Using KVM Events to Detect VM Memory-Sharing Lateral Movement Attacks in a Virtualized Environment
Kun Zhang, Junchao Ma, Chen Li · 2024
Virtual machine (VM) memory-sharing lateral movement attacks are becoming more advanced, while detection methods against them are still perceived as non-practical. Especially the current detection methods can't detect the VM escape attack. In this paper, we introduce a novel monitoring approach to detect VM memory-sharing lateral movement attacks operations inside a virtualization environment. We utilize the Kernel Virtual Machine (KVM) event sequence data in the kernel and process this data using a machine learning technique to identify any VM memory-sharing lateral movement attacks operations in the guest VM. Experimental results demonstrate that our method successfully separates the VM memory-sharing lateral movement attacks datasets on VMs from the non attacks datasets on VMs, on both trained and nontrained data scenarios. Besides, we also explain the classification results by extracting the set of most important features that separate both classes using their Fisher scores and variance and show that our detecting approach can work to detect VM memory-sharing lateral movement attacks in general. Finally, we evaluate the overhead impact of our VM memory-sharing lateral movement attacks detecting method and show that it has a negligible computation overhead on the host and the guest VM.