Secure Virtual Machine Research Articles

Malware Detection Based on Multi-level and Dynamic Multi-feature Using Ensemble Learning at Hypervisor

As more and more applications migrate to clouds, the type and amount of malware attack against virtualized environments are increasing, which is a key factor that restricts the widespread deployment and application of cloud platforms. Traditional in-VM-based security software is not effective against malware attacks, as the security software itself becomes the target of malware attacks and can easily be tampered with or even subverted. In this paper, we propose a new malware detection method to improve virtual machine security performance and ensure the security of the entire cloud platform. This paper uses the virtual machine introspection(VMI) combined with the memory forensics analysis(MFA) technology to extract multiple types of dynamic features from the virtual machine memory, the hypervisor layer and the hardware layer. Furthermore, this paper proposes an adaptive feature selection method. By combining three different search strategies, three types of features are compared and analyzed from three aspects: effectiveness, system load and security. By adjusting the weight of each feature, it meets the detection requirements of different malware in the cloud environment as expected. Finally, the detection method improves the detection accuracy and generalization ability of the overall classifier using the AdaBoost ensemble learning method with Voting’s combination strategy. The experiment used a large number of real malicious samples, and achieved an accuracy of 0.999 (AUC), with a maximum performance overhead of 5.6%.

Enclavisor: A Hardware-software Co-design for Enclaves on Untrusted Cloud

The releases of Intel SGX and AMD SEV mark the transition of hardware-based enclaves from research prototypes to mainstream products. These two paradigms of secure enclaves are attractive to both the cloud providers and tenants, since security is one of the key pillars of cloud computing. However, it is found that current hardware-defined enclaves are not flexible and efficient enough for the cloud. For example, although SGX can provide strong memory protection with both confidentiality and integrity, the size of secure memory is tightly restricted. On the contrary, SEV enables enclaves to use more memory but has critical security flaws due to no memory integrity protection. Meanwhile, both types of enclaves have relatively long booting latency, which makes them not suitable for short-term tasks like serverless workloads. After an in-depth analysis, we find that there are some intrinsic tradeoffs between security and performance due to the limitation of architectural designs. In this article, we investigate a novel hardware-software co-design of enclaves to meet the requirements of cloud by placing a part of the logic of the enclave mechanism into a lightweight software layer, named Enclavisor, to achieve a balance between security, performance, and flexibility. Specifically, our implementation is based on AMD's SEV and, Enclavisor is placed in the guest kernel mode of SEV's secure virtual machines. Enclavisor inherently supports memory encryption with no memory limitation and also achieves efficient booting, multiple enclave granularities, and post-launch remote attestation. Meanwhile, we also propose hardware/software solutions to mitigate the security flaws caused by the lack of memory integrity. We implement a prototype of Enclavisor on an AMD SEV server. The experiments on both micro-benchmarks and application benchmarks show that enclaves on Enclavisor can have close-to-native performance.

Secure virtual machine allocation against attacks using support value based game policy

SummaryCloud computing, as a supreme computing stage, presents new security challenges. At the point when virtual machines (VMs) are sent in a cloud domain, VM placement strategies can essentially influence the general security dangers of the whole cloud. As of late, the attacks are explicitly intended to co‐locate with target VMs in the cloud. The VM placement without considering the security risks may put the clients, or even the whole cloud, in threat. Therefore, here we prompt an exhaustive approach to appraise the cloud environment security risk from network, host, and VM. In like manner, secure VM allocation against co‐resident attacks using support value based game policy is proposed that lessens the general security dangers of a cloud, while decides the multi‐objective measures such as efficiency, coverage, and the maximum link utilization. Then, the support value is calculated for the given multi‐objective values. At last, the game theory is used to allocate the best VM. The experimental results prove that the proposed method outperforms than the existing methods in regards of efficiency, coverage maximum link utilization, execution time, throughput, latency, workload balance, power consumption, and standard deviation.

Prediction of Virtual Machine State Based on BP Neural Network

Monitoring software for kernel-level rootkit malware in the cloud computing environment has been relatively perfect. However, these monitors can only ensure the security of virtual machines in the cloud environment, but cannot make a more accurate judgment on the future state of virtual machines. Kernel virtual machine for cloud computing environment safety status of prediction is affected by the impact factors of nonlinear, the traditional forecasting model is based on statistical methods, although dynamic allocation model can be used for the prediction, t the ability to overcome the non-linear influence is poorer, predicted results already can not meet the accuracy requirement of the Internet of things. In order to more accurately predict the cloud computing environment of virtual machine core security status in the future, based on the BP neural network in the virtual machine future state prediction model, and through factor analysis and factor analysis results normalized processing to reduce the size of the input data of BP neural network, the neural and network prediction time. Finally, by processing and simulating the data obtained by libvirt program, the feasibility of the model is verified. It can be seen that the model has a good prediction effect on the future state of the virtual machine.

A Secure Virtual Machine Allocation Strategy Against Co-Resident Attacks

In the area of network development, especially cloud computing, security has been a long-standing issue. In order to better utilize physical resources, cloud service providers usually allocate different tenants on the same physical machine, i.e., physical resources such as CPU, memory, and network devices are shared among multiple tenants on the same host. Virtual machine (VM) co-resident attack, a serious threat in this sharing methodology, includes malicious tenants who tend to steal private data. Currently, most solutions focus on how to eliminate known specific side channels, but they have little effect on unknown side channels. Compared to eliminating side channels, developing a VM allocation strategy is an effective countermeasure against VM co-resident attack as it reduces the probability of VM co-residency, but research on this topic is still in its infancy. In this study, firstly, a novel, efficient, and secure VM allocation strategy named Against VM Co-resident attack based on Multi-objective Optimization Best Fit Decreasing (AC-MOBFD) is proposed, which simultaneously optimizes load balancing, energy consumption, and host resource utilization during VM placement. Subsequently, security of the proposed allocation strategy is measured using two metrics – VM attack efficiency and VM attack coverage. Extensive experiments on simulated and real cloud platforms, CloudSim and OpenStack, respectively, demonstrate that using our strategy, the attack efficiency of VM co-residency is reduced by 37.3% and VM coverage rate is reduced by 24.4% when compared to existing strategies. Finally, we compare the number of co-resident hosts with that of hosts in a real cloud platform. Experimental results show that the deviation is below 9.4%, which validates the feasibility and effectiveness of the presented strategy.

Dolphin partner optimization based secure and qualified virtual machine for resource allocation with streamline security analysis

Cloud computing has mounted itself as an exciting computational version that provides a huge range of Virtual Machine (VM) resources, including CPU, storage, memory, network bandwidth and databases, etc. However, one important problem here is a way to efficiently allocate secure virtual machine for resource allocation that consumes more time. To overcome this problem, an efficient optimization algorithm with security has to be chosen to select most secure and qualified virtual machine for resource allocation. In this venture, this work has proposed Dolphin Partner Optimization based Secure and Qualified Virtual Machine for resource allocation with streamline security. The Energy based Prioritization and Memory aware Optimization is used to select energy based and memory based VMs for security purpose, moreover this work have added hypervisor security to the obtained two sets of VMs. Subsequently, the Dolphin Partner Optimization optimizes the two sets of VMs to produce the best qualified virtual machine for each set. Finally, streamline security is added to improve the security level and the selected virtual machine is virtually best secured one. Proposed methodology is implemented using the CloudSim tool and the experimental results shows that the proposed method gives better security level and less time consumption.

Designing in-VM-assisted lightweight agent-based malware detection framework for securing virtual machines in cloud computing

The security of cloud services and underlying resources is a major concern due to vulnerabilities existing in current implementation of the virtualization. Thus, there is a need of detecting system-level attacks like viruses, worms, malware, etc. In this paper, we extend our previous work on vulnerability assessment and patching by integrating in-VM-assisted agent-based malware detection (AMD) framework for securing high-risk virtual machines (VMs) in cloud. The proposed framework has two components, viz. agent at VM and anomaly detection at hypervisor. An agent continuously looks for the new deployment of the executable in-VM and applies the signature-based detection to detect known malware. For detecting unknown attacks, it generates the profile with optimal static features for new executable. The optimal features are derived using an extended binary bat algorithm with two new fitness functions. The profile is transferred to hypervisor where anomaly detection using random forest classifier is applied. It classifies the executable to either normal or malware and generates an alert to VM user. The functionality of the proposed AMD framework is validated over cloud testbed at NIT Goa, as well as with the latest malware datasets. In addition, we analyze the VM security requirements fulfilled by the proposed framework.

Secure virtual machine placement in cloud data centers

Abstract Due to an increasing number of avenues for conducting cross-VM side-channel attacks, the security of multi-tenant public IaaS cloud environments is a growing concern. These attacks allow an adversary to steal private information from a target user whose VM instance is co-located with that of the adversary. In this paper, we focus on secure VM placement algorithms which a cloud provider can use for the automatic enforcement of security against such co-location based attacks. To do so, we first establish a metric for evaluating and quantifying co-location security of multi-tenant public IaaS clouds, and then propose a novel VM placement algorithm called “Previously Co-Located Users First” which aims to reduce the probability of malicious VM co-location. Thereafter, we perform a theoretical and empirical analysis of our proposed algorithm to evaluate its efficiency and security. Our results, obtained using real-world cloud traces containing millions of VM requests and thousands of actual users, indicate that the proposed algorithm provides a significant increase in the cloud’s co-location resistance with little compromise in resource utilization, compared to existing approaches. We also explore the potential for cloud providers to leverage passive cache monitoring techniques as an additional security measure in order to automatically improve the co-location resistance provided by general VM placement algorithms.

Mixture Localization-Based Outliers Models for securing Data Migration in Cloud Centers

The cloud computing paradigm is changing how businesses operate, providing greater efficiency, tolerance, elasticity and flexibility in computing workloads. Underpinning these changes are multiple data centers, operated by different entities and distributed globally. Despite these benefits, cloud computing presents new classes of cyber-attack, opportunities to attack and processes to subvert. One of the primary strategies to defend against cyber-attacks is the migration process. A secure Virtual Machine (VM) migration is essential to safeguard cloud data centers against insider and outsider attacks. In this paper, we propose a collaborative anomaly detection system for discovering insider and outsider attacks from cloud systems and their migration process. The proposed system is named Mixture Localization-based Outliers (MLO) and utilizes Gaussian-mixture models for fitting network data and a local outlier factor function for discovering abnormal patterns in network traffic data. In order to validate the effectiveness of the models, the datasets of UNSW-NB15 and BoT-IoT are employed. The experimental results have revealed the high performance of the proposed system compared with several peer anomaly detection techniques.

Secure Data Verification and Virtual Machine Monitoring

Powerfully configurable virtualized assets make the physical area of the information and process autonomous of its portrayal and the clients have no influence over the physical arrangement of information and running procedure. In a multi-cloud condition the layer of deliberation between the physical equipment and virtualized frameworks gives a great way to convey cost reserve funds through server union and also expanded operational productivity and adaptability. This additional usefulness presents a virtualization layer that it turns into a chance of assault for the facilitated virtual administrations. The proposed access control show ensures virtual machines by receiving access control at various layers. The information shading plan help to secure the virtualized information utilized in the virtual machines. The information confirmation structure, which gives a grouping of trust wipes out the untrusted special virtual machines, and additionally utilize the confided in processing standards to guarantee the respectability of the checking condition. Safeguarding security plot ceaselessly screens the working and trade of information between the virtual machine. The test results demonstrate that this plan can viably counteract virtual machine escape without influencing the general productivity of the framework.

A quantitative security metric model for security controls: Secure virtual machine migration protocol as target of assessment

Quantitative security metrics are desirable for measuring the performance of information security controls. Security metrics help to make functional and business decisions for improving the performance and cost of the security controls. However, defining enterprise-level security metrics has already been listed as one of the hard problems in the In-foSec Research Council's hard problems list. Almost all the efforts in defining absolute security metrics for the enterprise security have not been proved fruitful. At the same time, with the maturity of the security industry, there has been a continuous emphasis from the regulatory bodies on establishing measurable security metrics. This paper addresses this need and proposes a relative security metric model that derives three quantitative security metrics named Attack Resiliency Measure (ARM), Performance Improvement Factor (PIF), and Cost/Benefit Measure (CBM) for measuring the performance of the security controls. For the effectiveness evaluation of the proposed security metrics, we took the secure virtual machine (VM) migration protocol as the target of assessment. The virtualization technologies are rapidly changing the landscape of the computing world. Devising security metrics for virtualized environment is even more challenging. As secure virtual machine migration is an evolving area and no standard protocol is available specifically for secure VM migration. This paper took the secure virtual machine migration protocol as the target of assessment and applied the proposed relative security metric model for measuring the Attack Resiliency Measure, Performance Improvement Factor, and Cost/Benefit Measure of the secure VM migration protocol.

Design, Implementation and Verification of Cloud Architecture for Monitoring a Virtual Machine's Security Health

Cloud customers need assurances regarding the security of their virtual machines (VMs), operating within an Infrastructure as a Service (IaaS) cloud system. This is complicated by the customer not knowing where his VM is executing, and on the semantic gap between what the customer wants to know versus what can be measured in the cloud. We present CloudMonatt , an architecture for monitoring a VM's security health. We show a full prototype based on the OpenStack open source cloud software. We also verify CloudMonatt to show that there are no security vulnerabilities that could allow an attacker to subvert its protection. As such, we conduct a systematic security verification of CloudMonatt . We model and verify the network protocols within the distributed system, as well as interactions of hardware/software modules inside the cloud server. Our results show that CloudMonatt is capable of delivering this monitoring and attestation service to customers in an unforgeable and reliable manner.

Task‐Oriented Multilevel Cooperative Access Control Scheme for Environment with Virtualization and IoT

With the development of cloud computing technology and the proliferation of the Internet of Things (IoT) terminals, more and more scenes need the collaboration of virtual machines and IoT terminals to resolve. However, there are many severe challenges on the security of virtual machines and IoT terminals. Based on Bell‐LaPadula Model (BLP), a task‐oriented multilevel cooperative access control scheme virtualization and reality BLP, named VR‐BLP, is proposed. Specifically, tasks are created for each user of the platform and tasks and users are divided into multiple levels to provide more granularities to limit access between virtual machines and IoT terminals. Moreover, with network isolation cooperating with process isolation and shared memory isolation mechanisms, VR‐BLP is implemented to enhance the security isolations between tasks. Performance evaluations show that VR‐BLP enhanced the security of environment with virtualization and IoT without causing significant performance penalty.

Research of Security as a Service for VMs in IaaS Platform

With the rapid promotion and application of cloud computing technology in various fields, cloud computing security has become the focus of attention. To satisfy the virtual machine (VM) security requirements of communication access control, network anomaly detection, memory monitoring, and file antivirus in Infrastructure as a Service (IaaS) platform, a comprehensive protection framework with the capacity of defense-in-depth for tenant VMs was proposed in this paper, which employed three different layers to satisfy above security requirements of tenant business from the outside to the inside of the VM. At the first layer, a tenant domain model was abstracted and realized based on software defined networking (SDN), which was used to re-obtain the capacity for communication access control for VM traffic and ensure security isolation of different tenant business networks. Besides, to detect the network abnormality of tenant VMs, a traffic structure stability model was constructed according to the deviation degree between current and historical normal network traffic structure profile. At the second layer, the capacities of network access control and anomaly detection, the same as the capacities used in the first layer, which were provided based on VM granularity. At the third layer, to monitor the VM memory information, a VM security monitoring method with agentless based on online analysis of VM memory was proposed by employing physical memory analysis mechanism. Moreover, a file antivirus method named HyperAV for VM based on virtualization was given, which was constructed of a frontend and a rear end. HyperAV optimized the process of virus scanning by monitoring the sector change information of a running VM with low performance costs. The experimental results demonstrated the effectiveness and low performance costs of the proposed protection framework and the corresponding security mechanisms, respectively.

Secure Virtualization Environment Based on Advanced Memory Introspection

Most existing virtual machine introspection (VMI) technologies analyze the status of a target virtual machine under the assumption that the operating system (OS) version and kernel structure information are known at the hypervisor level. In this paper, we propose a model of virtual machine (VM) security monitoring based on memory introspection. Using a hardware-based approach to acquire the physical memory of the host machine in real time, the security of the host machine and VM can be diagnosed. Furthermore, a novel approach for VM memory forensics based on the virtual machine control structure (VMCS) is put forward. By analyzing the memory of the host machine, the running VMs can be detected and their high-level semantic information can be reconstructed. Then, malicious activity in the VMs can be identified in a timely manner. Moreover, by mutually analyzing the memory content of the host machine and VMs, VM escape may be detected. Compared with previous memory introspection technologies, our solution can automatically reconstruct the comprehensive running state of a target VM without any prior knowledge and is strongly resistant to attacks with high reliability. We developed a prototype system called the VEDefender. Experimental results indicate that our system can handle the VMs of mainstream Linux and Windows OS versions with high efficiency and does not influence the performance of the host machine and VMs.

COW-IMM: A Novel Integrity Measurement Method Based on Copy-on-Write for File in Virtual Machine

The integrity measurement method is used to detect whether the files are tampered with and to build a trusted environment. It can improve the security of virtual machines using base and increment image. Currently, the traditional integrity measurement methods (MDA-IMM) are based on the message digest algorithm with high computational complexity and heavy data. As a result, the MDA-IMM consumes a lot of I/O resources and spends too much time. To address those issues, we propose a novel method (COW-IMM) based on copy-on-write for the files in base image, the precondition is that, there is oneto-one correspondence between the cluster of image and the logic block of file system, and both of them have the same size. The COW-IMM gets the information of files for integrity measurement from base image and measures the integrity of files in increment image. We implement a prototype based on KVM, Qcow2 image, and Ext4. The algorithm analysis shows that, the volume of data used by COW-IMM is 512 times smaller than that used by MDA-IMM at least, if the file size is the same. The experimental evaluations show that, the speed of COW-IMM is faster and faster than that of MDA-IMM with the increment of file size. For example, when the file size is 0.1M, the speed of COW-IMM is about 10 times faster than that of MDA-IMM; when the file size is 90M, the speed of COW-IMM is about 592 times faster than that of MDA-IMM.

NDynamic Framework for Secure VM Migration over Cloud Computing

In the centralized cloud controlled environment, the decision-making and monitoring play crucial role where in the host controller (HC) manages the resources across hosts in data center (DC). HC does virtual machine (VM) and physical hosts management. The VM management includes VM creation, monitoring, and migration. If HC down,the services hosted by various hosts in DC can`t be accessed outside the DC. Decentralized VM management avoids centralized failure by considering one of the hosts from DC as HC that helps in maintaining DC in running state. Each host in DC has many VM`s with the threshold limit beyond which it can`t provide service.To maintain threshold , the host`s in DC does VM migration across various hosts. The data in migration is in the form of plaintext, the intruder can analyze packet movement and can control hosts traffic. The incorporation of security mechanism on hosts in DC helps protecting data in migration. This paper discusses an approach for dynamic HC selection, VM selection and secure VM migration over cloud environment.

DFA-VMP: An efficient and secure virtual machine placement strategy under cloud environment

The problem of Virtual Machine (VM) placement is critical to the security and efficiency of the cloud infrastructure. Nowadays most research focuses on the influences caused by the deployed VM on the data center load, energy consumption, resource loss, etc. Few works consider the security and privacy issues of the tenant data on the VM. For instance, as the application of virtualization technology, the VM from different tenants may be placed on one physical host. Hence, attackers may steal secrets from other tenants by using the side-channel attack based on the shared physical resources, which will threat the data security of the tenants in the cloud computing. To address the above issues, this paper proposes an efficient and secure VM placement strategy. Firstly, we define the related security and efficiency indices in the cloud computing system. Then, we establish a multi-objective constraint optimization model for the VM placement considering the security and performance of the system, and find resolution towards this model based on the discrete firefly algorithm. The experimental results in OpenStack cloud platform indicates that the above strategy can effectively reduce the possibility of malicious tenants and targeted tenants on the same physical node, and reduce energy consumption and resource loss at the data center.

Mathematical Ontology for Infectious Virtual Machines in IaaS Cloud Environment

Background/Objectives: Cloud virtualization is a creative and one of the altogether accomplished improvements in the current figuring environment. It provides a virtualized environment based on Service Level Agreement (SLA) to cloud. Methods/Statistical Analysis: Infrastructures of Physical machines are rapidly replacing by Virtual machines (VMs) for their abilities to emulate hardware environments, share hardware resources, and utilization of a variety of operating systems. Accordingly, giving security to the cloud virtual machines and clients’ information is one of the essential difficulties to data frameworks. This manuscript describes about the mathematical ontology based upon the attacked VMs and infectious VMs which predicts the trustworthiness of the IaaS virtual platform. Findings: The proposed work will diminish the dangers to the VMs in the cloud surrounding independent of the client’s security and applications approach. Application/Improvements: It will fundamentally guarantee the level of the security of VMs in a cloud situation which assists the cloud administration suppliers to take the fast choices and about the up-degree of the counter assault estimations.

Monitoring and Attestation of Virtual Machine Security Health in Cloud Computing

Cloud customers need assurances regarding the security of their virtual machines (VMs) operating within an infrastructure-as-a-service cloud system. This is complicated by the customer not knowing where the VM is executing and by the semantic gap between what the customer wants to know versus what can be measured in the cloud. In this article, the authors present an architecture for monitoring a VM's security health. Their architecture can communicate this to the customer in an unforgeable manner. The authors show a concrete implementation of property-based attestation and a full prototype based on the OpenStack open source cloud software.