恶意代码安全虚拟执行环境研究  

Research on Malware Secure Virtual Execution Environments

作　　者：曹跃[1] 梁晓[1] 李毅超[1] 黄沾[1] 

机构地区：[1]电子科技大学计算机科学与工程学院网络攻防实验室,成都610054

出　　处：《计算机科学》2008年第1期97-99,共3页Computer Science

基　　金：国家科技基础条件平台工作基金资助项目(2003DIA7J051)

摘　　要：入侵容忍的系统要求具有在现实环境中执行不安全程序且不遭受永久性伤害的能力。虚拟机技术提供了一种虚拟的可执行环境,能够满足这个需求。通过对操作系统调用接口资源的重命名的研究,在此基础上设计并实现了一种Windows平台下基于操作系统层的安全虚拟执行环境的体系结构。实验结果表明,该系统可以有效地模拟应用程序的各种运行行为和结果,并为后续分析提供充足的信息。经对比发现,基于操作系统资源虚拟化的安全执行环境技术比传统虚拟技术更灵活,消耗系统资源更少。Intrusion tolerant and fault-tolerant systems require the ability to execute unknown programs in a realistic environment without leaving permanent damages. Virtual machine technique provides an execution environment that is both realistic and isolated, also meet this requirement. We present a new secure execution environments framework. After researched on rename mechanism of system call interface under operating systems, finally designed and implemented the system architecture of operating system level based secure execution environment under Windows. Central to our algorithm is namespace virtualization, which provides simulation of many runtime behaviors and results in appli cations with enough analysis information. Compared with traditional algorithms, our method is more flexible, and requires less system resource.

关 键 词：恶意代码 安全执行 虚拟机 命名空间虚拟化 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]