A virtual machine-based invasion detection system for the virtual computing environment

Under virtualization idea based on large-scale dismantling and sharing, the implementing of network interconnection of calculation components and storage components by loose coupling, which are tightly coupling in traditional server, achieves computing capacity, storage capacity and service capacity distri- bution according to need in application-level. Under the new server model, the segregation and protection of user space and system space as well as the security monitoring of virtual resources are the important factors of ultimate security guarantee. This article presents a large-scale and expansible distributed invasion detection system of virtual computing environment based on virtual machine. The system supports security monitoring management of global resources and provides uniform view of security attacks under virtual computing environment, thereby protecting the user applications and system security under capacity services domain.

Collision detection of virtual plant based on bounding volume hierarchy: A case study on virtual wheat

Visualization of simulated crop growth and development is of significant interest to crop research and production. This study aims to address the phenomenon of organs cross-drawing by developing a method of collision detection for improving vivid 3D visualizations of virtual wheat crops. First, the triangular data of leaves are generated with the tessellation of non-uniform rational B-splines surfaces. Second, the bounding volumes（BVs） and bounding volume hierarchies（BVHs） of leaves are constructed based on the leaf morphological characteristics and the collision detection of two leaves are performed using the Separating Axis Theorem. Third, the detecting effect of the above method is compared with the methods of traditional BVHs, Axis-Aligned Bounding Box（AABB） tree, and Oriented Bounding Box（OBB） tree. Finally, the BVs of other organs（ear, stem, and leaf sheath） in virtual wheat plant are constructed based on their geometric morphology, and the collision detections are conducted at the organ, individual and population scales. The results indicate that the collision detection method developed in this study can accurately detect collisions between organs, especially at the plant canopy level with high collision frequency. This collision detection-based virtual crop visualization method could reduce the phenomenon of organs cross-drawing effectively and enhance the reality of visualizations.

Hidden Process Offline Forensic Based on Memory Analysis in Windows

Malicious software programs usually bypass the detection of anti-virus software by hiding themselves among apparently legitimate programs.In this work,we propose Windows Virtual Machine Introspection（WVMI）to accurately detect those hidden processes by analyzing memory data.WVMI dumps in-memory data of the target Windows operating systems from hypervisor and retrieves EPROCESS structures’address of process linked list first,and then generates Data Type Confidence Table（DTCT）.Next,it traverses the memory and identifies the similarities between the nodes in process linked list and the corresponding segments in the memory by utilizing DTCT.Finally,it locates the segments of Windows’EPROCESS and identifies the hidden processes by further comparison.Through extensive experiments,our experiment shows that the WVMI detects the hidden process with high identification rate,and it is independent of different versions of Windows operating system.