CN110618854A - Virtual machine behavior analysis system based on deep learning and memory mirror image analysis - Google Patents

Abstract

The invention discloses a virtual machine behavior analysis system based on deep learning and memory mirror image analysis, which carries out delta coding by acquiring memory mirror image data, extracts map characteristic point information from a coded memory map, trains a neural network by using the obtained characteristic information to obtain a classifier, and finally operates the neural network to analyze unknown virtual machine behavior by using the obtained classifier. The invention has simple operation, easy realization and convenient modularization; the invention has wide application range, can be used for detecting various attack modes such as known attack, unknown attack and the like, and can not influence the detection performance of the invention even if an attacker leaves attack after being latent for a period of time; in addition, the invention has better robustness, reliability and usability on different system platforms.

Description

Virtual Machine Behavior Analysis System Based on Deep Learning and Memory Mirroring Analysis

technical field

The invention belongs to the field of wireless network security, specifically the field of mimetic active defense, and relates to a virtual machine behavior analysis system based on deep learning and memory image analysis.

Background technique

The virtualized cloud platform is an important part of cloud computing. A virtualized cloud platform refers to running multiple operating systems on the same cloud platform at the same time, and each system has its own independent operating space. By running multiple virtual servers on one server, the utilization efficiency of the machine is improved, thereby reducing hardware procurement expenses, which is an important way to build a green data center. The virtual machine-based cloud platform enables users to independently build their own business environment. It runs stably and has good scalability and migration. It is widely used in financial industry, retail industry, digital marketing, education industry, government and enterprise units and other fields.

The virtualized cloud platform structure is open, which leads to a series of security issues related to virtual machines. Resource data and applications running in a virtual machine are vulnerable to damage by intruders. Therefore, virtual machines need more security mechanisms to accelerate the deployment of large-scale cloud services. The primary problem is how to correctly judge the behavior of the virtual machine in real time and determine whether the virtual machine is under malicious attack.

At present, the methods for solving virtual machine operation security include: methods for judging virtual machine operating status based on network flow data, based on logs, and based on prior knowledge. The virtual machine behavior judging method based on network flow data detects whether the virtual machine suffers malicious attacks by judging whether the data received by the network card of the virtual machine contains malicious data packets. This method requires the communication protocol to be parseable and cannot cope with unknown protocols. In addition, the use of a large number of data packets leads to a large calculation overhead of the judgment method. The method based on log analysis judges whether the virtual machine is under malicious attack by analyzing the virtual machine system log. However, the log itself has a hysteresis, and often the system needs to judge a series of activities and actions to determine the occurrence of an intrusion, which is very unfavorable for even preventing active intrusions. Judgment methods based on prior knowledge require known attack behaviors and cannot cope with unknown vulnerabilities, unknown backdoors, and unknown attacks.

In order to ensure the security of virtual machines in real time, there is an urgent need for a fast and effective virtual machine behavior analysis method that does not depend on existing vulnerability databases and attack databases, so as to improve the accuracy and efficiency of threat discovery, and realize the reliability and security of virtual machines. Availability, security.

Contents of the invention

The purpose of the present invention is to provide a virtual machine behavior analysis system based on deep learning and memory image analysis to address the deficiencies of the prior art. The present invention aims at internal attacks and external attacks, known attacks and unknown attacks in the network, ensures the security of the virtual machine platform, gives timely early warning for unknown threats, can correctly and real-time judge the behavior of the virtual machine, and improves the security of the cloud virtual machine , reliability, availability.

The purpose of the present invention is achieved through the following technical solutions: a virtual machine behavior analysis system based on deep learning and memory mirroring analysis, comprising the following steps:

(1) Obtain memory mirroring data, including the following sub-steps:

(1.1) At the initial time t ₀ , use the memory forensics tool to obtain the initial memory image data, and obtain the initial memory.

(1.2) At any time t ₀ +Δt, on VirtualBox and VMware virtualization platforms, according to the memory management mechanisms of different operating systems, automatically sample the memory image data of each isomer at the current moment when it is not attacked or under attack. , to get the current memory, that is, normal samples and malicious samples.

(2) Carry out delta encoding, including the following sub-steps:

(2.1) Run the memory forensics tool, use the pslist and dlllist commands on the initial memory obtained in step (1.1), and determine the executable file of the EXE type and the dynamic link library list of the DLL type in the initial memory respectively.

(2.2) pslist and dlllist commands in the current memory operation memory forensics tool that step (1.2) obtains determine the executable file of the EXE type and the dynamic link library list of the DLL type in the current memory respectively;

(2.3) The executable file of EXE type and the dynamic link library list of DLL type obtained by analysis steps (2.1) and (2.2), determine the executable file in the current memory but not in the initial memory, called new executable file ;

(2.4) According to the initial memory, generate a predicted memory for each new executable file, including the following sub-steps:

(2.4.1) determine the process ID of each new executable file, determine the base address of this process in the virtual memory address space simultaneously;

(2.4.2) For the process of each new executable file, according to the process base address in step (2.4.1), run the memmap command in the memory forensics tool in the current memory to extract the mapping between the process virtual memory and physical memory relation;

(2.4.3) Copy the new executable file from the virtual disk to the initial memory. For each virtual memory page of the new executable file, perform the following two steps: first, the virtual memory page is in the current memory, use the step The mapping relationship between virtual memory and physical memory extracted in (2.4.2), copy the new executable file to the initial memory; then, record the page copy information, including the source page position of the virtual memory page and the target page position in the physical memory , page length; finally generate prediction memory;

(2.5) output header information, including the path information of the new executable file that needs to be loaded and the page copy information of all new executable files extracted in the step (2.4.3);

(2.6) Use the predicted memory generated in step (2.4) as the source, and the current memory as the comparison object, and use xdelta3 encoding to obtain the memory map after encoding the current memory image data; use M and N to represent the number of rows and columns of the memory map respectively , use I(i,j)=[a,b,c] to represent the elements of row i and column j of the memory map; among them, 0≤i<M, 0≤j<N, a, b, c are all 32 Bit floating point number, I(i,j) is a three-dimensional vector;

(3) The feature point information of the memory map obtained in the extraction step (2.6), including the feature point position, the feature point size, and the feature strength of the feature point, including the following sub-steps:

(3.1) Construct the Hessian matrix, specifically: calculate the determinant of the Hessian matrix H(i, j) corresponding to each element in the memory map, as the eigenvalue of the element, the calculation formula is:

det(H(i,j))＝D _ii ·D _jj -0.9D _ij ·D _ij

Among them, D _ii =I(i+1,j)+I(i-1,j)-2I(i,j), D _jj =I(i,j+1)+I(i,j-1) -2I(i,j), D _ij =I(i+1,j)+I(i,j-1)-2I(i,j);

(3.2) Use SURF to construct the scale space: first use a 9×9 box filter to filter the original image of the memory map as the bottom image; then gradually increase the size of the box filter to filter the original image of the memory map Continue the filtering process; finally obtain filter response maps of different scales, and construct a scale space; the scale space has 4 layers, and the scaling ratio between layers is 2;

(3.3) Accurately locate feature points, specifically: in each local region of 3×3×3, perform non-maximum suppression on the scale space constructed in step (3.2); combine each element in the scale space with its three-dimensional neighborhood Compare the eigenvalues of the 26 elements, and the elements whose eigenvalues are larger or smaller than the surrounding 26 elements are feature points, and record the feature point position (i, j) and scale s;

(3.4) Determine the map feature points and feature vectors according to the threshold, specifically: compare the feature value of each feature point obtained in step (3.3) at the corresponding scale with the preset threshold, if the corresponding feature value is less than the preset threshold , then the feature point is not used as the final feature point; if the corresponding feature value is greater than or equal to the preset threshold, the feature point is used as the final feature point, and the feature vector is expressed as [i,j,s,det(H(i, j,s))]; where i, j are the row number and column number of the final feature point in the memory map, s is the filter scale corresponding to the final feature point, det(H(i,j,s)) is The feature value of the final feature point at scale s;

(3.5) Statistical feature vectors, specifically: the source of the feature vector obtained in the judgment step (3.4), said source including the memory mirror data under the unattacked situation and the memory mirror data under the attacked situation in the step (1.2); Determine the label z corresponding to each eigenvector, use z=0 to indicate that the eigenvector comes from the memory image data under the unattacked situation, and use z=1 to indicate that the eigenvector comes from the memory image data under the attacked situation; finally Get the feature vector sequence [i,j,s,det(H(i,j,s)),z];

(4) training the neural network, specifically: using the feature vector sequence obtained in step (3.5) as the input sample of the deep neural network, and whether the behavior of the virtual machine is normal is output, and training the deep neural network to obtain a virtual machine behavior classifier;

(5) Run the neural network to analyze the behavior of the unknown virtual machine, specifically: use the virtual machine behavior classifier obtained in step (4) to analyze the virtual machine with an unknown running state, and judge whether the behavior of the unknown virtual machine is normal.

Further, the initial time t ₀ in the step (1.1) is a positive real number.

Further, Δt in the step (1.2) is a positive real number.

Further, in the step (1.2), normal samples can be obtained by using commonly used memory mirroring means; for malicious samples, a shared space is opened for all heterogeneous executables to store different types of malicious tool samples, and all heterogeneous The configuration of the execution body of the structure simulates the intrusion environment, so as to obtain the memory image data when the virtualization platform is attacked by different types.

Further, the 26 elements in the three-dimensional neighborhood of an element in the step (3.3) refer to 8 elements on the same scale as the element and 9 elements in two scale layers above and below it.

Further, the preset threshold in the step (3.4) depends on the number of features to be identified, and the higher the threshold is set, the fewer features can be identified.

Further, the deep neural network in the step (4) is any existing deep neural network structure.

The beneficial effects of the present invention are: the present invention utilizes the memory mirroring data analysis and deep learning mechanism to analyze the behavior attributes of the virtual machine through the encoding features of the memory mirroring data; compared with the existing virtual platform state analysis method, the present invention is simple in operation and easy to implement , which is convenient for modularization; the present invention has a wide application range and can be used to detect various attack methods such as known attacks and unknown attacks. The invention has good robustness, reliability and usability on different system platforms.

Description of drawings

Fig. 1 is a schematic diagram of a system model in an embodiment of the present invention;

Fig. 2 is a flow chart of the method of the present invention.

Detailed ways

The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and examples.

Considering that the memory image data can completely represent the running state of a virtual machine, the present invention uses the memory image data and combines with the deep neural network to propose a virtual machine behavior analysis system based on deep learning and memory image analysis.

As shown in accompanying drawing 1, the system model of this embodiment is: run multiple operating systems on a virtual platform, including WinServer, Ubuntu, CentOS, RedHat. By manually importing backdoors and virus malicious tool databases into each operating system, the memory mirror data of each system when it is not attacked and the memory mirror data after being attacked by different types can be obtained at any time. This method will use these data to extract memory data features through memory map coding, and then use the memory features to judge whether the behavior state of the virtual machine is under attack. The process is shown in Figure 2, which specifically includes the following steps:

Step 1. Obtain memory mirroring data; the specific process is as follows:

(1) At the initial time t ₀ =0, use the memory forensics tool to obtain the initial memory image data;

(2) After Δt = 1 time, on VirtualBox and VMware virtualization platforms, according to the memory management mechanism of different operating systems, automatically sample the memory of each isomer in the normal state (not attacked) and under attack at the current moment Mirror data, that is, normal samples and malicious samples. For normal samples, common memory mirroring methods can be used; for malicious samples, a shared space is opened for all heterogeneous executables to store different types of malicious tool samples, and a simulated intrusion environment is configured for all heterogeneous executables to obtain a virtual Memory image data when the platform is attacked by different types;

Step 2, perform delta encoding; the specific process is as follows:

(1) Run the memory forensics tool, and use the pslist and dlllist commands on the initialized memory to determine the executable file of the EXE type and the dynamic link library list of the DLL type in the initialized memory;

(2) Run the pslist and dlllist commands in the memory forensics tool on the current memory to determine the executable file of the EXE type and the dynamic link library list of the DLL type in the current memory;

(3) analyze the EXE/DLL list obtained in the previous two steps, and determine the executable (portable executable, PE) file in the current memory but not in the initial memory;

(4) Generate a prediction memory for each new PE according to the initial memory;

a) determine the process ID of each new PE, and determine the base address of the process in the virtual memory address space;

b) For the process of each new PE, run the memmap command in the memory forensics tool in the current memory to extract the mapping relationship between the virtual memory and the physical memory of the process;

c) Copy the new PE from the corresponding file on the virtual disk to the initial memory; for each virtual memory page of the PE file, perform the following two steps: first, if the page is in the current memory, use step 2 (4) The virtual memory and physical memory mapping relationship obtained in b) copy the PE file into the initial memory; second, record the page copy information, including the source page position in the PE file, the target page position in the physical memory, and the page length;

(5) output header information, including the path information of the new PE to be loaded and all copied pages of each PE;

(6) Using the predicted memory as the source and the current memory as the comparison object, use xdelta3 encoding to obtain the memory map after encoding the current memory image data; use M and N to represent the number of rows and columns of the map respectively, and use I(i, j)=[a,b,c] means the element in row i and column j of the map, 0≤i<M, 0≤j<N, a, b, and c are all 32-bit floating point numbers, I(i, j) is a three-dimensional vector;

Step 3. Extract the feature point information of the memory map, including the feature point position, feature point size, and feature strength of the feature point; the specific process is as follows:

(1) Construct the Hessian matrix;

The Hessian matrix is the core operator of the feature extraction algorithm. The Hessian matrix H of any binary function f(x,y) is expressed as:

Express the eigenvalues of f(x,y) by the determinant of matrix H:

For the feature extraction process, in order to speed up the calculation speed in practical applications, an approximate method is used to solve the Hessian matrix, and the determinant calculation of the Hessian matrix H(i, j) corresponding to the element in the i-th row and j-th column in the memory image map for:

det(H(i,j))=D _ii ·D _jj -0.9D _ij ·D _ij ;

Among them, represents the vector dot product, that is, the sum of the product of each element, D _ii =I(i+1,j)+I(i-1,j)-2I(i,j), D _jj =I(i,j) j+1)+I(i,j-1)-2I(i,j), D _ij =I(i+1,j)+I(i,j-1)-2I(i,j);

Do the above calculations for each element in the memory image map, and obtain the determinant of the Hessian matrix corresponding to each pixel in the map, that is, the eigenvalue of the pixel;

(2) Construct scale space;

Scale space is the representation of a map at different resolutions; in order to simulate the multi-scale characteristics of image data, find extreme points in the space domain and scale domain, and determine preliminary feature points, it is necessary to construct a scale space for the map. The repeated binary function and the Gaussian function kernel convolution construct the eigenvalues of the map on different scale domains;

This patent adopts the method of SURF to construct the scale space; for any memory image map, the size of the original image is kept unchanged, and the original image is filtered by changing the size of the template box to construct the scale space; at the same time, SURF can use parallel computing, Simultaneously process the images of each layer in the scale space; through the convolution of the gradually increasing box size filter template and the integral image, the response image is obtained from the determinant of the Hessian matrix corresponding to each pixel, and a pyramid is constructed;

First, the response image obtained by the 9×9 box filter is used as the bottom image, and then the size of the box is gradually increased, and the original image is continued to be filtered; the scale space is divided into 4 layers, and the scaling between layers The ratio is 2, and each layer contains filter response maps of different scales; each layer is processed with a gradually increasing filter size to obtain a series of maps of different scales containing multiple layers;

(3) Accurate positioning of feature points;

In each 3×3×3 local area, non-maximum suppression is performed; for each pixel, it is performed with 8 points on the same scale and 9 points in the two scale layers above and below it. In comparison, only extreme points that are larger or smaller than the surrounding 26 field values can be used as feature points, and record the feature point position (i, j) and scale s;

(4) Determine the feature points and feature vectors of the map according to the threshold;

For each feature point obtained in the previous step, compare the feature value of the point at the corresponding scale with the preset threshold. If the corresponding eigenvalue is less than the preset threshold, the point cannot be used as a feature point; if the corresponding eigenvalue is greater than or equal to the preset threshold, the point can be used as the final feature point, and the feature vector is expressed as [i, j, s ,det(H(i,j,s))], where i, j are the row number and column number of the feature point in the map, s is the corresponding filter scale when the point can be used as a feature point, det( H(i,j,s)) is the eigenvalue of the point at scale s;

(5) Statistical feature vector;

For the feature vector obtained in the previous step, according to its source, that is, from the unattacked memory image data or the attacked memory image data, determine the corresponding label z for each feature vector, and use z=0 to indicate the source of the feature vector For the memory image data that is not attacked, use z=1 to represent that the feature vector comes from the memory image data that is attacked;

So far, the delta-encoded memory map is extracted through feature extraction, and the memory map is abstracted into a specific coded sequence of labeled feature vectors;

Step 4, train the neural network;

An input sample of a deep neural network is expressed as [i, j, s, det(H(i, j, s)), z]; a classifier is obtained by training an existing deep neural network structure, which is used in practice Runtime analysis of unknown virtual machine behavior;

Step 5. Run the neural network to analyze unknown virtual machine behaviors;

Use the neural network trained in step 4 to analyze the virtual machine whose running status is unknown, and judge whether the behavior of the unknown virtual machine is normal.

The above is an embodiment of the present invention, and the present invention is not limited by the above embodiment, and a specific implementation method can be determined by combining the technical solutions of the present invention with actual application scenarios.

Claims (7)

1. A virtual machine behavior analysis system based on deep learning and memory mirroring analysis, characterized in that, comprising the following steps: (1) Obtain memory mirroring data, including the following sub-steps: (1.1) At the initial time t ₀ , use the memory forensics tool to obtain the initial memory image data, and obtain the initial memory. (1.2) At any time t ₀ +Δt, on VirtualBox and VMware virtualization platforms, according to the memory management mechanisms of different operating systems, automatically sample the memory image data of each isomer at the current moment when it is not attacked or under attack. , to get the current memory, that is, normal samples and malicious samples. (2) Carry out delta encoding, including the following sub-steps: (2.1) Run the memory forensics tool, use the pslist and dlllist commands on the initial memory obtained in step (1.1), and determine the executable file of the EXE type and the dynamic link library list of the DLL type in the initial memory respectively. (2.2) pslist and dlllist commands in the current memory operation memory forensics tool that step (1.2) obtains determine the executable file of the EXE type and the dynamic link library list of the DLL type in the current memory respectively; (2.3) The executable file of EXE type and the dynamic link library list of DLL type obtained by analysis steps (2.1) and (2.2), determine the executable file in the current memory but not in the initial memory, called new executable file ; (2.4) According to the initial memory, generate a predicted memory for each new executable file, including the following sub-steps: (2.4.1) determine the process ID of each new executable file, determine the base address of this process in the virtual memory address space simultaneously; (2.4.2) For the process of each new executable file, according to the process base address in step (2.4.1), run the memmap command in the memory forensics tool in the current memory to extract the mapping between the process virtual memory and physical memory relation; (2.4.3) Copy the new executable file from the virtual disk to the initial memory. For each virtual memory page of the new executable file, perform the following two steps: first, the virtual memory page is in the current memory, use the step The mapping relationship between virtual memory and physical memory extracted in (2.4.2), copy the new executable file to the initial memory; then, record the page copy information, including the source page position of the virtual memory page and the target page position in the physical memory , page length; finally generate prediction memory; (2.5) output header information, including the path information of the new executable file that needs to be loaded and the page copy information of all new executable files extracted in the step (2.4.3); (2.6) Use the predicted memory generated in step (2.4) as the source, and the current memory as the comparison object, and use xdelta3 encoding to obtain the memory map after encoding the current memory image data; use M and N to represent the number of rows and columns of the memory map respectively , use I(i,j)=[a,b,c] to represent the elements of row i and column j of the memory map; among them, 0≤i<M, 0≤j<N, a, b, c are all 32 Bit floating-point number, I(i,j) is a three-dimensional vector; (3) The feature point information of the memory map obtained in the extraction step (2.6), including the feature point position, the feature point size, and the feature strength of the feature point, including the following sub-steps: (3.1) Construct the Hessian matrix, specifically: calculate the determinant of the Hessian matrix H(i, j) corresponding to each element in the memory map, as the eigenvalue of the element, the calculation formula is: det(H(i,j))＝D _ii ·D _jj -0.9D _ij ·D _ij Among them, D _ii =I(i+1,j)+I(i-1,j)-2I(i,j), D _jj =I(i,j+1)+I(i,j-1) -2I(i,j), D _ij =I(i+1,j)+I(i,j-1)-2I(i,j); (3.2) Use SURF to construct the scale space: first use a 9×9 box filter to filter the original image of the memory map as the bottom image; then gradually increase the size of the box filter to filter the original image of the memory map Continue the filtering process; finally obtain filter response maps of different scales, and construct a scale space; the scale space has 4 layers, and the scaling ratio between layers is 2; (3.3) Accurately locate feature points, specifically: in each local region of 3×3×3, perform non-maximum suppression on the scale space constructed in step (3.2); combine each element in the scale space with its three-dimensional neighborhood Compare the eigenvalues of the 26 elements, and the elements whose eigenvalues are larger or smaller than the surrounding 26 elements are feature points, and record the feature point position (i, j) and scale s; (3.4) Determine the map feature points and feature vectors according to the threshold, specifically: compare the feature value of each feature point obtained in step (3.3) at the corresponding scale with the preset threshold, if the corresponding feature value is less than the preset threshold , then the feature point is not used as the final feature point; if the corresponding feature value is greater than or equal to the preset threshold, the feature point is used as the final feature point, and the feature vector is expressed as [i,j,s,det(H(i, j,s))]; where i, j are the row number and column number of the final feature point in the memory map, s is the filter scale corresponding to the final feature point, det(H(i,j,s)) is The feature value of the final feature point at scale s; (3.5) Statistical feature vectors, specifically: the source of the feature vector obtained in the judgment step (3.4), said source including the memory mirror data under the unattacked situation and the memory mirror data under the attacked situation in the step (1.2); Determine the label z corresponding to each eigenvector, use z=0 to indicate that the eigenvector comes from the memory image data under the unattacked situation, and use z=1 to indicate that the eigenvector comes from the memory image data under the attacked situation; finally Get the feature vector sequence [i,j,s,det(H(i,j,s)),z]; (4) training the neural network, specifically: using the feature vector sequence obtained in step (3.5) as the input sample of the deep neural network, and whether the behavior of the virtual machine is normal is output, and training the deep neural network to obtain a virtual machine behavior classifier; (5) Run the neural network to analyze the behavior of the unknown virtual machine, specifically: use the virtual machine behavior classifier obtained in step (4) to analyze the virtual machine with an unknown running state, and judge whether the behavior of the unknown virtual machine is normal. 2. The virtual machine behavior analysis system based on deep learning and memory mirroring analysis according to claim 1, characterized in that, in the step (1.1), initial time t ₀ is a positive real number. 3. The virtual machine behavior analysis system based on deep learning and memory mirroring analysis according to claim 1, wherein Δt in the step (1.2) is a positive real number. 4. The virtual machine behavior analysis system based on deep learning and memory mirroring analysis according to claim 1, characterized in that, in the step (1.2), for normal samples, it can be obtained by using commonly used memory mirroring means; for malicious Samples, open up a shared space for all heterogeneous executables to store different types of malicious tool samples, and configure simulated intrusion environments for all heterogeneous executables, so as to obtain memory image data when the virtualization platform is attacked by different types. 5. The virtual machine behavior analysis system based on deep learning and memory mirroring analysis according to claim 1, wherein the 26 elements in the three-dimensional neighborhood of an element in the step (3.3) are on the same scale as the element 8 elements of and 9 elements of the two scale layers above and below it. 6. The virtual machine behavior analysis system based on deep learning and memory mirroring analysis according to claim 1, wherein the preset threshold in the step (3.4) depends on the number of features to be identified, and the higher the threshold is set , the fewer features can be identified. 7. The virtual machine behavior analysis system based on deep learning and memory image analysis according to claim 1, wherein the deep neural network in the step (4) is any existing deep neural network structure.