Abstract:Cloud-assisted Cognitive Internet of Things has powerful data analytics abilities based on the computing and data storage capabilities of cloud virtual machines, which makes protecting virtual machine filesystem very important for the whole system security. Agentless periodic filesystem monitors are optimal solutions to protect cloud virtual machines because of the secure and low-overhead features. However, most of the periodic monitors usually scan all of the virtual machine filesystem or protected files in every scanning poll, so lots of secure files are scanned again and again even though they are not corrupted. In this paper, we propose a novel agentless periodic filesystem monitor framework for virtual machines with different image formats to improve the performance of agentless periodic monitors. Our core idea is to minimize the scope of the scanning files in both file integrity checking and virus detection. In our monitor, if a file is considered secure, it will not be scanned when it has not been modified. Since our monitor only scans the newly created and modified files, it can check fewer files than other filesystem monitors. To that end, we propose two monitor methods for different types of virtual machine disks to reduce the number of scanning files. For virtual machine with single disk image, we hook the backend driver to capture the disk modification information. For virtual machine with multiple copy-onwrite images, we leverage the copy-on-write feature of QCOW2 images to achieve the disk modification analysis. In addition, our system can restore and remove the corrupted files. The experimental results show that our system is effective for both Windows and Linux virtual machines with different image formats and can reduce the number of scanning files and scanning time.

A Comprehensive Monitoring Framework for Virtual Computing Environment

Virtualization-Based Security Monitoring

Performance Measuring and Comparing of Virtual Machine Monitors

A Concurrent Security Monitoring Method for Virtualization Environments

Performance Combinative Evaluation of Typical Virtual Machine Monitors

A Framework to Evaluate and Predict Performances in Virtual Machines Environment

A VIRTUAL MACHINE BASED SECURITY MONITORING SCHEME

Multi-Core Virtual Machine Monitoring System

Information Monitor Research Oriented to Complex Virtual Test Supporting Environment

An Integrated Runtime Monitoring Method for Internet-Based Virtual Computing Environment.

Design and implementation of a trusted monitoring framework for cloud platforms

VMDriver: A Driver-Based Monitoring Mechanism for Virtualization

CloudMon: Monitoring Virtual Machines in Clouds

Vmon: An Efficient Out-Of-Vm Process Monitor For Virtual Machines

A high-performance virtual machine filesystem monitor in cloud-assisted cognitive IoT

CloudMoni: A Monitoring Framework for on Demand Virtual Machine Allocation in Cloud Data Centers

CloudDVMM: Distributed Virtual Machine Monitor for Cloud Computing

Cadm : A Centralized Administration And Dynamic Monitoring Framework For Network Intrusion Detection Based On Virtualization

SimMon: A Toolkit for Simulating Monitoring Mechanism in Cloud Computing Environments.

A Guest-Transparent File Integrity Monitoring Method in Virtualization Environment

SeVMM: VMM-Based Security Control Model