JP7310885B2 - Virtual Machine Control System, Virtual Machine Control Method, and Control Program - Google Patents

Description

The present disclosure relates to a virtual machine control device, a virtual machine control system, a virtual machine control method, and a non-transitory computer-readable medium storing a program.

With the recent increase in cyber-attacks, information security measures in organizations are becoming more and more important. An event that may pose a threat to information security is called an incident, and incident management to prepare for the occurrence of an incident is being studied (see Non-Patent Document 1). In particular, measures after the occurrence of an incident (incident response) are important (for example, see Non-Patent Document 2 and Non-Patent Document 3).

As a post-incident operation, it is essential to conduct a fact-finding investigation (incident investigation) based on the information logs recorded in the information devices that make up the network system and the logs of the communication network. Therefore, the importance of information log management, such as information log collection guidelines and information log collection mechanisms, in various systems, including core systems, has been re-recognized.

Targeted attacks, which are a type of cyber-attack that causes particularly large damage, move between terminals within the target network and spread the damage, so it is necessary to collect communication logs between terminals on the internal network It is essential. In general, inter-terminal communication logs are collected by capturing packets flowing in the network between terminals or by software installed in the terminals.

Furthermore, due to the development of cloud-related technologies and the benefits of mobility, fault tolerance, and price, an increasing number of organizations are introducing virtual terminal services such as thin clients placed in the cloud (for example, Non-Patent Document 4 reference). Therefore, collecting logs for the purpose of incident investigation in a cloud environment has also become important.

However, when a user of a terminal in a cloud environment tries to collect communication logs between terminals in the cloud for the purpose of investigating incidents caused by cyberattacks, it is difficult to collect communication logs between terminals within the cloud. occurs.

That is, regarding the collection of internal communications between a plurality of virtual machines arranged on the same virtual machine host, continuous collection from within the same virtual machine host or continuous collection within the virtual machine Stress memory input/output (IO) and disk IO. This causes performance degradation for all virtual machines stored on the virtual machine host. A virtual machine host is a so-called physical machine.

On the other hand, in order to collect communication logs between terminals in the cloud, a method of installing a device for collecting communication logs outside the virtual machine host (normal monitoring method) is also conceivable. With this method, it is possible to collect communication logs between virtual machines within a virtual machine host and the outside of the virtual machine host (external networks, other virtual machine hosts, or other communication devices). However, this method has the problem that communication logs between multiple virtual machines placed on the same virtual machine host cannot be collected.

Particularly in targeted attacks, for example, multiple machines belonging to the same department may be attacked. In other words, in a targeted attack, for example, it is conceivable that other machines having attribute information similar to the attribute information of the first attacked machine will be attacked in succession. Note that the attribute information refers to, for example, specifications of the machine, or any distinguishable characteristics of a single or multiple users (users) who use the machine. The attribute information includes, for example, the OS (Operation System) running on the machine, the type or name of the application, or the department or position to which the user using the machine belongs.

Therefore, if an incident-related communication occurs between multiple virtual machines stored in the same virtual machine host, there is a possibility that the inter-terminal communication log cannot be collected as a network log by the normal monitoring method described above. This means that there will be omissions in the inter-terminal communication logs that serve as evidence in incident investigations.

Here, whether or not the inter-terminal communication log required for incident investigation can be collected from outside the virtual machine host depends on the virtual machine management method, ie, in which virtual machine host each virtual machine is placed.

For example, Patent Literature 1 and Patent Literature 2 are known as techniques related to management of virtual machines in a cloud environment. In Patent Document 1, it is possible to calculate the network cost when a new virtual machine is operated on a certain physical machine using communication permission information and network distance between physical machines in which a plurality of virtual machines are stored. disclosed. This calculation result can minimize the cost of the entire network system. Further, Patent Literature 2 discloses a method of arranging virtual machines based on the level of virtual machines requested by users and the attributes of physical machines.

Japanese Patent No. 5377775 JP 2013-3946 A

JPCERT Coordination Center, “CSIRT Guide”, Internet <URL: https://www.jpcert.or.jp/csirt_material/files/guide_ver1.0_20151126.pdf> Ponemon Institute, “Ponemon Institute's 2017 Cost of Data Breach Study: Global Overview,” Internet <URL: https://www-01.ibm.com/marketing/iwm/dre/signup?source=urx-15763> Information-technology Promotion Agency, Japan, “Cyber Rescue Team (J-CRAT) Analysis Report 2015, Analysis of Attack Campaigns Relentlessly Targeting Specific Industries,” Internet <URL: https://www.ipa.go.jp/files /000053445.pdf> IDC Japan, “Announcement of domestic client virtualization related market forecast”, Internet <URL: https://www.idcjapan.co.jp/Press/Current/201806251Apr.html> Ward, J. H., Jr., "Hierarchical Grouping to Optimize an Objective Function," Journal of the American Statistical Association, 58, p.236-244.

However, the related art only discloses reduction of the network load of the entire cloud system or optimal arrangement of virtual machines that satisfies the requirements of virtual machines requested by users. In other words, the related art does not disclose how to easily collect communication logs between virtual machines with similar attribute information necessary for incident investigation in a cloud environment. Therefore, the related art has a problem that the security performance cannot be sufficiently improved.

For example, in the method disclosed in Patent Document 1, a certain virtual machine and another virtual machine that communicates with the certain virtual machine are arranged on the same virtual machine host in order to reduce the network load of the entire system. be. Therefore, a plurality of other virtual machines that communicate with a certain virtual machine are all collectively arranged in the same virtual machine host as the certain virtual machine. Here, there is a high possibility that attribute information of a plurality of virtual machines collectively arranged on the same virtual machine host are similar. For example, a group of terminals (virtual machines) that connect to a certain server may belong to the same job or department. Therefore, in the method disclosed in Patent Document 1, in a cloud environment, it is difficult to collect communication logs between virtual machines with similar attribute information necessary for incident investigation. cannot be improved.

Further, in the method disclosed in Patent Document 2, each virtual machine is arranged in a virtual machine host that satisfies the required level of the virtual machine. As a result, multiple virtual machines with similar requirements are clustered together on the same virtual machine host. Here, there is a high possibility that the attribute information of virtual machines that require the same required level are similar in terms of user duties, job titles, departments, and the like. Therefore, in the method disclosed in Patent Document 2, it is difficult to collect communication logs between virtual machines with similar attribute information necessary for incident investigation in a cloud environment, and as a result, security performance is not sufficiently improved. cannot be improved.

An object of the present disclosure is to solve such problems. That is, an object of the present disclosure is to provide a virtual machine control device, a virtual machine control system, a virtual machine control method, and a non-transitory computer-readable medium storing a program that can improve security performance. is.

A virtual machine device according to the present disclosure includes: communication terminal information receiving means for receiving attribute information of a plurality of virtual machines; and determining similarity of attribute information of the plurality of virtual machines received by the communication terminal information receiving means. a similarity determination means; and a terminal arrangement means for distributing and arranging the plurality of virtual machines determined by the similarity determination means to have similar attribute information in at least two or more virtual machine hosts. .

Further, the virtual machine control method according to the present disclosure includes a step of receiving attribute information of a plurality of virtual machines, a step of determining a degree of similarity of the received attribute information of the plurality of virtual machines, and determining whether the attribute information is similar. distributing and arranging the plurality of virtual machines determined to be present in at least two or more virtual machine hosts.

Furthermore, the non-transitory computer-readable medium according to the present disclosure includes a process of receiving attribute information of a plurality of virtual machines, a process of determining similarity of the received attribute information of the plurality of virtual machines, and A program for causing a computer to execute a process of distributing and arranging the plurality of virtual machines determined to be similar to at least two or more virtual machine hosts is stored.

According to the present disclosure, it is possible to provide a virtual machine control device, a virtual machine control system, a virtual machine control method, and a non-transitory computer-readable medium storing a program that can improve security performance. .

1 is a block diagram showing a configuration example of a virtual machine control system according to a first embodiment; FIG. 2 is a block diagram showing an overview of a virtual machine control device provided in the virtual machine control system shown in FIG. 1; FIG. 2 is a block diagram showing a specific configuration example of a virtual machine control device provided in the virtual machine control system shown in FIG. 1; FIG. 4 is a diagram showing a specific example of attribute information of each virtual machine received by a communication terminal information receiving unit provided in the virtual machine control device shown in FIG. 3; FIG. 4 is a diagram showing a specific example of attribute information of each virtual machine host stored in a host requirement storage unit provided in the virtual machine control device shown in FIG. 3; FIG. 4 is a diagram showing a specific example of a feature vector of each virtual machine calculated by a data converter provided in the virtual machine control device shown in FIG. 3; FIG. FIG. 3 is a diagram showing the relationship between each virtual machine and a virtual machine host on which each virtual machine is arranged; 4 is a flowchart showing the operation of the virtual machine control device shown in FIG. 3; 4 is a dendrogram visualizing the progress of clustering by a cluster calculation unit provided in the virtual machine control device shown in FIG. 3; FIG. 4 is a flow chart showing details of a method of determining the placement destination of each virtual machine by the virtual machine control device shown in FIG. 3 ; FIG.

Embodiments of the present disclosure will be described below with reference to the drawings. In each drawing, the same reference numerals are given to the same or corresponding elements, and redundant description will be omitted as necessary for clarity of description.

<Embodiment 1>
First, the configuration of the virtual machine control system according to this embodiment will be described using FIG. FIG. 1 is a block diagram showing a configuration example of a virtual machine control system 1. As shown in FIG.

A virtual machine control system 1 shown in FIG. 1 is a system that arranges a virtual machine in a virtual machine host so that the communication log of the virtual machine can be easily collected from outside the virtual machine host.

Specifically, the virtual machine control system 1 is composed of a virtual machine control device 100 , a network 2 , a plurality of virtual machine hosts 200 and a communication history recording device 300 . A virtual machine control device 100 , a plurality of virtual machine hosts 200 and a communication history recording device 300 are connected via a network 2 .

Note that the network 2 may be a wired network or a wireless network. Also, the network 2 may be, for example, a network in a data center to which a plurality of virtual machine hosts 200 are connected, or a network logically configured using a VPN or the like. Any other network may be used. Note that VPN is an abbreviation for Virtual Private Network. In the following description, the network 2 is assumed to be a normal IP (Internet Protocol) network.

The virtual machine control device 100 determines the virtual machine host 200 to which each virtual machine is to be placed, based on the obtained attribute information of each virtual machine and the pre-stored attribute information of each virtual machine host 200. do. At this time, the virtual machine control device 100 determines the virtual machine host 200 to which each virtual machine is placed so that the communication log between the virtual machines can be easily collected by the communication history recording device 300 . Note that the virtual machine control device 100 may be a dedicated analysis device, or may be realized by a general-purpose device such as a personal computer.

Each virtual machine host 200 is a so-called physical machine, and is a host computer that stores a plurality of virtual machines. Virtual machines stored on each virtual machine host 200 can communicate with other virtual machines stored on the same virtual machine host, as well as other virtual machines stored on different virtual machine hosts and other communications. It can communicate with the device via the network 2 .

The communication history recording device 300 is a device that receives communication information that can be collected in the network 2 using wireless or wired communication, and records the collected communication information.

<<Overview of Virtual Machine Control Device 100>>
Next, an overview of the virtual machine control device 100 according to the present embodiment will be described with reference to FIG. FIG. 2 is a block diagram showing an overview of the virtual machine control device 100. As shown in FIG.

As shown in FIG. 2, the virtual machine control device 100 includes a communication terminal information receiving section (communication terminal information receiving means) 101, a similarity determination section (similarity determination means) 110, and a communication terminal placement section (terminal placement means). ) 105 .

The communication terminal information receiving unit 101 receives attribute information of a virtual machine scheduled to be placed in one of the plurality of virtual machine hosts 200 using wireless or wired communication.

The similarity determination unit 110 determines the similarity of attribute information of one or more virtual machines received by the communication terminal information reception unit 101 .

The communication terminal arrangement unit 105 does not centrally arrange a plurality of virtual machines whose attribute information is determined to be similar by the similarity degree determination unit 110 to the same virtual machine host 200, but arranges at least two or more virtual machines. are distributed to the virtual machine hosts 200 . In other words, the communication terminal placement unit 105 places a plurality of virtual machines determined by the similarity determination unit 110 to have similar attribute information in different virtual machine hosts 200 as much as possible.

As a result, the virtual machine control device 100 can store communication logs between virtual machines with similar attribute information necessary for incident investigation in a cloud environment by the communication history recording device 300 installed outside the plurality of virtual machine hosts 200 . can be easily collected using In other words, the virtual machine control device 100 can sufficiently improve security performance.

<<Specific Configuration Example of Virtual Machine Control Device 100>>
Next, details of the virtual machine control device 100 according to the present embodiment will be described with reference to FIG. FIG. 3 is a block diagram showing a specific configuration example of the virtual machine control device 100. As shown in FIG.

As shown in FIG. 3, the virtual machine control device 100 includes a communication terminal information receiving section 101, a host requirement storage section 102, a similarity determination section 110, a communication terminal placement section 105, and a placement information storage section . The similarity determination unit 110 includes a data conversion unit (data conversion means) 103 and a cluster calculation unit (cluster calculation means) 104 . Note that the configuration of the virtual machine control device 100 is not limited to the configuration shown in FIG. 3, and can be appropriately changed to another configuration capable of realizing functions equivalent to the configuration shown in FIG.

The communication terminal information receiving unit 101 receives attribute information of a virtual machine scheduled to be placed in one of the plurality of virtual machine hosts 200 using wireless or wired communication.

FIG. 4 is a diagram showing a specific example of attribute information of each virtual machine received by the communication terminal information receiving unit 101. As shown in FIG. In the example of FIG. 4, the terminal IP (IP address) of each virtual machine, and the attribute information of the virtual machine having the terminal IP, such as "department", "usage", "security requirements", "network requirements", and , "Communication Destinations", and a combined table are shown. The attribute information of each virtual machine received by the communication terminal information receiving unit 101 is not limited to the above contents. It may also include information such as the memory capacity required for the machine.

The host requirement storage unit 102 holds attribute information of each of the plurality of virtual machine hosts 200 that serve as the placement destination (storage destination) of each virtual machine.

FIG. 5 is a diagram showing a specific example of attribute information of each virtual machine host 200 held by the host requirement storage unit 102. As shown in FIG. As shown in FIG. 5, for example, a table 41 shows combinations of the IP of each virtual machine host 200 and the corresponding virtual machine host identifier. Table 42 also shows combinations of each virtual machine host identifier and its corresponding "security requirement." Further, a table 43 shows a list of "departments", a table 44 shows a list of "terminal uses", and a table 45 shows a list of "security requirements".

The data conversion unit 103 refers to the attribute information of each virtual machine and the attribute information of each virtual machine host 200, converts the attribute information of each virtual machine received by the communication terminal information reception unit 101 into a data structure representing the distance. to a feature vector of .

FIG. 6 is a diagram showing a specific example of the feature vector of each virtual machine calculated by the data conversion unit 103. As shown in FIG. The example of FIG. 6 shows a table in which a terminal identifier, which is an identifier of each virtual machine, and a feature vector of the virtual machine having the terminal identifier are combined. Here, the feature vector of each virtual machine is composed of a combination of all kinds of elements (for example, "sales department" and "development department") of each attribute (for example, "department"). , the corresponding element is represented by 1, and the non-corresponding element is represented by 0. In the example of FIG. 6, the number of elements (types) of each attribute depends on the tables 43 and 44 held by the host requirement storage unit 102. FIG. Also, in the example of FIG. 6, in addition to the terminal identifier of each virtual machine and the feature vector corresponding thereto, the terminal IP of the virtual machine having that terminal identifier is shown.

The cluster calculation unit 104 classifies each of the plurality of feature vectors output from the data conversion unit 103 into an arbitrary number of clusters based on their similarities. The classified clusters and virtual machine identifiers included in them are supplied to the communication terminal placement unit 105 .

For each cluster output from the cluster calculation unit 104, the communication terminal placement unit 105 does not concentrate and place a plurality of virtual machines included in the cluster on the same virtual machine host 200, but places at least two virtual machines. are distributed to the virtual machine hosts 200 . At this time, placement requirements and network requirements are also taken into consideration. Details of deployment requirements and network requirements will be described later.

The placement information storage unit 106 holds the placement information of each virtual machine placed on one of the virtual machine hosts 200 by the communication terminal placement unit 105 .

FIG. 7 is a diagram showing the relationship between each virtual machine and the virtual machine host on which each virtual machine is arranged. The example of FIG. 7 shows a table in which the terminal identifier assigned to each virtual machine, the terminal IP of the virtual machine, and the virtual machine host identifier of the arrangement destination are combined.

<<Virtual machine control operation according to the present embodiment>>
Next, the virtual machine control operation according to the present embodiment will be explained using FIG.
FIG. 8 is a flowchart showing the operation of the virtual machine control device 100. As shown in FIG.

As shown in FIG. 8, in the calculation process by the virtual machine control device 100, first, the communication terminal information including the attribute information of one or more virtual machines is received by the communication terminal information receiving unit 101 (S001).

After that, based on each communication terminal information received by the communication terminal information receiving section 101, the data conversion section 103 generates a feature vector corresponding to the communication terminal information (S002).

In the feature vector generation process, first, based on the communication terminal information received by the communication terminal information receiving section 101, an attribute vector of an arbitrary attribute described in the communication terminal information is created (S003).

Specifically, first, prepare a vector consisting of all types of elements (for example, “sales department” and “development department”) for each attribute (for example, “department”) held in the host requirement storage unit 102. , initialize all the elements that make up this vector to zero. After that, among the plurality of elements forming the initialized vector, the element corresponding to the attribute of the virtual machine included in the communication terminal information is rewritten from 0 to 1. Thereby, an attribute vector for each attribute is formed (S003).

One or more attribute vectors are then combined to form a feature vector corresponding to the virtual machine. The order of the plurality of attribute vectors to be combined may be, for example, the order of the attributes described in the communication terminal information, the order obtained by sorting the attribute names in ascending order, or an arbitrary index of the attribute names. It may be the order obtained by sorting using In this embodiment, one feature vector is formed by combining a plurality of attribute vectors in the order of the attributes described in the communication terminal information (S004).

As an example, the operation when the communication terminal information shown in FIG. 4 is received by the communication terminal information receiving unit 101 and the attribute information includes two attributes "department" and "usage". explain. In this case, for each terminal IP in the communication terminal information received by communication terminal information receiving section 101, a feature vector is calculated and an arbitrary terminal identifier that is unique within the network is assigned. Thereby, a feature vector group as shown in FIG. 6 is obtained.

For example, in a virtual machine whose terminal IP indicates "192.168.0.11", the type (element) of the attribute "Department" indicates "Sales Department" and the type of the attribute "Usage" indicates "Client". is shown. Therefore, the attribute vector of "department" is "100", and the attribute vector of "sales department" is "1000". By connecting these attribute vectors in the order of "department" and "use", the feature vector is expressed as "1001000".

After that, the feature vector of each virtual machine output from the data conversion unit 103 is clustered in the cluster calculation unit 104 (S005).

Specifically, by using an arbitrary algorithm such as an agglomerative clustering algorithm, the feature vector group is classified into an arbitrary number of clusters. In the present embodiment, the Ward method (see Non-Patent Document 5) is adopted as the clustering method, the distance is represented by the Euclidean distance, and the threshold is set to 3.0 to set the number of separated clusters to 2. An example will be explained. FIG. 9 shows the results of classifying the feature vectors shown in FIG. 6 into two clusters using the above clustering method (Ward's method).

FIG. 9 is a dendrogram visualizing the progress of clustering by Ward's method. The dotted line in FIG. 9 represents the threshold (3.0 in this embodiment). The feature vectors shown in FIG. 6 are classified into two clusters, cluster 1 and cluster 2, by using the clustering setting of the present embodiment. Specifically, terminal identifiers “M0001”, “M0002”, “M0003” and “M0004” are classified into cluster 1, and terminal identifiers “M0021”, “M0022” and “M0031” are classified into cluster 2. ing.

After that, the communication terminal placement unit 105 distributes one or more virtual machines included in each cluster to the virtual machine hosts for each cluster calculated by the cluster calculation unit 104 while considering the placement requirements and network requirements. (S006).

Specifically, for each cluster calculated by the cluster calculation unit 104, a plurality of virtual machine hosts (placement candidate groups) that satisfy the placement requirements for all virtual machines having terminal identifiers classified into the cluster. A process of selecting one of them is performed.

The arrangement requirement is arbitrary one or a plurality of attribute information selected from the attribute information included in the communication terminal information. Further, the network requirement is attribute information requesting that virtual machines, which are expected to perform high-frequency communication in advance, be arranged on the same virtual machine host. Therefore, a virtual machine having attribute information with "network requirements" of "yes" is arranged in the same virtual machine host 200 as a virtual machine having a terminal IP specified in the attribute information of "communication destination". In the example of FIG. 4, the virtual machine whose terminal IP is "192.168.0.21" has the "network requirements" of "yes", so the terminal IP "192.168" specified in the "destination" .0.22" on the same virtual machine host 200.

A virtual machine host that satisfies the placement requirements of a virtual machine is, for example, when the "network requirements" of the virtual machine are other than "Yes", one that has the same level or higher level attribute information for all placement requirements of the virtual machine. or multiple virtual machine hosts. Alternatively, a virtual machine host that satisfies the placement requirements of a virtual machine is, for example, a host whose attributes of the virtual machine are a subset of the attributes of the virtual machine host when the "network requirement" of the virtual machine is other than "yes". One or more virtual machine hosts.

For example, if the placement requirements include attribute information of "security requirements", a virtual machine host whose attribute information of "security requirements" indicates "high" must have "network requirements" of "none" and "security requirements". satisfies the placement requirements for a "typical" virtual machine.

Communication terminal placement section 105 specifies, for each cluster, a group of placement candidates for all virtual machines classified into the cluster. Then, the communication terminal placement unit 105 evenly distributes all the virtual machines classified into the cluster to each of the virtual machine hosts of the placement candidate group. Alternatively, the communication terminal placement unit 105 assigns all the virtual machines classified into the cluster to the virtual machines of the placement candidate group so that the number of virtual machines placed on each of the virtual machine hosts of the placement candidate group is minimized. Allocate to each machine host.

In the present embodiment, by using the flowchart shown in FIG. 10 and the algorithm of the following formula (1), for each cluster, all the virtual machines classified into the cluster are allocated virtual machines Choose a host. In formula (1), m represents a virtual machine, C represents a cluster to which virtual machine m belongs, and H represents a virtual machine host.

・・・（１）

... (1)

Also, a virtual machine with "network requirements" indicating "yes" is arranged in the virtual machine host where the largest number of virtual machines having the terminal IP described in the communication destination attribute are arranged. If there are a plurality of virtual machine hosts with the largest number of terminal IPs described in the communication destination attribute, the virtual machine host is randomly selected among them.

After that, in the arrangement information storage unit 106, the terminal identifier, the corresponding terminal IP, and the virtual machine host identifier in which the virtual machine is arranged, calculated by the communication terminal arrangement unit 105, in each virtual machine are collected together. Store (S007).

FIG. 7 shows an example of information stored in the arrangement information storage unit 106 when the virtual machine hosts (identifiers H1 and H2) shown in FIG. 5 are provided. In the example of FIG. 7, virtual machines with terminal identifiers "M0001", "M0003", and "M0031" are arranged in the virtual machine host with the identifier H1. Virtual machines with terminal identifiers "M0002", "M0004", "M0021", and "M0022" are arranged in the virtual machine host with the identifier H2.

As described above, the virtual machine control device 100 according to the present embodiment divides a plurality of virtual machines with similar attribute information into at least two or more virtual machines while considering the arrangement requirements and network requirements of the virtual machines. Distributed across hosts. In other words, the virtual machine control device 100 arranges a plurality of virtual machines with similar attribute information in different virtual machine hosts as much as possible while considering the arrangement requirements and network requirements of the virtual machines. As a result, the virtual machine control device 100 can easily record communication logs between virtual machines with similar attribute information necessary for incident investigation in a cloud environment by means of a communication history recording device installed outside a plurality of virtual machine hosts. can be collected. In other words, the virtual machine control device 100 can sufficiently improve security performance.

In the related technology, each virtual machine is arranged in a virtual machine host with the most free storage capacity in a cloud environment from the viewpoint of computational resource efficiency. In other words, related technologies do not consider collection of communication logs for incident investigation when receiving a cyber attack in a cloud environment. On the other hand, the virtual machine control device 100 according to the present embodiment calculates the similarity of attribute information of each virtual machine, and assigns a plurality of virtual machines having similar attribute information to at least two or more virtual machine hosts. They are distributed and placed. As a result, the virtual machine control device 100 records communication logs between virtual machines with similar attribute information necessary for incident investigation in a cloud environment using a communication history recording device installed outside a plurality of virtual machine hosts. Can be easily collected. In other words, the virtual machine control device 100 can sufficiently improve security performance.

Each configuration in the above embodiments is configured by hardware or software, or both, and may be configured by one piece of hardware or software, or may be configured by multiple pieces of hardware or software. Each function (each process) in the embodiment may be realized by a computer having a CPU (Central Processing Unit), memory, and the like. For example, a storage device (storage medium) may store a program for performing the method (processing) in the embodiments, and each function may be realized by executing the program stored in the storage device with a CPU.

Such programs can be stored and provided to computers using various types of non-transitory computer readable media. Non-transitory computer-readable media include various types of tangible storage media. Non-transitory computer-readable media include, for example, magnetic recording media, magneto-optical recording media, CD-ROMs (Read Only Memory), CD-Rs, CD-R/Ws, and semiconductor memories. Magnetic recording media are, for example, flexible disks, magnetic tapes, hard disk drives, and the like. The magneto-optical recording medium is, for example, a magneto-optical disk. The semiconductor memory includes, for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, and RAM (Random Access Memory). The program may also be supplied to the computer on various types of transitory computer readable medium. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. Transitory computer-readable media can deliver the program to the computer via wired channels, such as wires and optical fibers, or wireless channels.

Although the embodiments of the present disclosure have been described in detail above with reference to the drawings, the specific configurations are not limited to those described above, and various design changes can be made without departing from the gist of the present disclosure. etc. is possible.

1 virtual machine control system 2 network 41-45 table 100 virtual machine control device 101 communication terminal information receiving unit 102 host requirement storage unit 103 data conversion unit 104 cluster calculation unit 105 communication terminal placement unit 106 placement information storage unit 110 similarity determination unit 200 virtual machine host 300 communication history recording device

Claims (9)

multiple virtual machine hosts;
a virtual machine control device connected to the plurality of virtual machine hosts via a network;
a communication history recording device for collecting, as information necessary for incident investigation, communication logs between virtual machines with similar attribute information distributed among the plurality of virtual machine hosts;
with
The virtual machine control device
a communication terminal information receiving means for receiving attribute information of a plurality of virtual machines;
a similarity determining means for determining a similarity of attribute information of the plurality of virtual machines received by the communication terminal information receiving means;
terminal arrangement means for distributing and arranging a plurality of virtual machines whose attribute information is judged to be similar by the similarity judgment means to at least two or more virtual machine hosts;
A virtual machine control system with The similarity determination means is
data conversion means for converting the attribute information of the plurality of virtual machines received by the communication terminal information reception means into a feature vector having a data structure representing a distance;
cluster calculation means for classifying the plurality of virtual machines into one or more clusters based on the plurality of feature vectors output from the data conversion means;
has
The terminal arrangement means arranges the virtual machines included in the cluster on the virtual machine host for each cluster, and if the cluster includes two or more virtual machines, the terminal arrangement means arranges the virtual machines included in the cluster. configured to distribute and arrange two or more virtual machines on at least two or more of the virtual machine hosts;
The virtual machine control system according to claim 1. When two or more of the virtual machines are included in the same cluster, the terminal arrangement means arranges the two or more virtual machines contained in the cluster on each of the two or more virtual machine hosts. are configured to be distributed and arranged on the two or more virtual machine hosts so that the number of virtual machines on the
The virtual machine control system according to claim 2. When two or more of the virtual machines are included in the same cluster, the terminal arrangement means distributes the two or more virtual machines included in the cluster equally to each of the two or more virtual machine hosts. configured to be distributed and arranged,
The virtual machine control system according to claim 2. When two or more of the virtual machines are included in the same cluster, the terminal placement means further provides for each of the two or more virtual machines included in the cluster, a placement requirement requested to the virtual machine host and configured to be distributed across the two or more virtual machine hosts to meet network requirements;
The virtual machine control system according to any one of claims 2-4. multiple virtual machine hosts;
a virtual machine control device connected to the plurality of virtual machine hosts via a network;
a communication history recording device for collecting, as information necessary for incident investigation, communication logs between virtual machines with similar attribute information distributed among the plurality of virtual machine hosts;
A virtual machine control method by the virtual machine control device in a virtual machine control system comprising
receiving attribute information for a plurality of virtual machines;
determining the similarity of the received attribute information of the plurality of virtual machines;
a step of distributing and arranging the plurality of virtual machines determined to have similar attribute information to at least two or more virtual machine hosts;
A virtual machine control method with The step of determining the similarity of the received attribute information of the plurality of virtual machines,
converting the received attribute information of the plurality of virtual machines into a feature vector of a data structure representing a distance;
classifying the plurality of virtual machines into one or more clusters based on the plurality of feature vectors;
has
In the step of distributing and arranging the plurality of virtual machines determined to have similar attribute information to at least two or more virtual machine hosts,
For each cluster, the virtual machines included in the cluster are arranged on the virtual machine host, and when the cluster includes two or more virtual machines, the two or more virtual machines included in the cluster distributed over at least two or more of said virtual machine hosts,
The virtual machine control method according to claim 6 . multiple virtual machine hosts;
a virtual machine control device connected to the plurality of virtual machine hosts via a network;
a communication history recording device for collecting, as information necessary for incident investigation, communication logs between virtual machines with similar attribute information distributed among the plurality of virtual machine hosts;
A control program for causing a computer to execute control processing of the virtual machine control device in a virtual machine control system comprising
a process of receiving attribute information of a plurality of virtual machines;
a process of determining the similarity of the received attribute information of the plurality of virtual machines;
a process of distributing and arranging the plurality of virtual machines determined to have similar attribute information to at least two or more virtual machine hosts;
A control program that causes a computer to execute The process of determining the similarity of the received attribute information of the plurality of virtual machines includes:
a process of converting the received attribute information of the plurality of virtual machines into a feature vector of a data structure representing a distance;
A process of classifying the plurality of virtual machines into one or more clusters based on the plurality of feature vectors;
has
In the process of distributing and arranging the plurality of virtual machines determined to have similar attribute information to at least two or more virtual machine hosts,
For each cluster, the virtual machines included in the cluster are arranged on the virtual machine host, and when the cluster includes two or more virtual machines, the two or more virtual machines included in the cluster distributed over at least two or more of said virtual machine hosts,
The control program according to claim 8 .

Images