Abstract:IoT generates considerable amounts of data, which often requires leveraging cloud computing to effectively scale the costs of transferring and computing these data. The concern regarding cloud security is more severe because many devices are connected to the cloud. It is important to automatically monitor and control these resources and services to efficiently and securely deliver cloud computing. The writable virtual machine introspection (VMI) technique can not only detect the runtime state of a guest VM from the outside but also update the state from the outside without any need for administrator efforts. Thus, the writable VMI technique can provide the benefit of high automation, which is helpful for automated cloud management. However, the existing writable VMI technique produces high overhead, fails to monitor the VMs distributed on different host nodes, and fails to monitor multiple VMs with heterogeneous guest OSes within a cloud; therefore, it cannot be applied for automated and centralized cloud management. In this paper, we present CloudVMI, which is a writable and crossnode monitoring VMI framework that can overcome the aforementioned issues. CloudVMI solves the semantic gap problem by redirecting the critical execution of system calls issued by the VMI program into the monitored VM. It has strong practicability by allowing one introspection program to inspect heterogeneous guest OSes and to monitor VMs distributed on remote host nodes. Thus, CloudVMI can be directly applied for automated and centralized cloud management. Moreover, we implement some defensive measures to secure CloudVMI itself. To highlight the writable capability and practical usefulness of CloudVMI, we implement four applications based on CloudVMI. CloudVMI is designed, implemented, and systematically evaluated. The experimental results demonstrate that CloudVMI is effective and practical for cloud management and that its performance overhead is acceptable compared with existing VMI systems.

VMSPY: An Automatic Guest Virtual Machine System Function Hook and Control Program

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

A Protective Mechanism for the Access Control System in the Virtual Domain

A VMM-Based System Call Interposition Framework for Program Monitoring

A Method to Defend Intrusion from Hypercall of Xen

Shadow Memory-Based Agentless Virtual Machine Process Protection

VASP: virtualization assisted security monitor for cross-platform protection.

VMInsight: Hardware Virtualization-Based Process Security Monitoring System

The Application of Virtual Machines on System Security

Detecting Hidden Malware Method Based on "In-VM" Model

A Highly Reliable In-VM Hidden Process Detection Countermeasure

SAVM: A Practical Secure External Approach for Automated In‐vm Management

Vmon: An Efficient Out-Of-Vm Process Monitor For Virtual Machines

KVM-Based Windows Virtual Machine User Process Protection

Opkh: A Lightweight Online Approach to Protecting Kernel Hooks in Kernel Modules

Paging-measurement method for virtual machine process code based on hardware virtualization

A VIRTUAL MACHINE BASED SECURITY MONITORING SCHEME

Inter-domain Communication Protocol for Real-time File Access Monitor of Virtual Machine

System Call Redirection: A Practical Approach to Meeting Real-World Virtual Machine Introspection Needs

A study on security enhancement technology for KVM Hypervisor

CloudVMI: A Cloud-Oriented Writable Virtual Machine Introspection