一种基于虚拟化的文件杀毒实现方法

doi:10.13190/j.jbupt.2017-192

北京邮电大学学报 ›› 2018, Vol. 41 ›› Issue (2): 50-55.doi: 10.13190/j.jbupt.2017-192

一种基于虚拟化的文件杀毒实现方法

尹学渊¹, 陈兴蜀², 李辉¹, 陈林¹

1. 四川大学计算机学院, 成都 610065;
2. 四川大学网络空间安全研究院, 成都 610065

收稿日期:2017-09-20 出版日期:2018-04-28 发布日期:2018-03-17
作者简介:尹学渊(1988-),男,博士生;陈兴蜀(1968-),女,教授,博士生导师,E-mail:chenxsh@scu.edu.cn.
基金资助:
国家科技支撑计划项目（2012BAH18B05）；国家自然科学基金项目（61272447）

A Method to Implement File Antivirus Based on Virtualization

YIN Xue-yuan¹, CHEN Xing-shu², LI Hui¹, CHEN Lin¹

1. College of Computer Science, Sichuan University, Chengdu 610065, China;
2. Cybersecurity Research Institute, Sichuan University, Chengdu 610065, China

Received:2017-09-20 Online:2018-04-28 Published:2018-03-17

摘要/Abstract

摘要： 针对云计算环境下因虚拟机杀毒和病毒库更新等引发的性能开销及资源占用问题，提出了一种基于虚拟化的云杀毒实现框架——HyperAV，HyperAV能够在较低性能开销的情况下对虚拟机文件进行杀毒，并提供扇区级别的访问控制和隔离机制.通过获取虚拟机运行过程中的扇区更改信息，HyperAV优化了文件病毒的扫描方式，对虚拟机杀毒过程起到了显著加速效果.HyperAV实现了控制-杀毒相互分离的前后端框架，杀毒所需数据可以导入专用杀毒服务集群，从而避免了病毒库的重复更新，解决了因杀毒而使虚拟机运行缓慢的问题.在基于内核的虚拟机虚拟化平台下实现了原型系统.实验结果表明，HyperAV能够在虚拟机较低负载开销的情况下为虚拟机文件提供病毒扫描防护能力.

关键词: 云计算, 虚拟化, 虚拟机, 杀毒

Abstract: To solve the performance overhead and resource consumption brought by an antivirus software when performing operations of virus scanning and virus database updating, an antivirus framework named HyperAV based on virtualization was proposed. HyperAV was able to provide antivirus capability for virtual machine files with low performance overhead, a mechanism of access control and isolation at the granularity of sector level was also provided. The process of virus scanning was optimized by monitoring the sector change information of a running virtual machine, which had a significant acceleration effect to the virus scanning process of virtual machines. HyperAV was constructed by a front and a rear end with each used as a controller and an antivirus worker, the data needed by antivirus software was redirected to server clusters so that duplications of virus database updating could be avoided, and performance overload brought by antivirus software running inside virtual machines was avoided. A prototype system based on kernel-based virtual machine virtualization platform was realized, the results showed that HyperAV was able to provide antivirus capability with low performance overload for virtual machines.

Key words: cloud computing, virtualization, virtual machine, antivirus

中图分类号:

TP316

尹学渊, 陈兴蜀, 李辉, 陈林. 一种基于虚拟化的文件杀毒实现方法[J]. 北京邮电大学学报, 2018, 41(2): 50-55.

YIN Xue-yuan, CHEN Xing-shu, LI Hui, CHEN Lin. A Method to Implement File Antivirus Based on Virtualization[J]. JOURNAL OF BEIJING UNIVERSITY OF POSTS AND TELECOM, 2018, 41(2): 50-55.

参考文献

[1] Islam T, Manivannan D, Zeadally S. A classification and characterization of security threats in cloud computing[J]. International Journal of Next-Generation Computing, 2016, 7(1):1-17.
[2] Khari M, Gupta S, Kumar M. Security outlook for cloud computing:a proposed architectural-based security classification for cloud computing[C]//2016 International Conference on Computing for Sustainable Global Development (INDIACom). NJ:IEEE, 2016:2153-2158.
[3] Khurana R, Gupta H. A hybrid model on cloud security[C]//20165^th International Conference on Reliability, Infocom Technologies and Optimization (ICRITO) (Trends and Future Directions). NJ:IEEE, 2016:347-352.
[4] Chen Lin, Chen Xingshu, Jiang Junfang, et al. Research and practice of dynamic network security architecture for IaaS platforms[J]. Tsinghua Science and Technology, 2014, 19(5):496-507.
[5] 俞能海, 郝卓, 徐甲甲, 等. 云安全研究进展综述[J]. 电子学报, 2013, 41(2):371-381. Yu Nenghai, Hao Zhuo, Xu Jiajia, et al. Review of cloud computing security[J]. Acta Electronica Sinica, 2013, 41(2):371-381.
[6] 金鑫, 陈兴蜀. 可信链跨物理主机迁移及快速恢复方法[J]. 武汉大学学报(理学版), 2016(2):103-109. Jin Xin, Chen Xingshu. Rapid restoration of migrated trusted chain between physical machines[J]. Journal of Wuhan University (Natural Science Edition), 2016(2):103-109.
[7] Zhang Lei, Chen Xingshu, Liu Liang, et al. Trusted domain hierarchical model based on noninterference theory[J]. The Journal of China Universities of Posts and Telecommunications, 2015, 22(4):7-16.
[8] Oberheide J, Cooke E, Jahanian F. Rethinking antivirus:executable analysis in the network cloud[C]//2^nd USENIX Workshop on Hot Topics in Security (HotSec 2007). Berkeley:USENIX, 2007:1-5.
[9] Zheng Xufei, Fang Yonghui. An ais-based cloud security model[C]//2010 International Conference on Intelligent Control and Information Processing. NJ:IEEE, 2010:153-158.
[10] Oberheide J, Cooke E, Jahanian F. CloudAV:N-version antivirus in the network cloud[C]//USENIX Security Symposium. Berkeley:USENIX, 2008:91-106.
[11] Nachenberg C. Antivirus accelerator:U. S, 6021510[P]. 2000-02-01.
[12] McAfee. McAfee management for optimized virtual environments AntiVirus[EB/OL].[2017-03-24]. https://www.mcafee.com/cn/resources/data-sheets/ds-move-anti-virus.pdf.
[13] Kivity A, Kamay Y, Laor D, et al. KVM:the Linux virtual machine monitor[C]//Proceedings of the Linux Symposium. Ottawa:USENIX, 2007:225-230.
[14] Uhlig R, Neiger G, Rodgers D, et al. Intel virtualization technology[J]. Computer, 2005, 38(5):48-56.
[15] Bellard F. QEMU, a fast and portable dynamic translator[C]//USENIX Annual Technical Conference, FREENIX Track. Berkeley:USENIX, 2005:41-46.
[16] McLoughlin M. The QCOW2 image format[EB/OL]. Orinda:GNOME Foundation, 2008[2017-03-24]. https://people.gnome.org/~markmc/qcow-image-format.html.
[17] ClamAV. ClamAV official website[EB/OL].[2018-1-6]. https://www.clamav.net/.

一种基于虚拟化的文件杀毒实现方法

A Method to Implement File Antivirus Based on Virtualization

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	孔紫璇李航向万陈亚文郑伟. 用户动态接入下的多播业务链部署和调整方法[J]. 北京邮电大学学报, 2022, 45(6): 55-61.
[2]	贾雨宁, 魏翼飞, 周军华. 基于SDN与NFV的服务功能链编排算法[J]. 北京邮电大学学报, 2022, 45(2): 85-90.
[3]	张志华, 王梦情, 毛文涛, 刘春红, 程渤. 基于时序相关性的云平台多负载序列联合预测[J]. 北京邮电大学学报, 2020, 43(4): 68-75.
[4]	岳毅, 程渤. 面向终端用户的轻量级网络功能虚拟化服务编排环境[J]. 北京邮电大学学报, 2019, 42(4): 24-31.
[5]	赵国喜, 金顺福, 马聪变, 曹建宇, 许利军. 服务台数量可变的云服务系统分析[J]. 北京邮电大学学报, 2019, 42(4): 114-120.
[6]	易芝玲, 崔春风, 韩双锋, 潘成康, 陈亚迷. 5G蜂窝物联网关键技术分析[J]. 北京邮电大学学报, 2018, 41(5): 20-25.
[7]	唐宏伟, 冯圣中, 赵晓芳. TOChain:一种高性能虚拟网络安全服务功能链[J]. 北京邮电大学学报, 2018, 41(1): 70-80.
[8]	张淑慧, 孟祥旭, 王连海, 徐淑奖. 基于内存自省技术的虚拟化安全防护模型[J]. 北京邮电大学学报, 2017, 40(s1): 43-47.
[9]	朱晓宁, 孙斌, 朱春鸽. 大规模云资源可靠性评价模型[J]. 北京邮电大学学报, 2017, 40(s1): 53-57.
[10]	徐九韵, 管超, 江丹. 一种面向信誉主观性和时变性的云服务信任管理方法[J]. 北京邮电大学学报, 2017, 40(5): 30-35.
[11]	刘世栋, 王瑶. 一种网络虚拟化环境下的动态探测站点选择算法[J]. 北京邮电大学学报, 2016, 39(s1): 1-5.
[12]	张俊贤, 李舟军. 基于动态符号执行的C代码缓冲区溢出检测[J]. 北京邮电大学学报, 2016, 39(s1): 50-54.
[13]	刘靖, 吴海博, 王少帅, 贾垒. 着色Petri网模型驱动的云测试生成方法与实现[J]. 北京邮电大学学报, 2016, 39(5): 89-93,115.
[14]	肖丁, 贾亚璞, 石川. 云计算环境下的非线性能耗建模方法[J]. 北京邮电大学学报, 2016, 39(1): 107-111.
[15]	郭力争, 张翼飞, 赵曙光. 数据中心环境下能耗性能感知的优化方法[J]. 北京邮电大学学报, 2015, 38(s1): 72-76.