Hypervisor introspection: a technique for evading passive virtual machine monitoring

security;virtual machine introspection (VMI);side-channel;cloud

Wang, Gary L

关键词: security;    virtual machine introspection (VMI);    side-channel;    cloud;   

Others  :  https://www.ideals.illinois.edu/bitstream/handle/2142/78671/WANG-THESIS-2015.pdf?sequence=1&isAllowed=y

美国|英语

来源: The Illinois Digital Environment for Access to Learning and Scholarship

【 摘 要 】

Virtualization technology has enabled powerful security monitoring techniques, such as virtual machine introspection (VMI). These monitoring techniques, however, rely on the assumed isolation of virtualized environments from the hypervisor. We show that there are still some events that can be observed that break this isolation. External observers can discern when virtual machines are suspended due to hypervisor activity, and can use this information to mount advanced attacks that go undetected by VMI monitoring systems. We demonstrate some example attacks against realistic monitors using our technique, and discuss existing and potential defenses against these kinds of attacks.