计算机工程

所属专题: 云计算专题

• 云计算专题 • 上一篇    下一篇

CloudStack恶意隐藏进程监测框架设计

崔竞松1a,1b,田昌友1a,郭迟2,尹雪1a   

  1. (1.武汉大学 a.计算机学院; b.空天信息安全与可信计算教育部重点实验室,武汉 430072;2.武汉大学卫星定位导航技术研究中心,武汉 430079)
  • 收稿日期:2014-12-18 出版日期:2016-02-15 发布日期:2016-01-29
  • 作者简介:崔竞松(1975-),男,副教授、博士,主研方向为云安全;田昌友,硕士研究生;郭迟(通讯作者),讲师、博士;尹雪,硕士研究生。
  • 基金项目:
    国家“863”计划基金资助项目(2013AA12A206);国家自然科学基金资助项目(41104010,91120002,61170026)。

Design of Monitoring Framework for Malicious Hidden Process on CloudStack

CUI Jingsong  1a,1b,TIAN Changyou  1a,GUO Chi  2,YIN Xue  1a   

  1. (1a.Computer School;1b.Key Laboratory of Aerospace Information and Trusted Computing,Ministry of Education, Wuhan University,Wuhan 430072,China;2.Global Navigation Satellite System Research Center,Wuhan University,Wuhan 430079,China)
  • Received:2014-12-18 Online:2016-02-15 Published:2016-01-29

摘要: 在CloudStack等云平台中缺少提高虚拟机安全性的插件或功能。针对该问题,基于Xen虚拟机监视器提出一种CloudStack恶意隐藏进程监测框架。通过安装在特权虚拟机中的监控前端请求监测目标虚拟机中的进程,利用守护进程经事件通道将该请求转发给Xen虚拟机监视器,并采用事件注册/捕获模块在客户虚拟机中注册事件钩子。在监听到目标虚拟机中内核发生CR3转换事件后,将事件通知至监控响应模块,使用虚拟机自省技术获得客户虚拟机中的内存数据并进行语义还原,通过共享内存机制将相关进程数据传递到监控前端。实验结果表明,该框架能够准确发现目标虚拟机内部的恶意隐藏进程,并获得相关的资源占用信息。

关键词: CloudStack云平台, Xen虚拟化技术, 虚拟机监视器, 安全插件, 恶意隐藏进程, 进程资源监测

Abstract: Most cloud platforms like CloudStack have no safety plug-in or function to protect the virtual machines.Aiming at this problem,this paper proposes a monitoring framework for malicious hidden process based on Xen virtual machine monitor on CloudStack.Firstly,the monitor client installed in the privileged virtual machine requests to monitor the processes in the target virtual machine,and the daemon process passes the request to the Xen virtual machine monitor using the event channel,then the event registration/capture module in the virtual machine monitor registers the event hook in the guest virtual machine.After listening CR3 register content changing in the target virtual machine kernel,this event is notified to the monitor response module,and then it uses the virtual machine introspection technology to get memory data of the target virtual machine and restores them by semantic restoration technology,and finally passes the processes monitor information from the virtual machine monitor to the monitor client through shared memory mechanism.Experimental results show that the proposed framework can accurately find malicious hidden processes in the target virtual machine,and obtain resource usage information of hidden processes.

Key words: CloudStack cloud platform, Xen virtualization technology, virtual machine monitor, security plug-in, malicious hidden process, process resource monitoring

中图分类号: