虚拟化环境下恶意软件攻击的修复机制  

A Recovery Scheme Against Malware Attacks in Virtualization System

作　　者：孙显军[1,2] 林闯[1] 蒋屹新[1] 刘卫东[1] 

机构地区：[1]清华大学计算机科学与技术系,北京100084 [2]中国人民解放军61741部队,北京100081

出　　处：《电子学报》2011年第2期309-314,共6页Acta Electronica Sinica

基　　金：国家自然科学基金(No.60673187;No.60803123;No.60702009);国家自然科学基金重大研究计划重点项目(No.90718040)

摘　　要：恶意软件常常能够成功攻击虚拟机和其管理系统,使虚拟环境处于一种不安全、难以恢复的状态.传统的安全防护机制无法满足虚拟环境的安全要求,本文提出一种基于代理的检测和协作修复机制,通过多个虚拟机节点共享修复情况信息,快速获取有效的修复工具,提高恢复能力.模拟分析和仿真实验结果证明该机制的实用性和效率.Intricate malwares can result in the failure of Virtual System,and enable the system to be in an unsafe state and difficult to restore.The existing policies thwarting this extreme attack are ineffective.In this paper,based on cooperative recovery among multiple Virtual Machines and agent-based lightweight intrusion detection,an efficient recovery mechanism is proposed for Virtualization systems against malware attacks.The basic policy is to deploy an Emergency Response/Recovery（ER） agent on Virtual Machine to identify the state of the system,and cooperative security among multiple nodes is carried out so that the infected nodes can be rapidly recovered.Simulation results also demonstrate the practicality and efficiency of the proposed schemes.

关 键 词：虚拟化系统 恶意软件 攻击 修复机制 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]