RapidVMI: Fast and multi-core aware active virtual machine introspection

Abstract

Virtual machine introspection (VMI) is a technique for the external monitoring of virtual machines. Through previous work, it became apparent that VMI can contribute to the security of distributed systems and cloud architectures by facilitating stealthy intrusion detection, malware analysis, and digital forensics. The main shortcomings of active VMI-based approaches such as program tracing or process injection in production environments result from the side effects of writing to virtual address spaces and the parallel execution of shared main memory on multiple processor cores.In this paper, we present RapidVMI, a framework for active virtual machine introspection that enables fine-grained, multi-core aware VMI-based memory access on virtual address spaces. It was built to overcome the outlined shortcomings of existing VMI solutions and facilitate the development of introspection applications as if they run in the monitored virtual machine itself. Furthermore, we demonstrate that hypervisor support for this concept improves introspection performance in prevalent virtual machine tracing applications considerably up to 98 times. CCS CONCEPTS• Security and privacy → Virtualization and security.

Memory Analysis Based Estimation of Hook Point by Virtual Machine Monitor

“…VMMs are used for security monitoring of VMs [16,5,2,3,12,6,9,14,7]. VM is used for malware analysis [3,7], VM introspection [5,12,9,11,2], and VM protection [16,17].…”

“…VMMs are used for security monitoring of VMs [16,5,2,3,12,6,9,14,7]. VM is used for malware analysis [3,7], VM introspection [5,12,9,11,2], and VM protection [16,17]. There is various targets for monitoring including memory, file, and behavior of malicious processes.…”

“…Therefore, VMs are suitable for malware analysis. Security monitoring is also used to detect and prevent malicious activities on VMs [5,2]. VMs are used as infrastructure for cloud computing; therefore, detecting and preventing malicious behavior from outside of the VMs is required.…”