A Hybrid Monitoring Mechanism in Virtualized Environments
Yandong Han, Zhiyu Hao, Lei Cui, Chonghua Wang, Yafei Sang · 2016
Virtual machine introspection plays an important role in the area of security. Most virtual machine introspection mechanisms either poll the VM state actively or intercept the VM execution passively. Unfortunately, the active introspection approach cannot acquire information in real time, while the information acquired by passive method is fragmented and is hard to build complete semantic views of guests. This paper proposes HVMI, a hybrid virtual machine introspection mechanism that acquires complete semantic information in real time and without compromising performance. Firstly, HVMI leverages active acquisition to create an initial semantic view of the monitored guests and then employs the passive method to update the views in real time by capturing all related events. We implement a prototype of HVMI on Xen virtualization platform, and show its functional capability by developing two applications, FileFetcher and ProDetector. The experimental results demonstrate that our approach can effectively monitor VMs and detect several kinds of malware without imposing significant performance loss.