云环境下基于VMI技术的入侵检测架构研究

摘要

虚拟机自省（Virtual Machine Introspection，VMI）指在虚拟机监视器层对虚拟机进行安全监控，VMI技术可用于监控和分析云环境下虚拟机内部的恶意行为。本文设计了一个可以检测云环境中虚拟机内部恶意行为的入侵检测架构，为解决当前虚拟环境下监控数据获取方法安全性的不足，本文提出并设计了一种云环境下利用硬件辅助虚拟化（Virtualization Technology）技术在虚拟机监视器层获取监控数据的方法，将此数据作为入侵检测的数据源。%Virtual Machine Introspection (VMI) refers to monitoring the state of a virtual machine from the virtual machine monitor layer.It can also be used for monitoring and analysis of the malicious behavior of cloud infrastructure. this article designed an intrusion detection framework to detect the malicious behavior of virtual machine in the cloud,in order to solve the problem that lack of security in monitoring current virtual machines' state,this article also presented and designed a VT-based technology to get monitoring data from the virtual machine monitor layer,and made sure this method meet the characteristics of the cloud.