High Performance Virtual Machine Introspection

Recently, virtualization technology, as the basis of Cloud Computing, has been widelydeployed. Meanwhile, the security of virtual machines has been receiving more and moreattentions. Among various potential solutions, Virtual Machine Introspection (VMI), as amethod of monitoring virtual machines from the outside, is a novel one that addressingsecurity concerns of virtual machines, which leverages the isolation provided by VirtualMachine Monitor as well as the new abstract level between hardware and virtualizedoperating system and hence has a comprehensive understanding to the internal states ofvirtual machines.Based on a deep investigation and analysis of current VMI research and related works,this thesis unveils three contradictions that have hindered current VMI technology. Thecontradictions exist, say,1. between the access efficiency of states and the isolation ofvirtualization technology,2. between the consistency of large-scale state and the dynamicnature of virtual machines,3. between the comprehensibility of virtual machine states and thetransparency of VMI system.For the sake of resolving the three contradictions orienting to the scenario of large-scalememory access to virtual machines, this thesis introduces two novel technologies, say, sharedmemory snapshot and direct guest memory access technologies. According to analytical study,the two technologies well address the three contradictions in this specific scenario, and alsobuild a foundation of high performance virtual machine introspection.Base on those two technologies, this thesis designs and implements a prototype systemof high performance virtual machine introspection, at the basis of KVM virtualization andLibVMI introspection framework. This prototype system has been merge to the masterdevelopment branch of LibVMI project. According to series of benchmarks, the proposedhigh performance virtual machine introspection system runs efficiently in practice.