A Survey on Hypervisor-Based Monitoring

Abstract

When designing computer monitoring systems, one goal has always been to have a complete view of the monitored target and at the same time stealthily protect the monitor itself. One way to achieve this is to use hypervisor-based, or more generally out of virtual machine (VM)-based, monitoring. There are, however, challenges that limit the use of this mechanism; the most significant of these is the semantic gap problem. Over the past decade, a considerable amount of research has been carried out to bridge the semantic gap and develop all kinds of out-of-VM monitoring techniques and applications. By tracing the evolution of out-of-VM security solutions, this article examines and classifies different approaches that have been proposed to overcome the semantic gap—the fundamental challenge in hypervisor-based monitoring—and how they have been used to develop various security applications. In particular, we review how the past approaches address different constraints, such as practicality, flexibility, coverage, and automation, while bridging the semantic gap; how they have developed different monitoring systems; and how the monitoring systems have been applied and deployed. In addition to systematizing all of the proposed techniques, we also discuss the remaining research problems and shed light on the future directions of hypervisor-based monitoring.

BAHK: Flexible Automated Binary Analysis Method with the Assistance of Hardware and System Kernel

“…(11) Check and mark the loops in the traversed nodes. (12) end (13) else (14) Disassemble and parse block (15) while Get instruction ins from block successfully do (16) if ins is a system call instruction or has memory operations then (17) Mark block as abort (18) break (19) else if ins is a direct unconditional jump instruction then (20) Construct the node of target block, and push it to stack_dfs (21) break (22) else if ins is a conditional branch instruction then (23) Construct all successor nodes of block, and push them to stack_dfs (24) break (25) else if ins is an indirect branch instruction or other transfers then (26) Mark block as pending, and save the traversed nodes and execution paths (27) break (28) else if ins is the end_ins then (29) Mark block as the end (30) break (31) else (32) Save the parse result to block en we still need to reexecute part of the instructions in the paths to obtain the real execution path. For two possible…”

“…(13) Get the jump target address target_ins. (14) curr_ins ⟵ target_ins (15) break (16) else if curr_ins is a system call, interrupt or trap instruction then (17) break (18) end (19) else (20) Insert curr_ins and extra analysis code to buf has errors; otherwise the correct value is written to the simulated memory space (iii) Read from the address outside the stack. First we obtain the two memory writes before and after this operation of current thread from the log; meanwhile check if there exists a write to this address by another thread during the period of the two writes.…”

“…In addition, some research works based on virtual machines (VM) or emulators to implement system-wide application analysis will also face the challenge of many types of detection methods [11,12], and the virtual machines themselves will cause difficulties in deployment and analysis efficiency. In recent years, due to the development of hardware technology, many studies have begun to take advantage of hardware features, especially hardware virtualization technology, which has been widely used in cloud computing, access control, vulnerability discovery, and program analysis [13][14][15]. Since the confrontation between analysis and antianalysis exists not only at the kernel level but also in virtualized environments and simulators [16], some studies use more hardware features to further improve the stealthiness of debugging, such as MALT [17] and SPIDER [18].…”

Tenant-Oriented Monitoring for Customized Security Services in the Cloud

“…Baliga et al [2] have demonstrated how easy to launch such an attack by manipulating Linux Netfilter to remove hook functions to packet filtering. To address that, researchers and practitioners have proposed a stream of "out-of-the-box" solutions [3][4][5][6][7][8]. They leverage the ability provided by virtualization, called virtual machine introspection(VMI), to deploy monitoring and protection components in the hypervisor or a privileged VM, which makes the security solutions more robust.…”

VirtAV: an Agentless Runtime Antivirus System for Virtual Machines

“…The external approach is inspired by the feature that the VMM has supervisory privilege on guest VMs. Antivirus software is totally moved out of the VM [8][9] [10], and gets necessary information from the guest OS using VMI techniques [11] [40] [46]. The existing work following this approach can only detect virus in guest files or memory, and can't prohibit it properly.…”