中文摘要：

在CloudStack等云平台中缺少提高虚拟机安全性的插件或功能。针对该问题,基于Xen虚拟机监视器提出一种CloudStack恶意隐藏进程监测框架。通过安装在特权虚拟机中的监控前端请求监测目标虚拟机中的进程,利用守护进程经事件通道将该请求转发给Xen虚拟机监视器,并采用事件注册/捕获模块在客户虚拟机中注册事件钩子。在监听到目标虚拟机中内核发生CR3转换事件后,将事件通知至监控响应模块,使用虚拟机自省技术获得客户虚拟机中的内存数据并进行语义还原,通过共享内存机制将相关进程数据传递到监控前端。实验结果表明,该框架能够准确发现目标虚拟机内部的恶意隐藏进程,并获得相关的资源占用信息。

英文摘要：

Most cloud platforms like Cloud Stack have no safety plug-in or function to protect the virtual machines.Aiming at this problem,this paper proposes a monitoring framework for malicious hidden process based on Xen virtual machine monitor on Cloud Stack. Firstly,the monitor client installed in the privileged virtual machine requests to monitor the processes in the target virtual machine,and the daemon process passes the request to the Xen virtual machine monitor using the event channel,then the event registration / capture module in the virtual machine monitor registers the event hook in the guest virtual machine. After listening CR3 register content changing in the target virtual machine kernel,this event is notified to the monitor response module,and then it uses the virtual machine introspection technology to get memory data of the target virtual machine and restores them by semantic restoration technology,and finally passes the processes monitor information from the virtual machine monitor to the monitor client through shared memory mechanism.Experimental results show that the proposed framework can accurately find malicious hidden processes in the target virtual machine,and obtain resource usage information of hidden processes.