标题：Secure Virtualization Environment Based on Advanced Memory Introspection
作者：Zhang, Shuhui; Meng, Xiangxu; Wang, Lianhai; Xu, Lijuan; Han, Xiaohui
作者机构：[Zhang, Shuhui; Meng, Xiangxu] Shandong Univ, Sch Comp Sci & Technol, Jinan 250101, Shandong, Peoples R China.; [Zhang, Shuhui; Wang, Lianhai; Xu, L 更多
通讯作者：Zhang, SH;Zhang, SH;Zhang, Shuhui
通讯作者地址：[Zhang, SH]Shandong Univ, Sch Comp Sci & Technol, Jinan 250101, Shandong, Peoples R China;[Zhang, SH]Qilu Univ Technol, Shandong Acad Sci, Shandong Pr 更多
来源：SECURITY AND COMMUNICATION NETWORKS
摘要：Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the virtual machine control structure (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.