基于VMM的Windows文件系统监控

WINDOWS FILE SYSTEM MONITORING BASED ON VMM

文件系统监控是文件保护的基础。针对现有文件系统监控容易被恶意软件破坏的问题,提出一种基于VMM的Windows文件系统监控方法。该方法利用硬件虚拟化技术,通过监控系统调用监控文件系统操作,且监控手段对客户系统透明,保证实施的监控安全可信。最后设计并实现了相应的原型系统,同时对原型系统的监控效果和时间开销进行测试。实验结果表明,原型系统能够监控常见的Windows文件系统操作,并且时间开销在可接受的范围内。

File system monitoring is the foundation of file protection. In view of the problem that existing file system monitoring is easily destroyed by malware,this paper puts forward a VMM-based method to monitor Windows file system. The method uses hardware virtualisation technology and monitors the file system operation through monitoring system call. The implemented monitoring is guaranteed to be secure and trusted because it is transparent to clients. Corresponding prototype system is designed and implemented,at the same time the monitoring effect and time overhead of the prototype system are tested. Experimental results show that the prototype system can monitor the operations of common Windows file system,and the time overhead is within the acceptable range.