CN114499945A - Intrusion detection method and device for virtual machine - Google Patents

Abstract

An intrusion detection method and device for a virtual machine are used to solve the problems of easy false detection and complexity in the intrusion detection of a virtual machine in the prior art. It can be applied to a first physical host, where the first physical host virtualizes at least one virtual machine, the virtual machine includes a Virtio paravirtualized driver, and the Virtio paravirtualized driver includes a detection module. The method includes that a detection module of a first virtual machine acquires detection data, the first virtual machine is any one of at least one virtual machine; the detection module of the first virtual machine processes the backend of the first physical host through a paravirtualized channel The module sends detection data; the back-end processing module of the first host sends the detection data to the second physical host. Based on the method, the detection module and the processing back-end module can exchange data through the paravirtualized channel, so that the communication between the first virtual machine and the first physical host can be realized.

Description

Intrusion detection method and device for virtual machine

technical field

The present invention relates to the field, in particular to a method and device for intrusion detection of a virtual machine.

Background technique

With the rapid development of computer technology, cloud computing, virtualization and other technologies have emerged. Among them, cloud computing abstracts all computers into specific computing resources, and then provides these computing resources to users. Usually, cloud computing builders use virtualization technology to virtualize multiple virtual computers (referred to as virtual machines) on a single physical host for use by multiple users. This physical host can be called computing node. The various security problems that follow are gradually exposed. Compared with the traditional physical host, the impact scope of the security threat of the virtual machine is relatively increased. Therefore, the security detection of the virtual machine is more and more important.

Virtual machine security detection is a monitoring of virtual machine performance security and functional security. Among them, virtual intrusion detection is a kind of virtual machine security detection. At present, virtual machine intrusion detection is a real-time all-round detection of the user space and kernel space of the virtual machine system. When the virtual machine is invaded by hackers, it can detect the intrusion behavior and perform event alarm and protection. Currently, security agents are installed in virtual machines or temporary scripts are executed to achieve real-time detection, alarm, and protection.

However, security agents or temporary scripts run in the user layer of the operating system, occupying user layer resources, and there may be a possibility of false detection during actual operation. Moreover, when the security agent detects the kernel space of the virtual machine system, it needs to deploy the kernel module and communicate with the kernel space, which is more complicated. Moreover, when a security agent or a temporary script reports events, it needs to rely on user network resources.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide an intrusion detection method and device for a virtual machine, which are used to solve the problems of false detection, detection complexity, and dependence on the user network caused by installing a security agent program in a virtual machine or executing a temporary script for intrusion detection in the prior art The problem.

In a first aspect, an embodiment of the present invention provides an intrusion detection method for a virtual machine, the method is applied to a first physical host, the at least one virtual machine includes a Virtio paravirtualized driver, and the Virtio paravirtualized driver includes detection module, the Virtio paravirtualized driver runs on the kernel framework of the corresponding virtual machine. The method includes that a detection module of a first virtual machine acquires detection data, and the first virtual machine is any one of the at least one virtual machine; the detection module of the first virtual machine sends the detection data to the The back-end processing module of the first physical host sends the detection data; the back-end processing module of the first host sends the detection data to the second physical host.

Based on the above solution, through the Virtio paravirtualized driver, the detection module in the virtual machine and the processing back-end module can interact with the detection data through the paravirtualized channel, that is to say, the virtual machine and the physical sink are realized based on the paravirtualized channel Host data interaction. Further, data interaction is carried out through the network between the two physical hosts (ie, the first physical host and the second physical host), which can achieve independence from user network resources, thereby reducing disturbance to the user's network environment, and does not depend on user network resources. It will be interfered by user network operation and maintenance, which improves the stability and timeliness of data interaction.

In a possible implementation manner, the paravirtualized channel is a data queue of a Virtio paravirtualized device. The data queue may include an uplink data queue and a downlink data queue.

In a possible implementation manner, acquiring the detection data by the detection module of the first virtual machine includes: the detection module of the first virtual machine performs intrusion detection through the kernel framework of the first virtual machine, and obtains the detection data. the detection data.

The detection module in the first virtual machine uses the kernel framework (Linux/Windows) of the operating system of the first virtual machine to perform intrusion detection when the first virtual machine is running, which can make the operation more transparent to the user and is not easy to be misused lead to false detection.

In a possible implementation manner, the back-end processing module of the first physical host may further receive configuration information from a second physical host, and the second physical host is deployed with an intrusion detection management service; the The back-end processing module of the first virtual machine sends the configuration information to the detection module of the first virtual machine through the paravirtualized channel; the detection module of the first virtual machine is based on the configuration information, update the detection module.

In a possible implementation manner, the back-end processing module of the physical host is a program of a Virtio paravirtualized device.

In a possible implementation manner, the back-end processing module of the first physical host receives the configuration information from the second physical host, including: the back-end processing module of the first physical host is based on the first physical host. The network between a physical host and the second physical host receives the configuration information from the second physical host.

Data interaction through the network between two physical hosts (ie, the first physical host and the second physical host) can achieve independence from user network resources, thereby reducing disturbance to the user's network environment, and will not be affected by The interference of user network operation and maintenance improves the stability and timeliness of data interaction.

In a possible implementation manner, sending the detection data to the second physical host by the back-end processing module of the first physical host includes: the back-end processing module of the first physical host is based on The network between the first physical host and the second physical host sends the detection data to the second physical host.

Data interaction through the network between two physical hosts (ie, the first physical host and the second physical host) can achieve independence from user network resources, thereby reducing disturbance to the user's network environment, and will not be affected by The interference of user network operation and maintenance improves the stability and timeliness of data interaction.

In a second aspect, an embodiment of the present invention provides a detection device, which can be applied to a first physical host, where the first physical host virtualizes at least one virtual machine, and the at least one virtual machine includes Virtio paravirtualized Virtualization driver, the Virtio paravirtualized driver includes a detection module. The detection device includes a detection module and a back-end processing module.

Wherein, the detection module is used to obtain detection data; and through the paravirtualized channel, send the detection data to the back-end processing module of the first physical host; the back-end processing module is used to send the detection data to the second physical host The detection data is sent.

In a possible implementation manner, the paravirtualized channel is a data queue of a Virtio paravirtualized device.

In a possible implementation manner, the detection module is configured to perform intrusion detection through the kernel framework of the first virtual machine to obtain the detection data.

In a possible implementation manner, the back-end processing module is further configured to receive configuration information from a second physical host, where the second physical host is deployed with an intrusion detection management service; and through the paravirtualized channel, The configuration information is sent to the detection module of the first virtual machine; the detection module is configured to update the detection module according to the configuration information.

In a possible implementation manner, the back-end processing module of the physical host is a program of a Virtio paravirtualized device.

In a possible implementation manner, the back-end processing module is specifically configured to: receive the data from the second physical host based on the network between the first physical host and the second physical host configuration information.

In a possible implementation manner, the back-end processing module sends the detection data to the second physical host based on the network between the first physical host and the second physical host.

In a third aspect, the present application provides a computer-readable storage medium, where a computer program or instruction is stored in the computer-readable storage medium, and when the computer program or instruction is executed by a detection device, the detection device is made to execute the first aspect or the first aspect above. A method in any possible implementation of an aspect.

In a fourth aspect, the present application provides a computer program product, the computer program product includes a computer program or an instruction, when the computer program or instruction is executed by a detection device, the detection device is made to perform the above-mentioned first aspect or any of the first aspects. methods in possible implementations.

For the technical effects that can be achieved in any one of the above-mentioned second aspect to the fourth aspect, reference may be made to the description of the beneficial effects in the above-mentioned first aspect, which will not be repeated here.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic diagram of a communication system architecture according to an embodiment of the present invention;

FIG. 2 is a schematic flowchart of an intrusion detection method for a virtual machine according to an embodiment of the present invention;

3 is a schematic flowchart of another intrusion detection method for a virtual machine provided by an embodiment of the present invention;

FIG. 4 is a schematic flowchart of another intrusion detection method for a virtual machine provided by an embodiment of the present invention;

5 is a schematic structural diagram of a detection device according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a detection apparatus according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. . Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a schematic diagram of an architecture of a communication system applicable to an embodiment of the present invention. The communication system may be referred to as a cloud computing cluster. The communication system typically includes a management node and a plurality of computing nodes. The management node and the computing node are both physical hosts. FIG. 1 takes the example including two computing nodes and one management node. In FIG. 1 , the physical host 101 is used as the computing node, and the physical host 102 is used as the management node. The physical host machine 101 and the physical host machine 102 may communicate with each other in a wired or wireless manner. Specifically, the physical host 101 and the physical host 102 can use a mobile communication network (eg, 2G/3G/4G/5G/future 6G and other networks), or wireless local area networks (WLAN), or wireless fidelity (wireless fidelity, Wi-Fi) network, etc.

Wherein, each computing node can virtualize multiple virtual machines. In FIG. 1 , two virtual machines, namely virtual machine 1011 and virtual machine 1012 , are virtualized in the computing node (ie, physical host machine 101 ) as an example. An intrusion detection management service (or referred to as an intrusion detection management platform) is deployed on the management node (ie, the physical host 102 ), and the intrusion detection management service is mainly used to manage intrusion detection of virtual machines. The virtual machines (such as the virtual machine 1011 and the virtual machine 1012 in FIG. 1 above) include a Virtio paravirtualized driver, and the Virtio paravirtualized driver includes a detection module. It can also be understood that the detection module is implemented in a Virtio paravirtualized driver (such as virtio-blk, virtio-net, etc.) in the virtual machine. Among them, the Virtio paravirtualized driver is the kernel framework (or called kernel space or kernel layer) of the virtual machine. Therefore, the detection module in the virtual machine can use the kernel framework of the operating system of the virtual machine to perform intrusion detection when the virtual machine is running. Among them, Virtio is an abstract application programming interface (Application Programming Interface, API) interface on the hypervisor, so that the virtual machine knows that it is running in a virtualized environment, so as to cooperate with the hypervisor according to the virtio standard, so that the virtual machine can achieve better performance performance, such as input/output port (Input/Output, I/O) performance.

The computing node (or referred to as a physical host) further includes a back-end processing module 1013. The back-end processing module 1013 is implemented in a QEMU program, and the back-end processing module is a Virtio paravirtualized device simulation program. Wherein, the Virtio paravirtualized driver can also be called a front-end driver compared with the back-end processing module 1013 . QEMU/KVM provides a fully virtualized environment that allows virtual machines to run in a KVM environment without any modification. KVM is a hypervisor that must use hardware virtualization assist technologies (such as Intel VT-x, AMD-V).

Further, communication between the detection module and the back-end processing module 1013 is supported through a paravirtualized channel between the detection module and the back-end processing module 1013 . It can also be understood that the communication between the virtual machine and the physical host is implemented through a paravirtualized channel. The Virtio paravirtualized driver can use zero or more queues, depending on requirements. For example, the Virtio paravirtualized driver uses two virtual queues (one for receive, called the upstream queue, and one for transmit, called the downstream queue). It should be noted that the uplink and the downlink are relatively defined, which are not limited in this embodiment of the present invention.

In a possible implementation manner, the physical host may further include a virtio-ring layer to implement a ring buffer, which is used to save the information executed by the detection module and the back-end processing module 1013, and it can be used once The multiple I/O requests of the detection module are stored and processed in batches by the back-end processing module 1013. Finally, the device driver in the physical host 101 is actually called to implement the physical I/O operation, so that batch processing can be realized according to the agreement. Not every I/O request in the virtual machine needs to be processed once, which can improve the efficiency of information exchange between the virtual machine and the hypervisor.

It should be noted that after the virtual machine is started in the physical host, the detection module in the virtual machine automatically takes effect, that is, defense, intrusion detection, and detection data reporting begin.

As described in the background, in the prior art, by running a security agent program or a temporary script in the user layer, resources of the user layer need to be occupied, and there may be a possibility of false detection during actual operation. Moreover, when the security agent detects the kernel space of the virtual machine system, it needs to deploy the kernel module and communicate with the kernel space, which is more complicated. Moreover, when a security agent or a temporary script reports events, it needs to rely on user network resources.

In view of this, embodiments of the present invention provide an intrusion detection method for a virtual machine. This method can avoid false detection and help reduce the complexity of intrusion detection, and does not need to rely on the user network.

Based on the above content, as shown in FIG. 2 , an intrusion detection method for a virtual machine provided by an embodiment of the present invention is provided. The method is applied to a first physical host, where the first physical host virtualizes at least one virtual machine, and the at least one virtual machine is deployed with a Virtio paravirtualized driver. Taking the first virtual machine as an example below, the method includes the following steps:

Step 201, the detection module of the first virtual machine acquires detection data.

The first virtual machine is any one of at least one virtual machine virtualized by the first physical host machine. 1 , the first physical host may be the physical host 101 in the foregoing FIG. 1 , and the first virtual machine may be the virtual machine 1011 or the virtual machine 1012 .

In a possible implementation manner, the detection module in the first virtual machine implements detection through a kernel driving technology, and can be loaded and run as a device driver of the kernel of the first virtual machine. Specifically, the detection module in the first virtual machine is mainly used to perform intrusion detection on the runtime of the first virtual machine by using the kernel framework (Linux/Windows) of the operating system of the first virtual machine, so as to obtain detection data. Based on this, the operation can be more transparent to the user, and it is not easy to cause detection failure due to misoperation, that is, false detection is not easy to occur.

Step 202, the detection module of the first virtual machine sends the detection data to the back-end processing module of the first host through a paravirtualized channel.

In a possible implementation manner, the first virtual machine is deployed with a Virtio paravirtualized driver, and a paravirtualized channel is formed between the detection module of the first virtual machine and the back-end processing module of the first physical host. Here, the paravirtualized channel may also be referred to as a data queue of the Virtio paravirtualized device, and the queue in which the detection module sends data to the back-end processing module may be referred to as an upstream queue of data of the Virtio paravirtualized device.

It can also be understood that the detection module of the first virtual machine may use the data queue of the Virtio paravirtualized device of QEMU-KVM to send the detection data to the back-end processing module of the first host.

Step 203, the back-end processing module of the first host sends the detection data to the second physical host.

1 , the first physical host may be the physical host 101 shown in FIG. 1 , and the second physical host may be the physical host 102 shown in FIG. 1 .

In a possible implementation manner, the back-end processing module of the first physical host can be developed based on the QEMU-KVM virtualization technology to implement a program of a Virtio paravirtualized device, which can be used as the back-end of the first host. part of the virtual machine program to run.

Exemplarily, the back-end processing module of the first physical host may be a character device or the like. Among them, the character device refers to the device that transmits in units of characters during the I/O transmission process. In the LUNIX system, character devices occupy positions in the file directory tree as special files and have corresponding nodes. Character devices can use the same file operation commands as ordinary files to operate on character device files, such as open, close, read, write, etc.

In a possible implementation manner, an intrusion detection management service is deployed in the second physical host. Wherein, the back-end processing module of the first host and the data deployed with the intrusion detection management service can interact through the network between the first physical host and the second physical host. Specifically, the network between the first physical host and the second physical host may include, but is not limited to, a mobile communication network (such as a 2G/3G/4G/5G/future 6G network), or a wireless local area network (wireless local area network). area networks, WLAN), or wireless fidelity (wireless fidelity, Wi-Fi) networks.

Through the above steps 201 to 203, the detection module in the first virtual machine uses the kernel framework (Linux/Windows) of the operating system of the first virtual machine to perform intrusion detection on the runtime of the first virtual machine, which can make it more transparent to users It is not easy to be misused and cause false detection. Moreover, the detection module in the virtual machine and the processing back-end module can interact with detection data based on the paravirtualized channel, that is, the data interaction between the virtual machine and the physical host is realized based on the paravirtualized channel. Further, data interaction is carried out through the network between the two physical hosts (ie, the first physical host and the second physical host), which can achieve independence from user network resources, thereby reducing disturbance to the user's network environment, and does not depend on user network resources. It will be interfered by user network operation and maintenance, which improves the stability and timeliness of data interaction.

In a possible implementation manner, the detection module can be operated in a unified manner with the intrusion detection component of the host, so as to improve the efficiency of the intrusion detection of the physical host.

In a possible implementation manner, the intrusion detection management service can be implemented through any application service framework. The application service framework may include, but is not limited to, a view, model, and controller (Model View Controller, MVC) framework, a remote procedure call (Remote Procedure Call, RPC) framework, or a service-oriented architecture (Service-Oriented Architecture, SOA) Wait. The intrusion detection management service is mainly used to manage the intrusion detection of virtual machines, which may include, but is not limited to, storage, analysis, and alarming of detection data. Further, the intrusion detection management service can also be used for configuration management of the detection module, for example, to deliver configuration information to update the detection module.

When the intrusion detection management service needs to send the configuration information to the first virtual machine, it can be sent through the network between the first physical host and the second physical host. Specifically, the intrusion detection management service may send configuration information to the back-end processing module of the first physical host through the network between the first physical host and the second physical host. For the network between the physical host and the second physical host, reference may be made to the foregoing related introduction, which will not be repeated here.

Further, optionally, when the back-end processing module in the first physical host sends configuration information to the detection module in the first virtual machine, it can also pass the paravirtualized channel in the above step 202, or called the Virtio paravirtualization channel. Data queues for virtualized devices. Here, the data queue of the Virtio paravirtualized device may be referred to as a downstream queue. Specifically, the back-end processing module in the first physical host sends configuration information to the detection module in the first virtual machine through the paravirtualized channel.

Further, optionally, the detection module in the first virtual machine may update the detection module according to the received configuration information.

Based on the above content, in order to further illustrate the intrusion detection method for a virtual machine provided by the embodiment of the present invention, another intrusion detection method for a virtual machine is given as follows. The virtual machine intrusion detection method can introduce the intrusion detection method of the virtual machine in detail from the data flow of the detection data. The method includes the following steps:

Step 301, the first virtual machine is started, and the detection module included in the Virtio paravirtualized driver in the first virtual machine starts intrusion detection.

Step 302, the detection module collects detection data.

For this step 302, reference may be made to the introduction of the above-mentioned step 201, and details are not repeated here.

Step 303, the detection module sends detection data to the Virtio paravirtualized driver. Correspondingly, the Virtio paravirtualized driver receives the detection data from the detection module.

Step 304, the Virtio paravirtualized driver sends the detection data to the back-end processing module through the upstream queue of the data of the Virtio paravirtualized device. Correspondingly, the back-end processing module receives detection data from the Virtio paravirtualized driver.

For this step 304, reference may be made to the introduction of the foregoing step 202, and details are not repeated here.

Step 305, the back-end processing module sends detection data to the intrusion detection management service. Accordingly, the intrusion detection management service receives detection data from the back-end processing module.

For this step 305, reference may be made to the introduction of the above-mentioned step 203, which will not be repeated here.

It should be noted that, before the above step 301, the relevant configuration of the Virtio paravirtualized device may be added to the configuration file of the first virtual machine. Specifically, a paravirtualized device driver may be added to the basic image of the first virtual machine and boot loading may be configured.

Through the above steps 301 to 305, the detection module can report detection data to the intrusion detection management service.

Based on the above content, in order to further illustrate the intrusion detection method for a virtual machine provided by the embodiment of the present invention, another intrusion detection method for a virtual machine is given as follows. The virtual machine intrusion detection method can introduce the intrusion detection method of the virtual machine in detail from the flow of configuration information. The method includes the following steps:

Step 401, the intrusion detection management service sends configuration information to the back-end processing module. Correspondingly, the back-end processing module receives the configuration information from the intrusion detection management service.

In a possible implementation manner, the intrusion detection management service may send configuration information to the backend processing module of the first physical host through the network between the first physical host and the second physical host.

Step 402, the back-end processing module sends configuration information to the Virtio paravirtualized driver through the downlink queue of data of the Virtio paravirtualized device. Correspondingly, the Virtio paravirtualized driver receives configuration information from the back-end processing module.

Step 403, the Virtio paravirtualized driver injects configuration information into the detection module.

Step 404, the detection module is updated according to the injected configuration information.

Through the above steps 401 to 404, the intrusion detection management service can send configuration information to the detection module, so as to update the detection module.

It can be understood that, in order to realize the functions in the above-mentioned embodiments, the detection apparatus includes corresponding hardware structures and/or software modules for performing each function. Those skilled in the art should easily realize that the modules and method steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software-driven hardware depends on the specific application scenarios and design constraints of the technical solution.

Based on the same technical concept described above, an embodiment of the present invention further provides a detection device. Referring to FIG. 5 , it is a schematic structural diagram of a detection apparatus provided by an embodiment of the present invention. The detection device can be used to perform the function of the physical host in the above method embodiments, so the beneficial effects of the above method embodiments can also be achieved.

As shown in FIG. 5 , the detection device 500 includes a detection module 501 and a back-end processing module 502 . The detection device 500 can be used to execute the method shown in FIG. 2 or FIG. 3 or FIG. 4 .

When the detection apparatus 500 is used to implement the method embodiment shown in FIG. 2, the detection module 501 is used to acquire detection data; and send the detected data to the back-end processing module 502 of the first physical host through a para-virtualized channel. the detection data; the back-end processing module 502 is configured to send the detection data to the second physical host.

In a possible implementation manner, the paravirtualized channel is a data queue of a Virtio paravirtualized device.

In a possible implementation manner, the detection module 501 is configured to perform intrusion detection through the kernel framework of the first virtual machine to obtain the detection data.

In a possible implementation manner, the back-end processing module 502 is further configured to receive configuration information from a second physical host, where the second physical host is deployed with an intrusion detection management service; and pass the paravirtualized channel , sending the configuration information to the detection module 501 of the first virtual machine; the detection module 501 is configured to update the detection module 501 according to the configuration information.

In a possible implementation manner, the back-end processing module 502 of the physical host is a program of a Virtio paravirtualized device.

In a possible implementation manner, the back-end processing module 502 is specifically configured to: receive all data from the second physical host based on the network between the first physical host and the second physical host configuration information.

In a possible implementation manner, the back-end processing module 502 sends the detection data to the second physical host based on the network between the first physical host and the second physical host.

More detailed descriptions of the detection module 501 and the back-end processing module 502 can be obtained directly by referring to the relevant descriptions in the method embodiment shown in FIG. 2 , and details are not repeated here.

Based on the same technical concept, an embodiment of the present application also provides a detection device, as shown in FIG. 6 , including at least one processor 601 and a communication interface 602, and a memory 603 connected to the at least one processor. The embodiment of the present application The specific connection medium between the processor 601 and the memory 603 is not limited herein, and the connection between the processor 601 and the memory 603 is taken as an example in FIG. 6 through a bus. The bus can be divided into address bus, data bus, control bus and so on.

In this embodiment of the present application, the memory 603 stores instructions that can be executed by at least one processor 601 , and the at least one processor 601 can execute the steps included in the foregoing virtual machine intrusion method by executing the instructions stored in the memory 603 .

Among them, the processor 601 is the control center of the detection device, and can use various interfaces and lines to connect various parts of the detection device, and realize the data by running or executing the instructions stored in the memory 603 and calling the data stored in the memory 603. deal with. Optionally, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem The calling processor mainly deals with issuing instructions. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 603 may be implemented on the same chip, and in some embodiments, they may be implemented separately on separate chips.

The processor 601 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the intrusion method in combination with a virtual machine can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

As a non-volatile computer-readable storage medium, the memory 603 can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 603 may include at least one type of storage medium, for example, may include a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk, CD and so on. Memory 603 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 603 in this embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, for storing program instructions and/or data.

Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a detection device, and when the program runs on the detection device, makes the detection device Perform the steps of the intrusion method of the above virtual machine.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (10)

1. The intrusion detection method of the virtual machine is applied to a first physical host machine, the first physical host machine virtualizes at least one virtual machine, the at least one virtual machine comprises a Virtio paravirtualization driver, the Virtio paravirtualization driver comprises a detection module, and the method comprises the following steps:

a detection module of a first virtual machine acquires detection data, wherein the first virtual machine is any one of the at least one virtual machine;

the detection module of the first virtual machine sends the detection data to a back-end processing module of the first physical host machine through a paravirtualized channel;

and the back-end processing module of the first host machine sends the detection data to the second physical host machine.

2. The method of claim 1, wherein the paravirtualized channel is a data queue of a Virtio paravirtualized device.

3. The method of claim 1, wherein the detection module of the first virtual machine obtains detection data comprising:

and the detection module of the first virtual machine carries out intrusion detection through the kernel framework of the first virtual machine to obtain the detection data.

4. The method of claim 1 or 2, wherein the method further comprises:

a back-end processing module of the first physical host machine receives configuration information from a second physical host machine, and the second physical host machine is deployed with an intrusion detection management service;

the back-end processing module of the first virtual machine sends the configuration information to the detection module of the first virtual machine through the paravirtualization channel;

and the detection module of the first virtual machine updates the detection module according to the configuration information.

5. The method of claim 4, wherein the back-end processing module of the physical host is a program of a Virtio para-virtualization device.

6. The method of claim 5, wherein the back-end processing module of the first physical host receives configuration information from the second physical host, comprising:

the back-end processing module of the first physical host receives the configuration information from the second physical host based on a network between the first physical host and the second physical host.

7. The method of claim 1, wherein the back-end processing module of the first physical host sending the detection data to the second physical host comprises:

and the back-end processing module of the first physical host machine sends the detection data to the second physical host machine based on the network between the first physical host machine and the second physical host machine.

8. A detection apparatus applied to a first physical host machine, wherein the first physical host machine virtualizes at least one virtual machine, the at least one virtual machine includes a Virtio paravirtualization driver, the Virtio paravirtualization driver includes a detection module, and the detection apparatus includes:

the detection module is used for acquiring detection data; sending the detection data to a back-end processing module through a paravirtualized channel; and the back-end processing module is used for sending the detection data to the second physical host.

9. A detection apparatus, comprising a processor coupled to a memory for storing a computer program and a transceiver for executing the computer program stored in the memory to cause the detection apparatus to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium, having stored thereon a computer program or instructions which, when executed by a detection apparatus, cause the detection apparatus to perform the method of any one of claims 1 to 7.

Images