一个基于虚拟机的日志审计和分析系统

SNARE是Linux操作系统的一个日志审计和分析工具，但它容易受到攻击。提出了一个新的方法被用来保护它免受攻击。运用虚拟机监控器的功能，SNARE被移植到运行在虚拟机监控器Xen上的两个虚拟机中，SNARE的两个主要部分——Linux内核补丁和审计后台进程被分隔而分别放入两个被Xen强隔离的虚拟机。Xen提供了两个虚拟机间共享内存的机制，运用这一机制，运行在一个虚拟机上的Linux内核补丁记录并转移审计日志到运行在另一个虚拟机上的审计后台进程。与传统的SNARE相比，新方法使攻击者毁坏或篡改这些日志更加困难。初步的评估表明这个原型是简单而有效的。

Logs auditing and analysis system based on virtual monitor

SNARE is an audit logging and analysis tool for the Linux operating system. However, it is also vulnerable. A new approach was designed to protect SNARE from being tampered. With the capability of virtual machine monitor, SNARE was ported on two virtual machines running over the Xen which was a virtual machine monitor. The SNARE patch for Linux and audit daemon, which were two principal components of SNARE, were separated into two virtual machines isolated strongly by Xen. The mechanism for sharing memory between virtual machines was provided by Xen. By the mechanism, SNARE patch for Linux running on one virtual machine records and transfers the audit logs into the audit daemon running on another virtual machine. Compared with the traditional SNARE, the new method makes it is more difficult to destroy or tamper the audit logs. Preliminary evaluation shows that the prototype is simple and efficient.