摘要
提出了通过进程移植实现对用户级进程执行实施监控的方法,旨在同时解决隔离和兼容性问题,并采取重定向系统调用来保证被移植进程执行的连续性.实验结果表明了文中方法的有效性和可行性,以及对系统性能的微小影响.
Computer malware has forced the transfer of the traditional in-host security tools to the development of VMM-based solutions which isolate the anti-malware software from untrusted systems.However,the inherent semantic gap poses a great challenge in supporting existing monitoring tools.In this paper,we present a process transferring method for fine-grained process execution monitoring to address both isolation and compatibility problems.Also by redirecting system calls invoked by the suspect process we guarantee the execution flow of the transferred process.Evaluation results show its effectiveness and feasibility with a tiny influence on the system.
出处
《西安电子科技大学学报》
EI
CAS
CSCD
北大核心
2012年第6期181-186,共6页
Journal of Xidian University
关键词
进程监控
语义鸿沟
虚拟机自省
process monitoring
semantic gap
virtual machine introspection