Netinfo Security ›› 2022, Vol. 22 ›› Issue (11): 62-67.doi: 10.3969/j.issn.1671-1122.2022.11.008

Previous Articles     Next Articles

Design and Implementation of Abnormal Behavior Detection System for Virtualization Platform

LIN Faxin1,2, ZHANG Jian1,2()   

  1. 1. College of Cyber Science, Nankai University, Tianjin 300350, China
    2. Tianjin Key Laboratory of Network and Data Security Technology, Tianjin 300350, China
  • Received:2022-07-10 Online:2022-11-10 Published:2022-11-16
  • Contact: ZHANG Jian E-mail:zhang.jian@nankai.edu.cn

Abstract:

This paper proposed an abnormal behavior detection method implemented of virtualization platform based on image and deep learning, designed and implemented the system prototype. This method used the Xen virtualization platform to dump the system memory of VMS running normal software and malicious software respectively and collects 1100 memory dump files containing normal behaviors and 2200 memory dump files containing abnormal behaviors. For each file, the first 10 MB of system sensitive area is extracted and then converted into a 2-dimensional image using SFC. Finally, convolutional neural network is used to classify the memory images to judge whether there are abnormal behaviors in the virtualization platform. Experimental results show that the system achieves 98.78% classification accuracy and can effectively detect abnormal behaviors in virtualization platform.

Key words: cloud computing, virtualization, abnormal behavior detection, convolutional neural network

CLC Number: