WO2025066589A1 - Host machine, virtualization instance introspection method, and storage medium - Google Patents

Abstract

Embodiments of the present disclosure provide a host machine, a virtualization instance introspection method, and a storage medium. A kernel address space of a virtualization instance is mapped to a user mode address space of a host machine, so that the user mode address space of the host machine stores kernel data and kernel functions corresponding to the virtualization instance. In response to a security check request, on the basis of a memory mapping relationship between the kernel address space of the virtualization instance and the user mode address space of the host machine, a virtualization manager may obtain kernel data associated with the security check request from the user mode address space of the host machine, and provide the kernel data to a security check program deployed on the host machine outside the virtualization instance. In this way, the security check program can obtain the kernel data of the virtualization instance, that is, obtain semantics of an operating system level of the virtualization instance, which fills the semantic gap between a virtual machine and the virtualization instance, and realizes the virtualization instance introspection across the semantic gap.

Description

Host machine, virtualization instance introspection method and storage medium

This disclosure claims the priority of the Chinese patent application filed with the China Patent Office on September 26, 2023, with application number 202311249724.5 and application name “Host machine, virtualization instance introspection method and storage medium”, the entire contents of which are incorporated by reference in this disclosure.

Technical Field

The present disclosure relates to the technical field of cloud computing, and in particular to a host machine, a virtualization instance introspection method, and a storage medium.

Background Art

In recent years, with the widespread application of cloud computing and virtualization technology, multiple virtual machines can be deployed on a host to provide a variety of services for different users. Various security issues have gradually been exposed. Compared with traditional physical hosts, the impact of security threats on virtual machines has increased, and the security issues of virtual machines should be paid more attention.

Virtual Machine Introspection (VMI) is a method used in virtualized environments to enhance the security of virtual machines from outside the virtual machine. This technology can perform security operations such as antivirus and network firewall by directly scanning the memory and disk of the virtual machine while it is running and monitoring network behavior.

Among them, the security detection software runs on the host machine outside the virtual machine. Compared with the traditional detection solution running inside the virtual machine, the security of the security detection software is no longer affected by the virtual machine environment. Even if the virtual machine is invaded, the security detection software can still execute normally based on the isolation between the host machine and the virtual machine. However, the isolation between the host machine and the virtual machine also increases the difficulty of implementing virtual machine introspection technology, which brings great challenges to the application of virtual machine introspection technology to enhance virtual machine security.

Summary of the invention

Multiple aspects of the present disclosure provide a host machine, a virtualization instance introspection method, and a storage medium to implement virtualization instance introspection across a semantic gap.

In a first aspect, an embodiment of the present disclosure provides a host machine, on which a virtualization manager, a virtualization instance managed by the virtualization manager, and a security detection program located outside the virtualization instance are deployed; the virtualization manager provides a security detection service interface to the security detection program to interact with the security detection program;

The virtualization manager is used to map the kernel address space of the virtualization instance to a target address space in the user state address space of the host machine, wherein the target address space stores kernel data and kernel functions corresponding to the virtualization instance; and

receiving a security detection request sent by the security detection program, obtaining a target data object associated with the security detection request from the target address space based on a memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine, wherein the target data object includes at least part of the kernel data of the virtualization instance, and providing the target data object to the security detection program for the security detection program to detect the target data object based on the target address space. The target data object performs security detection on the virtualized instance.

In a second aspect, an embodiment of the present disclosure further provides a virtualization instance introspection method, which is applied to a virtualization manager deployed on a host machine, wherein a virtualization instance corresponding to the virtualization manager and a security detection program are also deployed on the host machine, and a kernel address space of the virtualization instance is mapped to a target address space in a user state address space of the host machine; the method comprises:

Receiving a security detection request sent by the security detection program;

Based on a memory mapping relationship between the kernel address space of the virtualized instance and the user state address space of the host machine, obtaining a target data object associated with the security detection request from the target address space, wherein the target data object includes at least part of the kernel data of the virtualized instance;

The target data object is provided to the security detection program so that the security detection program performs security detection on the virtualization instance based on the target data object.

In a third aspect, an embodiment of the present disclosure further provides a virtualization instance introspection method, which is applied to a security detection program deployed on a host machine, wherein a virtualization manager and a virtualization instance are also deployed on the host machine, and a kernel address space of the virtualization instance is mapped to a target address space in a user state address space of the host machine; the method comprises:

According to the security detection requirement for the virtualized instance, a target virtualized instance introspection mode is selected from a plurality of virtualized instance introspection modes;

Generate a security detection request according to the identifier of the introspection mode of the target virtualization instance;

Sending the security detection request to the virtualization manager, so that the virtualization manager obtains a target data object associated with the security detection request from the target address space based on a memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine and an identifier of the introspection mode of the target virtualization instance, wherein the target data object includes at least part of the kernel data of the virtualization instance;

The target data object returned by the virtualization manager is received, and security detection is performed on the virtualization instance according to the target data object.

In a fourth aspect, an embodiment of the present disclosure further provides an electronic device, which can be implemented as a host machine, on which a virtualization manager, a virtualization instance managed by the virtualization manager, and a security detection program located outside the virtualization instance are deployed; the virtualization manager provides a security detection service interface to the security detection program to interact with the security detection program;

The electronic device also includes: a memory and a processor; the memory stores the program code corresponding to the virtualization manager and the security detection program; wherein the processor is coupled to the memory, and is used to execute the program code corresponding to the virtualization manager to implement the steps in the host introspection method provided in the second aspect of the present disclosure; and is used to execute the security detection program to implement the steps in the host introspection method provided in the third aspect of the present disclosure.

In a fifth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, causes the one or more processors to execute the steps in the above-mentioned virtualization instance introspection method.

In a sixth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which implements the steps in the above-mentioned virtualization instance introspection method when executed by a processor.

In the disclosed embodiment, by mapping the kernel address space of the virtualized instance to the user-state address space of the host machine, the host machine's user-state address space can store kernel data and kernel functions corresponding to the virtualized instance. When responding to a security detection request, the virtualization manager can obtain the kernel data associated with the security detection request from the host machine's user-state address space based on the memory mapping relationship between the kernel address space of the virtualized instance and the host machine's user-state address space, and provide it to a security detection program on a host machine deployed outside the virtualized instance, so that the security detection program can obtain the kernel data of the virtualized instance, that is, obtain the semantics of the virtualized instance at the operating system level, thereby bridging the semantic gap between the virtual machine and the virtualized instance, and realizing virtualized instance introspection across the semantic gap.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

FIG1 is a schematic diagram of the internal system structure of a host machine provided by an embodiment of the present disclosure;

2-4 are schematic diagrams of a virtualization instance introspection process provided by an embodiment of the present disclosure;

FIG5 is a flow chart of a virtualization instance introspection method provided by an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure will be clearly and completely described below in combination with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

In order to realize the introspection of virtualized instances, in some embodiments of the present disclosure, the kernel address space of the virtualized instance is mapped to the user state address space of the host machine, so that the user state address space of the host machine can store the kernel data and kernel functions corresponding to the virtualized instance. When responding to a security detection request, the virtualization manager can obtain the kernel data associated with the security detection request from the user state address space of the host machine based on the memory mapping relationship between the kernel address space of the virtualized instance and the user state address space of the host machine, and provide it to the security detection program deployed on the host machine outside the virtualized instance, so that the security detection program can obtain the kernel data of the virtualized instance, that is, obtain the semantics of the virtualized instance at the operating system level, cross the semantic gap between the virtual machine and the virtualized instance, and realize the introspection of the virtualized instance across the semantic gap.

The technical solutions provided by various embodiments of the present disclosure are described in detail below in conjunction with the accompanying drawings.

It should be noted that the same reference numerals denote the same objects in the following drawings and embodiments, and therefore, once an object is defined in one drawing or embodiment, it does not need to be further discussed in the subsequent drawings and embodiments.

FIG1 is a schematic diagram of the internal system structure of a host machine provided by an embodiment of the present disclosure. The host machine S10 can be implemented as any computer device with computing, storage and other functions, such as a server or a terminal device. The terminal device can be a computer, a workstation or a mobile phone. As shown in FIG1 , a virtualization manager 10, a virtualization instance 20 managed by the virtualization manager 10, and a security detection program 30 located outside the virtualization instance are deployed on the host machine S10.

In this embodiment, the virtualization instance 20 refers to multiple virtual servers deployed on a host machine using virtual machine technology, which can provide different services. The virtualization instance 20 can be a virtual machine (VM), a container or a container group (such as Pod, etc.). The virtualization instance 20 can also be called a client (Guest). The host operating system is responsible for allocating hardware resources among multiple virtualization instances 20, making multiple virtualization instances 20 independent of each other.

As shown in FIG1 , the host machine S10 is divided into a user state and a kernel state. The virtualization instance 20 and the virtualization manager 10 are deployed in the user state of the host machine S10. The kernel state and the user state are two different operating states of the operating system. In the kernel state, the operating system program can be run and the hardware can be operated; in the user state, only the application program can be run.

The virtualization instance 20 can be divided into user state and kernel state. The user state address space of the virtualization instance 20 is used to store user state data of the virtualization instance 20. The kernel state address space of the virtualization instance 20 is used to store kernel state data corresponding to the virtualization instance 20, such as kernel data and kernel functions.

The virtualization manager 10 is a computer program for managing the virtualization instance 20, which can be implemented as a software function module or a plug-in, etc. The operating system of the virtualization instance 20 can enable the virtualization manager 10 to communicate with the hardware. The virtualization manager 10 is different depending on the implementation form of the virtualization instance 20.

For example, in an embodiment where the virtualization instance 20 is a container or a container group, the operating system virtualization architecture can be used to divide the single operating system of the host S10 into multiple containers, and the container manager can be used to manage them. Multiple refers to 2 or more. The host operating system is responsible for allocating hardware resources among multiple containers so that multiple containers are independent of each other. Accordingly, the virtualization manager 10 is implemented as a container manager.

For another example, in an embodiment where the virtualization instance 20 is a virtual machine, the underlying hardware resources are no longer divided, but a virtual machine manager (VMM) is installed on the host machine's operating system. The virtual layer exists as application-level software and does not involve the operating system kernel. The virtual layer simulates a set of independent hardware devices for each virtual machine, including hardware resources such as processors, memory, motherboards, graphics cards, and network cards, and installs the client operating system on them. Accordingly, the virtualization manager is implemented as a VMM.

In this embodiment, the security detection program 30 refers to a computer program that performs security detection on the virtualized instance 20, which is deployed in the user state of the host machine outside the virtualized instance 20 to realize virtualized instance self-reflection. In this embodiment, virtualized instance self-reflection is a method applied to a virtualized environment to enhance the security of the virtualized instance from the outside of the virtualized instance. In this way, the security of the security detection program 30 is no longer affected by the virtualized environment. Even if the virtualized instance 20 is invaded, based on the isolation between the host machine and the virtualized instance 20, the intrusion program cannot interfere with the security detection program 30, so that the security detection program 30 can run normally, which can improve the security of the security detection program.

However, the isolation between the host and the virtualized instance also brings about the semantic gap problem, that is, the security detection program 30 in the host cannot know the internal semantics of the virtualized instance, which brings difficulties to the application of using virtualized instance introspection technology to enhance the security of the virtualized instance. In other words, the interface between the host and the virtualized instance is the registers related to the virtualization technology, etc., which do not have the semantics of the virtualized instance at the operating system level that the security detection program 30 wants to obtain, resulting in the security detection program 30 being unable to know the semantics of the virtualized instance at the operating system level, which is the semantic gap.

In this embodiment, in order to solve the above technical problems and realize the introspection of virtualized instances across the semantic gap, the virtualization manager 10 maps the kernel address space of the virtualized instance to the target address space in the user state address space of the host machine S10. Specifically, during the process of creating the virtualized instance, the virtualization manager 10 can allocate the target address space to the virtualized instance from the free address space in the user state address space of the host machine S10; and establish a memory mapping relationship between the kernel address space of the virtualized instance and the target address space, so as to realize the kernel state address space of the virtualized instance 20. The memory mapping between the target address space in the user state address space of the host machine S10 and the target address space in the user state address space of the host machine S10.

Among them, the mapping between the kernel state address space of the virtualization instance 20 and the target address space in the user state address space of the host machine S10 is essentially the mapping of the data stored in the kernel state address space of the virtualization instance 20, that is, the kernel state address space of the virtualization instance 20 and the target address space in the user state address space of the host machine S10. The data stored in the kernel state address space of the virtualization instance 20 (such as the kernel data and kernel functions corresponding to the virtualization instance) can be stored in the target address space in the user state address space of the host machine S10. In this way, the target address space in the user state address space of the host machine S10 stores the kernel data and kernel functions corresponding to the virtualization instance 20.

Since the target address space in the user state address space of the host machine S10 stores the kernel data and kernel functions corresponding to the virtualization instance 20, the virtualization manager 10 deployed in the user state of the host machine S10 can obtain the operating system-level semantics of the virtualization instance 20 from the target address space, that is, obtain the kernel data corresponding to the virtualization instance 20, thereby eliminating the semantic gap between the virtualization instance 20 and the host machine S10.

Specifically, the security detection program 30 may send a security detection request to the virtualization manager 10 according to the security detection requirements. The security detection request is used to request security monitoring of the virtualized instance 20. The virtualization manager 10 may receive the security detection request (corresponding to step 1 of FIG. 1 ). In order to achieve interaction between the virtualization manager 10 and the security detection program 30, a security detection service interface 101 for the security detection program 30 may be set on the virtualization manager 10 to interact with the security detection program 30.

In this embodiment, the specific implementation form of the security detection service interface 101 is not limited. For example, the security detection service interface 101 can be implemented as a remote procedure call (RPC) interface, a socket interface, or an application programming interface (API).

In some embodiments, the security detection service interface 101 is implemented as an RPC interface, and the security detection program 30 can call the security detection service interface 101 through the RPC method, and send a security detection request to the virtualization manager 10 through the security detection service interface 101. Accordingly, the virtualization manager 10 can obtain the security detection request through the security detection service interface 101.

Further, the virtualization manager 10 may, in response to the security detection request, obtain the target data object associated with the security detection request from the target address space based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine. The target data object includes at least part of the kernel data of the virtualization instance 20. The kernel data included in the target data object may include kernel data directly read from the target address space, and may also include kernel data generated by the kernel function in the virtualization instance 20 in the process of responding to the security detection request, etc.

Among them, the target object that the security detection request requests to monitor is different, and the target data object obtained is also different. The target object and the target data object are defined from different perspectives. From the perspective of the security detection program, the object that needs to be detected is called the target object; the related data obtained by monitoring the target object is called the target data object. In some application scenarios, if a request is made to monitor some kernel data, then the kernel data has both a target object and a target data object; of course, if in some application scenarios, a request is made to monitor some kernel functions, processes or threads, etc., then these kernel functions, processes or threads are target objects, and the related data generated by the processes or threads are target data objects. In other words, the target object and the target data object may be the same or different. The following is a simple exemplary description of the target object and the target data object. For example, if the security detection request requests to monitor certain kernel data, then the target data object can be implemented as the kernel data to be monitored, etc. For another example, if the security detection request requests to monitor a kernel function, then the target data object can be implemented as the kernel data generated during the operation of the kernel function to be monitored, etc. The target objects that the security detection request requests to monitor are different, and the implementation methods for obtaining the target data object from the target address space are also different. This part is inside The content will be described in detail in the following embodiments and will not be described here in detail.

Furthermore, the virtualization manager 10 may provide the target data object to the security detection program 30. Specifically, the virtualization manager 10 may provide the target data object to the security detection program 30 through the security detection service interface 101.

In some embodiments, the virtualization manager 10 may convert the target data object into a target protocol format supported by the security detection service interface 101 ; and provide the target data object in the target protocol format to the security detection program 30 through the security detection service interface 101 .

For example, if the security detection service interface is an RPC interface, the target protocol format supported by the security detection service interface 101 is the RPC protocol format. The virtualization manager 10 can convert the target data object into the RPC protocol format; and provide the target data object in the RPC protocol format to the security detection program 30 through the security detection service interface. For another example, if the security detection service interface is a Socket interface, the target protocol format supported by the security detection service interface is the Socket protocol format. The virtualization manager 10 can convert the target data object into the Socket protocol format; and provide the target data object in the Socket protocol format to the security detection program 30 through the security detection service interface 101, etc.

Accordingly, the security detection program 30 can perform security detection on the virtualized instance 20 based on the target data object. The specific implementation method of the security detection on the virtualized instance 20 is different depending on the target object monitored by the security detection request, which will be described in detail in the following embodiments and will not be repeated here.

In this embodiment, by mapping the kernel address space of the virtualized instance to the target address space in the user state address space of the host machine, the host machine's user state address space stores the kernel data and kernel functions corresponding to the virtualized instance. In this way, when responding to a security detection request, the virtualization manager can obtain the kernel data associated with the security detection request from the host machine's user state address space based on the memory mapping relationship between the kernel address space of the virtualized instance and the user state address space of the host machine, and provide the kernel data associated with the security detection request to a security detection program on a host machine deployed outside the virtualized instance, so that the security detection program can obtain the kernel data of the virtualized instance, that is, the semantics of the virtualized instance at the operating system level, thereby bridging the semantic gap between the virtual machine and the virtualized instance, and realizing virtualized instance self-reflection across the semantic gap.

In conjunction with the target object monitored by the security detection request, the specific implementation method of the virtualization manager obtaining the target data object associated with the security detection request from the target address space in the user mode address space of the host machine is exemplarily described below.

As shown in FIG. 2 , in some embodiments, the target object of the security detection request request monitoring is specific kernel data (defined as target kernel data), and the target data object can be implemented as target kernel data. For example, the target data object can be a structure and specific attributes required to execute the query process command for describing the process. Among them, the structure used to describe the process is loaded into the memory and contains information about the process, including: process number (PID), process name (Comm), process state (State), process running time and process memory management information. When any process is found, the address of the structure used to describe the process of the next process can be obtained through the next pointer value in the task member variable of the current process. In this way, the structure used to describe the process of all processes can be found by traversing in sequence. For example, in the Linux system, the query process command can be a PS command, and the structure used to describe the process is task_struct.

In this embodiment, as shown in FIG2 , the security detection program 30 can determine the target kernel data to be monitored according to the actual detection requirements; and encapsulate the identifier of the target kernel data into the security detection request. Afterwards, the security detection request can be sent to the virtualization manager 10 (corresponding to step 1 in FIG2 ). The virtualization manager 10 can create a thread module 102 in response to the security detection request, and the thread module 102 is used to obtain the kernel data requested to be monitored by the security detection request. Further, the virtualization manager 10 can provide the security detection request to the thread module 102 (corresponding to step 2 in FIG2 ). Thread module 102 Based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, the target kernel data monitored by the security detection request can be obtained from the target address space as the target data object (corresponding to step 3 of Figure 2).

Specifically, the thread module 102 can obtain the identifier of the kernel data to be monitored from the security detection request; and based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine, obtain the kernel data corresponding to the identifier of the kernel data to be monitored from the target address space as the target kernel data to be monitored by the security detection request, that is, as the target data object.

In this embodiment, the thread module 102 can access the target address space based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine; and directly obtain the target kernel data requested to be monitored by the security detection request from the target address space as the target data object.

Of course, the thread module 102 can also execute the kernel function for data extraction corresponding to the virtualization instance (which can be recorded as the first kernel function); and based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine, control the kernel function for data extraction from the target address space to obtain the target kernel data requested to be monitored by the security detection request as the target data object.

Further, the thread module 102 may provide the target kernel data that the security detection request requests to monitor to the security detection program 30 (corresponding to steps 4 and 5 of Figure 2). Specifically, the thread module 102 may convert the target kernel data that the security detection request requests to monitor into a target protocol format supported by the security detection service interface 101; and provide the target kernel data in the target protocol format to the security detection program 30 through the security detection service interface 101 (corresponding to steps 4 and 5 of Figure 2). The security detection program 30 may obtain the target kernel data in the target protocol format; and parse the target kernel data in the target protocol format to obtain the target kernel data that the security detection request requests to monitor. Further, the security detection program 30 may perform a security check on the virtualization instance 30 based on the target kernel data that the security detection request requests to monitor (corresponding to step 6 of Figure 2).

Optionally, the security detection program 30 may perform integrity and accuracy verification on the target kernel data monitored by the security detection request; if the target kernel data monitored by the security detection request passes the integrity and accuracy verification, the target kernel data monitored by the security detection request in the virtualization instance 30 passes the security detection. On the contrary, if the target kernel data monitored by the security detection request in the virtualization instance 30 fails the security detection, it means that the virtualization instance 30 fails the security detection and there is a possibility of being invaded. For example, as shown in FIG2 , the virtualization instance 20 is invaded by malicious application B, etc.

The virtualization instance introspection mode shown in the above embodiment can be defined as a first virtualization instance introspection mode. For the first virtualization instance introspection mode: the security detection program actively scans the kernel state memory of the virtualization instance, that is, the kernel of the virtualization instance will not actively report the target data object. For the virtualization instance, it is a passive virtualization instance introspection. This virtualization instance introspection mode has little impact on the service performance of the virtualization instance, and is suitable for situations where the virtualization instance has high requirements for service performance, that is, the virtualization instance is more sensitive to service performance.

The following takes the kernel data monitored by the security detection request as the kernel data required by the query process command (such as the PS command) as an example to exemplify the above-mentioned first virtualization instance introspection mode.

For a query process command (such as a PS command), the required kernel data may include: a structure for describing the process (such as a task_struct list) and specific attributes, etc. Accordingly, the security detection request may include: an identifier of the kernel data required for the query process command (such as a PS command).

The thread module 102 can obtain the number of cores required for the query process command (such as the PS command) from the security detection request. According to the identification; and based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, a structure describing the process (such as a task_struct list) is obtained from the target address space, and based on the structure describing the process (such as a task_struct list), the structures describing the process (such as a task_struct list) of all processes in the target address space are traversed, and the structures used to describe the process of all processes in the virtualization instance and the specific attributes of all processes are obtained from the target address space.

Furthermore, the thread module 102 may provide the structures used to describe the processes and the specific attributes of all processes to the security detection program 30. The security detection program 30 may perform security detection on the virtualized instance based on the structures used to describe the processes and the specific attributes of all processes.

The first virtualization instance introspection mode shown in the above embodiment is only an illustrative description and does not constitute a limitation. In order to improve the timeliness of discovering that the virtualization instance has been invaded, the embodiment of the present disclosure also provides another virtualization instance introspection mode, which is defined as the second virtualization instance introspection mode. The second virtualization instance introspection mode is an active virtualization instance introspection mode, that is, the virtualization instance can report the relevant behavior and data of the virtualization instance to the security detection program in a timely manner through the virtualization manager. The security detection program can perform security detection on the virtualization instance based on the relevant content actively reported by the virtualization instance through the virtualization manager. The second virtualization instance introspection mode is described in detail below.

As shown in FIG3 , the security detection program 30 may request to detect a specific kernel function (defined as a target kernel function) according to the security detection requirements. For example, the specific kernel function may be a process management function, such as a kernel function for creating a new process, a kernel function for creating a child process in a parent process, etc. In a Linux system, the kernel function for creating a new process may be a do_fork() function; the kernel function for creating a child process in a parent process may be an execve() function, etc. Accordingly, the security detection program 30 may encapsulate the identifier of the target kernel function requested to be monitored in a security detection request; and send the security detection request to the virtualization manager 10 (corresponding to step 1 in FIG3 ). Regarding the implementation method of the security detection program 30 sending the security detection request to the virtualization manager 10, please refer to the relevant content of the above-mentioned embodiment, which will not be repeated here.

The virtualization manager 10 may create another thread module 103 in response to the security detection request (corresponding to step 2 of FIG. 3 ). In the embodiment of the present disclosure, for the convenience of description and distinction, the thread module 102 created in the introspection mode of the first virtualization instance is defined as the first thread module; the thread module 103 created in this embodiment is defined as the second thread module.

Further, the second thread module 103 may mount a hook function on the target kernel function that the security detection request requests to monitor (corresponding to step 3 of FIG. 3 ). The hook function may sense some events during the operation of the target kernel function and notify the second thread module 103, for example, it may sense the event that the target kernel is executed and notify the second thread module 103 that the target kernel function is executed, or it may sense the event that the target kernel function is executed and notify the second thread module 103, or it may sense the event that the target kernel function calls a certain function or accesses the target address space or creates a certain thread during the operation and notify the second thread module 103. Among them, the events that the hook function needs to sense can be flexibly set according to application requirements, and there is no limitation on this.

In this embodiment, the hook function may be mounted in real time by the second thread module 103, or may be pre-mounted by the second thread module 103 during the execution of other security detection requests.

For the above-mentioned security detection program 30, the identifier of the target kernel function requested for monitoring, the identifier of the tracepoint in the target kernel function for mounting the hook function, and the identifier of the hook function can be determined according to the actual security detection requirements. Further, the security detection program 30 can encapsulate the identifier of the target kernel function, the identifier of the tracepoint in the target kernel function for mounting the hook function, and the identifier of the hook function into a security detection request; and send the security detection request to the virtualization manager 10.

Accordingly, the second thread module 103 created by the virtualization manager 10 can obtain the target The second thread module 103 may download the code of the hook function from the code library based on the identifier of the hook function.

Further, the second thread module 103 can determine the code of the kernel function from the target address space based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine and the identifier of the target kernel function; and determine the tracking point in the code of the target kernel function according to the identifier of the tracking point; thereafter, the code of the hook function can be used to modify the code of the target kernel function at the tracking point in the target address space, thereby mounting the above-mentioned hook function on the tracking point of the target kernel function.

The hook function can sense the set event during the operation of the target kernel function and notify the second thread module 103. Accordingly, the second thread module 103 can obtain the kernel data generated during the operation of the target kernel function from the target address space based on the memory mapping relationship between the kernel state address space of the virtualization instance and the user state address space of the host machine, as the target data object (corresponding to step 4 of FIG. 3 ), when the hook function issues a notification during the operation of the target kernel function.

Specifically, during the operation of the target kernel function, the generated kernel data can be stored in the kernel state address space of the virtualization instance; the virtualization manager 10 can map the kernel data generated by the target kernel function in the kernel state address space of the virtualization instance during the operation to the target address space in the user state address space of the host machine. Therefore, the target address space stores the kernel data generated by the target kernel function during the operation. Based on this, the second thread module 103 running in the user state of the host machine can obtain the kernel data generated by the target kernel function during the operation from the target address space as the target data object based on the memory mapping relationship between the kernel state address space of the virtualization instance and the user state address space of the host machine.

In some embodiments, the target kernel function is a process management function, and the hook function can notify the second thread module 103 to execute the management function during the operation of the process management function. The second thread module 103 can respond to the notification issued by the hook function, based on the memory mapping relationship between the kernel state address space of the virtualization instance and the user state address space of the host machine, and obtain the kernel data of the target process managed during the operation of the process management function from the target address space as the target data object. Among them, the kernel data of the target process includes but is not limited to: process number (PID), process name, process state (State), process running time, process memory management information and context data, etc. Context data refers to the data in the register of the processor when the process is executed.

For example, the process management function is a kernel function for creating a new process, such as a do_fork() function, etc. The hook function can notify the second thread module 103 that the kernel function for creating a new process is executed during the execution of the kernel function for creating a new process in the virtualized instance. The second thread module 103 can obtain the kernel data of the new process created during the execution of the kernel function for creating a new process as the target data object in response to the notification of the hook function.

Further, the second thread module 103 may provide the kernel data generated by the target kernel function during operation to the security detection program 30 (corresponding to steps 5 and 6 of FIG. 3 ). For the specific implementation of providing the kernel data generated by the target kernel function during operation to the security detection program 30, please refer to the relevant content of the above embodiment, which will not be repeated here. Accordingly, the security detection program 30 may perform security detection on the virtualized instance based on the kernel data generated by the target kernel function during operation (corresponding to step 7 of FIG. 3 ).

Optionally, the security detection program 30 can extract features from the kernel data generated during the operation of the target kernel function to obtain kernel data features; and use a pre-trained malicious program detection model to perform security detection on the kernel data features to identify whether the virtualized instance is invaded by a malicious program. After the instance is invaded by a malicious program, the kernel data generated by the kernel function of the virtualized instance during operation is used to complete the training of the training samples.

In the second virtualization instance introspection mode provided in the above embodiment, the virtualization manager can mount a hook function on the target kernel function of the monitored virtualization instance, and use the hook function to actively notify the target kernel function to be run. In this way, the second thread module in the virtualization manager can timely obtain the kernel data generated during the operation of the target kernel function, and timely feed it back to the security detection program for security detection, which helps to improve the timeliness of the virtualization instance security detection. Therefore, the above second virtualization instance introspection mode is suitable for situations where the timeliness of virtualization instance security detection is required to be high, that is, situations that are sensitive to the timeliness of virtualization instance security detection.

The security detection logic of the security detection program in the first virtualization instance self-reflection mode and the second virtualization instance self-reflection mode provided in the above embodiments runs outside the virtualization manager 10. During the security detection process of the virtualized instance, the virtualization manager 10 and the security detection program 30 need to interact through the security detection service interface 101. For embodiments with more complex security detection logic, the interaction between the virtualization manager 10 and the security detection program 30 is also more complex, which affects the security detection speed.

In order to improve the security detection speed of the virtualized instance, the embodiment of the present disclosure also provides another virtualized instance self-reflection mode, which is defined as the third virtualized instance self-reflection mode. In the third virtualized instance self-reflection mode, the security detection logic running in the virtual machine in the traditional solution is "sunk" to the virtualization manager 10 of the host machine, and the result is the same as if the security detection logic runs in the virtualized instance. The following is a detailed description.

As shown in FIG4 , the security detection program 30 can determine the security detection logic agreed in advance with the virtualization manager 10 according to the actual security detection requirements. The security detection logic runs in the virtualization manager 10 in the form of a thread. Accordingly, the security detection program 30 can determine the target security detection thread to be monitored according to the actual security detection requirements; and encapsulate the identifier of the target security detection thread into the security detection request. Further, the security detection program 30 can send the security detection request to the virtualization manager 10 (corresponding to step 1 in FIG4 ).

In response to the security detection request, the virtualization manager 10 may create another thread module 104 (defined as a third thread module) (corresponding to step 2 in FIG. 4 ). The third thread module 104 may create a target security detection thread 105 (corresponding to step 3 in FIG. 4 ) for monitoring by the security detection request. Among them, the target security detection thread 105 may be based on the system call interface of the pre-packaged virtualization instance as a user state program, running on the operating system of the virtualization instance 20 (corresponding to step 4 in FIG. 4 ). In this way, the target security detection thread 105 looks like a thread running in the user state of the virtualization instance in the user state of other virtualization instances, that is, it looks like a target security detection thread agent running in the user state of the virtualization instance in FIG. 4 . The system call interface of the pre-packaged virtualization instance may be a syscall interface, such as a fork() interface for creating a new process, an execv() interface for creating a child process in a parent process, etc.

Since the target security detection thread 105 can be run as a user-mode program based on the system call interface of the pre-packaged virtualization instance on the operating system of the virtualization instance 20, the target security detection thread 105 can access the user-mode address space of the operating system. Therefore, the target security detection thread can obtain the kernel data that the target security detection thread is concerned about from the target address space based on the memory mapping relationship between the kernel-mode address space of the virtualization instance and the user-mode address space of the host machine.

The kernel data that the target security detection thread 105 is concerned about is determined by the security detection logic of the thread itself. For example, if the target security detection thread 105 is used to monitor specific kernel data of a virtualized instance, the kernel data monitored by the target security detection thread can be obtained from the target address space based on the memory mapping relationship between the kernel state address space of the virtualized instance and the user state address space of the host machine as the kernel data that the target security detection thread 105 is concerned about. For another example, the target security detection thread 105 is used to monitor a specific kernel function corresponding to a virtualization instance. The target security detection thread 105 can obtain the kernel data generated during the running of the monitored kernel function from the target address space based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, as the kernel data that the target security detection thread 105 is concerned about.

For example, in some embodiments, the security detection logic of the target security detection thread is to run a periodic monitoring (Watch) program. The Watch program is a command that periodically executes a command and displays the execution result. For example, to monitor the dynamic load of the processor of the virtualized instance, such as the central processing unit (CPU), the load information of the CPU can be refreshed according to the specified time interval. Then the kernel data that the target security detection thread focuses on is the load information of the CPU of the virtualized instance.

Further, the target security detection thread 105 may output the obtained kernel data of interest. Accordingly, the third thread module 104 may obtain the data output by the target security detection thread 105 as the target data object (corresponding to step 5 in FIG. 4 ). The data output by the target security detection thread 105 is the kernel data of interest to the target security detection thread 105.

Further, the third thread module 104 can provide the kernel data concerned by the target security detection thread 105 to the security detection program 30 (corresponding to steps 6 and 7 in FIG. 4 ). The security detection program 30 can perform security detection on the virtualization instance 20 based on the kernel data concerned by the target security detection thread 105 (corresponding to step 8 in FIG. 4 ).

In the case where the kernel data that the target security detection thread 105 is concerned about is the specific kernel data of the virtualization instance, the virtualization instance 20 can be security-checked based on the specific kernel data of the virtualization instance. The specific security detection method can refer to the relevant content of the above-mentioned first virtualization instance introspection mode, which will not be repeated here. In the case where the kernel data that the target security detection thread 105 is concerned about is the kernel data generated during the operation of a specific kernel function of the virtualization instance, the virtualization instance 20 can be security-checked based on the kernel data generated during the operation of the specific kernel function. The specific security detection method can refer to the relevant content of the above-mentioned second virtualization instance introspection mode, which will not be repeated here.

According to the above three virtualization instance introspection modes, it can be known that the three virtualization instance introspection modes each have their own advantages and disadvantages. In actual use, one of the three virtualization instance introspection modes can be adopted for implementation. Of course, it can also be implemented in combination with multiple of the three virtualization instance introspection modes. For example, it can be implemented in combination with any two of the three virtualization instance introspection modes, and of course it can also be implemented in combination with three. When multiple virtualization instance introspection modes are implemented in combination, the multiple virtualization instance introspection modes can complement each other's advantages and disadvantages, learn from each other's strengths and weaknesses, and improve the performance of virtualization instance security detection.

In an example of implementing multiple of the three virtualization instance introspection modes, the security detection program 30 may determine which virtualization instance introspection mode to use during online security detection. Specifically, the security detection program 30 may determine the target virtualization instance introspection mode from multiple virtualization instance introspection modes according to the security detection requirements for performing security detection on the virtualization instance 20; and generate a security detection request according to the identifier of the target virtualization instance introspection mode and send it to the virtualization manager.

The security detection requirement for performing security detection on the virtualized instance 20 may be determined by the user or by the security detection logic of the security detection program 30. The security detection requirement for performing security detection on the virtualized instance 20 may include at least one of: service performance requirements of the virtualized instance during the entire detection process, timeliness requirements of security detection, and logic complexity of the security detection thread for performing security detection on the virtualized instance.

Based on the characteristics of the above three virtualization instance self-reflection modes, it can be seen that the above first virtualization instance self-reflection mode is less invasive to the virtualization instance and has less impact on the service performance of the virtualization instance. Therefore, the first virtualization instance self-reflection mode is suitable for the situation where the virtualization instance is more sensitive to service performance. When the measurement demand indicates that the virtualized instance is more sensitive to the service performance, the target virtualized instance introspection mode is determined to be the first virtualized instance introspection mode.

Since the timeliness of security detection in the second virtualization instance introspection mode is higher, the security detection program 30 can determine that the target virtualization instance introspection mode is the second virtualization instance introspection mode when the security detection requirement indicates that the virtualization instance is more sensitive to the timeliness of security detection.

Since the third virtualization instance introspection mode is applicable to embodiments with relatively complex security detection logic, the security detection program 30 can determine that the target virtualization instance introspection mode is the third virtualization instance introspection mode when the security detection requirement indicates that the logic complexity of the security detection of the virtualization instance is the set logic complexity. Further, in this case, the type of the target object can be determined as a security detection thread that performs security detection on the virtualization instance. The disclosed embodiment does not limit the specific complexity of the "set logic complexity" and can be flexibly set according to application requirements.

Furthermore, the security detection requirement may also include description information of the target object and the type of the target object. In this case, the security detection program 30 may also determine the identifier of the target object according to the description information of the target object and the type of the target object included in the security detection requirement; and generate a security detection request according to the identifier of the target object and the identifier of the target virtualization instance introspection mode. Furthermore, the security detection program 30 may provide the security detection request to the virtualization manager 10.

Accordingly, the virtualization manager 10 can obtain the identifier of the target virtualization instance introspection mode from the security detection request; and create a target thread module corresponding to the target virtualization instance introspection mode according to the identifier of the target virtualization instance introspection mode. Among them, the target virtualization instance introspection mode is at least one virtualization instance introspection mode selected and used from a plurality of virtualization instance introspection modes by the security detection program according to the security detection requirements for security detection of the virtualization instance, and different virtualization instance introspection modes correspond to different thread modules. Among them, the thread module corresponding to the first virtualization instance introspection mode is the first thread module; the thread module corresponding to the second virtualization instance introspection mode is the second thread module; and the thread module corresponding to the third virtualization instance introspection mode is the third thread module.

The target virtualization instance introspection mode may be one or more. Multiple means two or more. The specific number of the target virtualization instance introspection modes is determined by the security detection requirements for the security detection of the virtualization instance 20. For example, if the security detection requirements for the security detection of the virtualization instance 20 indicate that the virtualization instance is more sensitive to service performance and is also more sensitive to the timeliness of security detection, then the target virtualization instance introspection mode is determined to be the first virtualization instance introspection mode and the second virtualization instance introspection mode. Accordingly, the virtualization manager 10 can determine that the target thread module to be created includes the first thread module and the second thread module according to the identifier of the target virtualization instance introspection mode, and then simultaneously control the first thread module to obtain the kernel data requested to be monitored by the security detection request from the target address space based on the memory mapping relationship as the target data object, and control the second thread module to obtain the kernel data generated by the target kernel function during the operation as the target data object by using the hook function mounted on the kernel function of the virtualization instance.

Further optionally, in the case where the security detection request includes the identifier of the target object, the target thread module can obtain the identifier of the target object from the security detection request; and based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, obtain the target data object associated with the identifier of the target object from the target address space. Among them, the type of the target object includes the type of kernel data, and the target data object associated with the identifier of the target object includes the target kernel data monitored by the security detection request. And/or, the type of the target object includes the type of target kernel function, and the target data object associated with the identifier of the target object includes the kernel data generated during the operation of the target kernel function monitored by the security detection request. And/or, the type of the target object includes the type of target security detection thread, and the target data object associated with the identifier of the target object includes the kernel data concerned by the target security detection thread.

Regarding the thread module corresponding to the introspection mode of the target virtualization instance, based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, the specific implementation method of obtaining the target data object associated with the identification of the target object from the target address space can be referred to the relevant content in the above embodiments, which will not be repeated here.

When the embodiments of the present disclosure are implemented in combination with multiple virtualization instance self-reflection modes, the multiple virtualization instance self-reflection modes can complement each other's strengths and weaknesses, learn from each other's strengths and overcome each other's weaknesses, and improve the performance of virtualization instance security detection.

In addition to the above host machine, the embodiment of the present disclosure also provides a virtualization instance self-reflection method. The virtualization instance self-reflection method provided by the embodiment of the present disclosure is exemplarily described below.

FIG5 is a flow chart of a virtualization instance introspection method provided by an embodiment of the present disclosure. The virtualization instance introspection method is applicable to a virtualization manager deployed on a host machine. The host machine is also deployed with a virtualization instance managed by the virtualization manager and a security detection program located outside the virtualization instance, and the kernel address space of the virtualization instance is mapped to a target address space in the user state address space of the host machine. As shown in FIG5 , the virtualization instance introspection method mainly includes:

501. Receive a security detection request sent by a security detection program.

502. Based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine, obtain a target data object associated with the security detection request from the target address space, where the target data object includes at least part of the kernel data of the virtualization instance.

503. Provide the target data object to the security detection program, so that the security detection program performs security detection on the virtualization instance based on the target data object.

In this embodiment, the virtualization instance and the virtualization manager are deployed in the user state of the host machine. The virtualization instance can be divided into user state and kernel state. The user state address space of the virtualization instance is used to store the user state data of the virtualization instance. The kernel state address space of the virtualization instance is used to store the kernel state data corresponding to the virtualization instance, such as kernel data and kernel functions. For the description of the implementation form of the virtualization manager, virtualization instance and security detection program, please refer to the relevant content of the above host machine embodiment, which will not be repeated here.

In this embodiment, the security detection program is deployed in the user state of the host machine outside the virtualized instance to realize the self-reflection of the virtualized instance. In this way, the security of the security detection program is no longer affected by the virtualized environment. Even if the virtualized instance is invaded, based on the isolation between the host machine and the virtualized instance, the intrusion program cannot interfere with the security detection program, so that the security detection program can run normally, which can improve the security of the security detection program.

However, the isolation between the host machine and the virtualized instance also brings about the semantic gap problem, that is, the security detection program in the host machine cannot know the internal semantics of the virtualized instance, which brings difficulties to the application of using virtualized instance introspection technology to enhance the security of virtualized instances.

In this embodiment, in order to solve the above technical problems and realize the introspection of virtualized instances across the semantic gap, the virtualization manager maps the kernel address space of the virtualized instance to the target address space in the user state address space of the host machine. Specifically, during the process of creating the virtualized instance, the target address space can be allocated to the virtualized instance from the free address space in the user state address space of the host machine; and a memory mapping relationship between the kernel address space of the virtualized instance and the target address space is established to realize the memory mapping between the kernel address space of the virtualized instance and the target address space in the user state address space of the host machine.

The mapping between the kernel state address space of the virtualized instance and the target address space in the user state address space of the host machine is essentially the mapping of the data stored in the kernel state address space of the virtualized instance, that is, the kernel state address space of the virtualized instance and the target address space in the user state address space of the host machine can be mapped to the kernel state address space of the virtualized instance. The data stored in the address space (such as the kernel data and kernel functions corresponding to the virtualized instance) are stored in the target address space in the user address space of the host machine. In this way, the target address space in the user address space of the host machine stores the kernel data and kernel functions corresponding to the virtualized instance.

Since the target address space in the user-state address space of the host machine stores the kernel data and kernel functions corresponding to the virtualization instance, the virtualization manager deployed in the user state of the host machine can obtain the operating system-level semantics of the virtualization instance from the target address space, that is, obtain the kernel data corresponding to the virtualization instance, thereby eliminating the semantic gap between the virtualization instance and the host machine.

Specifically, the security detection program can send a security detection request to the virtualization manager according to the security detection requirement. The security detection request is used to request security monitoring of the virtualized instance. For the virtualization manager, in step 501, the security detection request can be received. In order to realize the interaction between the virtualization manager and the security detection program, a security detection service interface for the security detection program can be set on the virtualization manager to interact with the security detection program.

Optionally, the security detection service interface can be implemented as an RPC interface, a socket interface or an API, etc.

In some embodiments, the security detection service interface is implemented as an RPC interface, and the security detection program can call the security detection service interface through the RPC method, and send a security detection request to the virtualization manager through the security detection service interface. Accordingly, the virtualization manager can obtain the security detection request through the security detection service interface.

Further, for the virtualization manager, in step 502, in response to the security detection request, based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine, the target data object associated with the security detection request can be obtained from the target address space. The target data object includes at least part of the kernel data of the virtualization instance. The kernel data included in the target data object may include kernel data directly read from the target address space, and may also include kernel data generated by the virtualization instance in the process of responding to the security detection request, etc.

Further, in step 503, the target data object may be provided to the security detection program. Specifically, the target data object may be provided to the security detection program through a security detection service interface.

In some embodiments, the target data object may be converted into a target protocol format supported by a security detection service interface; and the target data object in the target protocol format may be provided to a security detection program through the security detection service interface.

Accordingly, the security detection program can perform security detection on the virtualized instance based on the target data object.

In this embodiment, by mapping the kernel address space of the virtualized instance to the target address space in the user state address space of the host machine, the host machine's user state address space stores the kernel data and kernel functions corresponding to the virtualized instance. In this way, when responding to a security detection request, the virtualization manager can obtain the kernel data associated with the security detection request from the host machine's user state address space based on the memory mapping relationship between the kernel address space of the virtualized instance and the user state address space of the host machine, and provide the kernel data associated with the security detection request to a security detection program on a host machine deployed outside the virtualized instance, so that the security detection program can obtain the kernel data of the virtualized instance, that is, the semantics of the virtualized instance at the operating system level, thereby bridging the semantic gap between the virtual machine and the virtualized instance, and realizing virtualized instance self-reflection across the semantic gap.

In conjunction with the target object monitored by the security detection request, the specific implementation method of the virtualization manager obtaining the target data object associated with the security detection request from the target address space in the user mode address space of the host machine is exemplarily described below.

2, in some embodiments, the target object monitored by the security detection request is specific kernel data (defined as target kernel data), and the target data object can be implemented as target kernel data. For example, the target data object can be a structure and specific attributes required to execute the query process command to describe the process.

In conjunction with Figure 2, the security detection process can determine the target kernel data to be monitored according to the actual detection requirements; and encapsulate the identifier of the target kernel data into the security detection request. Afterwards, the security detection request can be sent to the virtualization manager. For the virtualization manager, the above step 502 can be implemented as follows: in response to the security detection request, create a first thread module, and the first thread module is used to obtain the kernel data requested to be monitored by the security detection request. Further, the first thread module is controlled to obtain the target kernel data requested to be monitored by the security detection request from the target address space as the target data object based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine.

Specifically, the first thread module can be controlled to obtain the identifier of the kernel data to be monitored from the security detection request; and based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine, the kernel data corresponding to the identifier of the kernel data to be monitored is obtained from the target address space as the target kernel data to be monitored by the security detection request, that is, as the target data object.

In this embodiment, the first thread module can be controlled to access the target address space based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine; and directly obtain the target kernel data monitored by the security detection request from the target address space as the target data object.

Of course, the first thread module can also be controlled to execute the kernel function for data extraction corresponding to the virtualization instance in the target address space based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine; and use the kernel function for data extraction to obtain the target kernel data requested to be monitored by the security detection request from the target address space as the target data object.

Further, the first thread module can be controlled to provide the target kernel data monitored by the security detection request to the security detection program. Specifically, the first thread module can be controlled to convert the target kernel data monitored by the security detection request into a target protocol format supported by the security detection service interface; and provide the target kernel data in the target protocol format to the security detection program through the security detection service interface. The security detection program can perform a security detection on the virtualized instance based on the target kernel data monitored by the security detection request. For the specific implementation method of the security detection program performing a security detection on the virtualized instance based on the target kernel data monitored by the security detection request, please refer to the relevant content of the above-mentioned host machine embodiment.

The virtualization instance introspection mode shown in the above embodiment can be defined as a first virtualization instance introspection mode. The first virtualization instance introspection mode security detection program actively scans the kernel state memory of the virtualization instance and does not modify the hook function of the kernel of the virtualization instance, that is, the kernel of the virtualization instance will not actively report the target data object. For the virtualization instance, it is a passive virtualization instance introspection. This virtualization instance introspection mode has little impact on the service performance of the virtualization instance, but cannot detect intrusions in a timely manner. It is suitable for situations where the virtualization instance has high service performance requirements, that is, the service performance of the virtualization instance is sensitive.

In order to improve the timeliness of intrusion detection, the embodiment of the present disclosure also provides another virtualization instance self-reflection mode, which is defined as the second virtualization instance self-reflection mode. The second virtualization instance self-reflection mode is an active virtualization instance self-reflection mode, that is, the virtualization manager can report the relevant behavior of the virtualization instance to the security detection program in a timely manner. The security detection program can perform security detection on the virtualization instance based on the active report content of the virtualization manager. The second virtualization instance self-reflection mode is described in detail below.

In conjunction with Figure 3, the security detection program can request to detect a specific kernel function (defined as a target kernel function) based on the security detection requirements. For example, the specific kernel function can be a process management function, such as a kernel function for creating a new process, a kernel function for creating a child process in a parent process, etc. Accordingly, the security detection program can encapsulate the identifier of the target kernel function requested to be monitored in the security detection request; and send the security detection request to the virtualization manager. About security detection For the implementation method of the program sending the security detection request to the virtualization manager, please refer to the relevant content of the above embodiment, which will not be repeated here.

For the virtualization manager, the above step 502 can be implemented as follows: in response to the security detection request, another thread module (defined as the second thread module) is created; further, the second thread module can be controlled to mount a hook function on the target kernel function monitored by the security detection request. The hook function can notify the second thread module that the target kernel function is executed during the operation of the target kernel function.

In this embodiment, the hook function may be mounted by the second thread module in real time, or may be pre-mounted by the second thread module during the execution of other security detection requests.

For the above security detection program, the identifier of the target kernel function requested for monitoring, the identifier of the tracepoint in the target kernel function for mounting the hook function, and the identifier of the hook function can be determined according to the actual security detection requirements. Further, the security detection program can encapsulate the identifier of the target kernel function, the identifier of the tracepoint in the target kernel function for mounting the hook function, and the identifier of the hook function into a security detection request; and send the security detection request to the virtualization manager.

Accordingly, for the virtualization manager, the second thread module can be controlled to obtain the identifier of the target kernel function, the identifier of the tracking point in the target kernel function and the identifier of the hook function from the security detection request; and based on the identifier of the hook function, the code of the hook function is obtained. Optionally, the code of the hook function can be downloaded from the code library based on the identifier of the hook function.

Furthermore, the second thread module can be controlled to determine the code of the kernel function from the target address space based on the memory mapping relationship between the kernel state address space of the above-mentioned virtualization instance and the user state address space of the host machine and the identifier of the target kernel function; and determine the tracking point in the code of the target kernel function according to the identifier of the tracking point; thereafter, the code of the hook function can be used in the target address space to modify the code of the target kernel function at the tracking point, thereby mounting the above-mentioned hook function on the tracking point of the target kernel function.

The hook function can notify the second thread module that the target kernel function is executed during the operation of the target kernel function. Accordingly, the second thread module can be controlled to obtain the kernel data generated during the operation of the target kernel function from the target address space as the target data object based on the memory mapping relationship between the kernel state address space of the virtualization instance and the user state address space of the host machine when the hook function issues a notification during the operation of the target kernel function.

Specifically, during the operation of the target kernel function, the generated kernel data may be stored in the kernel state address space of the virtualized instance; the virtualization manager may map the kernel data generated during the operation of the target kernel function in the kernel state address space of the virtualized instance to the target address space in the user state address space of the host machine. Therefore, the target address space stores the kernel data generated during the operation of the target kernel function. Based on this, the second thread module running in the user state of the host machine can obtain the kernel data generated during the operation of the target kernel function from the target address space as the target data object based on the memory mapping relationship between the kernel state address space of the virtualized instance and the user state address space of the host machine.

Further, the second thread module can be controlled to provide the kernel data generated by the target kernel function during operation to the security detection program. For the specific implementation of providing the kernel data generated by the target kernel function during operation to the security detection program, please refer to the relevant content of the above-mentioned embodiment, which will not be repeated here. Accordingly, the security detection program can perform security detection on the virtualized instance based on the kernel data generated by the target kernel function during operation. For the specific implementation of the security detection program performing security detection on the virtualized instance based on the kernel data generated by the target kernel function during operation, please refer to the relevant content of the above-mentioned host machine embodiment, which will not be repeated here.

In the second virtualization instance introspection mode provided in the above embodiment, the virtualization manager can mount a hook function on the target kernel function of the monitored virtualization instance, and use the hook function to actively notify the target kernel function to be run. In this way, the second thread module in the virtualization manager can timely obtain the kernel data generated during the operation of the target kernel function, and timely feed it back to the security detection program for security detection, which helps to improve the timeliness of the virtualization instance security detection. Therefore, the above second virtualization instance introspection mode is suitable for situations where the timeliness of virtualization instance security detection is required to be high, that is, situations that are sensitive to the timeliness of virtualization instance security detection.

The security detection logic of the security detection program in the first virtualization instance self-reflection mode and the second virtualization instance self-reflection mode provided in the above embodiments runs outside the virtualization manager. During the security detection process of the virtualization instance, the virtualization manager and the security detection program need to interact through the security detection service interface. For embodiments with more complex security detection logic, the interaction between the virtualization manager and the security detection program is also more complex, which affects the security detection speed.

In order to improve the security detection speed of the virtualized instance, the embodiment of the present disclosure also provides another virtualized instance self-reflection mode, which is defined as the third virtualized instance self-reflection mode. In the third virtualized instance self-reflection mode, the security detection logic running in the virtual machine in the traditional solution is "sunk" to the virtualization manager of the host machine, and the result is the same as if the security detection logic runs in the virtualized instance. The following is a detailed description.

In conjunction with FIG4 , the security detection program can determine the security detection logic agreed in advance with the virtualization manager according to the actual security detection requirements. The security detection logic runs in the virtualization manager in the form of a thread. Accordingly, the security detection program can determine the target security detection thread to be monitored according to the actual security detection requirements; and encapsulate the identifier of the target security detection thread into the security detection request. Further, the security detection request can be sent to the virtualization manager.

For the virtualization manager, the above step 502 can also be implemented as follows: in response to the security detection request, another thread module (defined as the third thread module) can be created; and the third thread module is controlled to create a target security detection thread for monitoring by the security detection request. Among them, the target security detection thread can be based on the pre-packaged system call interface of the virtualization instance as a user state program, running on the operating system of the virtualization instance. In this way, the target security detection thread looks like a thread running in the user state of the virtualization instance in the user state of other virtualization instances, that is, it is like the target security detection thread agent running in the user state of the virtualization instance in Figure 4.

Since the target security detection thread can be run as a user-mode program based on the pre-packaged system call interface of the virtualization instance and on the operating system of the virtualization instance, the target security detection thread can access the user-mode address space of the operating system. Therefore, the target security detection thread can obtain the kernel data that the target security detection thread is concerned about from the target address space based on the memory mapping relationship between the kernel-mode address space of the virtualization instance and the user-mode address space of the host machine.

Among them, the specific content of the kernel data that the target security detection thread is concerned about can be found in the relevant content of the above-mentioned host machine embodiment, which will not be repeated here.

Further, the target security detection thread can output the obtained kernel data of interest. Accordingly, the third thread module can be controlled to obtain the data output by the target security detection thread as the target data object. The data output by the target security detection thread 105 is the kernel data of interest to the target security detection thread.

Furthermore, the third thread module may be controlled to provide the kernel data concerned by the target security detection thread to the security detection program. The security detection program may perform security detection on the virtualized instance based on the kernel data concerned by the target security detection thread.

According to the above three virtualization instance self-reflection modes, we can see that the three virtualization instance self-reflection modes have their own advantages and disadvantages. During use, one of the three virtualization instance self-reflection modes can be used for implementation, and of course, multiple of the three virtualization instance self-reflection modes can also be combined for implementation. For example, any two of the three virtualization instance self-reflection modes can be combined for implementation, and of course, three of them can also be combined for implementation. When multiple virtualization instance self-reflection modes are combined for implementation, the multiple virtualization instance self-reflection modes can complement each other's strengths and weaknesses, learn from each other's strengths and weaknesses, and improve the performance of virtualization instance security detection.

In an example of implementing a combination of multiple of the three virtualization instance introspection modes, the security detection program can determine which virtualization instance introspection mode to use during online security detection. Specifically, the security detection thread can select a target virtualization instance introspection mode from multiple virtualization instance introspection modes based on the security detection requirements for performing security detection on the virtualization instance. Generate a security detection request based on the identifier of the target virtualization instance introspection mode; send the security detection request to the virtualization manager, so that the virtualization manager can obtain the target data object associated with the security detection request from the target address space based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine and the identifier of the target virtualization instance introspection mode, the target data object includes at least part of the kernel data of the virtualization instance; then, receive the target data object returned by the virtualization manager and perform security detection on the virtualization instance based on the target data object.

The security detection requirements for security detection of virtualized instances may be determined by the user or by the security detection logic of the security detection program. The security detection requirements for security detection of virtualized instances may include at least one of the service performance requirements of the virtualized instances during the entire detection process, the timeliness requirements of security detection, and the logic complexity of the security detection thread for security detection of the virtualized instances.

Based on the characteristics of the above three virtualization instance introspection modes, it can be seen that the above first virtualization instance introspection mode is less invasive to the virtualization instance and has less impact on the service performance of the virtualization instance. Therefore, the first virtualization instance introspection mode is suitable for situations where the virtualization instance is more sensitive to service performance. Accordingly, the security detection program can determine that the target virtualization instance introspection mode is the first virtualization instance introspection mode when the security detection requirement indicates that the virtualization instance is more sensitive to service performance. The first virtualization instance introspection mode is a mode in which the virtualization manager controls the first thread module to obtain the target kernel data monitored by the security detection request from the target address space as the target data object based on the memory mapping relationship.

Since the timeliness of security detection in the second virtualization instance introspection mode is relatively high, the security detection program can determine that the target virtualization instance introspection mode is the second virtualization instance introspection mode when the security detection requirement indicates that the virtualization instance is more sensitive to the timeliness of security detection. The second virtualization instance introspection mode is a mode in which the virtualization manager controls the second thread module to use the kernel function of the virtualization instance to mount a hook function to obtain the kernel data generated by the target kernel function during operation as the target data object.

Since the third virtualization instance introspection mode is applicable to embodiments with relatively complex security detection logic, the security detection program can determine that the target virtualization instance introspection mode is the third virtualization instance introspection mode when the security detection requirement indicates that the logic complexity of the security detection of the virtualization instance is the set logic complexity. Further, in this case, the type of the target object can also be determined as a security detection thread that performs security detection on the virtualization instance. The third virtualization instance introspection mode is a mode in which the virtualization manager controls the third thread module to create a target security detection thread and obtains the kernel data output by the target security detection thread as the target data object; the target security detection thread runs as a user-mode program on the operating system of the virtualization instance based on the pre-packaged system call interface of the virtualization instance, and obtains the kernel data of its concern from the target address space based on the memory mapping relationship.

Furthermore, the security detection requirement may also include description information of the target object and the type of the target object. In this case, the security detection program may be based on the description information of the target object and the type of the target object included in the security detection requirement. Determine the identifier of the target object; and generate a security detection request according to the identifier of the target object and the identifier of the introspection mode of the target virtualization instance. Further, the security detection program may provide the security detection request to the virtualization manager.

Correspondingly, for the virtualization manager, the identifier of the target virtualization instance introspection mode can be obtained from the security detection request; and according to the identifier of the target virtualization instance introspection mode, a target thread module corresponding to the target virtualization instance introspection mode is created. Among them, the target thread module includes at least one of the first thread module, the second thread module and the third thread module. The thread module corresponding to the first virtualization instance introspection mode is the first thread module; the thread module corresponding to the second virtualization instance introspection mode is the second thread module; the thread module corresponding to the third virtualization instance introspection mode is the third thread module.

Further optionally, in the case where the security detection request includes the identifier of the target object, the target thread module can obtain the identifier of the target object from the security detection request; and based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, obtain the target data object associated with the identifier of the target object from the target address space. Among them, the type of the target object includes the type of kernel data, and the target data object associated with the identifier of the target object includes the target kernel data monitored by the security detection request. And/or, the type of the target object includes the type of target kernel function, and the target data object associated with the identifier of the target object includes the kernel data generated during the operation of the target kernel function monitored by the security detection request. And/or, the type of the target object includes the type of target security detection thread, and the target data object associated with the identifier of the target object includes the kernel data concerned by the target security detection thread.

Regarding the thread module corresponding to the introspection mode of the target virtualization instance, based on the memory mapping relationship between the kernel state address space of the above virtualization instance and the user state address space of the host machine, the specific implementation method of obtaining the target data object associated with the identification of the target object from the target address space can be referred to the relevant content in the above embodiments, which will not be repeated here.

When the embodiments of the present disclosure are implemented in combination with multiple virtualization instance self-reflection modes, the multiple virtualization instance self-reflection modes can complement each other's strengths and weaknesses, learn from each other's strengths and overcome each other's weaknesses, and improve the performance of virtualization instance security detection.

It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 501 and 502 can be device A; for another example, the execution subject of step 501 can be device A, and the execution subject of step 502 can be device B; and so on.

In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations appearing in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel, and the sequence numbers of the operations, such as 501, 502, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel.

Correspondingly, the embodiment of the present disclosure also provides an electronic device, which can be implemented as a host machine, on which a virtualization manager, a virtualization instance managed by the virtualization manager, and a security detection program located outside the virtualization instance are deployed; the virtualization manager provides a security detection service interface to the security detection program to interact with the security detection program; as shown in Figure 6, the electronic device also includes: a memory 61 and a processor 62; the memory 61 stores program codes and security detection programs corresponding to the virtualization manager; wherein the processor 62 is coupled to the memory 61, and is used to execute the program code corresponding to the virtualization manager, so as to implement the method steps that can be executed by the virtualization manager in the aforementioned method embodiment; and is used to execute the security detection program, so as to implement the method steps that can be executed by the security detection program in the aforementioned method embodiment. For detailed descriptions of each method step, please refer to the aforementioned embodiment, which will not be repeated here.

Further, as shown in FIG6 , the electronic device of this embodiment further includes: a communication component 63, a display 64, a power component 65, an audio component 66 and other components. FIG6 only schematically shows some components, which does not mean that the electronic device Only the components shown in FIG6 are included. In addition, the components in the dotted box in FIG6 are optional components, not mandatory components, and the specific components may depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone or an IOT device; it can also be a traditional server, a cloud server or a server cluster.

Accordingly, an embodiment of the present disclosure also provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, causes the one or more processors to execute the steps in the above-mentioned virtualization instance introspection method.

The embodiment of the present disclosure also provides a computer program product, including a computer program, which implements the steps in the above-mentioned virtualization instance introspection method when executed by a processor.

It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

It should also be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit "first" and "second" to different types.

It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

The present disclosure is described with reference to the flowchart and/or block diagram of the method, device (or system), and computer program product according to the embodiment of the present disclosure. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (such as a CPU, etc.), an input/output interface, a network interface, and a memory.

Memory may include non-permanent storage in computer-readable media, random access memory The memory is an example of a computer-readable medium.

The storage medium of a computer is a readable storage medium, which may also be referred to as a readable medium. The readable storage medium includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, Phase-Change Memory (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carriers.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the above elements.

The above contents are only embodiments of the present disclosure and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims of the present disclosure.

Claims (16)

A host machine, wherein a virtualization manager, a virtualization instance managed by the virtualization manager, and a security detection program located outside the virtualization instance are deployed on the host machine; the virtualization manager provides a security detection service interface to the security detection program to interact with the security detection program; The virtualization manager is used to map the kernel address space of the virtualization instance to a target address space in the user state address space of the host machine, wherein the target address space stores kernel data and kernel functions corresponding to the virtualization instance; and Receive a security detection request sent by the security detection program, and based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine, obtain a target data object associated with the security detection request from the target address space, wherein the target data object includes at least part of the kernel data of the virtualization instance, and provide the target data object to the security detection program so that the security detection program performs security detection on the virtualization instance based on the target data object. The host machine according to claim 1, wherein the virtualization manager is configured to adopt at least one of the following methods when obtaining the target data object associated with the security detection request from the target address space: Creating a first thread module, providing the security detection request to the first thread module, and controlling the first thread module to obtain the target kernel data monitored by the security detection request from the target address space as the target data object based on the memory mapping relationship; Create a second thread module, use the second thread module to mount a hook function on the target kernel function monitored by the security detection request, and when the hook function issues a notification, obtain the kernel data generated by the target kernel function during operation from the target address space based on the memory mapping relationship as the target data object; Create a third thread module, use the third thread module to create a target security detection thread that the security detection request monitors, and obtain the kernel data output by the target security detection thread as the target data object; wherein the target security detection thread runs on the operating system of the virtualization instance as a user-mode program based on the pre-packaged system call interface of the virtualization instance, and obtains and outputs the kernel data of its concern from the target address space based on the memory mapping relationship. A virtualization instance introspection method, wherein the method is applied to a virtualization manager deployed on a host machine, the host machine also has a virtualization instance and a security detection program corresponding to the virtualization manager deployed on it, and the kernel address space of the virtualization instance is mapped to a target address space in the user state address space of the host machine; the method comprises: Receiving a security detection request sent by the security detection program; Based on a memory mapping relationship between the kernel address space of the virtualized instance and the user state address space of the host machine, obtaining a target data object associated with the security detection request from the target address space, wherein the target data object includes at least part of the kernel data of the virtualized instance; The target data object is provided to the security detection program so that the security detection program performs security detection on the virtualization instance based on the target data object. The method according to claim 3, further comprising: During the virtualization instance creation process, the target address space is allocated to the virtualization instance to store kernel data and kernel functions corresponding to the virtualization instance; and a memory mapping relationship is established between the kernel address space of the virtualization instance and the user state address space of the host machine. The method according to claim 3, wherein the acquiring, from the target address space, the target data object associated with the security detection request based on the memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine comprises at least one of the following processing methods: Creating a first thread module, providing the security detection request to the first thread module, and controlling the first thread module to obtain the target kernel data monitored by the security detection request from the target address space as the target data object based on the memory mapping relationship; Create a second thread module, use the second thread module to mount a hook function on the target kernel function monitored by the security detection request, and when the hook function issues a notification, obtain the kernel data generated by the target kernel function during operation from the target address space based on the memory mapping relationship as the target data object; Create a third thread module, use the third thread module to create a target security detection thread that the security detection request monitors, and obtain the data output by the target security detection thread as the target data object; wherein the target security detection thread runs on the operating system of the virtualization instance as a user-mode program based on the pre-packaged system call interface of the virtualization instance, and obtains and outputs the kernel data of its concern from the target address space based on the memory mapping relationship. The method according to claim 5, wherein the controlling the first thread module to obtain the target kernel data monitored by the security detection request from the target address space as the target data object based on the memory mapping relationship comprises: Controlling the first thread module to access the target address space based on the memory mapping relationship; and obtaining the target kernel data monitored by the security detection request as the target data object from the target address space; or, Control the first thread module to execute the first kernel function of the virtualization instance, and control the first kernel function based on the memory mapping relationship to obtain the target kernel data monitored by the security detection request as the target data object from the target address space. The method according to claim 5, wherein the step of using the second thread module to mount a hook function on the target kernel function that the security detection request requests to monitor comprises: Using the second thread module to obtain the identifier of the target kernel function, the identifier of the tracking point in the target kernel function, and the identifier of the hook function from the security detection request; Based on the identifier of the hook function, obtaining the code of the hook function; Based on the memory mapping relationship and the identifier of the target kernel function, determining the code of the target kernel function from the target address space; Determining the tracking point in the code of the target kernel function according to the identifier of the tracking point; In the target address space, the code of the hook function is mounted on the tracking point. The method according to claim 5, wherein the target kernel function is a process management function; the target kernel function is obtained from the target address space in the running process based on the memory mapping relationship. The kernel data generated in is used as the target data object, including: Based on the memory mapping relationship, access the target address space; From the target address space, kernel data generated by the target process managed during the execution of the process management function is obtained as the target data object. The method according to any one of claims 3 to 8, wherein the receiving the security detection request sent by the security detection program comprises: receiving the security detection request sent by the security detection program through a security detection service interface provided by the virtualization manager; Accordingly, the method further includes: converting the target data object into a target protocol format supported by the security detection service interface; and providing the target data object in the target protocol format to the security detection program through the security detection service interface. The method according to any one of claims 5 to 8, wherein before creating the first thread module, the second thread module or the third thread module, it further comprises: Obtaining an identifier of a target virtualization instance introspection mode from the security detection request, wherein the target virtualization instance introspection mode is at least one virtualization instance introspection mode selected by the security detection program from a plurality of virtualization instance introspection modes according to a security detection requirement for performing security detection on the virtualization instance, and different virtualization instance introspection modes correspond to different thread modules; According to the identifier of the introspection mode of the target virtualization instance, a target thread module to be created is determined; the target thread module includes at least one of the first thread module, the second thread module and the third thread module. According to the method according to claim 10, the target data object includes the target kernel data that the security detection request requests to monitor; and/or, the kernel data generated during the operation of the target kernel function that the security detection request requests to monitor; and/or, the kernel data that the security detection request requests to use to perform security detection on the virtualized instance is concerned about. A virtualization instance introspection method, wherein the method is applied to a security detection program deployed on a host machine, the host machine also has a virtualization manager and a virtualization instance deployed on it, and the kernel address space of the virtualization instance is mapped to a target address space in the user state address space of the host machine; the method comprises: According to the security detection requirement for the virtualized instance, a target virtualized instance introspection mode is selected from a plurality of virtualized instance introspection modes; Generate a security detection request according to the identifier of the introspection mode of the target virtualization instance; Sending the security detection request to the virtualization manager, so that the virtualization manager obtains a target data object associated with the security detection request from the target address space based on a memory mapping relationship between the kernel address space of the virtualization instance and the user state address space of the host machine and an identifier of the introspection mode of the target virtualization instance, wherein the target data object includes at least part of the kernel data of the virtualization instance; The target data object returned by the virtualization manager is received, and security detection is performed on the virtualization instance according to the target data object. The method according to claim 12, wherein the selecting a target virtualization instance introspection mode from a plurality of virtualization instance introspection modes according to a security detection requirement for performing security detection on the virtualization instance comprises: When the security detection requirement indicates that the virtualized instance is sensitive to service performance, determining the target The virtualization instance introspection mode is a first virtualization instance introspection mode; the first virtualization instance introspection mode is a mode in which the virtualization manager controls the first thread module to obtain the target kernel data monitored by the security detection request from the target address space based on the memory mapping relationship as the target data object; In the case where the security detection requirement indicates that the virtualization instance is sensitive to the timeliness of security detection, determining that the target virtualization instance introspection mode is a second virtualization instance introspection mode; the second virtualization instance introspection mode is a mode in which the virtualization manager controls the second thread module to use the hook function mounted on the target kernel function of the virtualization instance to obtain the kernel data generated by the target kernel function during operation as the target data object; When the security detection requirement indicates that the logical complexity of the security detection on the virtualization instance is the set logical complexity, the target virtualization instance introspection mode is determined to be the third virtualization instance introspection mode; the third virtualization instance introspection mode is a mode in which the virtualization manager controls the third thread module to create a target security detection thread and obtains the kernel data output by the target security detection thread as the target data object; the target security detection thread runs as a user-mode program on the operating system of the virtualization instance based on the pre-packaged system call interface of the virtualization instance, and obtains the kernel data of its concern from the target address space based on the memory mapping relationship. An electronic device, wherein the electronic device can be implemented as a host machine, a virtualization manager, a virtualization instance managed by the virtualization manager, and a security detection program located outside the virtualization instance are deployed on the host machine; the virtualization manager provides a security detection service interface to the security detection program to interact with the security detection program; The electronic device further comprises: a memory and a processor; the memory stores a program code corresponding to the virtualization manager and the security detection program; Wherein, the processor is coupled to the memory and is used to execute the program code corresponding to the virtualization manager to implement the steps in the method described in any one of claims 3-11; and is used to execute the security detection program to implement the steps in the method described in any one of claims 12-13. A computer-readable storage medium storing computer instructions, wherein when the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the method according to any one of claims 3 to 13. A computer program product comprises a computer program, which, when executed by a processor, implements the steps in the method according to any one of claims 3 to 13.