TY - JOUR A1 - Beierlieb, Lukas A1 - Schmitz, Alexander A1 - Springer, Raphael A1 - Dietrich, Christian J. A1 - Iffländer, Lukas T1 - Benchmarking Hyper-Breakpoints for Efficient Virtual Machine Introspection JF - Electronics (Special Issue Computer Architecture & Parallel and Distributed Computing) N2 - Virtual Machine Introspection (VMI) is a powerful technology used to detect and analyze malicious software inside Virtual Machines (VMs) from outside. Asynchronously accessing the VM ’s memory can be insufficient for efficiently monitoring what is happening inside of a VM. Active VMI introduces breakpoints to intercept VM execution at relevant points. Especially for frequently visited breakpoints, and even more so for production systems, it is crucial to keep their performance overhead as low as possible. In this paper, we provide a systematization of existing VMI breakpoint implementation variants, propose workloads to quantify the different performance penalties of breakpoints, and implement them in the benchmarking application bpbench. We used this benchmark to measure that, on an Intel Core i5 7300U, SmartVMI’s breakpoints take around 81 μs to handle, and keeping the breakpoint invisible costs an additional 21 μs per read access. The availability of bpbench facilitates the comparison of disparate breakpoint mechanisms and their performance optimization with immediate feedback. KW - virtual machine introspection KW - performance KW - benchmarking Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-47235 SN - 2079-9292 VL - 2025 IS - 14 (3) SP - 1 EP - 20 PB - MDPI ER - TY - JOUR A1 - Beierlieb, Lukas A1 - Schmitz, Alexander A1 - Karazon, Anas A1 - Leinweber, Artur A1 - Dietrich, Christian J. T1 - EPT Switching vs. Instruction Repair vs. Instruction Emulation: A Performance Comparison of Hyper-Breakpoint Variants JF - Eng N2 - Virtual Machine Introspection (VMI) is a powerful technology used to detect and analyze malicious software inside Virtual Machines (VMs) from the outside. Asynchronous access to the VM’s memory can be insufficient for efficient monitoring of what is happening inside of a VM. Active VMI introduces breakpoints to intercept VM execution at relevant points. Especially for frequently visited breakpoints, and even more so for production systems, it is crucial to keep performance overhead as low as possible. In this paper, we present an empirical study that compares the performance of four VMI breakpoint-implementation variants—EPT switching (SLAT view switching) with and without fast single-stepping acceleration, instruction repair, and instruction emulation—from two VMI applications (DRAKVUF, SmartVMI) with the XEN hypervisor on 20 Intel Core i processors ranging from the fourth to the thirteenth generation. Instruction emulation was the fastest method across all 20 tested platforms. Modern processors such as the Intel Core i7 12700H and Intel Core i9 13900HX achieved median breakpoint-processing times as low as 15 µs for the emulation mechanism. The slowest method was instruction repair, followed by EPT switching and EPT switching with FSS. The order was the same for all measurements, indicating that this is a strong and generalizable result. KW - Virtual Machine Introspection KW - performance KW - benchmarking Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-48375 VL - 2025 IS - 6(10), Special Issue Interdisciplinary Insights in Engineering Research PB - MDPI ER -