Research on Anomaly Behavior Detection Technology in Virtualization Environment Based on KVM

doi:10.3969/j.issn.1671-1122.2017.11.001

Abstract

Abstract:

With the security problem becoming the major problem of cloud computing, the traditional anomaly detection technology based on hosts and network can guarantee the reliability and security of the cloud computing service to a certain extent, but still faces deceiving and attacking threats. VMM has a high degree of isolation and transparency, the analysis of virtual machine behavior and network information can effectively improve the accuracy and security of anomaly behavior detection based on the agentless out-VM monitoring method. This paper analyzes anomaly behavior detection technology on physical environment, mixes the traditional intrusion detection algorithms, proposes anomaly behavior detection method based on KVM virtualization environment, experiments and analyses some aspects of the detection model. The results shows that the model can effectively detect the anomaly behavior of guest OS.

Key words: cloud computing, virtualization technology, detection, KVM, anomaly behavior

CLC Number:

TP309.1

Jian ZHANG, Changliang CAI, Liangyi GONG, Zhaojun GU. Research on Anomaly Behavior Detection Technology in Virtualization Environment Based on KVM[J]. Netinfo Security, 2017, 17(11): 1-6.

Figures/Tables 10

References 23

[1]	方滨兴. “四朵云”保障云安全[J]. 保密科学技术,2016(11):36-37.
[2]	吴一冰. 基于VMI的虚拟机攻击防护机制研究[J]. 互联网天地,2013(10):28-33.
[3]	肖敏,韩继军,肖德宝,等. 基于聚类的入侵检测研究综述[J]. 计算机应用,2008,28(s1):34-38.
[4]	谢红,刘人杰,陈纯锴. 基于误用检测与异常行为检测的整合模型[J]. 重庆邮电大学学报:自然科学版,2012(1):73-77.
[5]	于明,张雨,刘畅,等. 云环境下基于多属性信息熵的虚拟机异常检测[J]. 华中科技大学学报:自然科学版,2015(5):63-67.
[6]	李保珲,徐克付,张鹏,等. 虚拟机自省技术研究与应用进展[J]. 软件学报,2016(6):1384-1401.
[7]	张瑜,刘庆中,李涛,等. 内存取证研究与进展[J]. 软件学报,2015(5):1151-1172.
[8]	MEMARIAN M R, CONTI M, LEPPÄNEN V, et al. EyeCloud: A BotCloud Detection System[C]//IEEE. 2015 IEEE Trustcom/BigDataSE/ISPA, August 20-22, 2015, Helsinki, Finland. New Jersey: IEEE, 2015: 1067-1072.
[9]	LENGYEL T K, MARESCA S, PAYNE B D, et al.Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System[C]//ACM. 30th Annual Computer Security Applications Conference, December 8-12, 2014, New Orleans, Louisiana, USA. New York: ACM, 2014: 386-395.
[10]	林杰. 面向服务监控的可控云关键技术研究[D]. 北京:北京邮电大学,2015.
[11]	HIZVER J, CHIUEH T C.Real-time Deep Virtual Machine Introspection and Its Applications[C]//ACM. 10th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, March 1-2, 2014, Salt Lake City, Utah, USA. New York: ACM, 2014: 3-14.
[12]	张静轩,常进达,郭栋,等. 一种基于用户行为控制语言的桌面虚拟化性能测试框架[J]. 信息网络安全,2016(7):53-60.
[13]	MISHRA P, PILLI E S, VARADHARAJANT V, et al.NvCloudIDS: A Security Architecture to Detect Intrusions at Network and Virtualization Layer in Cloud Environment[C]//IEEE. 2016 International Conference on Advances in Computing, Communications and Informatics, September 21-24, 2016, Jaipur, India. New Jersey: IEEE, 2016: 56-62.
[14]	蒋传勇,姚立红,潘理. 基于VMM的程序行为异常检测[J]. 信息安全与通信保密,2016(3):118-122.
[15]	牛鹏飞,张健,常青,等. 基于Xen的异常行为在线检测平台研究与设计[J]. 信息网络安全,2016(9):139-144.
[16]	PASCHALIDIS I C, CHEN Yin.Statistical Anomaly Detection with Sensor Networks[J]. ACM Transactions on Sensor Networks, 2010, 7(2): 1-23.
[17]	XUAN Chaoting, COPELAND J, BEYAH R.Toward Revealing Kernel Malware Behavior in Virtual Execution Environments[C]//Springer. 12th International Symposium on Recent Advances in Intrusion Detection, September 23-25, 2009, Saint-Malo, France. Heidelberg: Springer, 2009: 304-325.
[18]	王文旭,张健, 常青,等. 云计算虚拟化平台安全问题研究[J]. 信息网络安全,2016(9):163-168.
[19]	HEBBAL Y, LANIEPCE S, MENAUD J M.Virtual Machine Introspection: Techniques and Applications[C]//IEEE. International Conference on Availability, Reliability and Security, August 23-25, 2015, Toulouse, France. New Jersey: IEEE, 2015: 676-685.
[20]	WEBSTER M, MALCOLM G.Detection of Metamorphic and Virtualization-based Malware using Algebraic Specification[J]. Journal of Computer Virology and Hacking Techniques, 2009, 5(3): 221-245.
[21]	CHEN Xu, ANDERSEN J, MAO Z M, et al.Towards an Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware[C]//IEEE. 10th IEEE International Conference on Dependable Systems and Networks with Ftcs and DCC, August 24-27, 2015, Toulouse, France. New Jersey: IEEE, 2008: 177-186.
[22]	池亚平,姜停停,戴楚屏,等. 基于BLP的虚拟机多级安全强制访问控制系统设计与实现[J]. 信息网络安全,2016(10):1-7.
[23]	DENZ R, TAYLOR S.A Survey on Securing the Virtual Cloud[J]. Journal of Cloud Computing, 2013, 2(1): 1-9.