Research on Virtual Machine Introspection Technology

doi:10.3969/j.issn.1671-1122.2017.09.015

Abstract

Abstract:

Virtual machine introspection is the technology that takes the internal information of the guest OS from the external of the virtual machine. It overcomes the bottleneck of traditional security technology and therefore is widely concerned by the security field. In recent years, it has been applied in the intrusion detection, malware analysis, digital forensics etc. Especially, it has excellent application prospects in the increasingly prominent cloud security issues. This paper analyzes the realization principle and development history of VMI technology. According the above researches, this paper proposes a new VMI technology classification method and study application of VMI technology. In the final part, this paper analyzes and put forward the existing problems and future development direction of VMI technology.

Key words: virtual machine, cloud security, virtual machine introspection, OS

CLC Number:

TP309.1

Jian ZHANG, Cheng GAO, Liangyi GONG, Zhaojun GU. Research on Virtual Machine Introspection Technology[J]. Netinfo Security, 2017, 17(9): 63-68.

Figures/Tables 3

References 28

[1]	牛鹏飞,张健,常青,等. 基于Xen的异常行为在线检测平台研究与设计[J]. 信息网络安全,2016(9):139-144.
[2]	BAUMAN E, AYOADE G, LIN Z.A Survey on Hypervisor-based Monitoring: Approaches, Applications, and Evolutions[J]. ACM Computing Surveys, 2015, 48(1): 1-33.
[3]	王文旭,张健,常青,等. 云计算虚拟化平台安全问题研究[J]. 信息网络安全,2016(9):163-168.
[4]	李保珲,徐克付,张鹏,等. 虚拟机自省技术研究与应用进展[J]. 软件学报,2016,27(6):1384-1401.
[5]	崔超远,乌云,李平,等. 虚拟机自省中一种消除语义鸿沟的方法[J]. 通信学报,2015,36(8):31-37.
[6]	GARFINKEL T, ROSENBLUM M. A Virtual Machine Introspection Based Architecture for Intrusion Detection[EB/OL]. , 2017-5-11.
[7]	HEBBAL Y, LANIEPCE S, MENAUD J M.Virtual Machine Introspection: Techniques and Applications[C]//IEEE. 10th International Conference on Availability, Reliability and Security (ARES), August 24-27, 2015, Toulouse, France. New Jersey: IEEE, 2015: 676-685.
[8]	李勇钢,崔超远,李平. 基于虚拟机自省的客户机进程内容获取[J]. 计算机工程与设计,2016,37(6):1697-1700.
[9]	PETRONI N L, FRASER T, MOLINA J, et al.Copilot - A Coprocessor-based Kernel Runtime Integrity Monitor[C]//ACM. 13th Conference on USENIX Security Symposium, August 9-13, 2004, San Diego, CA, USA. New York: ACM, 2004: 179-194.
[10]	PAYNE B D, CARBONE M, SHARIF M, et al.Lares: An Architecture for Secure Active Monitoring Using Virtualization[C]//IEEE. 2008 IEEE Symposium on Security and Privacy, May 18-22, 2008, Oakland, CA, USA. New Jersey: IEEE, 2008: 233-247.
[11]	DOLAN-GAVITT B, LEEK T, ZHIVICH M, et al.Virtuoso: Narrowing the Semantic Gap in Virtual Machine Introspection[C]//IEEE. 2011 IEEE Symposium on Security and Privacy, May 22-25, 2011, Berkeley, CA, USA. New Jersey: IEEE, 2011: 297-312.
[12]	SUNEJA S, ISCI C, DE LARA E, et al.Exploring VM Introspection: Techniques and Trade-offs[J]. ACM Sigplan Notices, 2015, 50(7): 133-146.
[13]	FU Yangchun, LIN Zhiqiang.Space Traveling across VM: Automatically Bridging the Semantic Gap in Virtual Machine Introspection via Online Kernel Data Redirection[C]//IEEE. 2012 IEEE Symposium on Security and Privacy, May 20-23, 2012, San Francisco, CA, USA. New Jersey: IEEE, 2012: 586-600.
[14]	SABERI A, FU Yangchun, LIN Zhiqiang. HYBRID-BRIDGE: Efficiently Bridging the Semantic Gap in Virtual Memory Introspection via Decoupled Execution and Training Memoization[EB/OL]. , 2017-5-11.
[15]	乌云,李平,李勇钢. 基于虚拟机自省的隐藏文件检测方法[J]. 计算机系统应用,2016,25(1):175-180.
[16]	MISHRA P, PILLI E S, VARADHARAJAN V, et al.Intrusion Detection Techniques in Cloud Environment: A Survey[J]. Journal of Network & Computer Applications, 2017, 77(C): 18-47.
[17]	MISHRA P, PILLI E S, VARADHARAJANT V, et al.NvCloudIDS: A Security Architecture to Detect Intrusions at Network and Virtualization Layer in Cloud Environment[C]//IEEE. 2016 International Conference on Advances in Computing, Communications and Informatics, September 21-24, 2016, Jaipur, India. New Jersey: IEEE, 2016: 56-62.
[18]	RILEY R, JIANG Xuxian, XU Dongyan.Multi-aspect Profiling of Kernel Rootkit Behavior[C]//ACM. 4th ACM European Conference on Computer Systems, April 1-3, 2009, Nuremberg, Germany. New York: ACM, 2009: 47-60.
[19]	XUAN Chaoting, COPELAND J, BEYAH R.Toward Revealing Kernel Malware Behavior in Virtual Execution Environments[C]//Springer. 12th International Symposium on Recent Advances in Intrusion Detection, September 23-25, 2009, Saint-Malo, France. Heidelberg: Springer, 2009: 304-325.
[20]	CHENG Yingxin, FU Xiao, DU Xiaojiang, et al. A Lightweight Live Memory Forensic Approach Based on Hardware Virtualization[EB/OL]. , 2017-5-11.
[21]	XIAO Jidong, LU Lei, WANG Haining, et al.HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code[C]//IEEE. 2016 IEEE International Conference on Autonomic Computing. IEEE, July 17-22, 2016, Wurzburg, Germany. New Jersey: IEEE, 2016: 127-136.
[22]	WESTPHAL F, AXELSSON S, NEUHAUS C, et al.VMI-PL: A Monitoring Language for Virtual Platforms using Virtual Machine Introspection[J]. Digital Investigation, 2014, 11(4): S85-S94.
[23]	HAN Yyandong, HAO Zhiyu, CUI Lei, et al.A Hybrid Monitoring Mechanism in Virtualized Environments[C]//IEEE. 2016 IEEE International Conference on Trust, Security and Privacy in Computing and Communications, August 23-26, 2016, Tianjin, China. New Jersey: IEEE, 2016: 1038-1045.
[24]	FU Yangchun, ZENG Junjuan, LIN Zhiqiang.HYPERSHELL: A Practical Hypervisor Layer Guest OS Shell for Automated in-VM Management[C]//USENIX. 2014 USENIX conference on USENIX Annual Technical Conference, June 19-20, 2014, Philadelphia USA. New York: ACM, 2014: 85-96.
[25]	BAEK H W, SRIVASTAVA A, VAN D M J. CloudVMI: Virtual Machine Introspection as a Cloud Service[C]//IEEE. 2014 IEEE International Conference on Cloud Engineering, March 11-14, 2014, Boston, MA, USA. New Jersey: IEEE, 2014: 153-158.
[26]	TAUBMANN B, FRÄDRICH C, DUSOLD D, et al. TLSkex: Harnessing Virtual Machine Introspection for Decrypting TLS Communication[J]. Digital Investigation, 2016(16): S114-S123.
[27]	SHI Jiangyong, YANG Yuexiang, TANG Chuan.Hardware Assisted Hypervisor Introspection[J]. SpringerPlus, 2016, 5(1): 647.
[28]	池亚平,姜停停,戴楚屏,等. 基于BLP的虚拟机多级安全强制访问控制系统设计与实现[J]. 信息网络安全,2016(10):1-7.