Abstract:Cloud computing service has been evolved in providing a whole virtual data center from selling scattered virtual machines (VMs). Process Monitoring of a VM is a fundamental feature to guarantee the security of the virtual data center because of the rapid growth of the malware. Existing approaches are mainly based on virtual machine introspection (VMI) technique to isolate the monitor out-of-vm and designed to inspect the VM internal processes. However, few of them consider the real time control of process execution in the VMs, such as process termination or files operation conducted by the process. Early VMI-based solutions relied on some specific OS kernel data structures, so they need to know the OS information in advance instead of identifying the OS version at runtime for operating system compatible. In this paper, we propose a novel out-of-the-box process monitor named vMON, which can not only identify different guest OS versions and reconstruct rich semantic information for the target VM processes at runtime, but also control the behaviors of processes with fine granularity. In addition, vMON provides uniform programming interfaces to support the development of application-level security tools. A prototype of vMON has been implemented in kernel-based virtual machine (KVM) hypervisor, and its effectiveness and performance have also been evaluated through several experiments. The results show that vMON can successfully identify, analyze and control the behaviors of the processes in Guest OS with acceptable performance overhead. vMon incurs 0.74%similar to 10.20% I/O overhead and 0.003s average interface return time.

Virtual machine-based method for runtime monitoring of executing program

Runtime Verification Based on Multi-thread Monitor

A VIRTUAL MACHINE BASED SECURITY MONITORING SCHEME

An Integrated Runtime Monitoring Method for Internet-Based Virtual Computing Environment.

Multi-Core Virtual Machine Monitoring System

Middleware Based Runtime Monitoring and Analyzing Framework

A Method and Framework for Fetching Software Runtime State

VMInsight: Hardware Virtualization-Based Process Security Monitoring System

Full-virtualization-based Process Monitoring Method

Vmon: An Efficient Out-Of-Vm Process Monitor For Virtual Machines

Progress in development of generally applicable method for monitoring parallel software

Information Monitor Research Oriented to Complex Virtual Test Supporting Environment

A Comprehensive Monitoring Framework for Virtual Computing Environment

Checking virtual machine kernel control-flow integrity using a page-level dynamic tracing approach

Virtualization-Based Security Monitoring

A Concurrent Security Monitoring Method for Virtualization Environments

An agentless monitoring method for virtual machine processes

A Virtual Machine Introspection Triggering Mechanism Based on VMFUNC

A Runtime-Monitoring-Based Dependable Software Construction Method

Predictive Runtime Verification of Java Programs

Secure Virtualization-Based Fine-Grained Process Execution Monitoring