基于KVM虚拟化环境的异常行为检测技术研究

Research on Anomaly Behavior Detection Technology in Virtualization Environment Based on KVM

随着安全问题成为云计算面临的主要问题,虽然基于主机、网络的传统入侵检测技术在一定程度上可以保证云计算服务的可靠性和安全性,但会受到欺骗、攻击等威胁。虚拟机监视器具有高度的隔离性和透明性,基于无代理的方式对虚拟机行为和网络信息进行提取分析可以有效提升异常行为检测的准确性和安全性。文章分析了实体环境中的异常行为检测技术,结合传统入侵检测算法提出了基于KVM虚拟化环境的异常行为检测模型,并对检测模型进行了实验和分析。实验结果表明,该模型可以有效检测出客户虚拟机的异常行为。

With the security problem becoming the major problem of cloud computing, the traditional anomaly detection technology based on hosts and network can guarantee the reliability and security of the cloud computing service to a certain extent, but still faces deceiving and attacking threats. VMM has a high degree of isolation and transparency,the analysis of virtual machine behavior and network information can effectively improve the accuracy and security of anomaly behavior detection based on the agentless out-VM monitoring method. This paper analyzes anomaly behavior detection technology on physical environment,mixes the traditional intrusion detection algorithms, proposes anomaty behavior detection method based on KVM virtualization environment, experiments and analyses some aspects of the detection model. The results shows that the model can effectively detect the anomaty behavior of guest OS.