Abstract:

This paper proposed a dynamic detection method based on Hardware Performance Counter(HPC) and ensemble learning to solve the abnormal behavior detection problem of virtualization platform. This method collected HPC values of samples running on the KVM virtualization platform, and used feature importance scores generated during RF learning to filter features, so as to improve the accuracy of RF classification model and realized anomaly detection. This paper collected 1040 benign program samples and 1040 malicious program samples on the platform, and selected 8 important HPC events to judge malicious samples in the feature selection stage. The experimental results show that the RF classification model after feature selection can reach 95.38% accuracy on the test set, which has higher accuracy and stability than the similar model before feature selection and other traditional machine learning models. The method proposed in this paper can effectively detect the abnormal behavior on the virtualization platform

Key words: abnormal behavior detection, virtualization, hardware performance counter, ensemble learning