Secure and Flexible Monitoring of Virtual Machines

Payne, Bryan D.; Carbone, Martim; Lee, Wenke

doi:10.1109/acsac.2007.10

Cited by 243 publications

(70 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hence, many studies exploit virtualization to provide application integrity but assume that the hypervisor is trusted [Keller et al 2010], [Hofmann et al 2011], [Azab et al 2009], [Xiong et al 2011]. This is the case of solutions based upon virtual machine introspection [Garfinkel and Rosenblum 2003] [Bryan D. Payne and Martim Carbone and Wenke Lee 2007] ], which check the memory of a VM for compromise, and rely on the data gathered from a introspection interface exported by the hypervisor itself. However, in these scenarios, should a hypervisor be compromised, either fake data might be returned by the introspection interface or, worst, other VMs resident on the same host might by attacked from the compromised hypervisor.…”

Section: Discussionmentioning

confidence: 99%

“…It is important to realize that such trust assumptions, as well as other security assumptions, are not fixed, but change in time owing to changes in the tech-nology and the discovery of new vulnerabilities amongst others. Threat models for virtualized systems have considerably evolved over the years, and, therefore, research solutions have also become increasingly sophisticated to cope with them [Garfinkel and Rosenblum 2003], [Bryan D. Payne and Martim Carbone and Wenke Lee 2007], ]. For example, early studies assumed the hypervisor of a remote host to be trusted, and used this assumption to build a trusted chain of enforcement [Keller et al 2010], [Hofmann et al 2011], [Azab et al 2009], [Xiong et al 2011].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Evolution of Attacks, Threat Models, and Solutions for Virtualized Systems

Sgandurra

Lupu

2016

ACM Comput. Surv.

View full text Add to dashboard Cite

Virtualization technology enables Cloud providers to efficiently use their computing services and resources. Even if the benefits in terms of performance, maintenance, and cost are evident, virtualization has also been exploited by attackers to devise new ways to compromise a system. To address these problems, research security solutions have considerably evolved over the years to cope with new attacks and threat models. In this work we review the protection strategies proposed in the literature and show how some of the solutions have been invalidated by new attacks, or threat models, that were previously not considered. The goal is to show the evolution of the threats, and of the related security and trust assumptions, in virtualized systems which have given rise to complex threat models and the corresponding sophistication of protection strategies to deal with such attacks. We also categorize threat models, security and trust assumptions, and attacks against a virtualized system at the different layers, in particular hardware, virtualization, OS, application.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Evolution of Attacks, Threat Models, and Solutions for Virtualized Systems

Sgandurra

Lupu

2016

ACM Comput. Surv.

View full text Add to dashboard Cite

show abstract

“…The introspection of a paravirtualised guest VM is possible using libxc, a blktap driver and the xen store library . Xen_Access [13] is a good demonstration of memory and disk introspection with the Xen hypervisor. The introspection code remains safe, as it resides in a secure VM (Dom 0).…”

Section: Introspection Using Xen Librariesmentioning

confidence: 99%

“…It has already been shown [13,17] that VT microprocessor support features can be used for introspection activities. Useful information related to guest VM implementation can be retrieved by monitoring the VM control structure (VMCS) of the processor.…”

Section: Introspection Using Virtualization Supportmentioning

confidence: 99%

Virtual machine introspection: towards bridging the semantic gap

Tapaswi

2014

J Cloud Comp

View full text Add to dashboard Cite

Virtual machine introspection is a technique used to inspect and analyse the code running on a given virtual machine. Virtual machine introspection has gained considerable attention in the field of computer security research. In recent years, it has been applied in various areas, ranging from intrusion detection and malware analysis to complete cloud monitoring platforms. A survey of existing virtual machine introspection tools is necessary to address various possible research gaps and to focus on key features required for wide application of virtual machine introspection techniques. In this paper, we focus on the evolution of virtual machine introspection tools and their ability to address the semantic gap problem.

show abstract

“…VMI is used in many researches to offload security systems to the outside of VMs. XenAccess [26] is a monitoring library for VMI and Lib-VMI [27] is an extended version of XenAccess. These libraries enable IDS applications on a Host OS to introspect the memory and disks of other VMs.…”

Section: Related Workmentioning

confidence: 99%

Design of Function for Tracing Diffusion of Classified Information for IPC on KVM

Fujii

Sato

Yamauchi

et al. 2016

Journal of Information Processing

View full text Add to dashboard Cite

Abstract:The leaking of information has increased in recent years. To address this problem, we previously proposed a function for tracing the diffusion of classified information in a guest OS using a virtual machine monitor (VMM). This function makes it possible to grasp the location of classified information and detect information leakage without modifying the source codes of the guest OS. The diffusion of classified information is caused by a file operation, child process creation, and inter-process communication (IPC). In a previous study, we implemented the proposed function for a file operation and child process creation excluding IPC using a kernel-based virtual machine (KVM). In this paper, we describe the design of the proposed function for IPC on a KVM without modifying the guest OS. The proposed function traces the local and remote IPCs inside the guest OS from the outside so as to trace the information diffusion. Because IPC with an outside computer might cause information leakage, tracing the IPCs enables the detection of such a leakage. We also report the evaluation results including the traceability and performance of the proposed function.

show abstract

Secure and Flexible Monitoring of Virtual Machines

Cited by 243 publications

References 14 publications

Evolution of Attacks, Threat Models, and Solutions for Virtualized Systems

Evolution of Attacks, Threat Models, and Solutions for Virtualized Systems

Virtual machine introspection: towards bridging the semantic gap

Design of Function for Tracing Diffusion of Classified Information for IPC on KVM

Contact Info

Product

Resources

About