Towards Hypervisor Support for Enhancing the Performance of Virtual Machine Introspection - Distributed Applications and Interoperable Systems Access content directly
Conference Papers Year : 2020

Towards Hypervisor Support for Enhancing the Performance of Virtual Machine Introspection

Benjamin Taubmann
  • Function : Author
  • PersonId : 1098455
Hans P. Reiser
  • Function : Author
  • PersonId : 1031369

Abstract

Virtual machine introspection (VMI) is the process of external monitoring of virtual machines. Previous work has demonstrated that VMI can contribute to the security of cloud environments and distributed systems, as it enables, for example, stealthy intrusion detection. One of the biggest challenges for applying VMI in production environments is the performance overhead that certain tracing operations impose on the monitored virtual machine. In this paper, we show how this performance overhead can be significantly minimized by incorporating minor extensions for VMI operations into the hypervisor. In a proof-of-concept implementation, we demonstrate that the pre-processing of VMI events in the Xen hypervisor reduces the monitoring overhead for the use case of VMI-based process-bound monitoring by a factor of 18.
Fichier principal
Vignette du fichier
495624_1_En_3_Chapter.pdf (263.37 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03223259 , version 1 (10-05-2021)

Licence

Attribution

Identifiers

Cite

Benjamin Taubmann, Hans P. Reiser. Towards Hypervisor Support for Enhancing the Performance of Virtual Machine Introspection. 20th IFIP International Conference on Distributed Applications and Interoperable Systems (DAIS), Jun 2020, Valletta, Malta. pp.41-54, ⟨10.1007/978-3-030-50323-9_3⟩. ⟨hal-03223259⟩
73 View
24 Download

Altmetric

Share

Gmail Facebook X LinkedIn More