知识与财富的链接
与传统的入侵检测系统相比,基于虚拟机自省的入侵检测系统的抗干扰性更强.但由于存在语义鸿沟问题,即低层的硬件字节信息与操作系统级语义之间的差异,导致入侵检测系统的通用性和实时性下降.针对此问题,本文提出了Vlhd,一种基于语义鸿沟修复方法的rootkit隐藏对象检测技术.Vlhd将系统分离成离线和在线模块两部分.在线模块用于即时地在虚拟机外部重构虚拟机语义视图;离线模块用于离线地提取操作系统语义知识,并向在线模块提供语义服务.通过对各类Linux操作系统和多种rootkit进行入侵检测试验,发现Vlhd对rootkit的隐藏对象检测效果良好,通用性强.Vlhd的单次扫描时间为34ms,对系统引入了1.1%（扫描周期设置为8s时）的性能开销.
Compared with the traditional intrusion detection system,the intrusion detection system based on virtual machine introspection has stronger anti-jamming ability.However,the difference between the hardware byte information and the high level semantics leads to the decrease of the versatility and real-time.Aiming to solve this problem,this paper proposes Vlhd,a OS hidden object detection technology based on semantic repair method.Vlhd separates the system into two parts:the offline module and the online module.The online module reconstructs semantic view outside the target virtual machine;the offline module is responsible for the extraction of OS semantic knowledge,and providing semantic services to the online module.Through a variety of rootkit intrusion detection test in various types of Linux OS,we find that Vlhd can detect the objects hidden by rootkits.A single scan time of Vlhd is 34ms,and the performance overhead is 1.1% (scan cycle is set to 8s).
