基于虚拟机架构的文件系统监控  

File System Monitor based on Virtualization Technology

作　　者：彭华[1] 周安民[1] 刘亮[1] 左政[1] 

机构地区：[1]四川大学电子信息学院,四川成都610064

出　　处：《信息安全与通信保密》2012年第7期108-110,共3页Information Security and Communications Privacy

摘　　要：为了提高文件系统监控的准确性和抗攻击能力,设计并实现了一种基于虚拟机监视器的文件系统监控系统,该系统从虚拟机外部透明、实时地监控文件系统操作,获取被监控主机的相关信息,对文件操作进行记录和分析,并保存日志到与被监控主机隔离的安全主机。实验表明,该系统能够有效地监控文件系统操作,保证日志文件安全,检测出恶意代码隐藏文件。In order to improve the accuracy and anti-attack capability of file system monitoring, a virtual machine based framework is proposed, which could monitor the file system out of the guest operation system transparently and in real time, obtain the related information of the monitored host, record and analyze the file operations, and then keep the log to the secure host. Experiment shows that this technology could effectively monitor the file system, ensure the safety of log file, and detect the hidden file by malicious code.

关 键 词：虚拟机 硬件虚拟化 文件系统 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]