Hypervisor Research Articles

VBD-MF: A Block Device to Monitor the File System of Virtual Machine

The virtual block device is the data carrier of virtual machine (VM) and user information, while the file system is the ultimate goal of many attackers. We proposed a security device named virtual block device mapping to file (VBD-MF) that can translate block-level operations into file-level ones by building a mapping from blocks to files. VBD-MF could provide an out-of-VM way to monitor the file system with no modification on the code of virtual machine monitor (VMM) and guest OS, and it also provided other security tools and methods with direct interface to operate the file system. We implemented a prototype on Linux and KVM. The evaluation shows that VBD-MF has a better capability of monitoring with some loss on performance of read and write. Compared to the traditional monitoring of host-based file system, VBD-MF has a better hidden and safety property.

Efficient and retargetable SIMD translation in a dynamic binary translator

SummaryThe single‐instruction multiple‐data (SIMD) computing capability of modern processors is continually improved to deliver ever better performance and power efficiency. For example, Intel has increased SIMD register lengths from 128 bits in streaming SIMD extension to 512 bits in AVX‐512. The ARM scalable vector extension supports SIMD register length up to 2048 bits and includes predicated instructions. However, SIMD instruction translation in dynamic binary translation has not received similar attention. For example, the widely used QEMU emulates guest SIMD instructions with a sequence of scalar instructions, even when the host machines have relevant SIMD instructions. This leaves significant potential for performance enhancement. We propose a newly designed SIMD translation framework for dynamic binary translation, which takes advantage of the host's SIMD capabilities. The proposed framework has been built in HQEMU, an enhanced QEMU with a separate thread for applying LLVM optimizations. The current prototype supports ARMv7, ARMv8, and IA32 guests on the X86‐64 AVX‐2 host. Compared with the scalar‐translation version HQEMU, our framework runs up to 1.84 times faster on Standard Performance Evaluation Corporation 2006 CFP benchmarks and up to 6.81 times faster on selected real applications.

A novel disk I/O scheduling framework of virtualized storage system

Modern data centers usually use virtual machine technology to host various big data applications in a single physical machine, not only enhancing the server utilization, but also providing them with the hardware-level isolation. However, in a typical virtualized environment an extra software layer called virtual machine monitor (VMM) is often interposed between the hardware resource and guest operating system (virtual machine, VM), shielding the specific user-process semantic inside a running VM. As a result, it obstructs the disk I/O scheduler of VMM to acquire the accurate information of a user-process (often a big data application), and thus proposes a challenge on the I/O request scheduling as well as the disk resource management at the granularity of VM user-process. Eventually, the disk I/O performance of a virtualized system is sub-optimal. This paper introduces an improved disk I/O scheduling framework for the virtualized system. It aims at bridging the semantic gap between physical disk I/O scheduler and VM user-process, providing a fair sharing of disk I/O resource among concurrent VMs. At the same time, it improves the overall disk I/O performance through a novel method for creating the image file of VM. Besides, an extra scheduling algorithm is proposed to further refine the storage performance. Finally, we implement these improvements on Xen hypervisor and conduct extensive experiments to verify our framework. The experimental result shows that our work improve the performance of read-intensive, write-intensive and mixed workloads up to 9, 10.7 and 20% respectively.

Dynamic integrity measurement model based on vTPM

With the development of cloud computing, virtualization technology has been widely used in our life. Meanwhile, it became one of the key targets for some attackers. The integrity measurement in virtual machine has become an urgent problem. Some of the existing virtualization platform integrity measurement mechanism introduces the trusted computing technology, according to a trusted chain that the Trusted Platform Module (TPM) established for trusted root to measure the integrity of process in static. But this single chain static measurement cannot ensure the dynamic credible in platform running. To solve the problem that the virtual trusted platform can not guarantee the dynamic credibility, this paper put forward Dynamic Integrity Measurement Model (DIMM) based on virtual Trusted Platform Module (vTPM) which had been implemented with typical virtual machine monitor Xen as an example. DIMM combined with virtual machine introspection and event capture technology to ensure the security of the entire user domain. Based on the framework, this paper put forward Self-modify dynamic measurement strategy which can effectively reduce the measurement frequency and improve the measurement performance. Finally, it is proved that the validity and feasibility of the proposed model with comparison experiments.

An Efficient Cloud Scheduling Algorithm for the Conservation of Energy through Broadcasting

Method of broadcasting is the well known operation that is used for providing support to different computing protocols in cloud computing. Attaining energy efficiency is one of the prominent challenges, that is quite significant in the scheduling process that is used in cloud computing as, there are fixed limits that have to be met by the system. In this research paper, we are particularly focusing on the cloud server maintenance and scheduling process and to do so, we are using the interactive broadcasting energy efficient computing technique along with the cloud computing server. Additionally, the remote host machines used for cloud services are dissipating more power and with that they are consuming more and more energy. The effect of the power consumption is one of the main factors for determining the cost of the computing resources. With the idea of using the avoidance technology for assigning the data center resources that dynamically depend on the application demands and supports the cloud computing with the optimization of the servers in use.

Reactive redundancy for data destruction protection (R2D2)

Data destruction programs, such as Wiper Malware, cause substantial damage by overwriting critical digital assets on compromised machines, denying users access to computing resources. Our system, called R2D2, analyzes write buffers before they can reach a storage medium, determines if the write is destructive, and preserves the data under destruction. We interpose the inspection in the Virtual Machine Monitor (VMM) through a technique known as Virtual Machine Introspection (VMI). This has the benefit that it does not rely on the entire OS as a root of trust. We demonstrate the effectiveness of our prototype implementation by preserving data targeted for destruction by Wiper Malware such as Shamoon and Stonedrill, and a host of secure delete tools. We discover that R2D2 detects data destruction with high accuracy (99.8% true negative and true positive rates) and preserves critical data for all the Wiper Malware samples in the wild that we experimented with. While our prototype is not optimized for performance, we show that it is applicable for common user tasks in an office or home setting, with a latency increase of 1%–4% and 9%–20% to complete batch tasks and interactive tasks respectively. VMI accounts for 90.7%–98.5% of the latency overhead and thus R2D2 incurs a small cost for environments already using VMI.

State-control-limit-based rejuvenation modelling and optimisation of the virtualised cloud server

Software rejuvenation modelling and optimisation of the virtualised cloud server has been studied. A software rejuvenation policy on the virtual machines and the virtual machine monitor has been proposed in order to ensure high availability of the virtualised cloud server. The multi-component system, composed of the virtual machines and the virtual machine monitor, which are structurally dependent, has been reduced to the multiple two-component systems. The state-control-limit-based rejuvenation policy has been proposed and the joint probability density of the degraded state of the two-component VM-VMM has been derived. Furthermore, the solution to the joint probability density has been proposed. Finally, the stationary unavailability of the virtualised cloud server has been modelled. Numerical experiments have verified the correctness of the probability density function and the feasibility of the rejuvenation policy. The state-control-limit-based rejuvenation policy leads to lower unavailability of the virtualised cloud server in comparison with the lifetime-based rejuvenation policy.

Frequent failure monitoring and reporting in virtualisation environment using backing algorithm technique

In virtual platforms, disaster management yields to the platform oriented service which is precisely taught using virtual machines. Due to user, execution comes under various verities and simplified structure becomes a complex task. The automated system called backing technique method is introduced, in which proficient performance administration and simplified constitution are guaranteed. But, in the proposed technique, the concept of backing method is presented with additional features, which, persuades the structure so that intricacy diminution is made feasible. Analysis shows that malfunction of Exe, Win-x, kernel, and host can be detrimental for an individual virtual machine. On the basis of this, a new algorithm is developed called backing algorithm which is one of the finest in its concert. The backing algorithm is intelligent to afford continuous monitoring and can accomplish failure reporting proficiently. In addition to backing algorithm concept, we extensively build virtual machine solution provider (VMSP) to sustain this system by frequent monitoring using virtual machine monitor (VMM). These results are provided, backing algorithm with VMM gives that the competent precaution technique when the crash or system boot failure occurs and also it provides the best alert solution for data recovery process at the time of failure.

ITune: Engineering the Performance of Xen Hypervisor via Autonomous and Dynamic Scheduler Reconfiguration

Despite the widespread use of server virtualization technologies in cloud data centers, system administrators experience multiple challenges in configuring the hypervisor’s scheduler parameters to optimize its performance. Manually tuning the scheduler’s parameters is a common practice, however, this approach is not effective particularly when dealing with dynamically changing workload and resource utilizations on the host machines. This problem becomes even harder if cloud resources are overbooked while hosting both latency-sensitive and batched applications. To address these issues, this paper presents iTune, which is a framework for engineering the performance of a hypervisor intelligently via autonomous scheduler configurations. Concretely, iTune optimizes the Xen hypervisor’s scheduler configuration parameters autonomously through a three phase process comprising: (1) Discoverer, which monitors and saves the resource usage history of the host machines and groups set of related host machine workloads, (2) Optimizer, where optimum Xen scheduler configuration parameters for each workload cluster are explored by employing a simulated annealing machine learning algorithm, and (3) Observer, where iTune monitors the resource usage of host machines online, classifies them into one of the categories found in the Discoverer phase, and loads the optimum scheduler parameters determined in the Optimizer phase. Experimental results validate our claims.

Secure Virtualization Environment Based on Advanced Memory Introspection

Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the virtual machine control structure (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.

Performance benchmarking of hypervisors- A Case Study

Objectives: Benchmark the performance of the different hypervisors using standard benchmarking tools considering the different parameters like CPU, RAM, DISK Read-Write, Network Read-Write. We use different types of hypervisors and compare the performance of hypervisors how they behave differently for above mentioned parameters. Methods/ Statistical Analysis: Experiment setup consists of three hypervisors namely Virtual Box 6.0, VMware workstation as a hosted hypervisors and Xen as a Native or bare metal hypervisor. Open source hypervisor considered for the experiment. VMware Workstation 9.0, Virtual Box 5.0 as a hosted hypervisor and Citrix Xen as the native hypervisor were considered. Stress is used as the standard benchmarking tool and Glances tool helps to collect and monitor the traces. Findings: The virtualization is carried out by the software layer called as the Hypervisor or Virtual Machine Monitor (VMM). Hypervisor is widely used in cloud datacenters. Bench-mark is the measurement of best practice performance. Bench-marking is very essential term for the discovery of the best performance given by the particular system. Benchmarking can provides you the external references and the best practices on which to base your evaluations and to design your system pro-cesses which can be very useful in finding the gaps in the system to achieve the desired performance. The Bare metal Hypervisors have the direct access to the hardware resource rather than accessing resource via operating system as in hosted hypervisors. Performance analysis of desired work shows the keen differences in performance related to CPU, RAM, DISK Read-Write, and Network Read-Write performance. Results concludes that hosted hypervsors have good performance in N/W, Disk read and write because the architecturally bounded to operating system where interact with base OS while Xen as native hypervisor has a good CPU Performance because Virtual machine has direct access to hardware layer through Virtual machine manager. Improvements: We used single benchmark tool to test all parameters, it has potential to use different benchmarking tools specific to parameters like for Network Read-Write, AIO stress can be used. Further concentrates bench mark comparison of hypervisors and containers, where container adoption has increased in cloud data centers. Keywords: Benchmarking, Cloud, Glances, Hypervisors, VMware, Xen

Leveraging virtual machine introspection with memory forensics to detect and characterize unknown malware using machine learning techniques at hypervisor

The Virtual Machine Introspection (VMI) has emerged as a fine-grained, out-of-VM security solution that detects malware by introspecting and reconstructing the volatile memory state of the live guest Operating System (OS). Specifically, it functions by the Virtual Machine Monitor (VMM), or hypervisor. The reconstructed semantic details obtained by the VMI are available in a combination of benign and malicious states at the hypervisor. In order to distinguish between these two states, the existing out-of-VM security solutions require extensive manual analysis. In this paper, we propose an advanced VMM-based, guest-assisted Automated Internal-and-External (A-IntExt) introspection system by leveraging VMI, Memory Forensics Analysis (MFA), and machine learning techniques at the hypervisor. Further, we use the VMI-based technique to introspect digital artifacts of the live guest OS to obtain a semantic view of the processes details. We implemented an Intelligent Cross View Analyzer (ICVA) and implanted it into our proposed A-IntExt system, which examines the data supplied by the VMI to detect hidden, dead, and dubious processes, while also predicting early symptoms of malware execution on the introspected guest OS in a timely manner. Machine learning techniques are used to analyze the executables that are mined and extracted using MFA-based techniques and ascertain the malicious executables. The practicality of the A-IntExt system is evaluated by executing large real-world malware and benign executables onto the live guest OSs. The evaluation results achieved 99.55% accuracy and 0.004 False Positive Rate (FPR) on the 10-fold cross-validation to detect unknown malware on the generated dataset. Additionally, the proposed system was validated against other benchmarked malware datasets and the A-IntExt system outperforms the detection of real-world malware at the VMM with performance exceeding 6.3%.

Accurate CPU Proportional Share and Predictable I/O Responsiveness for Virtual Machine Monitor: A Case Study in Xen

In cloud computing, the performance of applications is heavily dependent on resource services provided by the virtualized environment. However, in some virtualized environment, such as Xen, the accuracy of CPU proportional share and the responsiveness of I/O processing are heavily dependent on the proportion of the allocated CPU resource. In this paper, we study how inaccurate share ratio of CPU proportional share and proportion dependent responsiveness of I/O affect the performance of Xen, and discover that they lead to unstable performance and is thus not able to conform service-level agreements (SLA). We conclude that the scheduling scheme and the coarse grained time-slice are the major negative impacts on this issue. Therefore, we propose a novel scheduling scheme, named Predictable Resource Guarantee Scheduler (PRGS), that achieves accurate CPU proportional share and predictable I/O responsiveness. We implement a PRGS prototype on Xen virtualization platform and carry out a thorough evaluation via experimentation. The experimental results show that PRGS achieves accurate CPU proportional share and predictable I/O responsiveness. Also, with only slight overhead, PRGS controls PING packet delay to a specified fixed time threshold (e.g. 30 ms in our experiments).

FPGA based data processing in the ALICE High Level Trigger in LHC Run 2

The ALICE High Level Trigger (HLT) is a computing cluster dedicated to the online compression, reconstruction and calibration of experimental data. The HLT receives detector data via serial optical links into FPGA based readout boards that process the data on a per-link level already inside the FPGA and provide it to the host machines connected with a data transport framework. FPGA based data pre-processing is enabled for the biggest detector of ALICE, the Time Projection Chamber (TPC), with a hardware cluster finding algorithm. This algorithm was ported to the Common Read-Out Receiver Card (C-RORC) as used in the HLT for RUN 2. It was improved to handle double the input bandwidth and adjusted to the upgraded TPC Readout Control Unit (RCU2). A flexible firmware implementation in the HLT handles both the old and the new TPC data format and link rates transparently. Extended protocol and data error detection, error handling and the enhanced RCU2 data ordering scheme provide an improved physics performance of the cluster finder. The performance of the cluster finder was verified against large sets of reference data both in terms of throughput and algorithmic correctness. Comparisons with a software reference implementation confirm significant savings on CPU processing power using the hardware implementation. The C-RORC hardware with the cluster finder for RCU1 data is in use in the HLT since the start of RUN 2. The extended hardware cluster finder implementation for the RCU2 with doubled throughput is active since the upgrade of the TPC readout electronics in early 2016.

Multi-objective optimization for rebalancing virtual machine placement

Load balancer, as a key component in cloud computing, seeks to improve the performance of a distributed system by allocating workload amongst a set of cooperating hosts. A good balancing strategy would make the distributed system efficient and enhance user satisfaction. However, the balance of Host Machines (HMs) in a real cloud environment often breaks due to frequently occurred addition and removal of Virtual Machines (VMs). Therefore, it is essential to schedule the VMs to be reBalanced (VMrB). In this paper, we first summarize and analyze the existing studies on load rebalancing. We then propose a novel solution to the VMrB problem, namely a Pareto-based Multi-Objective VM reBalance solution (MOVMrB), which aims to simultaneously minimize the disequilibrium of both inter-HM and intra-HM loads. It is one of the first solutions that leverages the inter-HM and intra-HM loads and applies a multiple objective optimization strategy to overcome the virtual machine rebalance problem. In our work, we keep migration cost in mind and propose a hybrid VM live migration algorithm that significantly reduces the I/O complexity of VMrB processing. The proposed rebalancing solution is evaluated based on two synthetic datasets and two real-world datasets under a CloudSim framework. Our experimental results show that MOVMrB outperforms other existing multi-objective solutions and also demonstrate its extensibility to support complex scenarios in cloud computing.

A Comprehensive Testing Technique for Embedded System PCBA

Objective: An electronic system developed for specific application with the integration of hardware and software is known as Embedded System. Due to complexity of hardware and software in a single system, it requires specific technique for testing before deployment of the device. This paper proposes the comparative study of testing techniques of embedded system. Methods/Analysis: In this paper, a test methodology of embedded system using PCBA has been proposed, that covers all the testing aspects of the embedded system from electrical board level hardware to the embedded system software. Three tests namely power rail test, interconnect test and the infrastructure tests are used for hardware functionality for stuck at and bridging faults. The functionality test has been used for programming validation using port interface. Findings: This paper proposed automatic testing of embedded board, which reduces manual errors, increases test coverage and reduces the test time in the production line. The proposed method showed that it can be applied to any board in any form with the same test hardware barring the input-output cables. The software in host machine has been used for testing purpose of different boards. This testing technique is useful for embedded systems implemented in control systems.

HACS: A Hypervisor-Based Access Control Strategy to Protect Security-Critical Kernel Data

Rootkits are prevalent in today’s Internet. Using virtual machine monitor (VMM) is an attractive way to deal with rootkits. However, most of the previous studies do not focus on protecting kernel data using VMMs, especially for the data that may be dynamically changed. Direct kernel object manipulation (DKOM) attacks can stealthily detach kernel data objects belonging to the malicious program from kernel’s normal list, or overwrite import fields in the kernel. It’s hard for OSes or VMMs to distinguish between normal accesses and malicious ones to kernel data. Although some works provides access control policy to kernel data, it can’t detect loadable kernel module (LKM) rootkits that place malicious code to their installation procedure. This paper presents a framework, namely HACS, to protect kernel data using module white list based access control. HACS runs in VMM and intercepts the write requests to protected regions. A mediation strategy is proposed in this paper that judges whether the modification requests are legitimate or not. Malicious modifications requests are forbidden and normal ones are approved. Our experiments with real-world DKOM rootkits demonstrate that HACS provides robust rootkits detection ability, with lower performance overhead than other kernel data protection methods.

A Virtual WLAN Device Model for High-Fidelity Wireless Network Emulation

The recent popularization of mobile devices has increased the amount of communication traffic. Hence, it is necessary both in academia and industry to research load distribution methods for mobile networks. An evaluation environment for large-scale networks that behaves like a practical system is necessary to evaluate these methods, and either a physical environment or simulation environment can be used. However, physical and simulation environments each have their advantages and disadvantages. A physical environment is suitable for practical operation because it is possible to obtain data from a real environment. In contrast, the cost for a large number of nodes and the difficulty of field preparation are its disadvantages. Reproducing radio propagation is also a challenge. Network simulators solve the disadvantages of the physical environment by modeling the entire evaluation environment. However, they do not exactly reproduce the physical environment because the nodes are abstracted. This article presents an evaluation environment that combines a network simulator and virtual machines with virtual wireless Local Area Network (LAN) devices. The virtual machines reproduce the physical environment with high fidelity by running the programs of the physical machines, and the virtual wireless LAN devices make it possible to emulate wireless LAN communication using default operating system drivers. A network simulator and virtual machines also reduce the cost for nodes, ease the burden of field preparation, and reproduce radio propagation by modeling the evaluation environment. In the evaluation, the proposed method decreased the difference from the physical environment to 5% in terms of transmission control protocol throughput. In the case of user datagram protocol, the proposed method decreased the difference from the physical environment down to 1.7%. The number of virtual machines available on a host machine and the practical use of the proposed method are also discussed.

CloudIntell: An intelligent malware detection system

Enterprises and individual users heavily rely on the abilities of antiviruses and other security mechanisms. However, the methodologies used by such software are not enough to detect and prevent most of the malicious activities and also consume a huge amount of resources of the host machine for their regular operations. In this paper, we propose a combination of machine learning techniques applied on a rich set of features extracted from a large dataset of benign and malicious files through a bespoke feature extraction tool. We extracted a rich set of features from each file and applied support vector machine, decision tree, and boosting on decision tree to get the highest possible detection rate. We also introduce a cloud-based scalable architecture hosted on Amazon web services to cater the needs of detection methodology. We tested our methodology against different scenarios and generated high achieving results with lowest energy consumption of the host machine.

APPLES: Efficiently Handling Spin-lock Synchronization on Virtualized Platforms

Spin-locks are widely used in software for efficient synchronization. However, they cause serious performance degradation on virtualized platforms, such as the Lock Holder Preemption (LHP) problem and the Lock Waiter Preemption (LWP) problem, due to excessive spinning by virtual CPUs (VCPUs). The excessive spinning occurs when a VCPU waits to acquire a spin-lock. To address the performance degradation, hardware facilities, such as Intel PLE and AMD PF, are provided on processors to preempt VCPUs when they spin excessively. Although these facilities have been predominantly used on mainstream virtualization systems, using them in a manner that achieves the highest performance is still a challenging issue. There are two core problems in using these hardware facilities to reduce excessive spinning. One is to determine the best time to preempt a spinning VCPU (i.e., the selection of spinning thresholds). The other is which VCPU should be scheduled to run after the spinning VCPU is descheduled. Due to the semantic gap between different software layers, the virtual machine monitor (VMM) does not have information about the computation characteristics on VCPUs, which is needed to address the above problems. This makes the problems inherently challenging. We propose a framework named AdPtive Pause-Loop Exiting and Scheduling (APPLES) to address these problems. APPLES monitors the overhead caused by excessive spinning and preempting spinning VCPUs, and periodically adjusts spinning thresholds to reduce the overhead. APPLES also evaluates and schedules “ready” VCPUs in a VM by their potential to reduce the spinning incurred by the spin-lock synchronization. The evaluation is based on the causality and the time of VCPU preemptions. The implementation of APPLES incurs only minimal changes to existing systems (about 100 lines of code in KVM). Experiments show that APPLES can improve performance by 3 <inline-formula><tex-math notation="LaTeX"> $\sim$</tex-math></inline-formula> 49 percent (14 percent on average) for the workloads with frequent spin-lock operations.