Method for checking compliance of payment application in virtualized environment

A compliance detecting method of payment applications in a virtualized environment, which is used for compliance detection for PCI DSS isolation demand, wherein comprising the following steps:

• collecting network flow across physical machines and across virtual machines in a virtualized environment;
• performing flow pre-processing for the network flow so as to determine each data stream which correspondingly connects two different virtual machines;
• identifying the data stream according to application layer load of the data stream so as to determine whether it is payment application flow to which the payment application corresponds;
• calculating the percentage of the payment application flow in all the data streams;
• determining whether the percentage is smaller than or equal to a predetermined value;
• if it is determined “yes”, a non-compliance state is determined;
• and if it is determined “no”, a compliance state is determined.

A compliance detecting method of payment applications in a virtualized environment, which is used for compliance detection for PCI DSS isolation demand, wherein comprising the following steps:

• collecting network flow across physical machines and across virtual machines in a virtualized environment;
• performing flow pre-processing for the network flow so as to determine each data stream which correspondingly connects two different virtual machines;
• and
• a data stream analyzing and detecting step;
• wherein the data stream analyzing and detecting step comprises the following steps:
• at least determining a virtual machine domain D (VM) to which one payment application corresponds according to all the data streams, and further determining a connection collection C (VMi) of other virtual machines correspondingly connected by each virtual machine VMi among M virtual machines in the virtual machine domain D (VM), wherein M is larger than or equal to 2, 1≤i≤M;
• comparing the virtual machine domain D (VM) of the payment application with a predetermined virtual machine domain D′ (VM) corresponding to the payment application, wherein the predetermined virtual machine domain D′ (VM) is a collection of virtual machines to which the payment application corresponds in a compliance state;
• if D (VM) is equal to D′ (VM), determining whether the connection collection C (VMi) of each virtual machine in the virtual machine domain D (VM) is correspondingly equal to a connection collection C′ (VMf) of each virtual machine VMf in the predetermined virtual machine domain D′ (VM);
• and if it is determined “yes”, a compliance state is determined, wherein f is an integer larger than or equal to 2;
• if D (VM) is not equal to D′ (VM), or C (VMi) is not equal to C′ (VMf), determining that the current virtual machine domain D (VM) is in a non-compliance state,
• wherein the data stream analyzing and detecting step further comprises the following steps:
• identifying the data stream according to application layer load of the data stream so as to determine whether it is payment application flow to which the payment application corresponds;
• calculating the percentage of the payment application flow in all the data streams;
• determining whether the percentage is smaller than or equal to a predetermined value;
• if it is determined “yes”, a non-compliance state is determined;
• and it is determined “no”, a compliance state is determined.