Cloud computing is developing fast and widely used, as an important support for cloud computing, virtualization has improved the efifciency of resource utilization and management capability for a platform. As an open source software for virtualization, the unique design and excellent performance make Xen adopted by many could service providers, which are also troubled by the security problems of Xen hypervisor. The privilege interfaces provided by Xen can be utilized by malicious code of virtual machine, which can be used by intruders to attack Xen or virtual machines running above. To solve the problem of hypercalls of Xen to be abused by malicious code inside guest kernel, a method to analyze the execution path of guest kernel is provided, which is used to trace the execution path of guest kernel that has launched this hypercall, compared with the training set constructed at the beginning, preventing hypercalls being misused by malicious code of guest kernel becomes possible. By tracking stack information of guest kernel, the execution path of virtual machine is reconstructed and built up with the help of instruction analysis and symbol table of guest kernel, unexpected execution paths of hypervalls are avoided with this method. We experimented our idea on Xen platform, a new virtual machine was created to get its training set during its running time. Then when this heprcall happens, the corresponding execution path is constructed dynamically, compared with the training set, unforeseen invoking to hypervalls is avoided.%云计算技术已飞速发展并被广泛应用，虚拟化作为云计算的重要支撑，提高了平台对资源的利用效率与管理能力。作为一款开源虚拟化软件，Xen独特的设计思想与优良的虚拟化性能使其被许多云服务商采用，然而Xen虚拟机监视器同样面临着许多安全问题。Xen为虚拟机提供的特权接口可能被虚拟机恶意代码利用，攻击者可以借此攻击Xen或者运行其上的虚拟机。文章针对Xen向虚拟机提供的超级调用接口面临被恶意虚拟机内核代码利用的问题，提出了一种基于执行路径的分析方法，用以追溯发起该超级调用的虚拟机执行路径，与一个最初的路径训练集进行对比，可以避免超级调用被恶意虚拟机内核代码利用。该方法通过追溯虚拟机内核堆栈信息，结合指令分析与虚拟机内核符号表信息，实现了虚拟化平台下对虚拟机执行路径的动态追踪与重构。在Xen下进行实验，通过创建新的虚拟机并让其单独运行来获得训练集，训练集中包含所有发起该超级调用的虚拟机路径信息。在随后虚拟机运行过程中针对该超级调用动态构造出对应的虚拟机执行路径，将其与训练集对比，避免非正常执行路径的超级调用发生。
展开▼
