KVM环境下内核级Rootkit检测及防护技术研究
刘 刚 徐 峥 崔士伟
【摘 要】Abstract Virtualization technology has been widely used in cloud computing environment,and its security is becoming more and more important.At present,malicious code attacks are developing in the direction of complexity,concealment,and
persistence,which has become one of the important threats to cloud infrastructure in China.Especially in the context of the massive use of Linux and kernel-based virtual machine (KVM)virtualization in cloud data centers,it’s very important to research on detection and protection technologies of Linux kernel rootkit in KVM virtualization environment.However,the current research in this field mainly focuses on detecting,and lacks in response and protecting stage.To solve this problem,this paper proposes a security architecture that integrates kernel-level Rootkit security detection,response and active protection in KVM virtualization environment,and validates it in KVM virtualization platform.The results show that the security architecture can effectively detect and prevent attacks of kernel-level Rootkit in Guest virtual machine.【期刊名称】《信息安全研究》【年(卷),期】2019(005)007【总页数】7
【关键词】Key words cloud computing;KVM virtualization;kernel Rootkit;virtual machine introspection;security reinforcement中图法分类号 TP309
近年来，云计算得到了越来越广泛的应用，已成为我国技术创新和经济发展的重要驱动力.根据中国信息通信研究院发布的《云计算发展白皮书》(2018年)[1]数据显示，未来几年，我国云计算产业仍将保持快速稳定增长态势，其中公有云年均增速将超过30%，私有云年均增速将超过20%.另据Gartner《中国区x86服务器虚拟化市场指南》(2018)数据显示，中国企业服务器虚拟化率约为40%，而全球市场已经达到80%以上，未来几年，我国服务器虚拟化的比例还将处于快速增长的趋势.因Linux系统和KVM虚拟化软件具备开源和稳定的特性，在我国云数据中心已大量使用，其占有率已超过50%，且比例还在不断提升.虚拟化技术作为云计算基础设施核心部分，其安全程度直接影响着整个云平台的安全性[2].
当前，恶意代码攻击正向复杂性、隐蔽性和持久性等方向发展，已成为我国云数据中心基础设施面临的重要威胁之一，尤其是内核级Rootkit[3]攻击.Linux环境下的内核级Rootkit常常以可加载内核
KVM环境下内核级Rootkit检测及防护技术研究
