A KVM Virtual Machine Memory Forensics Method Based on VMCS

Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the virtual machine control structure (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.

Download Full-text

VMMB: Virtual Machine Memory Balancing for Unmodified Operating Systems

Journal of Grid Computing ◽

10.1007/s10723-012-9209-4 ◽

2012 ◽

Vol 10 (1) ◽

pp. 69-84 ◽

Cited By ~ 13

Author(s):

Changwoo Min ◽

Inhyeok Kim ◽

Taehyoung Kim ◽

Young Ik Eom

Keyword(s):

Virtual Machine ◽

Operating Systems ◽

Machine Memory

Download Full-text

Introspection of Virtual Machine Memory Resource in the Virtualized Systems

2019 IEEE International Conference on Big Data and Smart Computing (BigComp) ◽

10.1109/bigcomp.2019.8679210 ◽

2019 ◽

Cited By ~ 2

Author(s):

Minho Lee ◽

Sujin Park ◽

Yongju Song ◽

Young Ik Eom

Keyword(s):

Virtual Machine ◽

Memory Resource ◽

Machine Memory

Download Full-text

Efficient Virtual Machine Memory Transfer in Datacenter with optimal downtime

10.35543/osf.io/rqpm7 ◽

2019 ◽

Author(s):

Girish L

Keyword(s):

Cloud Computing ◽

Virtual Machine ◽

Virtual Machines ◽

Flow Chart ◽

Key Factors ◽

Virtual Machine Migration ◽

Memory Transfer ◽

Vm Migration ◽

Host Machine ◽

Machine Memory

Cloud computing is a technology which relies onsharing various computing resources instead of having localservers to handle applications. Cloud computing is driven byvirtualization technology. Virtual machines need migration fromone host to anther due to the presence of error or over loading orslowness in the current running host machine. Live Virtualmachine migration is the transfer of running virtual machinefrom one host to another without stopping the current runningtask. During this live virtual machine migration Downtime is oneof the key factors that have to be considered and assessed.Here we present detailed survey on what are the importance oflive virtual machine migration in cloud computing technologyand various techniques to reduce the downtime during livevirtual machine migration. The flow chart showing the steps usedin Pre copy approach for VM migration. And also we presentthe result of the comparison between the two virtual machinemigration environments, VMWare and Xen Server.

Download Full-text