基于用户意图的网络流量授权安全框架

Security Framework for Traffic Authorization Based on User Intent

恶意软件对主机安全工具的威胁促使我们考虑借助虚拟化技术来提升安全系统的权限.本文提出了一种检测和阻止恶意软件伪装成合法程序发送非法数据流的方法,并基于虚拟机自省技术建立了安全框架,实现了以下三个方面的功能:首先,模型提供了对主机应用程序与用户交互的安全监控,通过对用户真正意图的捕捉与分析,检测和阻止被恶意软件伪装离开主机的网络数据流;其次,通过对虚拟机自省和内存分析技术的应用,并基于用户输入事件,保证了对程序预测行为的精确判断;最后,通过系统实现证实了模型对Windows下IE浏览器应用程序的兼容性.

Aiming to reconsider how to design and implement systems for security purposes based on virtualization technology, a secur-ity framework for supporting the security policies which consider the user intent in determining the legitimacy of network traffic leav-ing the host is presented. We use both virtual machine introspection and memory analysis to determine the expected application behav-ior based on user input events. The experiments with Internet Explorer demonstrate the viability of the framework＇s support for Win-dows applications.