CN103178988B - The monitoring method and system of the virtual resources that a kind of performance optimizes - Google Patents

Abstract

The present invention relates to the monitoring system method and system of the virtual resources that a kind of performance optimizes, the system of physical server and the runnability of guest virtual machine and guest virtual machine is first called event in virtual machine monitor layer and is monitored by the method, and according to the physical server monitored and the runnability of guest virtual machine, according to priority and security strategy, the system of described monitoring is called event at secure virtual machine and carry out data process, after data process, send control instruction call event for the operation calling virtual resources with control system.The monitoring system method and system of the virtual resources that performance involved in the present invention optimizes, can effectively monitoring system overall operation and safe condition, and good Consumer's Experience can be reached.

Description

A performance-optimized monitoring method and system for virtualized resources

technical field

The invention relates to the field of virtualization technology and information security technology, in particular to a performance-optimized monitoring method and system for virtualized resources.

Background technique

Virtualization technology is a technology widely used in the IT industry. Due to the large-scale use of cloud computing technology, virtualization technology, especially server virtualization technology, is developing rapidly and rapidly changing the face of IT, and fundamentally changing the How people count. By virtualizing physical resources, server resources can be allocated to multiple virtual machines. Virtualization supports different applications and even different operating systems running on the same server. By combining with cloud computing technology, it can provide flexible configuration methods, fast deployment mode and save computing resources.

However, while bringing great advantages, virtualization technology also brings great security risks different from traditional security models. After virtualization of physical resources, multiple virtual machines may run on one physical server. Actual computing resources (CPU, memory, disk, network, etc.) are shared by different virtual machines through virtualization to form virtualized resources. Therefore, in the actual use process, different virtual machines are actually sharing the same physical server resources, but for them, they think that they are exclusively sharing system resources, and the entire resource sharing process is monitored by virtualization modules (such as virtual machines such as Xen) device) to schedule. Once an attacker exploits its vulnerabilities to intrude into the system, the virtualization module can affect all virtual machines running on it, thereby threatening all applications and user data running on the virtual machines. Therefore, the security protection for virtual machines is very important. The new security threats brought by virtualization technology mainly include: Isolation of virtualized resources: In a multi-tenant environment, different business systems of different tenants may run on the same cloud platform, and the resources of tenants may be illegally accessed by other tenants. At the same time, a tenant’s malicious or misoperation and other security incidents may expand and affect other tenants’ business systems on the same cloud platform, posing a security threat to other tenants; virtual machine management layer (VMM) security issues: due to the virtual machine The management layer runs at a higher level than the virtual machine, so the attack on the virtual machine management layer threatens all virtual machines running on the same physical server; the problem of virtual machine escape: if the malicious program running in the virtual machine Bypassing the security mechanism of the virtual machine itself and obtaining certain permissions of the virtual machine management layer or physical server will pose a threat to all virtual machines on the same physical server; virtual network security risks: in the cloud computing environment, due to virtual With the wide application of network resources, traditional network boundaries become blurred. Traditional security devices, such as firewalls, IDS, IPS, etc., can only be deployed on physical boundaries, and cannot perform fine-grained access control on communications between virtual machines on the same physical computer. If an attack originates from a virtual machine on the cloud platform , can bypass all network border protection measures, and attack other virtual machines from the inside, which may threaten the safe operation of the entire virtual network and even the cloud computing platform in severe cases.

The isolation mechanism of the existing virtualization technology can only solve the basic isolation of the application program running environment, and cannot prevent program access from cross-border or illegal access. And this sharing of actual physical resources often makes data easier to be illegally accessed. For example, when programs of different virtual machines share the same cache, once one of the programs of the virtual machine is exploited by malicious code, it is easy to cause another The data of the virtual machine is illegally accessed or leaked.

At present, the existing solution is to monitor the security behavior of the upper-layer client virtual machine by deploying a security application on the virtual machine monitor layer, and intercept its system calls. Analyze and respond in real time according to the security policy, and decide to allow or block this system call. This solution can solve most of the virtual machine security problems, but its main disadvantage is that the security virtual machine and the guest virtual machine request the use of system resources at the same time, and the two requests for virtualization resources are directly proportional to each other. If the guest virtual machine is busy and needs to make a large number of system calls, the security virtual machine must simultaneously perform a large number of real-time security processing tasks, which causes the security virtual machine and the guest virtual machine to compete for system resources, doubling the overall resources The tension caused the overall performance of the physical server to drop sharply, which brought a bad customer experience. In order to release system resources, some security functions of the security virtual machine can only be forcibly reduced or turned off, thus causing a loss of security.

Contents of the invention

The present invention aims at the problem that the security virtual machine and the client virtual machine compete for resources in the existing technology of monitoring the security of the client virtual machine, resulting in system performance degradation, poor client experience and security loss, and provides a performance-optimized monitoring of virtualized resources The method can effectively monitor the overall operation and security status of the system, and can achieve a good user experience. The invention also relates to a performance-optimized virtualized resource monitoring system.

Technical scheme of the present invention is as follows:

A performance-optimized monitoring method for virtualized resources, characterized in that the operating performance of a physical server and a client virtual machine and system call events of a client virtual machine are first monitored at a virtual machine monitor layer, and based on the monitored physical For the running performance of the server and client virtual machines, the security virtual machine performs data processing on the monitored system call events according to the priority and security policy, and sends control instructions after the data processing to control the operation of the system call events for calling virtualized resources .

In the virtual machine monitor layer, the system call event of the client virtual machine is monitored to obtain event data, and the operating performance of the physical server and the client virtual machine is monitored to obtain performance monitoring data, and the performance monitoring data provides data processing for the system call event a security policy.

After the event data is obtained through monitoring, semantic conversion processing is performed on the event data first, and the event data is converted from low-level semantics to high-level semantics, and then data processing is performed on the event data after semantic conversion processing.

The data processing of the monitored system call event includes scheduling processing, real-time data processing, and log and alarm processing. The scheduling processing is to perform priority judgment and scheduling on event data, and perform log and alarm processing on low priority event data. Real-time data processing for high-priority event data.

The high-priority event data is analyzed by the security monitoring module and real-time data processing is performed according to the security policy, and a control instruction is issued after the real-time data processing to control the operation of the system call event for calling virtualized resources;

And/or, the log and alarm processing is to record the low-priority event data firstly, and then conduct post-event review through the security monitoring module, and perform alarm processing according to the security policy.

A performance-optimized monitoring system for virtualized resources is characterized in that it includes an interconnected security event monitoring and response module and a data processing module, and the security event monitoring and response module is set at the virtual machine monitor layer for monitoring The operating performance of the physical server and the client virtual machine and the system call event of the client virtual machine are monitored, and the monitoring information is sent to the data processing module; According to the operating performance of the client virtual machine, data processing is performed on the system call event according to the priority and security policy, and after data processing, a control instruction is sent to the security event monitoring and response module to control the operation of the system call event for invoking virtualized resources .

The security event monitoring and response module includes a security event monitoring module, a security event response module and a performance monitoring module, the security event monitoring module monitors the system call event of the client virtual machine to obtain event data and sends the event data to A data processing module, the performance monitoring module monitors the operating performance of the physical server and the client virtual machine to obtain performance monitoring data, and the performance monitoring data is provided to the data processing module for a security strategy for data processing, and the security event response The module receives the control instruction sent by the data processing module and makes a response.

The data processing module includes a sequentially connected semantic processing module, a core processing module and a security policy module, and the core processing module is respectively connected to a security policy module, a performance monitoring module and a security event response module; the semantic processing module is connected to a security event The monitoring module is connected to perform semantic conversion processing on the event data, convert the event data from low-level semantics to high-level semantics, and input it to the core processing module after semantic conversion processing; the core processing module is based on the security policy module The security policy and the performance monitoring data obtained by the performance monitoring module perform data processing on the event data, and send control instructions to the security event response module after the data processing.

The core processing module includes a scheduling processing module, a real-time data processing module and a log and an alarm processing module, and the real-time data processing module and a log and an alarm processing module are respectively connected with the scheduling processing module, and the scheduling processing module is respectively connected with the performance monitoring module Connected to the semantic processing module, the real-time data processing module and the log and alarm processing module are connected to the security policy module, the real-time data processing module is connected to the security event response module; the scheduling processing module performs priority judgment on event data and scheduling processing, the real-time data processing module performs real-time data processing on high-priority event data and sends control instructions to the security event response module after real-time data processing, and the log and alarm processing module processes low-priority event data Perform log and alarm processing.

The real-time data processing module and the log and alarm processing module are all connected to the security policy module through one or more security monitoring modules; the real-time data processing module analyzes the high-priority event data through the security monitoring module and according to the security policy Real-time data processing;

And/or, the log and alarm processing module first records the low-priority event data, and then conducts subsequent review through the security monitoring module, and performs alarm processing according to the security policy;

And/or, the security monitoring module is an intrusion detection module and/or an intrusion prevention module and/or a file access control module.

Technical effect of the present invention is as follows:

The present invention relates to a performance-optimized monitoring method for virtualized resources. Firstly, the operating performance of the physical server and the client virtual machine and the system call event of the client virtual machine are monitored at the virtual machine monitor layer, which can effectively monitor the physical server and the client virtual machine. The operation and security status of the client virtual machine, and at the same time, according to the monitored operating performance of the physical server and the client virtual machine, data processing is performed on the monitored system call events through the security virtual machine according to the priority and security policy, and in the data processing Afterwards, a control instruction is issued to control the operation of the system call event for invoking virtualized resources. Obtain the running status of the physical server and the client virtual machine by monitoring the operating performance of the physical server and the client virtual machine, that is, whether the system is busy or idle, and then the system call event of the client virtual machine, that is, the security event, according to the priority and security policy Scheduling and issuing control instructions to control the operation of virtualized resources (that is, hardware resources). For example, different data processing methods can be adopted for security events when the system is busy and idle, and only security events with higher priority can be processed when the system is busy. Real-time data processing is prioritized, and security events with relatively low priority are recorded first and then reviewed and processed afterwards when the system is idle, which can effectively avoid the situation where security virtual machines and customer virtual machines compete for system resources, and can also avoid A large number of security events are discarded due to resource constraints, resulting in a decrease in system security. The performance-optimized monitoring method of virtualized resources in the present invention enables the overall virtualized resources to be allocated and adjusted reasonably, avoids the problem of overall performance degradation of physical servers, and can achieve good user experience; and does not need to reduce or shut down safe virtual machines The security function avoids the loss of security and improves the system security performance of the security virtual machine.

In the performance-optimized virtualized resource monitoring method of the present invention, the security virtual machine performs data processing on the monitored system call event according to the priority and security policy, specifically including scheduling processing, real-time data processing, and log and alarm processing, Priority judgment and scheduling of event data through scheduling processing, combined with security policies and the operating performance of the monitored physical server and customer virtual machine, the operating performance of physical servers and customer virtual machines can also be used as one of the security policies , after scheduling processing, log and alarm processing is performed on low-priority event data, real-time data processing is performed on high-priority event data, and control instructions are issued after real-time data processing to control system call events for invoking virtualized resources operation. It can more clearly schedule data processing of security events according to the running status of physical servers and customer virtual machines, strictly avoid the problem of resource shortage caused by simultaneous requests of security virtual machines and customer virtual machines to use system virtualization resources, and enhance security virtual machines. The safety performance further enhances the customer experience.

The performance-optimized monitoring system for virtualized resources involved in the present invention sets a security event monitoring and response module at the virtual machine monitor layer, implements monitoring means for the operating performance of the physical server, the operating performance of the client virtual machine, and the system call event, It can effectively monitor the operation and security status of physical servers and customer virtual machines. At the same time, a data processing module is set in the security virtual machine. According to the operating performance of the physical server and customer virtual machines monitored by the security event monitoring and response module, the customer virtual machines System call events (or called security events) process data according to priority and security policies, and send control instructions to the security event monitoring and response module after data processing to control the operation of system call events for invoking virtualized resources. This can effectively avoid the situation where the security virtual machine and the client virtual machine compete for system resources, and at the same time, security events will not be missed. It can achieve real-time monitoring of high-level security events and priority processing, and the function of post-processing of low-level security events.

Description of drawings

FIG. 1 is a schematic structural diagram of a performance-optimized virtualized resource monitoring system of the present invention.

FIG. 2 is a schematic diagram of a preferred structure of the security event monitoring and response module in FIG. 1 .

FIG. 3 is a schematic diagram of a preferred structure of the data processing module in FIG. 1 .

FIG. 4 is a schematic diagram of a preferred structure of a performance-optimized virtualized resource monitoring system of the present invention.

FIG. 5 is a working flowchart of the performance-optimized virtualized resource monitoring system shown in FIG. 4 of the present invention.

FIG. 6 is a flow chart of the performance-optimized virtualized resource monitoring method of the present invention.

FIG. 7 is a preferred flow chart of the performance-optimized virtualized resource monitoring method of the present invention.

detailed description

The present invention will be described below in conjunction with the accompanying drawings.

The present invention relates to a performance-optimized monitoring system for virtualized resources. Its structural schematic diagram is shown in FIG. 1 , and logically includes two components, that is, a security event monitoring and response module and a data processing module connected to each other. The security event monitoring and response module is set at the virtual machine monitor layer, and is used to monitor the operating performance of the physical server and the client virtual machine as well as the system call event of the client virtual machine, and send the monitoring information to the data processing module. It includes the monitoring information of the running performance of the physical server and the guest virtual machine and the monitoring information of the system call event of the guest virtual machine. Furthermore, each guest virtual machine may have the same or different operating systems, and each guest virtual machine may have multiple applications invoked by the hardware resources (CPU, memory, hard disk, network, etc.) of the guest virtual machine. The security event monitoring and response module of the machine monitor layer provides the performance monitoring function of the system (consisting of the physical server and its client virtual machine), as well as the interception, monitoring and processing response functions of various system calls of the client virtual machine. The security event monitoring and response module is responsible for collecting and monitoring the operating performance of physical servers and customer virtual machines, that is, monitoring the overall operating performance of the system, and sending the performance monitoring data to the data processing module for scheduling. The performance monitoring data flow as shown in the figure ③. The security event monitoring and response module sends the monitoring information to the data processing module after monitoring the system call event that the client virtual machine accesses the virtualized resources, and responds to the system call event according to the control of the data processing module, as shown in the figure The event data stream shown in ①. The data processing module is set in the security virtual machine, and is used to process the data of the system call event according to the priority and security policy, and send a control instruction to the security event monitoring and response module after the data processing to control the system call event against the call virtual machine. Furthermore, the data processing module deployed on the security virtual machine provides the functions of processing security events and security control. After receiving the event data flow from the security event monitoring and response module, the data processing module processes it, and sends control instructions to the security event monitoring and response module according to the security policy and processing results, as shown in the control flow ② in the figure.

For the performance-optimized virtualized resource monitoring system shown in FIG. 1 , the preferred structure of its security event monitoring and response module deployed at the virtual machine monitor layer is shown in FIG. 2 . The security event monitoring and response module includes a security event monitoring module, a security event response module, and a performance monitoring module. The performance monitoring module monitors the overall performance of the physical server and the client virtual machine to obtain performance monitoring data. The performance monitoring data can be provided to A security policy for the data processing module to process event scheduling data, sending performance monitoring data to the data processing module, as shown in the performance monitoring data flow ③; the security event monitoring module monitors the system call events of the client virtual machine to obtain Event data and send the event data to the data processing module located on the security virtual machine, as shown in the event data flow ①, and then send the event to the security event response module according to the control flow ② issued by the data processing module Processing or direct release; the security event response module receives and responds to the control instructions sent by the data processing module, specifically, the security event response module processes, rejects, or Release the access operation of the system call for virtualized resources, wherein the security response module processes the received system call event according to the control instruction, which may be to implement fuzzy control processing on the system call event. For example, when the system call event is a file access, When the control instruction issued by the data processing module is processed, the security response module can read the content of the file through obfuscation processing.

For the performance-optimized virtualized resource monitoring system shown in FIG. 1 , the optimal structure of the data processing module deployed on the secure virtual machine is shown in FIG. 3 . The data processing module can process security events, and the data processing module adopts a priority scheduling method, which can reduce the performance loss caused by the resource occupation of the security function itself. The data processing module includes a semantic processing module, a core processing module, a security policy module, and one or more security monitoring modules. Both the core processing module and the semantic processing module are connected with the security event monitoring and response module; the core processing module includes a scheduling processing module, a real-time The data processing module and the log and alarm processing module, the real-time data processing module and the log and alarm processing module are respectively connected with the scheduling processing module, the scheduling processing module is connected with the semantic processing module, and the scheduling processing module and the real-time data processing module are connected with the security event monitoring and The response module is connected; the real-time data processing module and the log and alarm processing module are all connected with the security policy module through one or more security monitoring modules.

In Figure 3, the semantic processing module is used to perform semantic conversion processing on the event data monitored by the security event monitoring and response module, and convert the event data from low-level semantics to high-level semantics, that is, by identifying the related parties of the security event and involving Virtualized resource attributes and access environment context are processed, and input to the scheduling processing module in the core processing module after semantic conversion processing. The core processing module processes the event data according to the security policies in the pre-arranged security policy module and the performance monitoring data obtained by the security event monitoring and response module, and sends control instructions to the security event monitoring and response module after data processing. The scheduling processing module in the core processing module performs priority judgment and scheduling processing on the event data according to the security policy and performance monitoring data. The performance monitoring module monitors the operating performance of the physical server and the operating performance of the client virtual machine. Together as the basis for policy processing by the core processing module, low-priority security events are handed over to the log and alarm processing module for log and alarm processing. The specific work of the log and alarm processing module can be to log low-priority event data first Record, and then conduct post-event review through each security monitoring module when the physical server system is idle, as shown in the log processing data flow ⑤, and perform message alarm processing according to the security policy; hand over high-priority security events to real-time data The processing module performs real-time data processing, and the real-time data processing module pushes it to the safety monitoring module for analysis in real time, and returns the analysis results to the real-time data processing module, as shown in the real-time processing data flow ④, the real-time data processing module according to the safety monitoring module The analysis results send control instructions to the security event monitoring and response module. In addition to determining the priority based on the security policy and semantic conversion processing results, the scheduling processing module can also evaluate the current running performance based on the security event monitoring and response module of the virtual machine monitor layer, and can dynamically adjust the scheduling security policy module In the security policy, if the physical server system is busy, most of the security events will be recorded and message alarmed through the log and alarm processing module, and only a small number of security events with high security level will be processed in real time through the real-time data processing module; if the physical If the server system is relatively idle, more security events can be properly processed in real time through the real-time data processing module.

Security monitoring module: It can be composed of multiple modules, such as intrusion detection module (IDS module), intrusion prevention module (IPS module), file access control module, etc. Each module focuses on different security monitoring functions. According to different monitoring functions, the input events of the client virtual machine corresponding to the real-time processing data flow ④ may be some events or all events. Different modules can analyze and process security events in parallel, and submit the processing results to the security policy module. Security policy module: Configure security policies and serve as input for various security monitoring modules, and also for priority determination by the scheduling processing module in the core processing module.

FIG. 4 is a schematic diagram of a preferred structure of a performance-optimized monitoring system for virtualized resources in the present invention. The system adopts the preferred security event monitoring and response module shown in FIG. 2 and the preferred data processing module shown in FIG. 3 . The specific components between the security event monitoring and response module and the data processing module are connected as follows: the semantic processing module is connected to the security event monitoring module, and is used to perform semantic conversion processing on the event data monitored by the security event monitoring module, as shown in the figure Event data stream①. The performance monitoring module is connected with the scheduling processing module, and is used to transmit the performance monitoring data monitored by the performance monitoring module to the scheduling processing module as a reference for its scheduling processing, as shown in the performance monitoring data flow ③ in the figure. The real-time data processing module is connected to the security event monitoring module and the security event response module respectively, as shown in the control flow ② in the figure, the security event monitoring module can directly release the system call event according to the received control command or hand it over to the security event response module for processing , the security event response module can intercept or process the system call event according to the received control command and release it. Both the security event monitoring module and the security event response module can receive the control command sent by the real-time data processing module, which can improve the system operation efficiency. Of course, the functions of the security event monitoring module and the security event response module for receiving control instructions can also be combined and placed in any one of the two modules.

The workflow of the monitoring system of the performance-optimized virtualized resource of the present invention described in FIG. 4 is shown in FIG. 5 :

1) The client virtual machine sends a system call event request, such as an I/O request, etc., and the system call event can also be called a security event;

2) The security event monitoring module intercepts this system call and hands over the event data to the semantic processing module;

3) The semantic processing module performs semantic conversion of security events, and sends the converted event data to the scheduling processing module;

4) The scheduling processing module obtains the current system performance monitoring data from the performance monitoring module, and at the same time comprehensively performs scheduling processing according to the security policy:

a) If it is a low-priority security event, hand over the security event to the log and alarm processing module for log recording, and then read the log through the security monitoring module for post-mortem review when the physical server system is idle;

b) If it is a high-priority security event, hand over the security event to the real-time data processing module;

5) The real-time data processing module pushes this event to each required safety monitoring module for real-time data processing;

6). The security monitoring module conducts security analysis on this security event according to the security policy in the security policy module, and returns the analysis results to the real-time data processing module. The security monitoring module may include multiple parallel processing modules, such as IDS, IPS, File access control module, etc.;

7) The real-time data processing module makes and issues control instructions to the security event monitoring module and the security event response module according to the current security policy and the analysis results of the security monitoring module;

8) The security event monitoring module operates according to the control instructions:

a) If the control instruction is release, then the system call event is directly released;

b) If the control instruction is processing, the system call event is handed over to the security event response module for processing;

9) The security incident response module processes according to the control instructions:

a) If the control command is intercepted, then intercept this command and return an error message;

b) If the control instruction is processing, the system call event is processed according to the processing instruction and then released.

Compared with the existing virtualized security monitoring technology, the performance-optimized virtualized resource monitoring system of the present invention has the following advantages: no agent needs to be installed on the client virtual machine, and the components of the system of the present invention are installed on the virtual machine On the monitor layer and the security virtual machine; it can be compatible with different security monitoring modules, and supports third-party security extension functions; according to the usage status of system virtualization resources (or hardware resources), it can dynamically schedule security processing operations, and assign them according to the priority Select real-time processing or log recording operations for security events, which can avoid the sharp decline in system performance caused by security virtual machines and customer virtual machines robbing system virtualization resources. At the same time, security review operations can be performed when the physical server system is idle. Real-time monitoring of high-level security events gives priority to processing, and the function of post-mortem review of low-level security events avoids the problem of system security degradation caused by discarding and processing a large number of security events when the system is busy. It can also use system virtualization resources more efficiently, which is very good It balances performance and security, dynamically adjusts monitoring strategies, and improves user experience while ensuring security.

The present invention also relates to a performance-optimized monitoring method for virtualized resources, the flow chart of which is shown in FIG. Monitoring, monitoring the operating performance of the physical server and the client virtual machine is monitoring the overall performance of the system. According to the monitored overall operating performance of the system, the security virtual machine performs data processing on the monitored system call event according to the priority and security policy. After the data is processed, a control instruction is issued to control the operation of the system call event for invoking virtualized resources.

The performance-optimized virtualized resource monitoring method of the present invention corresponds to the above-mentioned performance-optimized virtualized resource monitoring system of the present invention. At the virtual machine monitor layer, monitor the system call events of the customer virtual machine to obtain event data, monitor the operating performance of the physical server and the customer virtual machine to obtain performance monitoring data, and the performance monitoring data can provide data processing for system call events a security policy. Preferably, after the event data is obtained through monitoring, semantic conversion processing is performed on the event data first, and the event data is converted from low-level semantics to high-level semantics, and then data processing is performed on the event data after semantic conversion processing.

At the virtual machine monitor layer, the operating performance of the physical server and the client virtual machine and the system call events of the client virtual machine are monitored, which can effectively monitor the operation and security status of the physical server and the client virtual machine; then the monitored security events are prioritized The data processing can include scheduling processing, real-time data processing, and log and alarm processing. The scheduling processing is to judge the priority and schedule processing of event data according to security policies and performance monitoring data. Priority event data is logged and alarmed. For example, low-priority event data is logged first, and then the security monitoring module is used for post-event review, and alarm processing is performed according to the security policy; high-priority event data is Real-time data processing, for example, high-priority event data is analyzed by the security monitoring module and real-time data processing is performed according to security policies, and control instructions are issued after real-time data processing to control the operation of system call events for calling virtualized resources. Consider the performance monitoring data obtained by monitoring the operating performance of physical servers and client virtual machines, obtain the operating status of physical servers, such as busy or idle, and obtain the operating and security status of client virtual machines, and then schedule and process system security events , if the physical server system is busy, only high-priority security events will be monitored in real time and pushed to the security monitoring module for processing; low-priority security events will be recorded in the log, and then the security monitoring will be performed when the physical server system is idle. The module reads logs for security review. The monitoring method of the present invention can effectively avoid the situation where the security virtual machine and the client virtual machine compete for system resources, and at the same time, it can also avoid the situation that a large number of security events are discarded and processed due to resource shortage, resulting in a decrease in system security, and achieves real-time monitoring of high-level security events. Monitoring and processing, low-level security event post-mortem review function.

FIG. 7 is a preferred flow chart of the performance-optimized virtualized resource monitoring method of the present invention.

1) The client virtual machine sends a system call event request, such as an I/O request, etc., and the system call event can also be called a security event;

2) Intercept the system call by monitoring the security event, and perform semantic conversion processing on the security event data;

3) The event data after semantic conversion processing enters into scheduling processing;

4) Scheduling processing Obtain current system performance monitoring data from the monitoring of the operating performance of physical servers and client virtual machines, and comprehensively perform scheduling processing according to security policies:

a) If it is a low-priority security event, log and alarm the security event, that is, record the log first, and then read the log through the security monitoring module for post-event review when the physical server system is idle;

b) If it is a high-priority security event, the security event will be processed in real time;

5) Real-time data processing Push this event to each required safety monitoring module for real-time data processing;

6) The security monitoring module performs security analysis on this security event according to the security policy. The security monitoring module may include multiple parallel processing modules, such as IDS, IPS, file access control module, etc.;

7) Make and issue control instructions according to the current security strategy and the analysis results of the security monitoring module;

8) Control the operation of the system call event to call the virtualization resource through the control instruction:

a) If the control instruction is release, then the system call event is directly released;

b) If the control command is intercepted, then intercept this command and return an error message;

c) If the control instruction is processing, the system call event is processed according to the processing instruction and then released.

It should be pointed out that the specific embodiments described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although this specification has described the invention in detail with reference to the accompanying drawings and embodiments, those skilled in the art should understand that the invention can still be modified or equivalently replaced. The technical solutions and their improvements in the spirit and scope should all be included in the protection scope of the invention patent.

Claims (9)

1. A monitoring method of a performance-optimized virtualized resource, characterized in that, at the virtual machine monitor layer, the operating performance of the physical server and the client virtual machine and the system call event of the client virtual machine are monitored, and the system call The event is a security event; and according to the monitored operating performance of the physical server and the client virtual machine, the security virtual machine performs data processing on the monitored security event of the client virtual machine according to the priority and security policy of the security event of the client virtual machine Processing, the data processing includes scheduling processing, real-time data processing, and log and alarm processing, the scheduling processing is to perform priority judgment and scheduling on security event data, log and alarm processing on low-priority security event data, and Real-time data processing is performed on high-priority security event data; control instructions are issued after data processing to control the operation of system call events for invoking virtualized resources. 2. the monitoring method of the virtualization resource of performance optimization according to claim 1 is characterized in that, at the virtual machine monitor layer, the system call event of client virtual machine is monitored to obtain event data, and physical server and client virtual machine The running performance of the system is monitored to obtain performance monitoring data, and the performance monitoring data provides a security strategy for data processing of system call events. 3. The monitoring method for performance-optimized virtualized resources according to claim 2, characterized in that, after the event data is obtained through monitoring, the event data is first subjected to semantic conversion processing, and the event data is converted from low-level semantics For high-level semantics, data processing is performed on event data after semantic conversion processing. 4. The method for monitoring virtualized resources with optimized performance according to claim 1, wherein the high priority event data is analyzed by a security monitoring module and processed in real time according to a security policy, and the real-time data After processing, a control instruction is issued to control the operation of the system call event for invoking virtualization resources; And/or, the log and alarm processing is to record the low-priority event data firstly, and then conduct post-event review through the security monitoring module, and perform alarm processing according to the security policy. 5. A monitoring system for performance-optimized virtualized resources, characterized in that it includes an interconnected security event monitoring and response module and a data processing module, and the security event monitoring and response module is arranged on a virtual machine monitor layer, using To monitor the operating performance of the physical server and the client virtual machine and the system call event of the client virtual machine, the system call event is a security event, and the monitoring information is sent to the data processing module; the data processing module is set in the security virtual machine, configured to perform data processing on the security event of the client virtual machine according to the priority and security policy of the security event of the client virtual machine according to the monitored operating performance of the physical server and the client virtual machine, and the data processing includes processing Perform priority judgment and scheduling on security event data, perform log and alarm processing on low priority security event data, and perform real-time data processing on high priority security event data; after data processing, the data processing module sends security event monitoring and the response module sends a control command to control the operation of the system call event on the call virtualization resource. 6. The monitoring system of the virtualized resources of performance optimization according to claim 5, wherein the security event monitoring and response module comprises a security event monitoring module, a security event response module and a performance monitoring module, and the security event The monitoring module monitors the system call event of the client virtual machine to obtain event data and sends the event data to the data processing module, and the performance monitoring module monitors the operating performance of the physical server and the client virtual machine to obtain performance monitoring data. A security strategy for providing the performance monitoring data to the data processing module for data processing, and the security event response module receives and responds to the control instructions sent by the data processing module. 7. the monitoring system of the virtualization resource of performance optimization according to claim 6, it is characterized in that, described data processing module comprises the semantic processing module, core processing module and security policy module connected in sequence, and described core processing module respectively It is connected with the security policy module, the performance monitoring module and the security event response module; the semantic processing module is connected with the security event monitoring module, and is used to perform semantic conversion processing on the event data, and convert the event data from low-level semantics to high-level Semantics, which are input to the core processing module after semantic conversion processing; the core processing module performs data processing on the event data according to the security policy in the security policy module and the performance monitoring data obtained by the performance monitoring module, and reports to the security event after the data processing The response module issues a control command. 8. the monitoring system of the virtualization resource of performance optimization according to claim 7, it is characterized in that, described core processing module comprises scheduling processing module, real-time data processing module and log and alarm processing module, and described real-time data processing module And the log and alarm processing module are respectively connected with the scheduling processing module, the scheduling processing module is respectively connected with the performance monitoring module and the semantic processing module, the real-time data processing module and the log and alarm processing module are all connected with the security policy module, the The real-time data processing module is connected with the security event response module; the scheduling processing module performs priority judgment and scheduling processing on the event data, and the real-time data processing module performs real-time data processing on high-priority event data and performs real-time data processing after real-time data processing. A control instruction is sent to the security event response module, and the log and alarm processing module performs log and alarm processing on low-priority event data. 9. The monitoring system of the virtualized resource of performance optimization according to claim 8, is characterized in that, described real-time data processing module and log and alarm processing module are all connected with security policy module by one or more security monitoring modules; The real-time data processing module analyzes the high-priority event data through the security monitoring module and performs real-time data processing according to the security policy; And/or, the log and alarm processing module first records the low-priority event data, and then conducts subsequent review through the security monitoring module, and performs alarm processing according to the security policy; And/or, the security monitoring module is an intrusion detection module and/or an intrusion prevention module and/or a file access control module.