一种基于虚拟机的安全监测方法  

A VIRTUAL MACHINE BASED SECURITY MONITORING SCHEME

作　　者：丁顺[1] 李明禄[1] 翁楚良[1] 刘谦[1] 

机构地区：[1]上海交通大学计算机科学与工程系,上海200240

出　　处：《计算机应用与软件》2012年第6期51-56,共6页Computer Applications and Software

基　　金：国家重点基础研究发展计划(2007CB310905);国家自然科学基金项目(90612018;60970008;90715030)

摘　　要：随着虚拟化广泛应用于如云计算等各种领域,渐渐成为各种恶意攻击的目标。虚拟机的运行时安全是重中之重。针对此问题,提出一种适用于虚拟化环境下的监测方法,并且在Xen中实现虚拟机的一个安全监测原型系统。通过这个系统,特权虚拟机可以对同一台物理机器上的大量客户虚拟机进行动态、可定制的监控。特别地,本系统对于潜伏在操作系统内核中的rootkit的检测十分有效。这种安全监测方法能有效提高客户虚拟机以及整个虚拟机系统的安全性。As virtualization is widely applied to various fields such as cloud computing,it gradually becomes a target that various malicious attacks aim at.The runtime security of virtual machines is of the most importance.Aiming at this problem,a monitoring scheme suitable for virtualized environments is proposed.Moreover a security monitoring prototype system of a virtual machine is implemented in Xen.With this scheme,a privileged virtual machine can execute dynamic and customized monitoring upon the massive client virtual machines hosted in a same physical machine.Particularly,this system is very effective at detecting rootkits inside OS kernels.The security monitoring scheme can effectively increase the security not only of client virtual machines but also of the whole VM system.

关 键 词：系统虚拟化 虚拟机 安全监测方法 ROOTKIT 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]