基于系统调用截获的虚拟机自省技术  

Virtual Machine Introspection Technology Based on System-Call Interception

作　　者：李铭 石磊 牛文强 李新友[4] Li Ming;Shi Lei;Niu Wenqiang;Li Xinyou(Shandong Jingwei Shengrui Data Technology Co.,Ltd,Jinan 250101;Shandong Trusted Cloud Computing Information Technology Research Institute,Jinan 250101;Shandong Massclouds Information Technologies Co.,Ltd,Jinan 250101;The State Information Center,Beijing 100058)

机构地区：[1]山东经伟晟睿数据技术有限公司,济南250101 [2]山东可信云信息技术研究院,济南250101 [3]山东乾云启创信息科技股份有限公司,济南250101 [4]国家信息中心,北京100058

出　　处：《信息安全研究》2020年第4期367-372,共6页Journal of Information Security Research

基　　金：泉城学者“可信云关键技术”研究及产业化项目;山东省自然科学基金资助产权云项目对本研究的支持。

摘　　要：虚拟机自省技术是一类从虚拟机外部监控虚拟机内部操作系统及应用的运行状态的技术.由于不需要在虚拟机内部安装代理,因而该技术的管理维护成本较低,且安全性更高.提出一种基于系统调用截获的虚拟机自省技术,通过调整VMM对系统调用的响应机制,截获虚拟机内部发生的系统调用;通过分析系统调用,达到监控虚拟机内部异常行为状态的目的.Virtual machine introspection technology is a kind of technology that monitors the operating system and the operating status of the virtual machine from outside the virtual machine.The technology is less expensive and more secure because it does not require agents to be installed inside the virtual machine.In this paper,a virtual machine introspection technology based on system call interception is proposed,which intercepts the system calls that occur within the virtual machine by adjusting the response mechanism of VMM to system calls,and by analyzing system calls,the purpose of monitoring abnormal behavior state within the virtual machine is achieved.

关 键 词：虚拟化 云计算 虚拟机 虚拟机自省 系统调用 中断 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]