Developing a virtual network environment for analyzing malicious network behavior

QEMU, an excellent PC simulator which emulates the entire hardware components, is widely used to construct virtual networks. But it's restricted by efficiency and security. In order to solve these problems, the authors design a new component for connecting multiple virtual machines (VMs) to the host machine so as to build an emulated network environment effectively and easily. This paper provides the component called VSFilter for every QEMU guest to forward network packets to the exact guest system. All the network packets coming from the emulated network card are designed to go through VSFilter, and then delivered to physical network interface. Any disallowed packets are discarded, while allowed packets are forwarded to the designated destination directly. Accordingly, this paper develops a manageable, high performance and efficiency virtual network for analyzing malicious activities on the Internet.