CN105592088A - Virtual machine flow monitoring method and device, and terminal - Google Patents

Abstract

The invention provides a virtual machine flow monitoring method and device. A virtual machine is internally provided with an agent client which is in connection with a control center. The method comprises: the agent client obtaining the access flow of the virtual machine, and performing monitoring on the access flow according to a preset strategy; and the agent client determining whether to intercept the access flow of the virtual machine according to the monitoring result, wherein the preset strategy is a strategy issued by the control center according to the identification of the virtual machine and corresponding to the virtual machine. The method monitors the access flow of each virtual machine through the agent client in the virtual machine, realizes interactive monitoring between virtual machines or virtual machines of different physical terminals, and improves virtual machine inner data security.

Description

Method, device, and terminal for monitoring virtual machine traffic

technical field

The present invention relates to the technical field of the Internet, in particular to a virtual machine flow monitoring method, device, and terminal.

Background technique

Generally, there are many physical terminals in an enterprise, and there is only one entrance or exit to the outside world. By adding a firewall to the entrance or exit, border defense is carried out. With the increasingly wide application of computers and networks and the increasing variety of business types in different fields , the virtual machine in the distributed environment (a virtual machine refers to a computer system that runs on a physical machine through software simulation, has complete hardware system functions, and runs in a completely isolated environment) came into being.

Due to the virtualization of multi-group call services, there is no traditional boundary, so it is impossible to monitor the interaction between virtual machines or between virtual machines of different physical terminals. Therefore, data between various departments within the enterprise may be risk of theft.

Contents of the invention

Aiming at the above-mentioned defects existing in the prior art, a virtual machine traffic monitoring method, device, and terminal for solving the above-mentioned technical problems are proposed.

In a first aspect, the present invention provides a virtual machine traffic monitoring device, the device is set in the virtual machine and connected to the control center, the device includes:

An acquisition module, configured to acquire the access traffic of the virtual machine;

A monitoring module, configured to monitor the access traffic according to a preset strategy;

A determining module, configured to determine whether to intercept the access traffic of the virtual machine according to the monitoring result;

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

Optionally, the access traffic of the virtual machine includes traffic for receiving access requests by the virtual machine and traffic for sending access requests by the virtual machine;

Correspondingly, the monitoring module is used for:

Monitoring is performed according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine.

Optionally, the device further includes: a receiving module, configured to receive the preset policy issued by the control center.

Optionally, the detection module is used for:

Obtain the source address, destination address and access information of the access traffic;

Monitoring the source address, destination address and access information of the access traffic according to the preset policy.

Optionally, the determination module is used for:

When the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

In a second aspect, the present invention also provides a monitoring device for virtual machine traffic, the device is connected to a proxy client set in the virtual machine, and the device includes:

The acquisition module is used to obtain the access rights of multiple virtual machines,

A policy configuration module, configured to configure a policy corresponding to the access rights of the plurality of virtual machines, where the policy includes an identifier of the virtual machine;

A sending module, configured to, according to the identifier of the virtual machine, send a policy corresponding to the identifier to a proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy according to the policy Monitor the access traffic of the virtual machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

Optionally, the device further includes: an update module, configured to update the configured policy.

In a third aspect, the present invention also provides a method for monitoring virtual machine traffic, wherein a proxy client is provided in the virtual machine, and the proxy client is connected to a control center, and the method includes:

The proxy client obtains the access traffic of the virtual machine, and monitors the access traffic according to a preset policy;

The proxy client determines whether to intercept the access traffic of the virtual machine according to the monitoring result;

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

Optionally, the access traffic of the virtual machine includes traffic for receiving access requests by the virtual machine and traffic for sending access requests by the virtual machine;

Correspondingly, the access traffic is monitored according to preset policies, including:

The proxy client performs monitoring according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine.

Optionally, before acquiring the access traffic of the virtual machine, the method further includes:

Receive the preset policy issued by the control center.

Optionally, the monitoring of the access traffic according to a preset strategy includes:

Obtain the source address, destination address and access information of the access traffic;

Monitoring the source address, destination address and access information of the access traffic according to the preset policy.

Optionally, the determining whether to intercept the access traffic of the virtual machine according to the monitoring results includes:

If the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

In a fourth aspect, the present invention also provides a virtual machine traffic monitoring method, wherein a proxy client is set in the virtual machine, and the proxy client is connected to a control center, and the method includes:

The control center obtains the access rights of multiple virtual machines, and configures policies corresponding to the access rights of the multiple virtual machines, where the policies include the identifiers of the virtual machines;

The control center, according to the identifier of the virtual machine, sends a policy corresponding to the identifier to the proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy on the virtual machine according to the policy. Monitor the access traffic of the machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

Optionally, after the control center obtains the access rights of multiple virtual machines, the method further includes:

Make updates to configured policies.

In a fifth aspect, the present invention further provides a terminal, including a virtual machine and the above-mentioned device, where the device is set in the virtual machine.

It can be seen from the above technical solution that the present invention provides a virtual machine traffic monitoring method, device, and terminal, by setting a proxy client in the virtual machine, and monitoring the access traffic of the virtual machine through the proxy client in each virtual machine , realizing the monitoring of the interaction between virtual machines or between virtual machines of different physical terminals, and improving the security of data in the virtual machines.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for monitoring virtual machine traffic provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for monitoring virtual machine traffic provided by another embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for monitoring virtual machine traffic provided by another embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a virtual machine traffic monitoring device provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for monitoring virtual machine traffic provided by another embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Fig. 1 shows a schematic flowchart of a method for monitoring virtual machine traffic provided by an embodiment of the present invention. As shown in Fig. 1 , in the method, a proxy client is set in the virtual machine, and the proxy client is connected with A control center connection, the method comprising:

101. The proxy client acquires access traffic of the virtual machine, and monitors the access traffic according to a preset policy.

It is understandable that each virtual machine is provided with a proxy client, which is connected to the control center, and the control center pushes different policies to the proxy client according to the virtual machine where the proxy client is located, so as to pass the proxy client The end monitors the access traffic of the virtual machine where the proxy client is located.

The preset policy may be sent by the control center to the agent client. Specifically, the proxy client can monitor the accessed traffic of the virtual machine where it resides and the traffic that initiates access.

102. The proxy client determines whether to intercept the access traffic of the virtual machine according to the monitoring result.

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

It should be noted that, in this embodiment, a proxy client is set in each virtual machine, and multiple proxy clients constitute a firewall monitoring system, which is equivalent to a firewall monitoring system in each virtual machine in a distributed manner. The agent client is deployed in the machine to realize the traffic monitoring between the virtual machines. Compared with the existing technology that uses a firewall to monitor the traffic of all the virtual machines as a whole, it can monitor the traffic between the virtual machines or the virtual machines. It monitors the interaction between virtual machines of different physical terminals, which improves the security of data in the virtual machines.

For example, for the administrative department of a company, the access traffic of all virtual machines between other departments and the administrative department is monitored through a firewall, but the firewall cannot realize the communication between the administrative departments. The monitoring between each virtual machine, and in the present embodiment, through the distributed mode, all set agent client between each virtual machine, adopt overall monitoring in the existing mode with respect to the virtual machine and the virtual machine inside the department Traffic between virtual machines is monitored, improving user experience.

Each virtual machine includes the identification of the virtual machine. Since the proxy client is set in each virtual machine, when the control center sends the policy to the proxy client, it needs to issue the policy according to the identification of the virtual machine. In this way, the virtual machine During migration, for example, when a physical machine needs to be maintained and replaced on another physical machine, it is only necessary to send the corresponding policy to the proxy client in the virtual machine of the replaced physical machine, and there is no need to replace the virtual machine. machine, which can ensure the synchronization of policies and virtual machines.

The above method monitors the access traffic of the virtual machine through the agent client in each virtual machine, realizes the monitoring of the interaction between virtual machines or virtual machines of different physical terminals, and improves the virtual machine data security within.

The above method will be described in detail below through specific examples.

201. Receive a preset policy issued by the control center.

In order to meet the business needs of different departments of the enterprise, different numbers of virtual machines are often allocated to different departments for their use. The multiple virtual machines have their own independent IP addresses and their respective identifiers. Of course, the identifier can be a group identifier within the department, and the identifier can correspond to multiple virtual machines. In this way, the preset policy can directly issue the same policy to the virtual machine corresponding to the identifier based on the group identifier, which is relatively simple and has high execution efficiency. ; However, if the distinction between leaders and subordinates within the department is fine, or the corresponding strategy needs to be strictly controlled between each virtual machine, then the logo can be understood as the logo of each virtual machine, that is, the logo and the virtual machine are one by one Corresponding relationship, in this way, preset policies are issued for each ID, and the preset policies corresponding to each ID are different, so that traffic monitoring between each virtual machine can be realized. Although the execution efficiency is not as fast as the above-mentioned group ID, it can Strictly control the traffic between each virtual machine to ensure the security of the traffic between virtual machines. This embodiment does not limit the meanings of the above-mentioned delivered preset policies and identifiers, and corresponding plans may be implemented according to specific situations.

For example, the virtual machines in the physical machines of the employees of the administrative personnel department may be grouped, and the virtual machines in the physical machines of the financial department may be in a one-to-one correspondence between identifiers and virtual machines.

202. The proxy client acquires access traffic of the virtual machine.

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

203. Monitor the access traffic according to a preset policy.

The aforementioned access traffic may include traffic of receiving access requests and traffic of virtual machines sending access requests, and the proxy client monitors according to the traffic of virtual machines receiving access requests and the traffic of virtual machines sending access requests.

Specifically, when monitoring access traffic, the following methods can be used, including the following sub-steps:

2031. Obtain the source address, destination address, and access information of the access traffic.

Taking the administrative personnel department as an example, if the proxy client in the virtual machine on the administrative manager's physical computer monitors each flow obtained for access, obtains the source address, destination address, and access information of the access traffic, and specifically obtains the access The source address of the request can be understood as the source of the access request, for example, the IP of a physical host in the technical department, or the identity of a virtual machine in a physical machine, etc.; the destination address is the path of the accessed folder, and the access The information is specific to the file being accessed.

2032. Monitor the source address, destination address, and access information of the access traffic according to the preset policy.

The preset policy includes the virtual machine ID and the policy corresponding to the virtual machine ID, where the policy can include some access rights information corresponding to the virtual machine ID, for example: which identified virtual machines or which physical machine IPs can be accessed , which identified virtual machines or which physical machine IPs can be accessed, which identified virtual machines or which physical machine IPs can be accessed, and which identified virtual machines or which physical machine IPs are allowed to access which files Wait.

For example, the IPs of the virtual machines and physical machines identified by other departments are not allowed to access any files on the virtual machine of the administrative and personnel department, or only allow access to files related to their own information, which include the personnel information of the accessing party , such as provident fund, social security, salary and other information. The files on the virtual machine of the manager of the administrative and human resources department do not allow the virtual machine or physical machine IP of the employee of the administrative and human resources department to access any file information. This is also applicable to the financial department or technical department to prevent some company financial information or the company's technical core from being stolen.

204. According to the monitoring result, determine whether to intercept the access traffic of the virtual machine, if not, perform step 205, and if yes, do not intercept the access traffic of the virtual machine.

205. If the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

In the above method, the proxy client monitors the traffic of the virtual machine it belongs to according to the policy issued by the control center. This method does not depend on any platform, such as kvm, xen, etc., and only needs to set the virtual machine or physical machine of the proxy client The virtual machine in the virtual machine can be set as a proxy client. This method is more convenient for the monitoring of the virtual machine. It only needs the control center to issue the corresponding preset policy according to the identity of the virtual machine. In addition, during the migration process of the virtual machine, Since the policy is issued to the proxy client instead of the virtual machine, it is no longer necessary to synchronize the policy with the virtual machine during the migration process of the virtual machine, but to the proxy client corresponding to the virtual machine Just re-send the preset policy.

Fig. 3 shows a schematic flow diagram of a method for monitoring virtual machine traffic provided by an embodiment of the present invention. As shown in Fig. 3, a proxy client is set in the virtual machine, and the proxy client is connected to the control center , the method includes the following steps:

301. The control center acquires access rights of multiple virtual machines, and configures policies corresponding to the access rights of the multiple virtual machines, where the policies include identifiers of the virtual machines;

The access right can be understood as the right to receive access requests and send access requests of the virtual machine corresponding to the identifier obtained for the identifier of the virtual machine.

302. According to the identifier of the virtual machine, the control center sends a policy corresponding to the identifier to the agent client in the virtual machine corresponding to the identifier, so that the agent client can implement the policy corresponding to the identifier according to the policy. Monitor the access traffic of the above virtual machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

In the above method, the control center sends the policy corresponding to the identity of the virtual machine to the agent client in the virtual machine according to the identity of the virtual machine, so that the agent client monitors the access traffic of the virtual machine to which it belongs according to the preset policy, ensuring that all The security of the access traffic between virtual machines plays a certain role in the internal data monitoring of the enterprise.

In addition, since the access traffic policies of different virtual machines may change, after the control center obtains the access rights of multiple virtual machines, the method further includes: updating the configured policies. It is ensured that the preset policy of the agent client in each virtual machine is the latest policy, which improves the monitoring efficiency.

Fig. 4 shows a schematic structural diagram of a virtual machine flow monitoring device provided by an embodiment of the present invention. As shown in Fig. 4, the device is set in the virtual machine and connected to the control center, and the device includes :

An acquisition module 41, configured to acquire the access traffic of the virtual machine;

A monitoring module 42, configured to monitor the access traffic according to a preset policy;

A determining module 43, configured to determine whether to intercept the access traffic of the virtual machine according to the monitoring result;

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

In a preferred implementation of this embodiment, the access traffic of the virtual machine includes the traffic of the virtual machine receiving the access request and the traffic of the virtual machine sending the access request;

Correspondingly, the monitoring module is used for:

Monitoring is performed according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine.

In a preferred implementation manner of this embodiment, the device further includes: a receiving module, configured to receive the preset policy issued by the control center.

In a preferred implementation of this embodiment, the detection module is used for:

Obtain the source address, destination address and access information of the access traffic;

Monitoring the source address, destination address and access information of the access traffic according to the preset policy.

In a preferred implementation of this embodiment, the determination module is configured to:

When the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

This embodiment also provides a terminal, including a virtual machine and the above-mentioned device, and the device is set in the virtual machine.

Fig. 5 shows a schematic structural diagram of a device for monitoring virtual machine traffic provided by an embodiment of the present invention, wherein the device is connected to a proxy client set in the virtual machine, and the device includes:

Obtaining module 51, configured to obtain the access rights of multiple virtual machines,

A policy configuration module 52, configured to configure a policy corresponding to the access rights of the plurality of virtual machines, where the policy includes the identity of the virtual machine;

The sending module 53 is configured to, according to the identifier of the virtual machine, send the policy corresponding to the identifier to the proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy corresponding to the identifier according to the policy. Monitor the access traffic of the above virtual machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

In a preferred implementation manner of this embodiment, the device further includes: an update module, configured to update the configured policy.

It should be noted that there is a one-to-one correspondence between the above-mentioned device and the above-mentioned method, and the specific implementation details in the above-mentioned method are also applicable to the above-mentioned device, and the specific implementation details of the above-mentioned device will not be described in detail in this embodiment.

Embodiments of the invention disclose:

A1. A monitoring device for virtual machine traffic, characterized in that said device is set in said virtual machine and connected to a control center, said device comprising:

An acquisition module, configured to acquire the access traffic of the virtual machine;

A monitoring module, configured to monitor the access traffic according to a preset policy;

A determining module, configured to determine whether to intercept the access traffic of the virtual machine according to the monitoring result;

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

A2. The device according to A1, wherein the access traffic of the virtual machine includes traffic for receiving access requests by the virtual machine and traffic for sending access requests by the virtual machine;

Correspondingly, the monitoring module is used for:

Monitoring is performed according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine.

A3. The device according to A1, further comprising: a receiving module, configured to receive the preset strategy issued by the control center.

A4. The device according to A1, wherein the detection module is used for:

Obtain the source address, destination address and access information of the access traffic;

Monitoring the source address, destination address and access information of the access traffic according to the preset policy.

A5. The device according to A1 or 4, wherein the determination module is used for:

When the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

B6, a kind of monitoring device of virtual machine flow, it is characterized in that, described device is connected with the proxy client that is arranged in described virtual machine, and described device comprises:

The acquisition module is used to obtain the access rights of multiple virtual machines,

A policy configuration module, configured to configure a policy corresponding to the access rights of the plurality of virtual machines, where the policy includes an identifier of the virtual machine;

A sending module, configured to, according to the identifier of the virtual machine, send a policy corresponding to the identifier to a proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy according to the policy Monitor the access traffic of the virtual machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

B7. The device according to B6, further comprising: an update module, configured to update the configured policy.

C8, a method for monitoring virtual machine traffic, characterized in that, an agent client is provided in the virtual machine, and the agent client is connected to a control center, and the method includes:

The proxy client obtains the access traffic of the virtual machine, and monitors the access traffic according to a preset policy;

The proxy client determines whether to intercept the access traffic of the virtual machine according to the monitoring result;

Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine.

C9. The method according to C8, wherein the access traffic of the virtual machine includes traffic for receiving access requests by the virtual machine and traffic for sending access requests by the virtual machine;

Correspondingly, the access traffic is monitored according to preset policies, including:

The proxy client performs monitoring according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine.

C10, according to the method described in C8, it is characterized in that, before obtaining the access flow of virtual machine, described method also comprises:

Receive the preset policy issued by the control center.

C11. The method according to C8, wherein the monitoring of the access traffic according to a preset policy includes:

Obtain the source address, destination address and access information of the access traffic;

Monitoring the source address, destination address and access information of the access traffic according to the preset policy.

C12, according to the method described in C8 or 11, it is characterized in that, according to the monitoring results, determining whether to intercept the access traffic of the virtual machine includes:

If the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic.

D13. A method for monitoring virtual machine traffic, characterized in that, an agent client is provided in the virtual machine, and the agent client is connected to a control center, and the method includes:

The control center obtains the access rights of multiple virtual machines, and configures policies corresponding to the access rights of the multiple virtual machines, where the policies include the identifiers of the virtual machines;

The control center, according to the identifier of the virtual machine, sends a policy corresponding to the identifier to the proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy on the virtual machine according to the policy. Monitor the access traffic of the machine;

Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine.

D14, according to the method described in D13, it is characterized in that, after the control center obtains the access rights of a plurality of virtual machines, the method also includes:

Make updates to configured policies.

E15. A terminal, characterized by comprising a virtual machine and the device according to any one of A1-5, the device being set in the virtual machine.

In the description of the invention, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the above description of exemplary embodiments of the invention, in order to streamline the present disclosure and to facilitate understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together into a single embodiment , figure, or description of it. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and installed in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except where at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in a browser terminal device according to an embodiment of the present invention . The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. All of them should be covered by the scope of the claims and description of the present invention.

Claims (10)

1. A monitoring device for virtual machine traffic, characterized in that said device is arranged in said virtual machine and connected with a control center, said device comprising: An acquisition module, configured to acquire the access traffic of the virtual machine; A monitoring module, configured to monitor the access traffic according to a preset policy; A determining module, configured to determine whether to intercept the access traffic of the virtual machine according to the monitoring result; Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine. 2. The device according to claim 1, wherein the access traffic of the virtual machine includes traffic for receiving access requests by the virtual machine and traffic for sending access requests by the virtual machine; Correspondingly, the monitoring module is used for: Monitoring is performed according to the flow of access requests received by the virtual machine and the flow of access requests sent by the virtual machine. 3. The device according to claim 1, further comprising: a receiving module, configured to receive the preset policy issued by the control center. 4. The device according to claim 1, wherein the detection module is configured to: Obtain the source address, destination address and access information of the access traffic; Monitoring the source address, destination address and access information of the access traffic according to the preset policy. 5. The device according to claim 1 or 4, wherein the determination module is configured to: When the access traffic of the virtual machine does not comply with the preset policy, intercept the access traffic. 6. A monitoring device for virtual machine traffic, characterized in that the device is connected to a proxy client provided in the virtual machine, and the device includes: The acquisition module is used to obtain the access rights of multiple virtual machines, A policy configuration module, configured to configure a policy corresponding to the access rights of the plurality of virtual machines, where the policy includes an identifier of the virtual machine; A sending module, configured to, according to the identifier of the virtual machine, send a policy corresponding to the identifier to a proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy according to the policy Monitor the access traffic of the virtual machine; Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine. 7. The device according to claim 6, further comprising: an update module, configured to update the configured policy. 8. A method for monitoring virtual machine traffic, characterized in that, an agent client is provided in the virtual machine, and the agent client is connected with a control center, and the method comprises: The proxy client obtains the access traffic of the virtual machine, and monitors the access traffic according to a preset policy; The proxy client determines whether to intercept the access traffic of the virtual machine according to the monitoring result; Wherein, the preset policy is a policy corresponding to the identity of the virtual machine issued by the control center according to the identity of the virtual machine. 9. A method for monitoring virtual machine traffic, characterized in that, an agent client is provided in the virtual machine, and the agent client is connected with a control center, and the method comprises: The control center obtains the access rights of multiple virtual machines, and configures policies corresponding to the access rights of the multiple virtual machines, where the policies include the identifiers of the virtual machines; The control center, according to the identifier of the virtual machine, sends a policy corresponding to the identifier to the proxy client in the virtual machine corresponding to the identifier, so that the proxy client can implement the policy on the virtual machine according to the policy. Monitor the access traffic of the machine; Wherein, the access traffic of the virtual machine includes the traffic of receiving the access request by the virtual machine and the traffic of sending the access request by the virtual machine. 10. A terminal, characterized by comprising a virtual machine and the device according to any one of claims 1-5, the device being set in the virtual machine.