A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

Dongyang Zhan, Huhua Li, Lin Ye, Hongli Zhang, Binxing Fang, Xiaojiang Du

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

3 Scopus citations

Abstract

Monitoring kernel object modification of virtual machine is widely used by virtual-machine-introspection-based security monitors to protect virtual machines in cloud computing, such as monitoring dentry objects to intercept file operations, etc. However, most of the current virtual machine monitors, such as KVM and Xen, only support page-level monitoring, because the Intel EPT technology can only monitor page privilege. If the out-of-virtual-machine security tools want to monitor some kernel objects, they need to intercept the operation of the whole memory page. Since there are some other objects stored in the monitored pages, the modification of them will also trigger the monitor. Therefore, page-level memory monitor usually introduces overhead to related kernel services of the target virtual machine. In this paper, we propose a low-overhead kernel object monitoring approach to reduce the overhead caused by page-level monitor. The core idea is to migrate the target kernel objects to a protected memory area and then to monitor the corresponding new memory pages. Since the new pages only contain the kernel objects to be monitored, other kernel objects will not trigger our monitor. Therefore, our monitor will not introduce runtime overhead to the related kernel service. The experimental results show that our system can monitor target kernel objects effectively only with very low overhead.

Original languageEnglish
Title of host publication2019 IEEE International Conference on Communications, ICC 2019 - Proceedings
ISBN (Electronic)9781538680889
DOIs
StatePublished - May 2019
Event2019 IEEE International Conference on Communications, ICC 2019 - Shanghai, China
Duration: 20 May 201924 May 2019

Publication series

NameIEEE International Conference on Communications
Volume2019-May
ISSN (Print)1550-3607

Conference

Conference2019 IEEE International Conference on Communications, ICC 2019
Country/TerritoryChina
CityShanghai
Period20/05/1924/05/19

Fingerprint

Dive into the research topics of 'A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection'. Together they form a unique fingerprint.

Cite this