VM processes state detection by hypervisor tracing

Abstract

The diagnosis of performance issues in cloud environments is a challenging problem, due to the different levels of virtualization, the diversity of applications and their interactions on the same physical host. Moreover, because of privacy, security, ease of deployment and execution overhead, an agent-less method, which limits its data collection to the physical host level, is often the only acceptable solution.In this paper, a precise host-based method, to recover wait state for the processes inside a given Virtual Machine (VM), is proposed. The virtual Process State Detection (vPSD) algorithm computes the state of processes through host kernel tracing. The state of a virtual Process (vProcess) is displayed in an interactive trace viewer (Trace Compass) for further inspection. Our proposed VM trace analysis algorithm has been opensourced for further enhancements and for the benefit of other developers. Experimental evaluations were conducted using a mix of workload types (CPU, Disk, and Network), with different applications like Hadoop, MySQL, and Apache. vPSD, being based on host hypervisor tracing, brings a lower overhead (around 0.03%) as compared to other approaches.

A Method for Malware Analysis by Virtual Machine Introspection Technique

“…Traditional malware monitoring tools are installed in the physical host, they trust in the integrity of the host, however, they are vulnerable to being infected by malware and delivering erroneous results about monitoring [10]. The approach proposed in this paper is based on Virtual Machine Introspection (VMI) [11] technique to obtain the memory image of a Virtual Machine (VM), from outside, in this case, with the help of the VirtualBox API [12], analyze its running processes, threads, network connections, and open files with the use of the Volatility Framework [13] and finally, report this information in a monitoring register.…”

“…Virtual Machine Introspection is a technique to analyze the memory of a given VM to detect its internal activities from outside over the Virtual Machine Monitor layer [10], [11]. Such activities are related with memory, disk, CPU registers, network connections and available kernel symbols of the VM [15,16].…”