A Virtual Machine Introspection Triggering Mechanism Based on VMFUNC
-
摘要: 虚拟化技术作为云计算的基础得到了广泛应用,但随之而来的虚拟机安全问题日趋严重.虚拟机自省作为一种从外部监控虚拟机内部运行状态的方法,为解决虚拟机安全问题提供了新视角,但同时也引入了巨大开销,阻碍了实际应用.提出了一种基于VMFUNC的虚拟机自省(virtual machine introspection, VMI)触发机制.该机制借助CPU硬件特性VM-Function以及RDTSC指令模拟,将调用时产生VM Exit开销降至最低;利用VMFUNC的功能为目标虚拟机切换备用扩展页表,避免VMI程序运行时对虚拟机执行的中断;通过重载VMFUNC指令和Xentrace的功能实现高效的触发与信息传递机制,主动触发VMI程序运行,克服了VMI程序常驻带来的大量资源消耗.实现了虚拟机自省即服务系统,并进行了实验验证.结果表明:本系统带来额外性能开销不超过2%,使VMI在实际云环境中的广泛应用成为了可能.Abstract: Virtualization technology as the basis of cloud computing has been widely used, while security issues of virtual machine have been attracted more and more attention. The virtual machine introspection, as an “out-of-the-box” method leveraged to monitoring virtual machine, provides a new perspective for solving the security problems. Aiming at this situation, a triggering mechanism based on VMFUNC is proposed. Taking the advantages of the CPU hardware features VM-Function and RDTSC emulation, the mechanism minimizes the overhead of VM exits. Based on the extended page table view switching through the VMFUNC, our mechanism avoids the system pause caused by VMI programs. By means of overloading VMFUNC and Xentrace, our method can trigger VMI programs actively, thus overcoming the VMI program resident consumption. In this paper, a VMI-as-a-service system is implemented and verified by experiments. The results show that the performance cost is no more than 2%, which makes VMI widely being used possible in practical cloud environment.
-
-
期刊类型引用(3)
1. 毛胜根,周超. 新业态领域中社会性风险的基本类型、生成逻辑与整体性治理. 湖南科技大学学报(社会科学版). 2024(05): 127-136 . 百度学术
2. 陈俊秀,郑慧. 网络黑灰产治理:从后端应对型到前端防控型的模式转换. 公共治理研究. 2023(05): 69-79 . 百度学术
3. 傅仕琛,胡志杰,张年臻,卓俊彦,吴浚弘,戴骅巍. 一种电力数据通信网设备漏洞检测系统. 电力大数据. 2022(10): 81-86 . 百度学术
其他类型引用(13)
计量
- 文章访问数: 1933
- HTML全文浏览量: 3
- PDF下载量: 1025
- 被引次数: 16