安全虚拟环境中的进程执行精确监控

Secure virtualization-based fine-grained process execution monitoring

提出了通过进程移植实现对用户级进程执行实施监控的方法,旨在同时解决隔离和兼容性问题,并采取重定向系统调用来保证被移植进程执行的连续性.实验结果表明了文中方法的有效性和可行性,以及对系统性能的微小影响.

Computer malware has forced the transfer of the traditional in-host security tools to the development of VMM-based solutions which isolate the anti-malware software from untrusted systems.However,the inherent semantic gap poses a great challenge in supporting existing monitoring tools.In this paper,we present a process transferring method for fine-grained process execution monitoring to address both isolation and compatibility problems.Also by redirecting system calls invoked by the suspect process we guarantee the execution flow of the transferred process.Evaluation results show its effectiveness and feasibility with a tiny influence on the system.