Bridging the event semantic gap

Abstract

Virtual Machine Introspection (VMI) presents the opportunity to externally ob- serve a Virtual Machine (VM) by obtaining the VM's hardware events from the virtual machine monitor (hypervisor) and analysing these events to retrieve in- formation about its executing OS state. However, the main challenge for VMI consists in the difficulty in translating low-level system information into high-level executing states of the monitored VMs OS. This research demonstrates how VM software events can be leveraged to tackle the shortcomings of the current known state-of-the-art VMI system. Subsequently, a generic real-time VM monitor that translates VM software events to hardware events that can be picked up by the VMI monitor is developed. The proposed system outperforms the current state-of- the-art hardware events only approach by attempting to be more accurate in terms of generating just the events of interest using a software-to-hardware event trans- lation mechanism based on Dynamic Binary Instrumentation (DBI) as a means to bridge the event semantic gap. This novel VMI approach is evaluated in terms of its effectiveness and the performance cost incurred on the monitored VM whilst monitoring. Good results were achieved in the context of our experimental setup both in its effectiveness and its run-time overheads on the monitored VM when compared to the hardware events only (state-of-the-art) approach.