Research On Virtual Machine Introspection And Effect Evaluation Technology For Cyber Security Testbed

With the rapid development of cloud computing,cloud services play an increasingly important role.Cloud services put services in the cloud which reduces the intermediate flow of services and facilitates the use of users.However,the network security problems are also becoming increasingly serious by the development of cloud services.In recent years,cyber attacks represented by DDo S attacks have gradually use cloud services as the main target of attacks.In order to face the new type of cyber attacks,the research of the cyber security testbed has been rapidly progressed.The cyber security testbed is a key research object in various countries in the world.The cyber security testbed can improve people's cyber security awareness and make people more familiar with the new cyber attacks.It can also reduce the damage through the defense against cyber attacks.This paper studies the date low loss acquisition technology and network attack effect evaluation technology in the cyber security testbed,and designs a virtual machine introspection acquisition system for data low loss acquisition technology.The system uses virtual machine introspection technology to eliminate semantic gaps,collect virtual machine data including basic information,memory information and disk information,and use address mapping technology.The memory location information is collected by the memory location technology,and the disk information is collected by the disk mounting technology,and the collection of different operating systems including the Linux operating system and the Windows operating system is supported.In order to test the entire acquisition system,this paper implements the test from two perspectives: function and performance.The functional test is mainly to construct different scenes respectively.It is to investigate whether the acquisition system can timely collect the change information of each data.The performance test mainly uses the benchmark.The internal performance of the Linux virtual machine and the loss of the internal performance of the Windows virtual machine are tested respectively.The experimental results show that the system does not consume more than 5% of the performance of the Linux virtual machine,and the performance consumption of the Windows virtual machine is approximately 10%.The results meet the needs of the cyber security testbed basically.For network attack effect evaluation technology,this paper uses virtual machine introspection technology to collect DDo S attack data.Attack strength,computing resources and network resources are used as condition attributes.Actual service delay is used as a decision attribute,and an evaluation index system for DDo S attack is established.An effect evaluation model based on BP neural network is established andthe neural network model is implemented from three aspects of hidden layer node number,activation function and learning rate.After the optimization,the model was finally evaluated for correctness,stability and redundancy.