WO2016091086A1

WO2016091086A1 - Virtualization security detection method and system

Info

Publication number: WO2016091086A1
Application number: PCT/CN2015/095821
Authority: WO
Inventors: 汪圣平; 杨晓东; 徐锐波; 王院生
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2014-12-12
Filing date: 2015-11-27
Publication date: 2016-06-16
Also published as: CN104504330B; CN104504330A

Abstract

Provided are a virtualization security detection method and system. The method comprises: a lightweight agent client acquiring information to be detected and sending the information to be detected to a caching server via a network; the caching server judging whether there is a cached correlation between the information to be detected and a security level corresponding to the information to be detected or not; if the correlation does not exist, the caching server sending the information to be detected to a checking and killing server via the network to detect the security of the information to be detected; determining the security level of the information to be detected according to a detection result of the checking and killing server; and if the correlation exists, determining the security level of the information to be detected according to the correlation, wherein the lightweight agent client is arranged in a virtual machine. The present invention increases the security detection efficiency and decreases a resource occupation rate of a physical machine.

Description

Virtualization security detection method and system

Technical field

The present invention relates to the field of computer technologies, and in particular, to a virtualization security detection method and system.

Background technique

Virtualization refers to virtualizing a computer into multiple logical computers through virtualization technology. Running multiple logical computers on a single computer, each running a different operating system, and the applications can run in separate spaces without affecting each other, significantly improving the efficiency of the computer.

In the existing virtualization security detection scheme, if there are multiple virtual logical computers (virtual machines) on the same physical machine, it is necessary to set the killing in each virtual machine when performing security detection on the information in multiple virtual machines. The server performs security detection on the information in each virtual machine in its own killing server.

Since each virtual machine contains the same or similar information, and the killing servers are also identical to each other, if multiple virtual machines simultaneously perform the same security detection, it is bound to increase the resource consumption of the physical machines where multiple virtual machines are located. .

Summary of the invention

In view of the above-mentioned existing virtualization security detection method for securing information in multiple virtual machines, which easily causes a high resource occupation of the physical machine, the present invention has been proposed to provide an overcoming of the above problems or at least partially solving the above problems. Virtualization security detection methods and systems.

According to an aspect of the present invention, a virtualization security detection method is provided, including:

The light proxy client obtains the to-be-detected information, and sends the to-be-detected information to the cache server through the network;

Determining, by the cache server, whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached;

If not, the cache server sends the to-be-detected information to the network through the network. Performing security detection of the information to be detected by the server; determining a security level of the information to be detected according to the detection result of the killing server;

If yes, determining a security level of the to-be-detected information according to the correspondence relationship;

The light proxy client is set in the virtual machine.

Optionally, the light proxy client obtains information to be detected, including:

The light proxy client obtains to-be-detected information from at least one virtual machine in the physical machine where the light proxy client is located, where multiple virtual machines are set in the physical machine;

and / or,

The light proxy client obtains to-be-detected information from at least one virtual machine of at least one physical machine in the same cluster as the physical machine where the light proxy client is located, where the cluster includes at least one physical machine Each of the physical machines includes at least one virtual machine.

Optionally, the to-be-detected information includes at least one of file information, web address information, access path information, and registry read/write information.

Optionally, the step of performing the security detection of the information to be detected by the killing server includes:

Obtaining, by the killing server, a feature value of the to-be-detected information;

The killing server scans the feature value by the killing engine to perform security detection on the to-be-detected information.

Optionally, the method further includes:

If the killing server scans the feature value to perform security detection on the to-be-detected information, and the detection result is not obtained, the killing server sends the feature value to the cluster of the light proxy client. The private cloud server performs security detection, obtains a detection result, and returns the detection result to the killing server.

Optionally, the method further includes:

If the private cloud server performs the security detection on the to-be-detected information, the feature value is sent to the public cloud server outside the cluster for security detection, the detection result is obtained, and the detection result is obtained. Returning to the private cloud server, and returning the detection result to the killing server by using the private cloud server.

Optionally, the killing server sends the feature value to the private cloud server of the cluster where the light proxy client is located for security detection, including:

The killing server sends the feature value to the private cloud server of the cluster where the light proxy client is located for security detection according to a preset scanning sequence.

Optionally, after the obtaining the detection result, and returning the detection result to the killing server, the method further includes:

The killing server sends the security detection result to the cache server for storage.

Optionally, the method further includes:

The private cloud server obtains update information from the public cloud server according to a setting rule, where the update information includes a correspondence between a feature value periodically updated by the public cloud server and a security level;

The private cloud server updates the correspondence between the feature value and the security level stored in the private cloud server according to the update information.

According to another aspect of the present invention, a virtualization security detection system is provided, including: a cache server, a kill server, and a light proxy client disposed in the virtual machine;

The light proxy client is configured to obtain information to be detected, and send the to-be-detected information to the cache server through a network;

The cache server is configured to determine whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached; if not, the information to be detected is sent to the check through the network. Killing the server; if yes, determining the security level of the to-be-detected information according to the corresponding relationship;

The killing server is configured to receive the to-be-detected information sent by the cache server, and perform security detection on the to-be-detected information to obtain a detection result;

The cache server is further configured to determine a security level of the to-be-detected information according to the detection result of the killing server.

Optionally, the light proxy client is from the physical machine where the light proxy client is located One less virtual machine obtains information to be detected, wherein the physical machine is provided with multiple virtual machines;

and / or,

Optionally, the killing server includes:

The feature value obtaining module is configured to acquire the feature value of the information to be detected;

The security detection module is configured to perform security detection on the to-be-detected information by scanning the feature value by using a killing engine.

Optionally, the killing server further includes:

The private cloud detection module is configured to send the feature value to the light proxy client if the security detection module performs security detection on the to-be-detected information by scanning the feature value by the killing engine. The private cloud server of the cluster performs security detection, obtains a detection result, and returns the detection result to the killing server.

Optionally, the killing server further includes:

The public cloud detection module is configured to: if the private cloud server performs security detection on the to-be-detected information, the feature value is sent to the public cloud server outside the cluster for security detection, and the detection result is obtained. And returning the detection result to the private cloud server, and returning the detection result to the killing server by using the private cloud server.

Optionally, the private cloud detecting module sends the feature value to a private cloud server of the cluster where the light proxy client is located for security detection according to a preset scanning sequence.

Optionally, the killing server further includes:

The cache storage module is configured to send the security detection result to the cache server for storage after the private cloud detection module obtains the detection result and returns the detection result to the detection server.

Optionally, the private cloud server obtains update information from the public cloud server according to a setting rule, where the update information includes a correspondence between a feature value periodically updated by the public cloud server and a security level;

According to still another aspect of the present invention, there is provided a computer program comprising computer readable code which, when executed on a computer, causes the computer to perform any of the virtualization security described above Detection method.

According to still another aspect of the present invention, there is provided a computer readable medium storing the computer program recited in the claims.

The beneficial effects of the invention are:

In the existing virtualization security detection scheme, when the information in multiple virtual machines is detected at the same time, the killing server in each virtual machine starts to perform security detection on the information, thereby increasing the resource occupancy rate of the physical machine. . According to the virtual machine security detection scheme of the present invention, the light proxy client is set in the virtual machine, and the information to be detected in the virtual machine is obtained by the light proxy client, and sent to the cache server for security level judgment, and the cache server determines whether Cache the correspondence between the information to be detected and the security level corresponding to the information to be detected. If yes, determine the security level of the information to be detected according to the corresponding relationship; if not, send the information to be detected to the killing server for security detection, and The security level is determined based on the results of the security test.

By setting a cache server that caches the correspondence between the information to be detected and its security level, the cache server is first used for judgment, and the security detection efficiency is improved without checking the server security detection.

Setting the light proxy client to a virtual machine in multiple virtual machines only occupies system resources in one virtual machine, which reduces the resource occupancy rate of the physical machine.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the present invention are as follows formula.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flow chart showing the steps of a virtualization security detection method according to Embodiment 1 of the present invention;

2 is a flow chart showing the steps of a virtualization security detection method according to Embodiment 2 of the present invention;

3 is a structural block diagram of a virtualization security detection system according to Embodiment 3 of the present invention;

4 is a structural block diagram of a virtualization security detection system according to Embodiment 4 of the present invention;

FIG. 5 is a block diagram schematically showing a structure of a computer for executing a virtualization security detecting method according to the present invention;

Fig. 6 schematically shows a storage unit for holding or carrying program code implementing the virtualization security detection method according to the present invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

Embodiment 1

A virtualization security detection method provided by an embodiment of the present invention is described in detail.

Referring to FIG. 1, a flow chart of steps of a virtualization security detection method in an embodiment of the present invention is shown.

The virtualization security detection method in the embodiment of the present invention can be applied to a system including a light proxy client, a cache server, and a kill server.

The light proxy client may be disposed in a virtual machine, and the cache server and the kill server may be disposed in a virtual machine or a physical machine. For example, the light proxy client may be disposed in one virtual machine of the plurality of virtual machines, and the cache server and the killing server may be disposed only in one physical machine, or may be disposed in one In the virtual machine. Optionally, the light proxy client, the cache server, and the killing server may be disposed in the same virtual machine among the multiple virtual machines, and the other virtual machines need not be set.

The virtualization security detection method of the embodiment of the present invention includes the following steps:

Step 100: The light proxy client obtains the to-be-detected information, and sends the to-be-detected information to the cache server through the network.

The information to be detected may be from the same virtual machine, or may be derived from multiple virtual machines, that is, the light proxy client in one virtual machine can obtain the information to be detected in other virtual machines. . Compared with the information to be detected by the underlying physical layer, only the file information can be transmitted due to the limitation of the underlying physical layer itself, and the information to be detected transmitted through the network, in addition to the file information, may include but is not limited to the URL information. , access path information, registry read and write information.

Step 102: The cache server determines whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached. If not, step 104 is performed; if yes, step 106 is performed.

The corresponding relationship between the to-be-detected information and its corresponding security level can be cached in the cache server. For example, the cache server caches the correspondence between the to-be-detected information A and its corresponding security level “dangerous”; the cache server caches the correspondence between the to-be-detected information B and its corresponding security level “security”.

Step 104: The cache server sends the to-be-detected information to the killing server through the network to perform security detection of the to-be-detected information. The security level of the to-be-detected information is determined according to the detection result of the killing server. .

For example, the cache server receives the to-be-detected information C from the light proxy client, and the cache server does not have the correspondence between the to-be-detected information C and its corresponding security level, and the cache server sends the to-be-detected information C to the killing server. Detection information C security detection, by The killing server obtains the detection result of the information C to be detected, and the cache server can determine the security level of the information C to be detected according to the detection result.

That is, when there is no correspondence between the to-be-detected information and the corresponding security level in the cache server, the cache server sends the to-be-detected information to the killing server for security detection, and the detection result obtained by the killing server is determined. The security level of the information to be detected.

Step 106: Determine a security level of the to-be-detected information according to the correspondence.

If the correspondence between the to-be-detected information and the corresponding security level exists in the cache server, the security level corresponding to the to-be-detected information is directly determined.

In summary, the embodiment of the present invention sets a light proxy client in the virtual machine, and the light proxy client obtains the to-be-detected information in the virtual machine, and sends the information to the cache server for security level judgment, and the cache server determines whether the cache is to be cached. Corresponding relationship between the detection information and the security level corresponding to the information to be detected, if yes, determining the security level of the information to be detected according to the corresponding relationship; if not, sending the information to be detected to the killing server for security detection, and according to security The test results determine the level of security.

Embodiment 2

Referring to FIG. 2, a flow chart of steps of a virtualization security detection method in an embodiment of the present invention is shown.

The light proxy client can be set in a virtual machine, and the cache server and the server The killing server can be set in a virtual machine or in a physical machine. For example, the light proxy client may be disposed in one virtual machine of the plurality of virtual machines, and the cache server and the killing server may be disposed only in one physical machine, or may be disposed in one In the virtual machine, the light proxy client, the cache server, and the killing server may be set in the same virtual machine among the multiple virtual machines, and the other virtual machines need not be set.

The virtualization security detection method of this embodiment includes the following steps:

Step 200: The light proxy client obtains the to-be-detected information, and sends the to-be-detected information to the cache server through the network.

The information to be detected may be from the same virtual machine, or may be derived from multiple virtual machines, that is, the light proxy client in one virtual machine can obtain the information to be detected in other virtual machines. .

Preferably, the process of obtaining the information to be detected by the light proxy client in step 200 according to different sources of the information to be detected may be:

1) The light proxy client obtains to-be-detected information from at least one virtual machine in the physical machine where the light proxy client is located, where multiple virtual machines are disposed in the physical machine.

For example, if the physical machine W1 where the light proxy client Q1 is located includes the virtual machines X1 and X2, the light proxy client Q1 can obtain the to-be-detected information from the virtual machines X1 and X2, and can separately obtain the to-be-detected from the virtual machine X1. The information can be separately obtained from the virtual machine X2 to be detected.

and / or,

2) The light proxy client obtains information to be detected from at least one virtual machine of at least one physical machine in the same cluster as the physical machine where the light proxy client is located, wherein the cluster includes at least one A physical machine, each of the physical machines including at least one virtual machine.

For example, the physical machine W1 where the light proxy client Q1 is located is located in the cluster J1, the cluster J1 further includes the physical machine W2, the physical machine W1 includes the virtual machines X1 and X2, and the physical machine W2 includes the virtual machines X3 and X4, and the light proxy client Q1 can obtain the information to be detected from the virtual machines X1, X2, X3, and X4, and can obtain the information to be detected from the virtual machine X1 separately, or obtain the information to be detected from the virtual machine X2 separately, or separately from the virtual machine. Obtaining information to be detected in X3, the same The information to be detected may also be obtained from the virtual machine X4 alone.

The light proxy client obtains the information to be detected, and may separately select the manner in the above 1), and may also separately select the manner in the above 2), or may select the manners in the above 1) and 2) at the same time.

Preferably, the information to be detected may include at least one of file information, web address information, access path information, and registry read and write information. The specific content of the information to be detected in the embodiment of the present invention is not limited.

Step 202: The cache server determines whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached. If not, step 204 is performed; if yes, step 206 is performed.

Step 204: The cache server sends the to-be-detected information to the killing server through the network to perform security detection of the to-be-detected information. The security level of the to-be-detected information is determined according to the detection result of the killing server. .

For example, the cache server receives the to-be-detected information C from the light proxy client, and the cache server does not have the correspondence between the to-be-detected information C and its corresponding security level, and the cache server sends the to-be-detected information C to the killing server. The security detection of the detection information C is obtained by the killing server, and the cache server can determine the security level of the information C to be detected according to the detection result.

Preferably, the step of performing the security detection of the information to be detected by the server in the above step 204 may include:

Step 041, the killing server acquires a feature value of the to-be-detected information.

The feature value of the information to be detected is an attribute letter for identifying that the information to be detected is unique. The information of the detection server can be calculated by performing operations such as the detection of the detection information to obtain the feature value. The embodiment of the present invention does not limit the technical means for the server to obtain the feature value of the information to be detected.

Step 042: The killing server scans the feature value by a killing engine to perform security detection on the to-be-detected information.

The killing engine is a core component of the killing server, and the killing engine can scan and identify the feature values to realize the security detection of the detected information.

Preferably, if in step 042, the killing server scans the feature value to perform security detection on the to-be-detected information, and the detection result is not obtained, step 043 is performed.

Step 043: The killing server sends the feature value to the private cloud server of the cluster where the light proxy client is located to perform security detection, obtain a detection result, and return the detection result to the killing server.

The cluster in which the light proxy client is located is provided with a private cloud server, and the private cloud server is generally configured to be accessed by a physical machine and a virtual machine in the cluster, and a large number of the clusters are stored on the private cloud server. Information about the information to be detected, including the feature value of the information to be detected, the corresponding security level, and the like.

Preferably, in the above step 043, the process of the security detection by the killing server to send the feature value to the private cloud server of the cluster where the light proxy client is located may be:

If there are multiple feature values that need to be sent to the private cloud server for security detection, the killing server may send multiple feature values to the private cloud server for security detection according to a preset scanning sequence.

Preferably, in step 043, after the obtaining the detection result and returning the detection result to the killing server, the killing server may further send the security detection result to the cache server. Store.

The purpose of the security server is to send the security detection result to the cache server for storage. The purpose is to increase the correspondence between the information to be detected and the corresponding security level of the cache server, and the efficiency of the cache server in the above step 202 can be improved.

Preferably, if the private cloud server performs security detection on the to-be-detected information in the above step 043, the step 044 is performed.

Step 044: Send the feature value to a public cloud server outside the cluster for security detection, obtain a detection result, and return the detection result to the private cloud server, and use the private cloud server to The detection result is returned to the killing server.

Generally, the security detection capability of the private cloud server is weaker than that of the public cloud server. When the private cloud server does not receive the detection result, the feature value is sent to the public cloud server for security detection, and the detection result can be obtained, and the detection result is obtained. Returning to the private cloud server and killing the server, the success rate of subsequent private cloud servers and killing servers can be increased.

Preferably, the private cloud server may obtain update information from the public cloud server according to a setting rule, where the update information may include a correspondence between a feature value periodically updated by the public cloud server and a security level.

Preferably, the private cloud server may update the correspondence between the feature value and the security level stored in the private cloud server according to the update information.

Step 206: Determine a security level of the to-be-detected information according to the correspondence.

In summary, the embodiment of the present invention sets a light proxy client, a cache server, and a killing server in a virtual machine of a plurality of virtual machines, and the light proxy client obtains the to-be-detected information in the virtual machine and sends the information. The cache server determines the security level of the information to be detected and the security level corresponding to the information to be detected. If yes, the security level of the information to be detected is determined according to the corresponding relationship; if not, the security level of the information to be detected is determined; The information to be detected is sent to the killing server for security detection, and the security level is determined according to the security detection result.

The light proxy client, the cache server, and the killing server are set in one virtual machine of multiple virtual machines, which only occupy system resources in one virtual machine, thereby reducing the resource occupancy rate of the physical machine.

Embodiment 3

A virtualization security detection system provided by an embodiment of the present invention is described in detail.

Referring to FIG. 3, a block diagram of a virtualized security detection system in an embodiment of the present invention is shown.

The system may include: a light proxy client 300 disposed in the virtual machine, and a cache server 302 and a kill server 304;

The cache server 302 and the kill server 304 may be disposed in a physical machine or a virtual machine. For example, the light proxy client 300 may be disposed in one virtual machine of the plurality of virtual machines, and the cache server 302 and the killing server 304 may be disposed only in one physical machine, or The virtual agent client 300, the cache server 302, and the killing server 304 may be disposed in the same virtual machine among multiple virtual machines, and other virtual devices are disposed in a virtual machine. There is no need to set it in the machine.

The light proxy client 300 is configured to obtain information to be detected, and send the to-be-detected information to the cache server 302 through the network.

The cache server 302 is configured to determine whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached; if not, the to-be-detected information is sent to the The server 304 is detected; if yes, the security level of the information to be detected is determined according to the correspondence.

The killing server 304 is configured to receive the to-be-detected information sent by the cache server 302, and perform security detection on the to-be-detected information to obtain a detection result.

The cache server 302 is further configured to determine a security level of the to-be-detected information according to the detection result of the killing server 304.

In summary, the embodiment of the present invention sets a light proxy client in a virtual machine, and is a light proxy. The client obtains the to-be-detected information in the virtual machine and sends it to the cache server to determine the security level. The cache server determines whether to cache the correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information. The security level of the information to be detected; if not, the information to be detected is sent to the killing server for security detection, and the security level is determined according to the security detection result.

Embodiment 4

Referring to FIG. 4, a block diagram of a virtualized security detection system in an embodiment of the present invention is shown.

The system may include: a light proxy client 400 disposed in the virtual machine, and a cache server 402 and a kill server 404; wherein the cache server 402 and the kill server 404 may be disposed in a physical machine or a virtual machine. For example, the light proxy client 400 may be disposed in one virtual machine of the plurality of virtual machines, and the cache server 402 and the killing server 404 may be disposed only in one physical machine, or The virtual proxy client 400, the cache server 402, and the cache server 404 may be disposed in the same virtual machine among multiple virtual machines, and other virtual There is no need to set it in the machine.

The killing server 404 may include: a feature value obtaining module 4041, a security detecting module 4042, a private cloud detecting module 4043, a public cloud detecting module 4044, and a cache storage module 4045.

The light proxy client 400 is configured to acquire information to be detected, and send the to-be-detected information to the cache server 402 through the network.

The information to be detected may include file information, web address information, and access path information. At least one of information, registry read and write information.

Preferably, the light proxy client 400 acquires to-be-detected information from at least one of the physical machines in which the light proxy client 400 is located, wherein the plurality of virtual machines are disposed in the physical machine.

and / or,

The light proxy client 400 obtains information to be detected from at least one virtual machine of at least one physical machine in the same cluster as the physical machine where the light proxy client 400 is located, wherein the cluster includes at least one A physical machine, each of the physical machines including at least one virtual machine.

The cache server 402 is configured to determine whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached; if not, the to-be-detected information is sent to the The server 404 is detected; if yes, the security level of the information to be detected is determined according to the correspondence.

The killing server 404 is configured to receive the to-be-detected information sent by the cache server 402, and perform security detection on the to-be-detected information to obtain a detection result.

Preferably, the killing server 404 can include:

The feature value obtaining module 4041 is configured to acquire the feature value of the information to be detected.

The security detection module 4042 is configured to perform security detection on the to-be-detected information by scanning the feature value by using a killing engine.

The private cloud detecting module 4043 is configured to send the feature value to the light proxy client if the security detecting module 4042 performs a security detection on the to-be-detected information by scanning the feature value by the killing engine without obtaining a detection result. The private cloud server in the cluster where the terminal 400 is located performs security detection, obtains a detection result, and returns the detection result to the killing server 404.

Preferably, the private cloud detecting module 4043 sends the feature value to the private cloud server of the cluster where the light proxy client 400 is located for security detection according to a preset scanning sequence.

The public cloud detection module 4044 is configured to: if the private cloud server performs security detection on the to-be-detected information, the feature value is sent to the public cloud server outside the cluster for security detection, and the detection is performed. Result and return the test result Giving the private cloud server, and returning the detection result to the killing server 404 through the private cloud server.

The cache storage module 4045 is configured to: after the private cloud detection module 4043 obtains the detection result, and returns the detection result to the killing server 404, send the security detection result to the cache server for storage. .

Preferably, the private cloud server obtains update information from the public cloud server according to a setting rule, where the update information includes a correspondence between a feature value periodically updated by the public cloud server and a security level.

Preferably, the private cloud server updates the correspondence between the feature value and the security level stored in the private cloud server according to the update information.

The cache server 402 is further configured to determine a security level of the to-be-detected information according to the detection result of the killing server 404.

The virtualization security detection scheme provided herein is not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. Root From the above description, it is apparent that the structure required to construct the system having the solution of the present invention is apparent. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects lie in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the claims, any one of the claimed embodiments may be in any combination. use.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the virtualization security detection scheme in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 5 illustrates a computer in which a virtualization security detection method in accordance with the present invention can be implemented. The computer traditionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520. The memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above. For example, storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 520 in the mobile terminal of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 531', code that can be read by a processor, such as 510, which when executed by a computer causes the computer to perform various steps in the methods described above.

"an embodiment," or "an embodiment," or "an embodiment," In addition, please note that the examples of the words "in one embodiment" are not necessarily all Refers to the same embodiment.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A virtualization security detection method includes:

The light proxy client obtains the to-be-detected information, and sends the to-be-detected information to the cache server through the network;

Determining, by the cache server, whether a correspondence between the to-be-detected information and the security level corresponding to the to-be-detected information is cached;

If not, the cache server sends the to-be-detected information to the killing server through the network to perform security detection of the to-be-detected information; and determining the to-be-detected information according to the detection result of the killing server. Security Level;

If yes, determining a security level of the to-be-detected information according to the correspondence relationship;

The light proxy client is set in the virtual machine.
The method of claim 1, wherein the light proxy client obtains information to be detected, including:

The light proxy client obtains to-be-detected information from at least one virtual machine in the physical machine where the light proxy client is located, where multiple virtual machines are set in the physical machine;

and / or,

The light proxy client obtains to-be-detected information from at least one virtual machine of at least one physical machine in the same cluster as the physical machine where the light proxy client is located, where the cluster includes at least one physical machine Each of the physical machines includes at least one virtual machine.
The method according to claim 1 or 2, wherein the information to be detected includes at least one of file information, web address information, access path information, and registry read and write information.
The method of claim 3, wherein the step of performing a security detection of the information to be detected by the killing server comprises:

Obtaining, by the killing server, a feature value of the to-be-detected information;

The killing server scans the feature value by the killing engine to perform security detection on the to-be-detected information.
The method of claim 4 wherein the method further comprises:

If the killing server scans the feature value to perform security detection on the to-be-detected information, and the detection result is not obtained, the killing server sends the feature value to the light The private cloud server of the cluster where the proxy client is located performs security detection, obtains the detection result, and returns the detection result to the killing server.
The method of claim 5 wherein the method further comprises:

If the private cloud server performs the security detection on the to-be-detected information, the feature value is sent to the public cloud server outside the cluster for security detection, the detection result is obtained, and the detection result is obtained. Returning to the private cloud server, and returning the detection result to the killing server by using the private cloud server.
The method of claim 5, wherein the killing server sends the feature value to a private cloud server of the cluster where the light proxy client is located for security detection, including:

The killing server sends the feature value to the private cloud server of the cluster where the light proxy client is located for security detection according to a preset scanning sequence.
The method according to claim 5, wherein after the obtaining the detection result and returning the detection result to the killing server, the method further comprises:

The killing server sends the security detection result to the cache server for storage.
The method of claim 6 wherein the method further comprises:

The private cloud server obtains update information from the public cloud server according to a setting rule, where the update information includes a correspondence between a feature value periodically updated by the public cloud server and a security level;

The private cloud server updates the correspondence between the feature value and the security level stored in the private cloud server according to the update information.
A virtualization security detection system includes: a cache server, a killing server, and a light proxy client disposed in the virtual machine;

The light proxy client is configured to obtain information to be detected, and send the to-be-detected information to the cache server through a network;

The cache server is configured to determine whether the information to be detected and the to-be-checked are cached Corresponding relationship of the security level corresponding to the information; if not, sending the to-be-detected information to the killing server through the network; if yes, determining the security of the to-be-detected information according to the corresponding relationship level;

The killing server is configured to receive the to-be-detected information sent by the cache server, and perform security detection on the to-be-detected information to obtain a detection result;

The cache server is further configured to determine a security level of the to-be-detected information according to the detection result of the killing server.
The system according to claim 10, wherein the light proxy client obtains information to be detected from at least one of the physical machines in which the light proxy client is located, wherein the physical machine has a plurality of settings Virtual machine

and / or,

The light proxy client obtains to-be-detected information from at least one virtual machine of at least one physical machine in the same cluster as the physical machine where the light proxy client is located, where the cluster includes at least one physical machine Each of the physical machines includes at least one virtual machine.
A system according to claim 10 or 11, wherein

The information to be detected includes at least one of file information, web address information, access path information, and registry read and write information.
The system of claim 12 wherein said killing server comprises:

The feature value obtaining module is configured to acquire the feature value of the information to be detected;

The security detection module is configured to perform security detection on the to-be-detected information by scanning the feature value by using a killing engine.
The system of claim 13 wherein the killing server further comprises:

The private cloud detection module is configured to send the feature value to the light proxy client if the security detection module performs security detection on the to-be-detected information by scanning the feature value by the killing engine. The private cloud server of the cluster performs security detection, obtains a detection result, and returns the detection result to the killing server.
The system of claim 14, wherein the killing server further comprises:

The public cloud detection module is configured to: if the private cloud server pairs the to-be-detected information If the security detection fails to obtain the detection result, the feature value is sent to the public cloud server outside the cluster for security detection, the detection result is obtained, and the detection result is returned to the private cloud server, and the The private cloud server returns the detection result to the killing server.
The system according to claim 14, wherein the private cloud detecting module sends the feature value to a private cloud server of the cluster where the light agent client is located for security detection according to a preset scanning order.
The system of claim 14, wherein the killing server further comprises:

The cache storage module is configured to send the security detection result to the cache server for storage after the private cloud detection module obtains the detection result and returns the detection result to the killing server.
The system of claim 15 wherein

The private cloud server obtains update information from the public cloud server according to a setting rule, where the update information includes a correspondence between a feature value periodically updated by the public cloud server and a security level;

The private cloud server updates the correspondence between the feature value and the security level stored in the private cloud server according to the update information.
A computer program comprising computer readable code causing the computer to perform the virtualization security detection method of any of claims 1-9 when the computer readable code is run on a computer.
A computer readable medium storing the computer program of claim 19.