CN105117649B - A kind of anti-virus method and system for virtual machine - Google Patents

Abstract

The present invention provides a kind of anti-virus methods for virtual machine, including：Step 1, the access for the first time of the more new content for the memory pages occurred on the memory pages for distributing to virtual machine on host is intercepted and captured；Step 2, the content of pages of the memory pages is scanned；Step 3, according to the scanning as a result, remove the content of pages of the memory pages, or restore the access to the memory pages.The present invention also provides a kind of Anti-Virus for virtual machine.Anti-Virus may be implemented independent of client operating system in technical solution of the present invention；It is identified before Virus execution and prevents the virus；The data volume of virus scan is reduced, scan efficiency is improved.

Description

Antivirus method and system for virtual machine

technical field

The invention relates to the technical field of computer virtualization, in particular, the invention relates to an antivirus method and system for a virtual machine.

Background technique

There are mainly two types of existing antivirus technologies for virtual machine environments. One is the structure shown in Figure 1, which is the same as the anti-virus method in the physical machine environment, that is, a complete anti-virus software is installed in the guest operating system of the virtual machine, and the anti-virus software runs on the guest operating system to protect files, etc. The information is scanned and processed for viruses. Another kind is the antivirus system of the light agent structure as shown in accompanying drawing 2, for example, by The vShield Endpoint architecture proposed by the company specifically includes: a security-enhanced security virtual device, a thin agent (EpsecThin Agent) running in the protected virtual machine, and an Epsec Thin Agent used to support communication between the security virtual device and the thin agent Hypervisor module (VMware Endpoint ESX). This solution monitors the operating system activities inside the virtual machine through the thin agent installed inside the virtual machine, and triggers the antivirus engine in the security virtual device to perform virus scanning, and the antivirus engine returns the virus scanning result to the protected computer via the thin agent. virtual machine. This solution supports real-time scanning of files when they are accessed, as well as scheduled file scanning operations initiated by the antivirus engine in the security virtual appliance. One of the main problems of the aforementioned first antivirus technology can be avoided by offloading the virus scanning task from the virtual machine to the security virtual appliance through the thin agent running inside the virtual machine and the virtualization hypervisor module in the security virtual appliance : In a virtualized environment, an "antivirus storm" (AV storm, antivirus storm) is caused, that is, when multiple virtual machines are simultaneously scanned on a host machine, the demand for computing resources will increase sharply in a short period of time, resulting in service degradation. However, there is another problem in this architecture itself, that is, the files to be scanned in the protected virtual machine need to be transmitted to the security virtual device through the communication channel provided by the virtualization hypervisor module before virus scanning can be performed. Transfers consume resources on the host physical server.

In addition, a common feature of the above-mentioned existing anti-virus technologies is that they need to rely on the guest operating system to run, so that the system is unprotected during the period from the start of the guest operating system to the normal operation of the anti-virus software (or agent). state, giving the virus an opportunity to invade. For example, the "boot sector virus" sneaks into the memory during the startup process of the operating system to invade the computer system. In addition, the above-mentioned existing anti-virus system relies on the operation of the client operating system, so its effectiveness cannot be well guaranteed. For example, an intruder may forcibly shut down the anti-virus system, thereby bypassing the virus protection. And invade the system.

In addition, the existing anti-virus systems often use system-wide file scanning to check for viruses, which is not only time-consuming, but also consumes a lot of computer resources. reduce.

Contents of the invention

The purpose of the present invention is to provide a solution capable of overcoming the above-mentioned technical problems.

The present invention provides an antivirus method for a virtual machine, comprising: step 1, intercepting the first access to the update content of the memory page that occurs on the memory page allocated to the virtual machine on the host machine; step 2, Scanning the page content of the memory page; step 3, clearing the page content of the memory page or restoring access to the memory page according to the scanning result.

Preferably, the step 1 further includes: intercepting the update content of the memory page allocated to the virtual machine on the host machine by dynamically adjusting the access rights of the memory page allocated to the virtual machine on the host machine Access for the first time; wherein, when one of the "writable" and "executable" permissions in the access permissions is enabled, the other permission is disabled.

Preferably, the step 3 further includes: when the scanning result shows that there is a virus, clearing the page content of the memory page, and locating and processing the virus in the virtual machine.

Preferably, the step 3 further includes: when the scanning result shows that there is a virus, processing the virus according to a preset anti-virus policy, and/or notifying the user of the virtual machine of the virus information.

Preferably, the step 2 further includes: scanning the page content of the memory page by using the virus signature code in the same memory page as the virus program entry.

The invention also provides an antivirus system for a virtual machine, which is based on a virtual machine monitor placed on a host machine. The system includes: a virtual antivirus engine, used to scan memory data based on virus memory signatures, and feed back scanning results to the virtual antivirus extension module; a virus memory signature database, used to store the virus memory signatures; The virtual antivirus extension module is placed in the virtual machine monitor, and is used to intercept the first access to the updated content of the memory page that occurs on the memory page allocated to the virtual machine on the host machine, and notify The virtual antivirus engine scans the memory page.

Preferably, the virtual anti-virus extension module is configured to dynamically adjust the access rights of the memory pages allocated to the virtual machines on the host to intercept all attacks occurring on the memory pages allocated to the virtual machines on the host The first access to the updated content of the memory page; wherein, in the access permissions, when one of the permissions of "writable" and "executable" is enabled, the other permission is disabled.

Preferably, the virtual antivirus engine is a multi-threaded and reentrant architecture; the virus memory signature database is stored on the host computer and shared between multiple concurrent virtual antivirus engines; and /or the virus memory signature is a virus signature in the same memory page as the entry of the virus program.

Preferably, the system further includes: a virtual antivirus agent, located inside the virtual machine, for receiving and processing the detected virus according to the information from the virtual antivirus extension module; the virtual antivirus extension module also uses The source of the virus found in the scanning result is located, and the virus information is sent to the virtual antivirus agent.

Preferably, the antivirus agent is configured to process the virus according to information from the virtual antivirus extension module and a preset antivirus strategy, and/or communicate with a user of a virtual machine.

Compared with the prior art, the technical solution proposed by the present invention has the following advantages:

The technical solution of the present invention can realize that the anti-virus system does not depend on the client operating system; accurately identify and block the virus before the virus program is executed; reduce the amount of virus scanning data and improve scanning efficiency, thereby maximally ensuring the operation of the virtual machine performance.

Description of drawings

In order to illustrate the technical solution of the present invention more clearly, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Apparently, the accompanying drawings in the following description do not limit the present invention.

Fig. 1 is a system schematic diagram of the first anti-virus technology according to the prior art;

Fig. 2 is a system schematic diagram of the second antivirus technology according to the prior art;

Fig. 3 is a schematic diagram of an antivirus system according to an embodiment of the present invention;

Fig. 4 is a schematic flowchart of an antivirus method according to an embodiment of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Fig. 3 shows a schematic diagram of an antivirus system according to an embodiment of the present invention. As shown in FIG. 3 , according to an embodiment of the present invention, the antivirus system for a virtual machine is implemented based on a virtual machine monitor (Virtual Machine Monitor, VMM) placed on the host computer, and the system includes a virtual antivirus engine ( VirtAV-engine), virus memory signature database, virtual antivirus expansion module (VirtAV-stub), and virtual antivirus agent (VirtAV-agent).

VirtAV-engine is a scanning engine based on virus memory signatures. The engine is implemented with a multi-threaded architecture and a reentrant design method. It runs in the context of the virtual central processing unit (virtual CPU, VCPU) of the virtual machine and works in the user mode of the host machine. It is used to synchronously scan the available memory in the memory Execute code to find viruses. The scanning engine can be implemented by commonly used algorithms for string matching, such as AC multi-pattern matching algorithm, BM single-pattern string matching algorithm, and so on. Specifically, the VirtAV-engine is used to scan the memory data to be scanned in the buffer of the user mode, and feed back the scanning result to the VirtAV-stub.

The aforementioned virus memory signature is a virus signature selected according to the following principles: it can uniquely identify the virus, that is, it can be accurately distinguished from other viruses and non-virus files; it can be composed of one or more character strings. Preferably, the aforementioned virus memory signature is also a signature on the same memory page as the entry of the virus program. Because the virus program adopts the "on-demand paging" mode of the operating system during the process of loading into the memory, that is, the virus program code is transferred from the virus program code in units of pages (generally 4096 bytes) when the VCPU is about to execute the virus program code. The memory is read from the source file, and then executed by fetching instructions from the memory. Therefore, virus scanning based on the feature code in the same memory page as the entry of the virus program can accurately detect the virus before the first instruction of the virus program is executed.

The selection of the virus memory characteristic code can be selected purely manually, and can also be selected with the assistance of existing program auxiliary means.

The virus memory signature database containing the aforementioned virus memory signatures, as shown in Figure 3, is stored on the host computer and shared between multiple concurrent VirtAV-engines. Based on this structure, since only one memory signature database needs to be stored on the host machine, the update of the database only needs to be performed on one shared database, thus avoiding the virus database update storm problem.

Further, according to an embodiment of the present invention, based on the parallel characteristics of multiple VCPUs of the existing virtual machine, each concurrent VirtAV-engine corresponds to a process of a VCPU, and then the antivirus system is directed at the instruction flow of each VCPU of the virtual machine Carry out an independent antivirus process including virus scanning and killing; during the antivirus process, the VCPU of the virtual machine that caused the antivirus will be suspended, and will resume operation after the antivirus is completed, while other VCPUs of the virtual machine can still be undisturbed keep running. Therefore, the antivirus system can make full use of the parallelism of multiple VCPUs of the virtual machine, and affect the running performance of the virtual machine as little as possible.

VirtAV-stub is an extension of the VMM memory virtualization function module, which is used to insert a virus scanning operation for memory data by intercepting the "first execution after update" event that occurs on the host memory page allocated to the virtual machine. When the event is intercepted, the virtual machine VCPU that generated the event is suspended, the corresponding physical CPU enters the host mode through the VMEXIT instruction, and the VirtAV-stub transfers the memory data to be scanned to the user-mode buffer for VirtAV -engine scan. After the VirtAV-engine scan is completed, the result of the scan is fed back to the VirtAV-stub. If no virus is found, the VirtAV-stub switches the physical CPU back to the guest mode through the VMENTER command, and resumes the execution of the virtual machine VCPU and the corresponding guest operating system and application program. If a virus is found, VirtAV-stub clears the virus code in the memory page, and then sets the corresponding page table entry in the guest operating system, so that the corresponding memory page in the guest operating system cannot be executed, and then the virus program is blocked by the guest operating system termination. Wherein, the guest mode is the mode when the CPU enters the guest operating system to run; the host mode is the mode when the CPU enters the VMM to run.

The aforementioned "first execution after update" event of the memory page of the host machine allocated to the virtual machine means that the memory page allocated to a virtual machine on the host machine is accessed for the first time after being updated. According to an embodiment of the present invention, based on the memory virtualization two-dimensional paging architecture, the VirtAV-stub implements the interception of the "first execution after update" event by dynamically adjusting the access rights of the physical memory pages on the host machine. Further, according to an embodiment of the present invention, the VirtAV-stub dynamically adjusts the access rights of the memory pages allocated to the virtual machine on the host machine based on the permission setting rule of "enabling different writable and executable permissions". Furthermore, the first instruction fetch operation issued by the virtual machine VCPU on the updated memory page will generate a VMEXIT event due to a permission violation (that is, the physical CPU corresponding to the virtual machine VCPU enters the host mode through the VMEXIT instruction) and Intercepted by VirtAV-stub.

In the case of finding a virus, the VirtAV-stub is also used to locate the source of the virus, and communicates with the VirtAV-agent running inside the guest operating system through a virtual input and output device interface such as VIRTIO to transfer the basic information of the virus (such as The virus name, the process (PID, Process Identification) of the virtual machine that executes the virus program, the virus file name, etc.) are notified to the VirtAV-agent, which isolates or deletes the virus file and records the virus log in the guest operating system. And the user of the corresponding virtual machine is notified of this virus event.

VirtAV-agent is an agent program running inside the virtual machine, and is used as an interactive interface between the antivirus system and the user of the virtual machine. The agent program is only used for handling after the virus is found (including the aforementioned isolation or deletion of virus files, recording virus logs, etc.) and user notification. As can be seen from the foregoing, the anti-virus work of the anti-virus system itself (including scanning for viruses, clearing virus codes in memory pages, and terminating virus execution) does not depend on the agent program, so the failure of the agent program will not Affects the antivirus functionality of the antivirus system itself.

To sum up, the antivirus system according to the present invention is an antivirus system based on the virus scanning mode of the memory view of the host computer. On the one hand, because in the guest operating system, shared link library files, binary files and other files are accessed in the form of memory file cache to accelerate access, and at the same time, shared access to files is provided to different processes, and these files are stored in the host memory view. Therefore, the antivirus system according to the present invention only needs to perform virus scanning for each executable file once; further, when multiple VCPUs generate the aforementioned "first execution after updating" on the same memory page In the event of an event, it only needs to be scanned once, thereby avoiding repeated scanning of the same content multiple times, and on the premise of ensuring full scan coverage, it can effectively reduce the number of virus scans and improve scanning efficiency, thereby avoiding the use of existing technologies The file-based virus scanning method has disadvantages such as time-consuming and resource-intensive consumption, so as to ensure the operating performance of the virtual machine to the greatest extent. On the other hand, because the antivirus system according to the present invention is based on the virus scanning mode of the host machine memory view, by intercepting the event of "executing for the first time after updating" that occurs on the host machine memory page allocated to the virtual machine, the virus program can The virus is found before the first instruction is executed, and then the virus is detected and killed in real time, and the virus is prevented from causing harm to the computer system in a more timely manner.

Fig. 4 shows a schematic flowchart of an antivirus method according to an embodiment of the present invention.

As shown in Figure 4, the process execution binary executable file (such as the ELF format file in the Linux operating system) on the virtual machine guest operating system is taken as an example below to describe the anti-virus method according to the present invention, wherein the solid arrow shows For the processing of files or page tables, the dotted arrows show other types of execution processes, and different dotted lines are used to distinguish the different positions of the process in the system, such as the client virtual machine (hereinafter referred to as the client), the client process , guest operating systems, virtual machine monitors, and antivirus engines.

The specific process is as follows:

The client process initiates the execve () system call to request the execution of the binary file; after the execve () system call passes through the corresponding permission check, it allocates a virtual memory space for the binary file and establishes a mapping between the virtual memory and the file (as shown in Figure 4 mmap()), but it will not allocate client physical memory for it at this time; when the process executes to the binary file, because the corresponding client physical memory has not been allocated, a page fault occurs (Page Fault);

The page fault interrupt is intercepted by the VMM;

The VMM handles the page fault interrupt of the client, allocates the host physical memory for it, and establishes a shadow page table entry. Further, an EPT (Extended Page Table, extended page table) page table entry can be established; VirtAV-stub in the VMM Turn on the "write permission" bit in the page table entry and turn off the "execution permission" bit, so that the process can load the code segment of the binary file into the memory page; the VMM injects a page fault interrupt into the guest, and the guest operating system Handle page faults, fill page tables, read code segments from binary files into newly allocated pages, and resume process execution;

The process executes the code in the page, because the VirtAV-stub in the aforementioned VMM turns off the "execution permission" bit in the shadow page table, resulting in an execution exception;

The execution exception is intercepted by the VMM;

The VirtAV-stub in the VMM notifies the address of the page to the VirtAV-engine; the VirtAV-engine utilizes the virtual machine memory access interface provided by the existing virtual machine introspection (Virtual Machine Introspection, VMI) module in the virtual machine to read the memory page and Do a scan, look for virus signatures, and feed the results back to VirtAV-stub:

If the result of the aforementioned virus checking is to find a virus, the VirtAV-stub injects an exception in the client computer again, that is, closes the "execution permission" bit of the corresponding shadow page table, so that the execution of the process is aborted when the client computer recovers; and, VirAV-stub clears the memory page containing the virus signature code to clear the virus through the relevant access interface provided by the aforementioned VMI module;

If the result of the aforementioned antivirus screening is that no virus is found, VirtAV-stub opens the "execution permission" bit in the corresponding shadow page table, closes the "write permission" bit, and resumes the operation of the client computer, so that the corresponding process of the client computer can be Safe execution; when the client tries to write data to the client memory page with the "execution permission" bit turned on, the VirtAV-stub in the VMM can intercept the event, and after completing the corresponding permission check, open the page's "write enable" bit, and turn off the "execute enable" bit at the same time, so that the legal memory page write operation inside the client can be executed.

According to an embodiment of the present invention, after the virus is found in the memory of the virtual machine, the source of the virus is further located. The following takes locating a virus source file as an example to describe the processing flow after a virus is found.

First, VirtAV-stub locates the process corresponding to the current instruction flow of the virtual machine VCPU through the relevant access interface provided by the aforementioned VMI module, and the virtual address space mapping table of the process (the mapping table records the start and end addresses of each interval in the virtual address space, attributes, mapped files, etc.), and then, according to the virtual address of the current instruction of the VCPU, determine the interval of the process virtual address space where the virus instruction is located, and find the corresponding virus source file. Afterwards, the VirtAV-stub communicates with the VirtAV-agent running inside the guest operating system through virtual input and output device interfaces such as VIRTIO, and the basic information of the virus (such as the process of the virus name, the virtual machine that executes the virus program (PID, ProcessIdentification) ), virus file name, etc.) to notify VirtAV-agent. Finally, the VirtAV-agent isolates or deletes the virus file in the guest operating system according to the preset antivirus policy, records the virus log, and notifies the administrator or relevant user of the corresponding virtual machine of the virus event.

By applying the method described in the above-mentioned embodiments, it is possible to realize that the anti-virus system does not depend on the client operating system; accurately identify and block the virus before the execution of the virus program; reduce the amount of virus scanning data and improve scanning efficiency, thereby maximizing protection The performance of the virtual machine.

The above descriptions are only illustrative specific implementations of the present invention, and are not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the protection scope of the present invention.

Claims (10)

1. a kind of anti-virus method for virtual machine, which is characterized in that the method includes：

Step 1, the update for the memory pages occurred on the memory pages for distributing to virtual machine on host is intercepted and captured The access for the first time of content；

Step 2, the content of pages of the memory pages is scanned；

Step 3, according to the scanning as a result, remove the content of pages of the memory pages, or restore to the memory pages Access.

2. anti-virus method according to claim 1, which is characterized in that the step 1 further includes：

It is intercepted and captured by the access authority for the memory pages for distributing to virtual machine on dynamic adjustment host and is distributed on host The access for the first time of the more new content for the memory pages occurred on the memory pages of virtual machine；

Wherein, " writeable " in the access authority and " executable " permission be in the case where one of wherein in enabled state, Another permission is in non-enabled state.

3. anti-virus method according to claim 1, which is characterized in that the step 3 further includes：

It is to deposit the content of pages for removing the memory pages in the case of viruses, and position and locate in the result of the scanning Manage the virus in virtual machine.

4. anti-virus method according to claim 3, which is characterized in that the step 3 further includes：

It is to deposit in the case of viruses in the result of the scanning, handles the virus according to preset Killing Tactics, and/or The information of the virus is notified to the user of virtual machine.

5. anti-virus method according to any one of claim 1 to 4, which is characterized in that the step 2 further includes：

Use the content of pages that the memory pages are scanned with virus signature of the Virus entrance in same memory pages.

6. a kind of Anti-Virus for virtual machine, based on the virtual machine monitor being placed on host, which is characterized in that The system comprises：

Virtual antivirus engine for scanning internal storage data based on viral memory features code, and scanning result is fed back to virtually Anti-virus expansion module；

Viral memory features code database, for storing the viral memory features code；

The virtual anti-virus expansion module, is placed in the virtual machine monitor, distributes on the host for intercepting and capturing To the access for the first time of the more new content for the memory pages occurred on the memory pages of virtual machine, and notify described virtual Antivirus engine is scanned the memory pages.

7. Anti-Virus according to claim 6, which is characterized in that

The virtual anti-virus expansion module, for adjusting the memory pages for distributing to virtual machine on the host by dynamic Access authority intercept and capture occur on the memory pages for distributing to virtual machine on the host for the memory pages The access for the first time of more new content；

Wherein, a case where permission is in enabled state wherein of " writeable " and " executable " permission in the access authority Under, another permission is in non-enabled state.

8. Anti-Virus according to claim 6, which is characterized in that

The virtual antivirus engine is multithreading and can reentry framework；

The virus memory features code database, is stored on the host, draws in multiple concurrent virtual anti-viruses It is shared between holding up；And/or

The virus memory features code is the virus signature with Virus entrance in same memory pages.

9. Anti-Virus according to claim 6, which is characterized in that the system also includes：

Virtual anti-virus agent is in virtual machine internal, for receiving and according to from the virtual anti-virus expansion module The virus that information processing is found；

The virtual anti-virus expansion module is also used to position the source for the virus found in the scanning result, and will be described The information of virus is sent to the virtual anti-virus agent.

10. Anti-Virus according to claim 9, which is characterized in that

The anti-virus agent, for according at information and preset Killing Tactics from the virtual anti-virus expansion module The virus is managed, and/or is communicated with the user of virtual machine.