Malicious Virtual Machines Research Articles

HClave: An isolated execution environment design for hypervisor runtime security

Virtualization is the cornerstone of cloud computing, but the hypervisor, the crucial software component that enables virtualization, is known to suffer from various attacks. It is challenging to secure the hypervisor due to at least two reasons. On one hand, commercial hypervisors are usually integrated into a privileged Operating System (OS), which brings in a larger attack surface. On the other hand, multiple Virtual Machines (VM) share a single hypervisor, thus a malicious VM could leverage the hypervisor as a bridge to launch “cross-VM” attacks. In this work, we propose HClave, an isolated execution environment (IEE) design for hypervisor runtime. We decouple the virtualization layer into a tiny trusted computing base (TCB), a large non-secure OS, and multiple HClave IEEs through a bidirectional isolation approach. HClave extends the nested kernel approach to deprive the traditional OS from accessing the tiny TCB’s memory and creates an IEE for hypervisor runtime. We implemented HClave based on KVM and evaluated its effectiveness and efficiency through case studies. Experimental results show that HClave can significantly improve the security of the hypervisor with reasonable runtime overhead.

Cross-VM Network Channel Attacks and Countermeasures Within Cloud Computing Environments

Cloud providers attempt to maintain the highest levels of isolation between Virtual Machines (VMs) and inter-user processes to keep co-located VMs and processes separate. This logical isolation creates an internal virtual network to separate VMs co-residing within a shared physical network. However, as co-residing VMs share their underlying VMM (Virtual Machine Monitor), virtual network, and hardware are susceptible to cross VM attacks. It is possible for a malicious VM to potentially access or control other VMs through network connections, shared memory, other shared resources, or by gaining the privilege level of its non-root machine. This research presents a two novel zero-day cross-VM network channel attacks. In the first attack, a malicious VM can redirect the network traffic of target VMs to a specific destination by impersonating the Virtual Network Interface Controller (VNIC). The malicious VM can extract the decrypted information from target VMs by using open source decryption tools such as Aircrack. The second contribution of this research is a privilege escalation attack in a cross VM cloud environment with Xen hypervisor. An adversary having limited privileges rights may execute Return-Oriented Programming (ROP), establish a connection with the root domain by exploiting the network channel, and acquiring the tool stack (root domain) which it is not authorized to access directly. Countermeasures against this attacks are also presented

Defending Against Co-Residence Attack in Energy-Efficient Cloud: An Optimization Based Real-Time Secure VM Allocation Strategy

Resource sharing among users serves as the foundation of cloud computing, which, however, may also cause vulnerabilities to diverse co-residence attacks launched by malicious virtual machines (VM) residing in the same physical server with the victim VMs. In this paper, we aim to defend against such co-residence attacks through a secure, workload-balanced, and energy-efficient VM allocation strategy. Specifically, we model the problem as an optimization problem by quantifying and minimizing three key factors: (1) the security risks, (2) the power consumption and (3) the unbalanced workloads among different physical servers. Furthermore, this work considers a realistic environmental setting by assuming a random number of VMs from different users arriving at random timings, which requires the optimization solution to be continuously evolving. As the optimization problem is NP-hard, we propose to first cluster VMs in time windows, and further adopt the Ant Colony Optimization (ACO) algorithm to identify the optimal allocation strategy for each time window. Comprehensive experimental results based on real world cloud traces validates the effectiveness of the proposed scheme.

S2H: Hypervisor as a setter within Virtualized Network I/O for VM isolation on cloud platform

Virtualized Network I/O (VNIO) plays a key role in providing the network connectivity to cloud services, as it delivers packets for Virtual Machines (VMs). Existing para-virtualized solutions accelerate the virtual Switch (vSwitch) data transfer via memory-sharing mechanism, that unfortunately impairs the memory isolation barrier among VMs. In this paper, we categorize existing para-virtualized solutions into two types: VM to vSwitch (V2S) and vSwitch to VM (S2V), according to the memory-sharing strategy. We then analyze their individual VM isolation issues, that is, a malicious VM may access other ones’ data by exploiting the shared memory. To solve this issue, we propose a new S2H memory sharing scheme, which shares the I/O memory from vSwitch to Hypervisor. The S2H scheme can guarantee both VM isolation and network performance as the hypervisor acts as a “setter” between VM and vSwitch for packet delivery. To show that S2H can be implemented easily and efficiently, we implement the prototype based on the de-facto para-virtualization standard vHost-User solution. Extensive experimental results show that S2H not only guarantees the isolation but also holds the comparable throughput with the same CPU cores configured, when comparing with the native vHost-User solution.

A Game-Theoretic Framework for the Virtual Machines Migration Timing Problem

In a multi-tenant cloud, a number of Virtual Machines (VMs) are collocated on the same physical machine to optimize performance, power consumption and maximize profit. This, however, increases the risk of a malicious VM performing side-channel attacks and leaking sensitive information from neighboring VMs. As such, this paper develops and analyzes a game-theoretic framework for the VM migration timing problem in which the cloud provider decides when to migrate a VM to a different physical machine to reduce the risk of being compromised by a collocated malicious VM. The adversary decides the rate at which she launches new VMs to collocate with the victim VMs. Our formulation captures a data leakage model in which the cost incurred by the cloud provider depends on the duration of collocation with malicious VMs. It also captures costs incurred by the adversary in launching new VMs and by the defender in migrating VMs. We establish sufficient conditions for the existence of Nash equilibria for general cost functions, as well as for specific instantiations, and characterize the best response for both players. Furthermore, we extend our model to characterize its impact on the attacker’s payoff when the cloud utilizes intrusion detection systems that detect side-channel attacks. Our theoretical findings are corroborated with extensive numerical results in various settings as well as a proof-of-concept implementation in a realistic cloud setting.

Hypervisor Vulnerabilities and Some Defense Mechanisms, in Cloud Computing Environment

Cloud computing is the most important technology at the present time, in terms of reducing applications costs and makes them more scalable and flexible. As the cloud currency is based on building virtualization technology, so it can secure a large-scale environment with limited security capacity such as the cloud. Where, Malicious activities lead the attackers to penetrate virtualization technologies that endanger the infrastructure, and then enabling attacker access to other virtual machines which running on the same vulnerable device. The proposed work in this paper is to review and discuss the attacks and intrusions that allow a malicious virtual machine (VM) to penetrate hypervisor, especially the technologies that malicious virtual machines work on, to steal more than their allocated quota from material resources, and the use of side channels to steal data and Passing buffer barriers between virtual machines. This paper is based on the Security Study of Cloud Hypervisors and classification of vulnerabilities, security issues, and possible solutions that virtual machines are exposed to. Therefore, we aim to provide researchers, academics, and industry with a better understanding of all attacks and defense mechanisms to protect cloud security. and work on building a new security architecture in a virtual technology based on hypervisor to protect and ensure the security of the cloud.

Secure VM management with strong user binding in semi-trusted clouds

In Infrastructure-as-a-Service (IaaS) clouds, remote users access provided virtual machines (VMs) via the management server. The management server is managed by cloud operators, but not all the cloud operators are trusted in semi-trusted clouds. They can execute arbitrary management commands to users’ VMs and redirect users’ commands to malicious VMs. We call the latter attack the VM redirection attack. The root cause is that the binding of remote users to their VMs is weak. In other words, it is difficult to enforce the execution of only users’ management commands to their VMs. In this paper, we propose UVBond for strongly binding users to their VMs to address this issue. UVBond boots user’s VM by decrypting its encrypted disk inside the trusted hypervisor. Then it issues a VM descriptor to securely identify that VM. To bridge the semantic gap between high-level management commands and low-level hypercalls, UVBond uses hypercall automata, which accept the sequences of hypercalls issued by commands. We have implemented UVBond in Xen and created hypercall automata for various management commands. Using UVBond, we confirmed that a VM descriptor and hypercall automata prevented insider attacks and that the overhead was not large in remote VM management.

An Software Defined Network Based Secured Model for Malicious Virtual Machine Detection in Cloud Environment

Cloud computing is an emerging technology that offers the services to all the users as per their demand. Services are leveraged according to the Service level agreement (SLA). Service level agreement is monitored so that services are offered to the users without any problem and deprival. Software Defined Network (SDN) is used in order to monitor the trust score of the deployed Virtual Machines (VM) and Quality of Service (QoS) parameters offered. Software Defined Network controller is used to compute the trust score of the Virtual Machines and find whether Virtual Machine is malicious or trusted. Genetic algorithm is used to find the trusted Virtual Machine and release the resources allocated to the malicious Virtual Machine. This monitored information is intimated to cloud provider for further action. Security is enhanced by avoiding attacks from the malicious Virtual Machine in the cloud environment. The main objective of the paper is to enhance the security in the system using Software Defined Network based secured model.

A signaling game approach to mitigate co-resident attacks in an IaaS cloud environment

Cloud service providers (CSPs) offer a variety of services that are opening the door to the infinite possibilities of cloud computing. Despite numerous benefits offered by the CSPs, there are, however, some security issues that may dissuade users. In cloud computing, different virtual machines (VMs) often share the same physical resources, which are known as co-resident VMs. The shared physical resources pose a significant threat to the users as resources may belong to competing organizations as well as unknown attackers. From the perspective of a cloud user, there is no guarantee whether the co-resident VMs are trustworthy. The shared resources make privacy and perfect isolation implausible, which paves the way for co-resident attacks in which a VM attacks another co-resident VM through a covert side channel that can be used to extract another user’s secret information or launch denial of service attacks. The attack campaign becomes more damaging when multiple co-resident VMs collaborate. In this paper, we analyze the co-resident attacks and corresponding defense strategies, with respect to benign and malicious VMs and the defender, i.e., the VM monitor (VMM), using a signaling game model. The solutions to the game provide optimal defense strategies for the VMM with respect to the expected number of malicious VMs in collaboration. We evaluate the game results through simulations on various synthetic attack scenarios. The results show that the defender can effectively resist co-resident attacks by distinguishing the benign and malicious VMs.

A trust‐based hypervisor framework for preventing DDoS attacks in cloud

SummaryDistributed Denial of Service (DDoS) attack is one of the major attacks that incur large financial loss in the cloud system. This motivated the research community to develop various detection techniques for controlling the effects of the DDoS attack. However, the existing techniques are not mature to satisfy the requirements of a cloud‐based attack detection system, as they manage the devious strategies that exploit the elastic and multi‐tenant properties of the cloud and ignore the resource constraints of the cloud system. This paper proposes a new solution that allows the hypervisor to establish trust‐based relationships towards the guest Virtual Machines (VMs). The Bayesian inference is applied to aggregate the objective and subjective trust sources. A trust‐based maximin game between DDoS attackers is designed. A hypervisor tries to maximize the attack minimization under a limited amount of resources. The game solution guides the hypervisor to determine the distribution of optimal detection load among VMs to improve the real‐time detection rate of DDoS attack. The Least Squares Support Vector Machine (LS‐SVM) classification is applied to classify the normal VMs and malicious VMs. The file is allocated to the VM based on the storage capacity of the VM. The experimental result shows that the proposed approach achieves high DDoS attack detection rate with minimum false positive and negative rate, when compared to the existing attack detection models.

Defensive Mechanism Against DDoS Attack to Preserve Resource Availability for IoT Applications

The major challenge of Internet of Things (IoT) generated data is its hypervisor level vulnerabilities. Malicious VM deployment and termination are so simple due to its multitenant shared nature and distributed elastic cloud features. These features enable the attackers to launch Distributed Denial of Service attacks to degrade cloud server performance. Attack detection techniques are applied to the VMs that are used by malicious tenants to hold the cloud resources by launching DDoS attacks at data center subnets. Traditional dataflow-based attack detection methods rely on the similarities of incoming requests which consist of IP and TCP header information flows. The proposed approach classifies the status patterns of malicious VMs and ideal VMs to identify the attackers. In this article, information theory is used to calculate the entropy value of the malicious virtual machines for detecting attack behaviors. Experimental results prove that the proposed system works well against DDoS attacks in IoT applications.

Critical analysis of layer 2 network security in virtualised environments

In this article, we explore whether layer 2 network attacks that work on physical switches apply to their virtualised counterparts by performing a systematic study across four major hypervisor environments - Open vSwitch, Citrix XenServer, Microsoft Hyper-V Server and VMware vSphere - in seven different virtual networking configurations. First, we use a malicious virtual machine to run a MAC flooding attack and evaluate the impact on co-resident virtual machines. We find that network performance is degraded on all platforms and that it is possible to eavesdrop on other client traffic passing over the same virtual network for Open vSwitch and Citrix XenServer. Second, we use a malicious virtual machine to run a rogue DHCP server and then run multiple DHCP attack scenarios. On all four platforms, co-resident virtual machines can be manipulated by providing them with incorrect or malicious network information.

An improved vTPM-VM live migration protocol

To prevent malicious virtual machine from harming the security of vTPM-VM live migration process, we propose an improved vTPM-VM live migration protocol which uses a TPM-based integrity verification policy and a specific encryption scheme to enhance security. The TPM-based integrity verification policy is presented to ensure that all participating entities in this process are trustworthy. In data transfer phase, the specific encryption scheme is designed to associate the decipher process with one certain platform status so that only the destination platform can gain the key data of the migrated VM and vTPM instance. The security of this new protocol is analyzed. The results show that this protocol can effectively resist most of the attacks in the process of vTPM-VM live migration.

Recent research advances in cloud computing and big data

Recent research advances in cloud computing and big data

Entropy‐based denial‐of‐service attack detection in cloud data center

SummaryCloud data centers today usually lack network resource isolation. Meanwhile, it is easy to deploy and terminate large number of malicious virtual machines in a few seconds, while the administrator is probably difficult to identify these malicious virtual machines immediately. These features open doors for attackers to launch denial‐of‐service (DoS) attacks that target at degrading the quality of cloud service. This paper studies an attack scenario that malicious tenants use cloud resources to launch DoS attack targeting at data center subnets. Unlike traditional data flow‐based detections, which heavily depend on the pattern of data flows, we propose an approach that takes advantage of virtual machine status including CPU usage and network usage to identify the attack. We notice that malicious virtual machines exhibit similar status patterns when attack is launched. Based on this observation, information entropy is applied in monitoring the status of virtual machines to identify the attack behaviors. We conduct our experiments in the campus‐wide data center, and the results show our detection system can promptly and accurately response to DoS attacks. Copyright © 2015 John Wiley & Sons, Ltd.

On detecting co-resident cloud instances using network flow watermarking techniques

Virtualization is the cornerstone of the developing third-party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat--unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels. This paper presents co-resident watermarking, a traffic analysis attack that allows a malicious co-resident VM to inject a watermark signature into the network flow of a target instance. This watermark can be used to exfiltrate and broadcast co-residency data from the physical machine, compromising isolation without reliance on internal side channels. As a result, our approach is difficult to defend against without costly underutilization of the physical machine. We evaluate co-resident watermarkingunder a large variety of conditions, system loads and hardware configurations, from a local laboratory environment to production cloud environments (Futuregrid and the University of Oregon's ACISS). We demonstrate the ability to initiate a covert channel of 4 bits per second, and we can confirm co-residency with a target VM instance in $$<$$ < 10 s. We also show that passive load measurement of the target and subsequent behavior profiling is possible with this attack. We go on to consider the detectability of co-resident watermarking, extending our scheme to create a subtler watermarking attack by imitating legitimate cloud customer behavior. Our investigation demonstrates the need for the careful design of hardware to be used in the cloud.

An experimental study of cascading performance interference in a virtualized environment

In a consolidated virtualized environment, multiple virtual machines (VMs) are hosted atop a shared physical substrate. They share the underlying hardware resources as well as the software virtualization components. Thus, one VM can generate performance interference to another co-resident VM. This work explores the adverse impact of performance interference from a security perspective. We present a new class of attacks, namely the cascade attacks, in which an adversary seeks to generate performance interference using a malicious VM. One distinct property of the cascade attacks is that when the malicious VM exhausts one type of hardware resources, it will bring "cascading" interference to another type of hardware resources. We present four different implementations of cascade attacks and evaluate their effectiveness atop the Xen virtualization platform. We show that a victim VM can see significant performance degradation (e.g., throughput drops in network and disk I/Os) due to the cascade attacks.

Architectural support for hypervisor-secure virtualization

Virtualization has become a standard part of many computer systems. A key part of virtualization is the all-powerful hypervisor which manages the physical platform and can access all of its resources, including memory assigned to the guest virtual machines (VMs). Continuing releases of bug reports and exploits in the virtualization software show that defending the hypervisor against attacks is very difficult. In this work, we present hypervisor-secure virtualization - a new research direction with the goal of protecting the guest VMs from an untrusted hypervisor. We also present the HyperWall architecture which achieves hypervisor-secure virtualization, using hardware to provide the protections. HyperWall allows a hypervisor to freely manage the memory, processor cores and other resources of a platform. Yet once VMs are created, our new Confidentiality and Integrity Protection (CIP) tables protect the memory of the guest VMs from accesses by the hypervisor or by DMA, depending on the customer's specification. If a hypervisor does become compromised, e.g. by an attack from a malicious VM, it cannot be used in turn to attack other VMs. The protections are enabled through minimal modifications to the microprocessor and memory management units. Whereas much of the previous work concentrates on protecting the hypervisor from attacks by guest VMs, we tackle the problem of protecting the guest VMs from the hypervisor.

Architectural support for hypervisor-secure virtualization

Virtualization has become a standard part of many computer systems. A key part of virtualization is the all-powerful hypervisor which manages the physical platform and can access all of its resources, including memory assigned to the guest virtual machines (VMs). Continuing releases of bug reports and exploits in the virtualization software show that defending the hypervisor against attacks is very difficult. In this work, we present hypervisor-secure virtualization - a new research direction with the goal of protecting the guest VMs from an untrusted hypervisor. We also present the HyperWall architecture which achieves hypervisor-secure virtualization, using hardware to provide the protections. HyperWall allows a hypervisor to freely manage the memory, processor cores and other resources of a platform. Yet once VMs are created, our new Confidentiality and Integrity Protection (CIP) tables protect the memory of the guest VMs from accesses by the hypervisor or by DMA, depending on the customer's specification. If a hypervisor does become compromised, e.g. by an attack from a malicious VM, it cannot be used in turn to attack other VMs. The protections are enabled through minimal modifications to the microprocessor and memory management units. Whereas much of the previous work concentrates on protecting the hypervisor from attacks by guest VMs, we tackle the problem of protecting the guest VMs from the hypervisor.