Research On Virtual Machine Anomaly Detection Based On Context

With the continuous development and improvement of cloud computing technology,virtualization technology has become one of the core features of the future network development,and more and more business and services will be deployed to the cloud platform.Virtual machine,as the main carrier of cloud platform,provides storage,computing and other resources for business and services.However,due to resource competition and other reasons,the virtual machine may function abnormally in the running process.However,due to the deployment of large-scale virtual machines in cloud computing environment,it has the characteristics of high dynamic and large data scale,which makes the traditional detection methods of virtual machine abnormal behavior can not adapt to the cloud computing environment under the virtualization structure.This article takes into account the limitations of virtual machine abnormal behavior detection methods at the current stage,and conducts relevant research work on detection of abnormal behavior of virtual machines.It analyzes and summarizes the advantages and disadvantages of traditional anomaly detection methods at this stage.Based on this,based on virtual The characteristics of the environment,a set of virtual machine anomaly detection system was designed,an adaptive periodic data transmission strategy was proposed to solve the problem of virtual machine performance data transmission,and a virtual machine operating environment clustering algorithm was proposed to place virtual machines with similar operating environments.Detection is performed in the same cluster,and a context-based virtual machine anomaly detection method is used to detect and judge the running state of the monitored virtual machine.Solved the problem of low accuracy and high false alarm rate in the current virtual machine anomaly detection.The work accomplished in this paper is as follows:(1)By studying the resource availability of virtual machine working mode,the system framework of virtual machine anomaly detection is proposed,and the flow of the whole detection is explained in detail.(2)In the traditional data transmission mode,the data transmission operation is performed at a fixed time interval,which can not meet the high dynamic requirement in the virtual environment.Therefore,an adaptive periodic data transmission strategy is proposed in this paper,which sets the threshold to judge the performance of the virtual machine Fluctuation,and then dynamically adjust the data transmission time interval,which effectively solves the problem that the traditional data transmission mode can not sense the fluctuation of the data of the monitored virtual machine performance index.(3)For the traditional anomaly detection methods can not be well adapted to the anomaly detection problem of multi-nodes in the virtual environment,this paper presents a virtual machine operating environment clustering algorithm and a context-based virtual machine abnormal data stream detection method.First,the virtual environment with similar operating environment The machine is placed in the same cluster for detection,and then PCA is used to reduce the dimension of the original data set for data processing,and the context information between the nodes is used to determine whether the virtual machine has abnormal data flow..(4)According to the above work,the accuracy and recall rate of this method in CPU fault,memory fault and I/O fault are verified by the way of fault injection in the experiment,and compared with the other two anomaly detection methods.It is found that this method is effective in detecting virtual machine anomalies.