CN104200162A - Computer program product for information security monitoring and defense and method thereof - Google Patents

Abstract

The invention discloses a computer program product for information security monitoring and defense and a method thereof. The method includes the following steps: first, retrieving program information of a program to be executed by a virtual machine through a virtual layer. Then, the program information is compared with the cache information. If they match, the program is judged to be a normal program. Furthermore, if the program information does not match the cache information, the program information is compared with the whitelist information. If it matches, the program information is compared with the cache information. When the list information is displayed, the program is judged to be a normal program. Next, if the program information does not match the whitelist information, the execution parameters of the program information are checked. If the program passes the check, it is determined that the program is a normal program. If it does not pass the check, the program is determined to be an abnormal program. Finally, if the program is an abnormal program, it is judged to perform security protection operations.

Description

Computer program product and method for information security monitoring and defense

【Technical field】

The present invention relates to a computer program product and method for information security monitoring and defense, in particular to a computer program product and method for information security monitoring and defense of a virtual machine that is set in a virtual layer.

【Background technique】

With the rapid development of network communication, network service providers have launched various cloud services. In order to save the cost of purchasing computer hardware devices, ordinary users and business owners gradually move the operations previously performed on personal computers to processing on cloud servers.

As cloud services have become an important part of e-commerce and electronic offices, hackers have gradually shifted the focus of their attacks to cloud servers. Due to the popularity of malicious program technology, malicious programs are quite rampant, and computer/server cause great harm. According to the research report of the international organization shadowserver, its organization can collect millions or even tens of millions of new malicious program samples every month, and has collected more than 200 million unique malicious program samples so far. And the domestic Trend Micro company also pointed out that it needs to analyze more than 40 million suspicious programs every day.

Traditional anti-virus software monitors the characteristics or behavior of a program to identify whether it is a malicious program. Turn off antivirus software before performing malicious activities. The traditional antivirus software has been unable to load the protection work. Therefore, how to provide an effective detection of changeable malicious programs is an urgent technical problem in this field.

【Content of invention】

In order to solve the above-mentioned technical problems of the conventional technology, the present invention provides a computer program product and method for information security monitoring and defense, so as to effectively perform virus protection operations.

To achieve the above purpose, the present invention provides a computer program product for information security monitoring and defense. The information security monitoring and defense computer program product is applied to a computer device, and the computer device provides at least one cloud virtual platform, and the cloud virtual platform matches a virtual layer (Hypervisor) and includes at least one virtual machine (Virtual Machine, referred to as VM). The authority of the virtual layer is higher than that of the virtual machine, and the computer program product includes at least one information collection module and a central control module. Each information collection module is respectively set on the virtual platform, and each information collection module retrieves the program information of the program to be executed by the virtual machine through the virtual layer. In addition to the connection information collection module, the central control module also includes a whitelist recording module, an information monitoring module, and an exception handling module. The white list recording module provides white list information, and the white list information is used to record the names of programs that are allowed to be executed. The information monitoring module is connected to the white list recording module, and executes: (1) comparing the program information with the cache information, if the program information matches the cache information, it is judged that the program is a normal program, and the cache information record is allowed to execute and For the program that has been executed, the cache information is the program that is temporarily stored and allowed to be executed; (2) If the program information does not match the cache information, compare the program information with a white list information set in the database of the computer device Yes, if the program information matches the whitelist information, the program is judged to be a normal program; (3) if the program information does not match the whitelist information, the execution parameters of the program information are checked, and if the check is passed, the program is judged to be a normal program, If the check fails, the program is judged to be an abnormal program. The exception processing module is a connection information monitoring module, and when the program is judged to be an abnormal program, it is judged to execute a security protection operation.

To achieve the above object, the present invention also provides a method for information security monitoring and defense, the method is applied to a computer device, the computer device provides at least one cloud virtual platform, the cloud virtual platform matches the virtual layer and includes at least one virtual machine, the virtual layer The authority of the virtual machine is higher than that of the virtual machine, and the method includes the following steps: firstly, the program information of the program to be executed by the virtual machine is captured through the virtual layer. Then, the program information is compared with the cache information, and if the program information matches the cache information, it is judged that the program described in the program information is a normal program, and the cache information is a program that is temporarily stored and allowed to be executed. Furthermore, when the program information does not match the retrieved information, the program information is compared with the white list information set in the database of the computer device, and if the program information matches the white list information, it is determined that the program is a normal program. Next, if the program information does not match the whitelist information, the execution parameters of the program information are checked, and if the check is passed, the program is judged to be a normal program, and if the check is not passed, the program is judged to be an abnormal program. Finally, if the program is judged as an abnormal program, it is judged whether to execute the security protection operation.

To sum up, since the present invention monitors and defends information at the virtual layer with higher authority than the virtual machine, no matter if the virus in the virtual machine wants to evade detection through encryption, packing, deformation and other technologies, the present invention can Effective monitoring and prevention.

【Description of drawings】

Fig. 1 is the block diagram of the computer program product of information security monitoring and defense of the present invention;

Fig. 2 is a flowchart of the information security monitoring and defense method of the present invention.

Explanation of reference signs

1. Computer program products for information security monitoring and defense;

11. Central control module;

111. Whitelist recording module;

112. Information monitoring module;

113. Exception handling module;

12. Information collection module;

121. Memory information analysis module;

122. File system analysis module;

2. Cloud virtual platform;

21. Virtual machine;

S101-S105, steps.

【Detailed ways】

The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

Please refer to FIG. 1 , which is a computer program product for information security monitoring and defense according to the present invention. The computer program product 1 for information security monitoring and defense is applied to a computer device. The computer device provides at least one cloud virtual platform 2 . The cloud virtual platform 2 matches a virtual layer and includes at least one virtual machine 21 . And the authority of the virtual layer is higher than that of the virtual machine 21, and the virtual machine 21 and the cloud virtual platform 2 are set outside the computer program product 1 for information security monitoring and defense. The computer program product 1 for information security monitoring and defense includes at least one information collection module 12 and a central control module 11 . Each information collection module 12 is respectively installed on the cloud virtual platform 2 , and each information collection module 12 retrieves the program information of the program to be executed by the matching virtual machine 21 through the virtual layer. The central control module 11 is connected to the information collection module 12 and includes a whitelist recording module 111 , an information monitoring module 112 and an exception handling module 113 . The white list recording module 111 provides white list information, and the white list information records the names of programs that are allowed to be executed. The information monitoring module 112 is connected to the whitelist recording module 111, and the information monitoring module 112 executes:

(1) Comparing the program information with the cache information, if the program information matches the cache information, it is judged that the program is a normal program, and the cache information is a program that is allowed to be executed by the temporary storage record and has been executed;

(2) If the program information does not match the cache information, compare the program information with the white list information set in the database of the computer device, and if the program information matches the white list information, it is determined that the program is a normal program;

(3) If the program information does not match the white list information set in the database, the execution parameters of the program information are checked. If the check is passed, the program is judged to be a normal program, and if the check is not passed, the program is judged to be an abnormal program.

The exception processing module 113 is connected to the information monitoring module 112 , and the exception processing module 113 judges whether to perform a security protection operation when the program is determined to be an abnormal program.

The white list information includes a plurality of program record information, and each record information includes name information of the allowed program, information about the execution file path of the program, loading file information, file hash value (hash) or date information. The inspection items for the execution parameters of the program information include: (1) Check the memory content of the new program, (2) Check the loaded file, (3) Check whether it is a malicious hidden program, (4) Check whether it is implanted with a malicious program. program code, and (5) checking whether each section of the memory is normal. The security protection operation includes isolating the network operation, terminating the malicious program execution operation, or suspending the execution operation of the virtual machine 21 .

The information collection module 12 includes a memory information analysis module 121 and a file system analysis module 122 . The memory information analysis module 121 analyzes the name information of the program to be loaded, the original file path information, and the loaded file information in the memory of the computer device, so as to configure the aforementioned program information. The file system analysis module 122 further analyzes the date information, MD5 of the file system of the virtual machine 21 executed or loaded into the file according to the program information (program name information, file path information, and loaded file information) of the memory information analysis module 121. Hash value, or digital signature information, etc.

Please refer to FIG. 2 , which is an information security monitoring and defense method of the present invention, which is applied to a computer device. The computer device provides at least one cloud virtual platform 2 , and each cloud virtual platform 2 matches a virtual layer and includes at least one virtual machine 21 . The authority of the virtual layer is higher than that of the virtual machine 21, and the information security monitoring and defense method includes the following steps:

S101: Discover a new execution program.

S102: Capture program information of a program to be executed by the virtual machine through the virtualization layer.

S103: Compare the program information with the cache information, if the program information matches the cache information, it is judged that the program described in the program information is a normal program, and jump to step S106, the cache information is allowed by the temporary storage record A program that is executed and has been executed.

S104: If the program information does not match the cache information, compare the program information with the whitelist information set in the database of the computer device, if the program information matches the whitelist information, it is judged that the program is a normal program, and skip to step S106 .

S105: If the program information does not match the white list information set in the database, then check the execution parameters of the program information and its memory content information, if the check is passed, it is judged that the program is a normal program, and skip to step S106; if not Checking means judging that the program is an abnormal program, and jumping to step S107

S106: Treat the program as a normal program.

S107: regard the program as an abnormal program, and skip to S108.

S108: Determine whether to execute a security protection operation.

Please refer to FIG. 1 and FIG. 2 together, which is an embodiment of the present invention. The computer program product 1 for information security monitoring and defense of the present invention utilizes the characteristics of the cloud virtual platform to set the computer program product on the virtual layer with high authority of the server, so as to obtain the running state, memory content, file system and other information.

The computer program product adopts a many-to-one Client-Server architecture, and can be divided into a central control module 11 (Server side) and an information collection module 12 (Client side) set on a virtual platform. The central control and management module 11 is an application software module, and the central control and management module 11 can be installed in the server, the virtual layer of the server, or further installed in the virtual machine 21 (Virtual Appliance), when the computer program product starts to operate At this time, the information collection module 12 monitors the temporary register (Register) of the server processor by combining the virtual layer, such as the change of CR3, etc., to know in real time whether the virtual machine 21 has a program to execute or a new initial execution program, and then Retrieves program information for a program. After retrieval, it will first check whether there is a program that is allowed to execute and has been executed in the cache information of the server's temporary storage. If the retrieved program information matches the program in the cache information, the program will pass the inspection. . If it fails, then compare the program information with the whitelist information. If the program belongs to the trusted whitelist, and the content information of the program has not been changed or modified at all (such as program name, execution file path, loading file Information, file hash value, date and other information are all correct), then let this program pass the test and let it continue to execute, and this computer program product can be based on the user's security needs, and by assigning the information monitoring module 112, memory information analysis module 121, or the file system analysis module 122 performs advanced file inspection, such as checking whether the file digital signature of the program is legal, and deeply analyzing whether the file content associated with the program contains malicious behavior. If no abnormalities are found, continuously monitor the memory content corresponding to the program, including whether the relevant loaded files (DLL, Library, Module, etc.) are legal, whether they are malicious hidden programs, whether malicious program codes are implanted, and deeply analyze the memory Whether each section is normal.

The above-mentioned cache check, whitelist check, and advanced memory check for execution parameters, if any of the steps pass, it is considered a normal program, and if all of them fail to comply, it is considered an abnormal program. Through the inspection of this process, the deficiency that the existing anti-virus software cannot detect unknown viruses can be strengthened, and advanced persistent threats can be effectively prevented, and the virus signature code does not need to be continuously updated. When an exception is found, an alarm message will be sent through the exception processing module 113; and corresponding measures will be taken according to the user requirements of the virtual machine 21, such as: isolating the network, terminating the execution of malicious programs, and suspending the execution of the virtual machine 21 and other security protections.

The present invention uses the architecture of the cloud virtualization platform to monitor the virtual machine 21 operating system and running programs with low privileges in the virtual layer with high privileges. Compared with the traditional technology, the present invention has the following advantages:

Different from the traditional anti-virus mechanism installed in the operating system, the protection ability is easily disturbed by viruses (such as: viruses can use loopholes to obtain high authority of the operating system); and the present invention monitors outside the virtual machine, and the authority is higher than that of the virtual machine. operating system, so it is not affected by viruses.

The present invention can monitor the integrity of the virtual machine operating system, and prevent rootkit attacks in user & kernel mode (including Ring3 and Ring0 hooking, DKOM, etc.), so as to achieve perfect protection.

Using operating system memory analysis technology for virtual machines can effectively observe the actual operation status of programs in virtual machines and prevent viruses from using encryption, packing, deformation and other technologies to avoid detection. It can strengthen the inability of anti-virus software to detect unknown viruses, and effectively prevent advanced persistent threats.

The computer software product and the method thereof described in the present invention are installed on the virtual layer, so there is no need to individually install programs on the virtual machine 21, and it is not necessary to continuously update virus signatures.

The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but should not be construed as limiting the patent scope of the present invention. It should be pointed out that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent for the present invention should be based on the appended claims.

Claims (10)

1. the computer program of an information spy and defence, be applied to computer installation, described computer installation provides at least one high in the clouds virtual platform, described high in the clouds virtual platform matching virtual layer and comprise at least one virtual machine, the authority of described virtual level is higher than described virtual machine, and described virtual machine and described high in the clouds virtual platform are arranged at the outside of the computer program of information spy and defence, it is characterized in that, described computer installation program product comprises:

At least one information search module, is arranged at respectively described at least one high in the clouds virtual platform, and each described information search module is wanted the program information of executive routine via the described virtual machine of described virtual level acquisition coupling;

Central authorities' control module, connects described at least one information search module, and described central control module comprises:

White list logging modle, provides white list information, and described white list information record allows the program name of carrying out;

Information monitoring module, connects described white list logging modle, and described information monitoring module is carried out:

Described program information and cache information are compared, if described program information is matched with described cache information, judge that described program is normal procedure, described cache information recording permission is carried out and executed program, and described cache information is the program that temporary record allows execution and executed;

If described program information does not mate described cache information, described program information and the white list information that is arranged at described computer installation database are compared, if described program information mates described white list information, judge that described program is normal procedure;

If described program information does not mate the described white list information that is arranged at described database, the execution parameter of described program information is checked, if judge that by checking described program is normal procedure, if do not judge that by checking described program is abnormal program.

2. the computer program of information spy according to claim 1 and defence, it is characterized in that, the described white list information that is arranged at computer installation comprises a plurality of program recorded informations, the name information that each program recorded information comprises permission program, the execution file route information of program, is written into archive information, archives hashed value or date and time information.

3. the computer program of information spy according to claim 1 and defence, it is characterized in that, the described execution parameter to program information institute inspection item comprise check new procedures memory content, check whether be written into archives, check is malice concealing program, whether check implanted rogue program code, and check that whether each section of storer normal.

4. the computer program of information spy according to claim 1 and defence, it is characterized in that, described central management and control module also comprises abnormality processing module, described abnormality processing module link information monitoring module, described abnormality processing module is that abnormal program judges that carrying out security protection operates in program, and wherein said security protection operation comprises isolation network operation, termination rogue program executable operations or virtual machine and suspends executable operations.

5. the computer program of information spy according to claim 1 and defence, is characterized in that, each described information search module comprises:

Memorizer information analysis module, the program name information of wanting to be written in the storer of described memorizer information analysis module analytical calculation machine, former file route information, or be written into archive information, to configure described program information; And

Archives economy analysis module, described archives economy analysis module is analyzed program name information, the file route information in the storer of described computer installation and is written into archive information, and the performed archives of routine analyzer are positioned at date and time information, the MD5 hashed value of archives economy, or digital signature information.

6. an information spy and defence method, be applied to computer installation, described computer installation provides at least one high in the clouds virtual platform, described high in the clouds virtual platform matching virtual layer and comprise at least one virtual machine, the authority of described virtual level is higher than described virtual machine, it is characterized in that, information spy and defence method comprise the following step:

Want the program information of executive routine via the described at least one virtual machine of described virtual level acquisition;

Described program information and cache information are compared, if described program information is matched with described cache information, judge that the described described program of described program information is normal procedure, described cache information is the program that temporary record allows execution and executed;

If described program information when described cache information, is not compared described program information and the white list information that is arranged at described computer installation database, if described program information mates described white list information, judge that described program is normal procedure; And

If when described program information does not mate the described white list information that is arranged at described database, the execution parameter of described program information is checked, if judge that by checking described program is normal procedure, if do not judge that by checking described program is abnormal program.

7. information spy according to claim 6 and defence method, it is characterized in that, the described white list that is arranged at database comprises a plurality of program recorded informations, name information, Program path information, archives hashed value or date and time information that each described program recorded information comprises permission program.

8. information spy according to claim 6 and defence method, it is characterized in that, the project that the execution parameter of described program information is checked comprise check described program memory content, check whether be written into archives, check is malice concealing program, whether check implanted rogue program code, and check that whether each section of storer normal.

9. information spy according to claim 6 and defence method, it is characterized in that, be that abnormal program judges that carrying out security protection operates in described program further, described security protection operation comprises isolation network operation, termination rogue program executable operations or virtual machine and suspends executable operations.

10. information spy according to claim 6 and defence method, is characterized in that, described program information comprises:

Storer analytical information, records program name information, former file route information that the storer of described computer installation is wanted to be written into, maybe needs to be written into archive information; And

Archives economy analytical information, record program described in described computer installation file name information, carry out file route information, be written into archive information, date and time information, MD5 hashed value, or digital signature information.