Difference between revisions of "Virtual Machine Introspection"

From Xen
Line 5: Line 5:
 
Key contributors in alphabetical order: Bitdefender, Intel, Novetta, Zentific
 
Key contributors in alphabetical order: Bitdefender, Intel, Novetta, Zentific
   
Background Information, papers, presentations:
+
== Background Information, papers, presentations ==
 
* [https://www.linux.com/news/virtual-machine-introspection-security-innovation-new-commercial-applications Virtual Machine Introspection: A Security Innovation With New Commercial Applications (2016)]
 
* [https://www.linux.com/news/virtual-machine-introspection-security-innovation-new-commercial-applications Virtual Machine Introspection: A Security Innovation With New Commercial Applications (2016)]
 
* [http://www.wesrch.com/electronics/paper-details/pdf-EL11TZ000PYAA-hypervisor-extensions-for-virtual-machine-memory-introspection Hypervisor Extensions for Virtual Machine Memory Introspection (2016)]
 
* [http://www.wesrch.com/electronics/paper-details/pdf-EL11TZ000PYAA-hypervisor-extensions-for-virtual-machine-memory-introspection Hypervisor Extensions for Virtual Machine Memory Introspection (2016)]
Line 15: Line 15:
 
* [https://www.youtube.com/watch?v=GGjPU6jHi_w YouTube video] ([http://events.linuxfoundation.org/sites/events/files/slides/Zero-Footprint%20Guest%20Memory%20Introspection%20from%20Xen%20_%20draft11.pdf presentation]) (2014)
 
* [https://www.youtube.com/watch?v=GGjPU6jHi_w YouTube video] ([http://events.linuxfoundation.org/sites/events/files/slides/Zero-Footprint%20Guest%20Memory%20Introspection%20from%20Xen%20_%20draft11.pdf presentation]) (2014)
   
Related Projects:
+
== Related Projects ==
 
* [http://tklengyel.github.io/drakvuf/ DRAKVUF - Dynamic Malware Analysis] (contains a number of demos)
 
* [http://tklengyel.github.io/drakvuf/ DRAKVUF - Dynamic Malware Analysis] (contains a number of demos)
 
* [https://github.com/Zentific/vmidbg vmidbg Enables debuggers to remotely access and manipulate VM memory, utilizing the virtual machine introspection capabilities of LibVMI]
 
* [https://github.com/Zentific/vmidbg vmidbg Enables debuggers to remotely access and manipulate VM memory, utilizing the virtual machine introspection capabilities of LibVMI]
Line 22: Line 22:
 
* [https://blog.xenproject.org/2015/08/04/the-bitdefender-virtual-machine-introspection-library-is-now-on-github/ The Bitdefender virtual machine introspection library is now on GitHub]
 
* [https://blog.xenproject.org/2015/08/04/the-bitdefender-virtual-machine-introspection-library-is-now-on-github/ The Bitdefender virtual machine introspection library is now on GitHub]
   
Commercial Applications (in alphabetical order):
+
== Commercial Applications (in alphabetical order) ==
 
* AIS IntroVirt (XenServer)
 
* AIS IntroVirt (XenServer)
 
** [https://www.ainfosec.com/innovative-products/#introvirt IntroVirt]
 
** [https://www.ainfosec.com/innovative-products/#introvirt IntroVirt]
Line 37: Line 37:
 
[[Category:Xen 4.6]]
 
[[Category:Xen 4.6]]
 
[[Category:Xen 4.7]]
 
[[Category:Xen 4.7]]
  +
[[Category:Xen 4.8]]
 
[[Category:Security]]
 
[[Category:Security]]

Revision as of 11:37, 1 March 2017

In Xen 4.5, VM introspection using Intel EPT / AMD RVI hardware virtualization functionality was added building on Xen Project Hypervisors Memory Inspection APIs introduced in 2011. In Xen 4.6 a number of significant improvements to Xen’s Virtual Machine Introspection (VMI) subsystems make it the best hypervisor for security applications. Hardware support for VM Functions (VMFunc) available on Intel’s 4th generation Haswell CPUs and Atom Silvermont CPUs decreases overheads. Support for Virtualization Exceptions is now available on Intel’s 5th generation Broadwell CPUs and Atom Goldmont CPUs has significantly reduced latency. VMI support for ARM CPUs has also been added. Further improvements were made in Xen 4.7 and 4.8.

VMI addresses a number of security issues from outside the guest OS without relying on functionality that can be rendered unreliable by advanced malware. The approach works by auditing access of sensitive memory areas using HW support in guests in an unobtrusive way (or maybe better: with minimal overhead) and allows control software running within a dedicated VM to allow or deny attempts to access sensitive memory based on policy and security heuristics.

Key contributors in alphabetical order: Bitdefender, Intel, Novetta, Zentific

Background Information, papers, presentations

Related Projects

Commercial Applications (in alphabetical order)