基于VMM的虚拟机隐藏网络连接检测研究

Research on Virtual Machine Hidden Network Connections Detection Based on VMM

恶意软件可通过隐藏自身行为来逃避安全监控程序的检测,具有较强的隐蔽性和不可察觉性。传统的基于主机的隐藏对象检测系统易被绕过或攻击而失效,针对当前研究中存在的对隐藏网络连接的检测较少,及在虚拟机监视器(VMM)中通过截获解析数据包难以维护可信网络连接视图的问题,提出基于硬件虚拟化的虚拟机隐藏网络连接检测方法。该方法在虚拟机内部获取网络连接的用户层及内核层视图;在VMM层截获虚拟机进程的系统调用获取可信网络连接视图及其与主体进程的映射关系;通过交叉视图对比实现对虚拟机隐藏网络连接的检测。实现的原型系统VNDec可在VMM层有效检测虚拟机中隐藏的网络连接,且可实现网络连接隐藏行为与进程主体的关联。

Malicious software can evade detection of security monitoring program by hiding its own behavior,which has strong concealment and imper⁃ceptivity.Traditional hidden objects detection systems based on host are liable to be bypassed or attacked,for the reason that current re⁃search about the detection of hidden network connections is less,and it’s difficult to maintain reliable network connections through inter⁃cepting and analyzing data packets in the VMM,proposes the detection method of virtual machine hidden network connections based on hardware virtualization.This method obtains the user layer and kernel layer view of network connections within virtual machine,captures the system calls of virtual machine process in VMM to obtain the credible network connections view and its mapping relationship with the process;and detects the hidden network connections by cross-view comparison.Realizes the prototype system of VNDec,and proves through experiments that the VNDec is effective in detecting the hidden network connections of virtual machine,and realizes the correla⁃tion between the hidden behavior of network connections and the process subject in the VMM layer.