关键词: 云计算, KVM虚拟化, 内核级Rootkit, 虚拟机自省, 安全加固

Abstract: Virtualization technology has been widely used in cloud computing environment, and its security is becoming more and more important. At present, malicious code attacks are developing in the direction of complexity, concealment, and persistence, which has become one of the important threats to cloud infrastructure in China.Especially in the context of the massive use of Linux and kernelbased virtual machine (KVM) virtualization in cloud data centers, its very important to research on detection and protection technologies of Linux kernel rootkit in KVM virtualization environment. However, the current research in this field mainly focuses on detecting, and lacks in response and protecting stage. To solve this problem, this paper proposes a security architecture that integrates kernellevel Rootkit security detection, response and active protection in KVM virtualization environment, and validates it in KVM virtualization platform. The results show that the security architecture can effectively detect and prevent attacks of kernellevel Rootkit in Guest virtual machine.

Key words: cloud computing, KVM virtualization, kernel Rootkit, virtual machine introspection, security reinforcement