| With the development of cloud computing, virtualization technology development become more and more quickly. Virtualization security is so important that virtualization security tool is an important guarantee of the virtualization application. But with the development of virtualization technology, the virtualization solution which becomes more and more functional and complicated is more diversified, the security of virtualization environment is also undergoing increasing pressure.Because of the unique characteristics of virtualization technology, the safety of virtualization technology is very different from the general host safety. The most important feature of virtualization is that it simulate real hosts, and relies on the presence of physical host. So, it’s safety should be considered not only about the virtual machine internal security, but also the virtualization external security. Thus virtualization application security faces more challenges.Aiming at the virtualization internal host security problems, this paper introduces the existing security tools and the open source products OSSEC. Based on these tools, this paper proposes a naive architecture. This architecture can ensure the virtualization internal security by combining virtualization platform and security detection technology and taking advantages of the isolation property, safety property and advantages of virtual machine communication mechanism in virtualization environment. This paper provides a security system based on virtualization and solution which can ensure the system security, and realizes a host intrusion detection system based on virtualization platform which is called VMHIDS, by using shared memory between the virtual machine realize a no network communication. The scheme solves the resources utilization during virtual machine internal installation of security software and system cost, it can also replace the traditional host-based client/server architecture. In addition, this scheme can satisfy safety testing in the virtualization environment within each virtual machine and ensure the minimum impact on the performance of the virtual machine. After modifying the source code of OSSEC, This paper realizes an intrusion detection system prototype system based on virtual machine. This paper introduces the framework of the system structure and the realization of each key links, and finally tests the whole system from two aspects-function and the performance. The results have proved that this system can be a very good solution in virtualization situation to solve its balance of performance and security. |
