Paper Info
Title
Secure Virtualization Environment Based on Advanced Memory Introspection.
Abstract
Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the virtual machine control structure (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.
Year
DOI
Venue
2018
10.1155/2018/9410278
SECURITY AND COMMUNICATION NETWORKS
Field
DocType
Volume
Kernel (linear algebra),Virtualization,Introspection,Microsoft Windows,Virtual machine,Memory forensics,Computer science,Security monitoring,Hypervisor,Computer network,Operating system
Journal
2018
ISSN
Citations 
PageRank 
1939-0114
2
0.45
References 
Authors
18
5
Name
Order
Citations
PageRank
Shuhui Zhang1324.82
Xiangxu Meng230860.76
Lianhai Wang34110.98
Lijuan Xu473.64
Xiaohui Han5175.41