VMIaaS: Virtual Machine Introspection as a Service
- In this digital era, communication in the digital world is becoming part of our daily lives. One key technology that becomes part of this digital transformation is cloud computing. It allows users to have a running system as a virtual machine (VM) on the cloud without owning a physical server. Unfortunately, adversaries can also use those systems to conduct criminal activities. Therefore, developing a method to extract evidence from those systems is also necessary. One way is through digital forensics, and one method to do digital forensics of a VM is using virtual machine introspection (VMI). However, VMI has yet to be made available by any public cloud provider. This thesis addresses this issue by introducing methods for deploying VMI on public cloud providers.
Four main challenges have to be solved. Firstly, VMI requires access to the hypervisor, which practically can access all VMs running on the same server. This leads to security and privacy issues where customers can introspect each other VMs. To solve this problem, thisIn this digital era, communication in the digital world is becoming part of our daily lives. One key technology that becomes part of this digital transformation is cloud computing. It allows users to have a running system as a virtual machine (VM) on the cloud without owning a physical server. Unfortunately, adversaries can also use those systems to conduct criminal activities. Therefore, developing a method to extract evidence from those systems is also necessary. One way is through digital forensics, and one method to do digital forensics of a VM is using virtual machine introspection (VMI). However, VMI has yet to be made available by any public cloud provider. This thesis addresses this issue by introducing methods for deploying VMI on public cloud providers.
Four main challenges have to be solved. Firstly, VMI requires access to the hypervisor, which practically can access all VMs running on the same server. This leads to security and privacy issues where customers can introspect each other VMs. To solve this problem, this thesis introduces KVMIveggur, a versatile access control of VMI. It comes with different options that every customer can choose from based on their needs.
Secondly, VMI introduces overhead to the running VM. This is because most of the introspection mechanisms perform data access to the monitored VM. Performing data access on a running VM can cause data inconsistency. Hence, pausing the VM before executing the data access is better. However, when the VM pausing frequency is high, it will affect the performance of the monitored VM. The current state-of-the-art techniques use caching to reduce the VM pausing frequency. However, it faces a problem: the cached data may be outdated compared to the actual data. Therefore, this thesis introduces VMIFresh, a better caching mechanism. We leverage both active and passive tracing mechanisms to ensure high performance and consistency of the data (freshness).
Thirdly, many state-of-the-art VMI libraries and applications run perfectly only on Intel processors because Intel CPUs provide the best hardware support for VMI. However, AMD and ARM processors are getting more popular in cloud computing. Thus, it is necessary to retrofit VMI capabilities to support AMD and ARM processors. This thesis describes the requirements to employ VMI on AMD and ARM processors. We also provide the implementation of those requirements.
Finally, to do introspection using VMI, it is crucial to have proper symbol information (layout and location of data structures) of the introspected operating system (OS) and user applications. While many existing VMI approaches concentrate primarily on analyzing OS data structures, analyzing user application data often receives no attention. In our approach, we address this gap by focussing on application-level introspection. We have identified several use cases that require this kind of introspection. We focus on cryptographic key extraction for two specific instances: secure shell (SSH) and transport layer security (TLS) by leveraging the power of machine learning techniques to locate those keys in the main memory effectively and efficiently.
After we had solved those challenges, we combined a couple of our approaches and introduced two VMI applications: Sarracenia and VMIGuard. Sarracenia is a deception technology that tracks activities done on an SSH session. The main goal of Sarracenia is to attract adversaries away from the production system and learn about their behavior. On the other hand, VMIGuard also monitors the SSH traffic. But, it specifically monitors the activity of any git-related activities. The main goal of VMIGuard is to ensure the integrity of the hosted data from any internal malicious actor.…


| Author: | Stewart Sentanoe |
|---|---|
| URN: | urn:nbn:de:bvb:739-opus4-15027 |
| Advisor: | Hans P. Reiser, Emmanouil Vasilomanolakis |
| Document Type: | Doctoral Thesis |
| Language: | English |
| Year of Completion: | 2024 |
| Date of Publication (online): | 2024/10/18 |
| Date of first Publication: | 2024/10/18 |
| Publishing Institution: | Universität Passau |
| Granting Institution: | Universität Passau, Fakultät für Informatik und Mathematik |
| Date of final exam: | 2024/10/14 |
| Release Date: | 2024/10/18 |
| GND Keyword: | Cloud ComputingGND; ComputersicherheitGND |
| Page Number: | vi, 121 Seiten |
| Institutes: | Fakultät für Informatik und Mathematik |
| Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik |
| open_access (DINI-Set): | open_access |
| Licence (German): | Standardbedingung laut Einverständniserklärung |

