一种基于VMM的内核级Rootkit检测技术

摘要

针对云平台中的虚拟机内核级Rootkit破坏租户虚拟机完整性的问题,文章提出一种基于VMM(虚拟机监视器,Virtual Machine Monitor)的内核级Rootkit检测技术.该技术以在关键路径设置陷入点的方式构建TML(True Module List),得到虚拟机中真实的内核模块视图,在VMM层利用自下而上的调用方式获取虚拟机用户态视图,并在VMM层获取重构的虚拟机内核态视图,通过交叉对比这三个视图检测隐藏在虚拟机中的Rootkit.最后,利用该技术在KVM(基于内核的虚拟机,Kernel-based Virtual Machine)中实现了原型系统,实验结果表明系统能迅速准确地检测出虚拟机中的Rootkit,并依据TML报告内核级Rootkit的详细信息,系统的综合性能损耗在可接受范围内.%Kernel-level Rootkits of virtual machine in cloud can destroy the integrity of virtual machine of tenant. This paper presents a kind of kernel-level Rootkit detection technology based on Virtual Machine Monitor (VMM). This technology establishes True Module List (TML) by critical path breakpoint and obtains the virtual machine''s kernel module view, the user mode view was established by bottom-up calls from VMM, and the reconstructed kernel mode view of virtual machine was get in the VMM layer, then by cross-referencing these three views to detect Rootkit hidden in a virtual machine. Finally, a prototype system was realized based on the Kernel-based Virtual Machine (KVM), experimental results showed that Rootkits in Virtual Machine could be quickly and ac-curately detected in the prototype system, details of Rootkit could be reported according to TML, the overall per-formance loss of the prototype system was in acceptable range.