106909509 B CN106909509 B CN 106909509B
Authority
CN
China
Prior art keywords
virtual machine
code
page
information
metric
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201710116432.2A
Other languages
Chinese (zh)
Other versions
CN106909509A (en
Inventor
陈兴蜀
赵成
金鑫
蔡梦娟
金逸灵
王伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sichuan University
Original Assignee
Sichuan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sichuan University filed Critical Sichuan University
Priority to CN201710116432.2A priority Critical patent/CN106909509B/en
Publication of CN106909509A publication Critical patent/CN106909509A/en
Application granted granted Critical
Publication of CN106909509B publication Critical patent/CN106909509B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/36Preventing errors by testing or debugging software
    • G06F11/3604Software analysis for verifying properties of programs

Abstract

The present invention disclose a kind of virtual machine process code without paging type gauging system and method is acted on behalf of, system includes trapping module, metric module, contrast module, base value library and log;Metric point is arranged in trapping module, the system event occurred in virtual machine is captured, using the progress information of the current executive process of VMI technology reengineering virtual machine;Metric module is divided according to progress information, by virtual machine process code according to virtual machine physical page size, is each page of generation page information, and the code page of virtual machine physical memory is loaded into according to page information measurement, generates metric;Contrast module is compared according to the metric of code page in conjunction with the base value in base value library, analyzes its integrality, and log is written in comparative information;The base value information of store code page in base value library;The comparative information of log recording code page metrics process.The present invention solves the problems, such as that virtual machine dynamic assigning memory mode causes Hypervisor that can not measure full virtual machine process code.

Description

A kind of virtual machine process code without acting on behalf of paging type gauging system and method
Technical field
The present invention relates to secure virtual machine monitoring technology fields, and in particular to a kind of virtual machine process code divides without agency Page gauging system and method.
Background technique
Virtualization technology is one of core technology of cloud computing platform, with the extensive application of cloud computing service, cloud computing Safety in platform becomes focus.Under normal circumstances, the key business being deployed on cloud needs long-play, is user Service is provided, and the safety of business, stability and availability are then the crucial requirements for guaranteeing service quality.On the one hand, virtually Carrier of the machine operating system as key business, there are different degrees of safety defects, such as system configuration, code vulnerabilities;Separately On the one hand, there is also loopholes etc. for key business native codes.Malware can use the loophole of operating system and operation system Key business code is modified, to pretend itself to exist, steal sensitive data etc., seriously threatens the stable operation of key business.Cause This, discovery is directed to distorting for key business as early as possible, it is necessary to virtual machine process code integrity progress amount.
Modern operating system generally uses Paging system to realize memory management, continuous logically for the distribution of User space process Location space, but as unit of Physical Page, physical memory is dynamically distributed by the way of distribution according to need, only load needs to immediately access Code or data.Integrity verification process generally comprises two parts of measurement and verifying: being responsible in collection system measurement part Portion's information is simultaneously sent to verification portion;Verification portion is responsible for saving original base value, and be compared with received metric with Verify integrality.It, can according to the deployed position of measurement part in the method measured under cloud environment for virtual machine system To be divided into two classes: one kind is will to measure partial deployment in virtual machine;Another kind of is that will measure partial deployment in Hypervisor In.
The available virtual machine system information abundant of first kind method, but existing defects: 1) target virtual machine version is relied on This, versatility is not strong;2) attack vulnerable to virtual machine internal Malware needs Hypervisor to provide additional protection and arranges It applies, increases the complexity of system.The high privilege level and isolation that second class method utilizes Hypervisor to have, avoid measuring Also faced the challenge simultaneously by the malicious attack for carrying out self virtualizing machine part: virtual machine is that internal process dynamically distributes in physics Simultaneously loading code or data are deposited, the measurement part in Hypervisor is difficult to completely obtain virtual machine process code or data And integrity verification is carried out to it.
Summary of the invention
In view of the above-mentioned problems, virtual machine process integrality can be measured the purpose of the present invention is to provide one kind Virtual machine process code without acting on behalf of paging type gauging system and method, caused in a manner of virtual machine dynamic assigning memory by solving Hypervisor can not measure the problem of full virtual machine process code section.Technical solution is as follows:
A kind of virtual machine process code without acting on behalf of paging type gauging system, including trapping module, metric module, base value Library, contrast module and log;
Trapping module captures the system event occurred in virtual machine in Hypervisor layers of setting metric point;It captures and is After system event, using the introspection of VMI(Virtual Machine Introspection virtual machine) technology progress Semantics Reconstruction, is obtained The progress information of the current executive process of virtual machine is taken, and progress information is transmitted to metric module;
Metric module receives the virtual machine process information of trapping module transmitting, will as unit of virtual machine physical page size Virtual machine process code segment is divided into multiple code pages, generates the page information of each code page;According to page information, code page is judged Whether it is loaded into virtual machine physical memory: if being loaded into virtual machine physical memory, measures this code page, generates Code page metric;If not being loaded into virtual machine physical memory, ignore the measurement of this code page;And code will be generated Page metric is transmitted to contrast module;
Base value library is the list of the measurement base value information of all virtual machine process code pages of storage;
Contrast module receives the metric of metric module transmitting, reads the base value information in base value library;By metric It is compared with base value information, and comparative information is written in log;
Log is used to receive and record the comparative information of measurement comparison transmission.
Further, the metric point is to trigger the virtual machine system event of Hypervisor layers of metrics process.
Further, the system event is the system action for causing virtual machine in virtual machine system and exiting event, packet It includes but is not limited to processes calling, process switching, page fault.
Further, the progress information is essential information needed for Hypervisor measures virtual machine process code, Including but not limited to virtual machine process title, virtual machine process code initial address, virtual machine process code length;It is described virtual Machine process code initial address is to be measured the virtual address of virtual machine process code.
Further, the page information is essential information needed for Hypervisor measures virtual machine process code page, Including but not limited to virtual machine process title, page number, start of Page address and page length degree;The start of Page address be virtual machine into The virtual address of range code page.
Further, the metric is essential information needed for contrast module executes comparison process, including but not It is limited to virtual machine process title, code page number, code page metric and code page length.
Further, the base value information is the credible metric of code page in normal state, credible measurement letter Breath includes but is not limited to process name, code page number and code page metric.
Further, the comparative information is virtual machine process code page metric and virtual machine process code page base value The comparing result of information, including but not limited to process name, code page number, metric, base value, comparing result, reduced time.
A kind of virtual machine process code without acting on behalf of paging type measure, comprising the following steps:
A: in virtual machine operational process, process falls into instruction access core system by system calling and calls processing journey Sequence;
B: virtual machine generates virtual machine and moves back when calling system calling falls into instruction access core system and calls processing routine Outgoing event;
C: the virtual machine that generates exits event in trapping module capture virtual machine, and by VMI technology reengineering virtual machine into Journey semantic information, then it is transmitted to metric module;
D: after metric module receives virtual machine process information, according to virtual machine process code initial address and virtual machine into Range code length divides multiple code pages with virtual machine physical page size, and generates page information;Further according to virtual in page information Machine process code page number and virtual machine process code page initial address, access virtual machine physical memory judge code page whether by Load;If being loaded, code page is measured, metric is generated and is transmitted to contrast module;If not being loaded, ignore The metrics process of this code page;
E: contrast module compares the metric received and the base value information read from base value library, and by comparative information It is transmitted in log;Restore the execution that virtual machine system calls processing routine;
F: system calls processing routine to continue to execute in virtual machine kernel according to normal flow, and system is called after being finished System calls the normal operation of exit instruction recovering process.
The beneficial effects of the present invention are:
(1) virtual machine process code is divided into multiple pages by the present invention, and to the code for being loaded into virutal machine memory Page is measured, and solving virtual machine dynamic assigning memory mode causes Hypervisor that can not measure full virtual machine process generation The problem of code;
(2) measurement process is deployed in Hypervisor layers by the present invention, transparent by the way of no agency, dynamically measure Virtual machine process code, it is not necessary to modify virtual machine kernels;Meanwhile measuring process and being located at except virtual machine, it avoids in virtual machine The attack of portion's Malware, improves safety;
(3) metric form that the present invention uses, can be used for measuring virtual machine other information, including but not limited to virtual machine Kernel static data, virtual machine process static data etc..
Detailed description of the invention
Fig. 1 is that the non-proxy virtual machine process system of the present invention calls behavior monitoring method block diagram.
Fig. 2 is the transparent capture virtual machine system call flow chart of the present invention.
Specific embodiment
To make the object, technical solutions and advantages of the present invention clearer, below in conjunction with the drawings and specific embodiments pair The present invention, which is done, to be further described in detail.The realization principle of this system is as follows:
In Hypervisor layers of setting metric point, the system event that virtual machine process causes is intercepted, is read using VMI technology Virtual machine process information.According to the virtual machine process information of reading, as unit of virtual machine Physical Page, by virtual machine process code Multiple code pages are divided into, determine the number and initial address of each code page.At Hypervisor layers according to each code page Initial address, judge whether each code page is loaded into virtual machine physical memory;If code page is loaded into void In quasi- machine physical memory, then in this code page of Hypervisor depth amount;If not being loaded into virtual machine physical memory, Ignore the measurement to this code page.According to progress information, code page number and metric, corresponding base value is read in base value library simultaneously It compares, verifies the integrality of each code page, and be recorded in log.
As shown in Figure 1, the virtual machine process code of the present embodiment without act on behalf of paging type gauging system include trapping module, Metric module, base value library, contrast module and log.
1) trapping module captures the system event occurred in virtual machine in Hypervisor layers of setting metric point;It captures After system event, Semantics Reconstruction is carried out using VMI technology, obtains the progress information of the current executive process of virtual machine, and by process Information is transmitted to metric module.
In the present embodiment, metric point is to trigger the virtual machine system event of Hypervisor layers of metrics process.System event Exit the process behavior of event to cause virtual machine in virtual machine system, including but not limited to processes calling, process switching, Page fault etc..
The progress information is essential information needed for Hypervisor measurement virtual machine process code, including but not limited to Virtual machine process title, virtual machine process code initial address, virtual machine process code length etc..Wherein, virtual machine process generation Code initial address is to be measured the virtual address of virtual machine process code.
Under type such as can be used and define progress information:
name address size
The information shows the entitled name of virtual machine process, and the initial address of virtual machine process code segment is address, The length of virtual machine code section is size.
2) metric module receives the virtual machine process information of trapping module transmitting, as unit of virtual machine physical page size, Virtual machine process code is divided into multiple code pages, generates the page information of each code page;According to page information, code page is judged Whether it is loaded into virtual machine physical memory: if being loaded into virtual machine physical memory, measures this code page, generates Code page metric;If not being loaded into virtual machine physical memory, ignore the measurement of this code page;And code will be generated Page metric is transmitted to contrast module.
The page information is essential information set needed for Hypervisor measurement virtual machine process code page, including but not It is limited to virtual machine process title, page number, start of Page address and page length degree etc..Wherein, start of Page address is virtual machine process generation The virtual address of code page.
Under type such as can be used and define page information:
name number page_address page_size
The information shows the entitled name of virtual machine process, and the number of virtual machine process code page is number, virtual machine The initial address of process code page is page_address, and the length of virtual machine process code page is page_size.
The metric is essential information set needed for contrast module executes comparison process, including but not limited to virtually Machine process title, code page number, code page metric and code page gage length etc..
Under type such as can be used and define metric:
name number hash(value) page_size
The information shows the entitled name of virtual machine process, and the number of virtual machine process code page is number, virtual machine The metric of process code page is hash (value), and the length of virtual machine process code page is page_size.
3) base value library is the list of the measurement base value information of all virtual machine process code pages of storage.Base value library include but It is not limited to the presence of the forms such as file, database, the acquisition modes of base value information are included in pure operating system, to normal condition Under process code section carry out paging type measurement.
The base value information is the credible metric of code page in normal state, and credible measurement information includes but unlimited In process name, code page number and code page metric etc..
4) contrast module receives the metric of metric module transmitting, reads the base value information in base value library;Measurement is believed Breath is compared with base value information, and comparative information is written in log.
5) log is used for the comparative information received and Record Comparison module transmits.
The comparative information is the comparison of virtual machine process code page metric Yu virtual machine process code page base value information As a result, including but not limited to process name, code page number, metric, base value, comparing result, reduced time etc..
Under type such as can be used and define comparative information:
name number hash(value) baseline result time
The information shows the entitled name of virtual machine process, and the number of virtual machine process code page is number, virtual machine The metric of process code page is hash (value), and the base value of virtual machine process code page is baseline, and comparing result is Result, reduced time time.
The stream compression of each intermodule is as follows:
1) before virtual machine starting, metric point is arranged in Hypervisor in trapping module;In virtual machine operational process, block The system event occurred in setup module capture virtual machine is cut, the progress information of the current executive process of virtual machine is read using VMI, And it is transmitted in metric module.
2) metric module receives the progress information of trapping module transmitting;According in progress information virtual machine process title, Virtual machine code segment base and virtual machine code segment length information carry out paging activity by virtual machine physical page size, and Generate page information;According in page information virtual machine code page number and virtual machine code start of Page address, determine code respectively Whether page is loaded into virtual machine physical memory: if being loaded, reading code page and is measured, generates code page degree Measure information;If not being loaded, ignore the metrics process of this page;The code page metric of generation is transmitted to contrast module.
3) base value library provides the base value information of virtual machine process code page for contrast module.
4) contrast module receives the metric of metric module transmitting;According in metric virtual machine process title and Virtual machine process code page number indexes corresponding base value information in base value library;According to the virtual machine process generation in metric Code page metric is compared with base value;Log is written into comparative information result.
5) log receives the comparative information of contrast module transmitting.
Based on above-mentioned gauging system, paging type measure such as Fig. 2's of virtual machine process code disclosed in the present embodiment Shown in flow chart, steps are as follows:
A: in virtual machine operational process, process falls into instruction access core system by system calling and calls processing journey Sequence;
B: virtual machine generates virtual machine and moves back when calling system calling falls into instruction access core system and calls processing routine Outgoing event;
C: the virtual machine that generates exits event in trapping module capture virtual machine, and by VMI technology reengineering virtual machine into Journey semantic information, then it is transmitted to metric module;
D: after metric module receives virtual machine process information, according to virtual machine process code initial address and virtual machine into Range code length divides multiple code pages with virtual machine physical page size, and generates page information;Further according to virtual in page information Machine process code page number and virtual machine process code page initial address, access virtual machine physical memory judge code page whether by Load;If being loaded, code page is measured, metric is generated and is transmitted to contrast module;If not being loaded, ignore The metrics process of this code page;
E: contrast module compares the metric received and the base value information read from base value library, and by comparative information It is transmitted in log;Restore the execution that virtual machine system calls processing routine;
F: system calls processing routine to continue to execute in virtual machine kernel according to normal flow, and system is called after being finished System calls the normal operation of exit instruction recovering process.

Claims (9)

1. a kind of virtual machine process code without acting on behalf of paging type gauging system, which is characterized in that including trapping module, measurement mould Block, base value library, contrast module and log;
Trapping module captures the system event occurred in virtual machine in Hypervisor layers of setting metric point;Capture system thing After part, Semantics Reconstruction is carried out using VMI technology, obtains the progress information of the current executive process of virtual machine, and progress information is passed It is delivered to metric module;
The virtual machine process information that metric module receives trapping module transmitting will be virtual as unit of virtual machine physical page size Machine process code is divided into multiple code pages, generates the page information of each code page;According to page information, judge code page whether by It is loaded into virtual machine physical memory: if being loaded into virtual machine physical memory, measuring this code page, generate code page Metric;If not being loaded into virtual machine physical memory, ignore the measurement of this code page;And code page measurement will be generated Information is transmitted to contrast module;
Base value library is the list of the measurement base value information of all virtual machine process code pages of storage;
Contrast module receives the metric of metric module transmitting, reads the base value information in base value library;By metric and base Value information compares, and comparative information is written in log;
Log is used to receive and the comparative information of Record Comparison module transmission.
2. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Metric point is to trigger the virtual machine system event of Hypervisor layers of metrics process.
3. virtual machine process code according to claim 1 or 2 without acting on behalf of paging type gauging system, which is characterized in that The system event is the system action for causing virtual machine in virtual machine system and exiting event, including processes call, process Switching, page fault.
4. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Progress information is essential information needed for Hypervisor measures virtual machine process code, including virtual machine process title, virtual Machine process code initial address, virtual machine process code length;The virtual machine process code initial address is to be measured virtually The virtual address of machine process code.
5. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Page information is essential information needed for Hypervisor measures virtual machine process code page, including virtual machine process title, page are compiled Number, start of Page address and page length degree;The start of Page address is the virtual address of virtual machine process code page.
6. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Metric is essential information needed for contrast module executes comparison process, including virtual machine process title, code page number, generation Code page metric and code page length.
7. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Base value information is the credible metric of code page in normal state, and credible measurement information includes process name, code page number With code page metric.
8. virtual machine process code according to claim 1 without acting on behalf of paging type gauging system, which is characterized in that it is described Comparative information is the comparing result of virtual machine process code page metric and virtual machine process code page base value information, including process Name, code page number, metric, base value, comparing result, reduced time.
9. a kind of virtual machine process code without acting on behalf of paging type measure, which comprises the following steps:
A: in virtual machine operational process, process falls into instruction access core system by system calling and calls processing routine;
B: virtual machine generates virtual machine and exits thing when calling system calling falls into instruction access core system and calls processing routine Part;
C: the virtual machine generated in trapping module capture virtual machine exits event, and passes through VMI technology reengineering virtual machine process language Adopted information, then it is transmitted to metric module;
D: after metric module receives virtual machine process information, according to virtual machine process code initial address and virtual machine process generation Code length divides multiple code pages with virtual machine physical page size, and generates page information;Further according to the virtual machine in page information into Range code page number and virtual machine process code page initial address, access virtual machine physical memory judge whether code page is added It carries;If being loaded, code page is measured, metric is generated and is transmitted to contrast module;If not being loaded, ignore this The metrics process of code page;
E: contrast module compares the metric received and the base value information read from base value library, and comparative information is transmitted Into log;Restore the execution that virtual machine system calls processing routine;
F: system calls processing routine to continue to execute in virtual machine kernel according to normal flow, calling system tune after being finished With the normal operation of exit instruction recovering process.
CN201710116432.2A 2017-03-01 2017-03-01 A kind of virtual machine process code without acting on behalf of paging type gauging system and method Active CN106909509B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710116432.2A CN106909509B (en) 2017-03-01 2017-03-01 A kind of virtual machine process code without acting on behalf of paging type gauging system and method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710116432.2A CN106909509B (en) 2017-03-01 2017-03-01 A kind of virtual machine process code without acting on behalf of paging type gauging system and method

Publications (2)

Publication Number Publication Date
CN106909509A CN106909509A (en) 2017-06-30
CN106909509B true CN106909509B (en) 2019-06-25

Family

ID=59208984

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710116432.2A Active CN106909509B (en) 2017-03-01 2017-03-01 A kind of virtual machine process code without acting on behalf of paging type gauging system and method

Country Status (1)

Country Link
CN (1) CN106909509B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108121593B (en) * 2017-12-22 2019-06-25 四川大学 A kind of virtual machine process anomaly detection method and system

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101344904A (en) * 2008-09-02 2009-01-14 中国科学院软件研究所 Dynamic measurement method
CN104134038A (en) * 2014-07-31 2014-11-05 浪潮电子信息产业股份有限公司 Safe and credible operation protective method based on virtual platform
CN106055385A (en) * 2016-06-06 2016-10-26 四川大学 System and method for monitoring virtual machine process, and method for filtering page fault anomaly

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101344904A (en) * 2008-09-02 2009-01-14 中国科学院软件研究所 Dynamic measurement method
CN104134038A (en) * 2014-07-31 2014-11-05 浪潮电子信息产业股份有限公司 Safe and credible operation protective method based on virtual platform
CN106055385A (en) * 2016-06-06 2016-10-26 四川大学 System and method for monitoring virtual machine process, and method for filtering page fault anomaly

Also Published As

Publication number Publication date
CN106909509A (en) 2017-06-30

Similar Documents

Publication Publication Date Title
US8978141B2 (en) System and method for detecting malicious software using malware trigger scenarios
Loscocco et al. Linux kernel integrity measurement using contextual inspection
CN101515316B (en) Trusted computing terminal and trusted computing method
CN105723348B (en) Unauthorized memory modification and access are detected using transactional memory
US7904278B2 (en) Methods and system for program execution integrity measurement
US9230106B2 (en) System and method for detecting malicious software using malware trigger scenarios in a modified computer environment
Wu et al. Xenpump: a new method to mitigate timing channel in cloud computing
CN106055385B (en) The system and method for monitoring virtual machine process, the method for filtering page fault exception
US10091216B2 (en) Method, apparatus, system, and computer readable medium for providing apparatus security
Chow et al. Multi-stage replay with crosscut
CN103310152B (en) Kernel state Rootkit detection method based on system virtualization technology
CN106649084A (en) Function call information obtaining method and apparatus, and test device
KR20140138206A (en) Reporting malicious activity to an operating system
CN108255716A (en) A kind of software assessment method based on cloud computing technology
CN107038373A (en) A kind of Process Debugging detection method and device
Milenkoski et al. Evaluation of intrusion detection systems in virtualized environments using attack injection
CN106909509B (en) A kind of virtual machine process code without acting on behalf of paging type gauging system and method
CN107301082A (en) A kind of method and apparatus for realizing operating system integrity protection
Pagani et al. Introducing the temporal dimension to memory forensics
Stirparo et al. In-memory credentials robbery on android phones
CN106650434B (en) A kind of virtual machine anomaly detection method and system based on I/O sequence
EP2831738A1 (en) System and method for determining correct execution of software
US9003236B2 (en) System and method for correct execution of software based on baseline and real time information
Bushouse et al. Goalkeeper: Comprehensive process enforcement from the hypervisor
Schwarz et al. KeyDrown: Eliminating Keystroke Timing Side-Channel Attacks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant