基於Hypervisor結構下的惡意網站封鎖機制

An Automatic Malicious Website Blocking Mechanism Based on a Hypervisor Architecture

孫敬智(Ching-chih Sun)

指導教授 ： 許富皓

國立中央大學/資訊電機學院/資訊工程學系碩士在職專班/碩士(2014年)

摘要

由於雲端系統帶來了有效降低成本、整合化統一便利管理、硬體資源最佳化運用，以及系統運作彈性與效能有效提升等好處，促使許多公司企業甚至學院，或多或少都會建構雲端系統與運用雲端服務、運算等相關技術。而在雲端所帶來便利與高彈性之餘，相對的產生了資訊安全防護相關議題，也因為隨著虛擬化技術的運用與廣泛的佈建，企業的資安政策將面臨新的挑戰與轉變。在系統環境的防護上虛擬系統引用虛擬交換器，來處理虛擬機之間的網路封包傳遞，使得網路架構在本質上與傳統實體環境有所差異。此外，既使在虛擬環境中已有妥善的防護設備，仍然難以防範人為操作所帶來的資安問題，例如任意下載與存取各類檔案或資料。
本論文將會依序介紹雲端系統中最常應用的虛擬化技術及其類型，並且也會說明Hypervisor在虛擬化技術中所扮演的角色與其運作架構，同時亦是利用Hypervisor架構中預設提供的virtual switch，結合本研究所開發的程式模組，來建構一項自動化運作機制，輔助virtual switch側錄與防護功能，以期望能夠對虛擬機操作行為進行有效的監控與防禦，達成提高雲端虛擬化環境的系統安全防護。

關鍵字

惡意網站 ； 封鎖機制

並列摘要

As the cloud system brings benefits which effectively reduce costs , integrate , manage system , optimize the using of hardware resources, enhance the flexibility and performance of the system. Prompting many companies and even college more or less construct and use cloud service , cloud computing and related technologies. Although a cloud system brings convenience and higher-flexibility, simultaneously generates information security protection related issues. Also because virtualization technologies are used , disposed and built extensively. Enterprise information security policies will face new challenges and changes. Virtual environments launch a default virtual switch to handle network packets transmission between virtual machines that make the network architecture different from traditional physical network environments essentially. Moreover, there have been an appropriate protection equipment in the virtual environment, but still difficult to guard against the security issue caused by human operation. For example, people arbitrarily download and access each kind of file or data.
This paper will introduce the most popular virtualization technology and type in the cloud system , also describe what Hypervisor play the role in virtualization technology and its operation structure. Simultaneously, we will also use the default virtual switch in Hypervisor structure to combine with program modules of our development to construct an automated operation mechanism. It will assist the virtual switch to sniff and protect. We expect to monitor and defense behavior of operations on virtual machines effectively and reach to improve system security of cloud virtualized environment.

並列關鍵字

Hypervisor

參考文獻

〔6〕Check Point Security Report 2014，13 May 2014，http://www.checkpoint.com/documents/ebooks/security-report-2014/index.html#I。

〔7〕趙驚人，Windows Server 2008 R2虛擬化技術Hyper-V R2，初版，精誠資訊，台北市，民國九十九年七月。

〔17〕鄭進興、潘得源，「建置VMware虛擬化平台Hypervisor based防護機制」，第二十三屆全國資訊安全會議(CISC 2013)，276-283頁，南臺科技大學資訊工程系，台南市，2013年 05 月 23 日。

〔24〕SECURITY GUIDANCE FOR CRITICAL AREAS OF FOCUS IN CLOUD COMPUTING V3.0，Cloud Security Alliance，2011，https://downloads.cloudsecurityalliance.org/initiatives/guidance/csaguide.v3.0.pdf。

﹝1﹞Global Enterprise Server Virtualization Market 2012-2016，2012年12月20日，取自http://www.technavio.com/report/global-server-virtualization-market-2012-2016。