VM-based Approach Research Articles

Implementation of L3 Function on Virtualization Environment using Virtual Machine Approach

There are 2 approaches to implement layer 3 network function on virtualization platforms, the first approach uses the conventional physical devices; while the second is software-based. Several previous studies have been carried out to test the performance of L3 function on virtualization using software-based and obtained positive result for the performance over the physical-based. While the previous studies were limited only within the scope of testing environment, this paper tries to extend the study not only limited to the performance test based-on RFC 2544 standard, but also implementation in the production environment using virtual machine (VM) approach. Mikrotik CHR (Cloud Hosted Router) designed specifically for virtualization environment will be used as the L3 platform on the VM. Implementation in the production environment was conducted at University computer laboratory that has 207 desktops (190 in the form of virtual desktops, 17 in the form of PCs) not including user' devices that connected via WiFi networks. VM-based approach for routing functions (Layer 3) using Mikrotik CHR has proven to be stable and sufficient for use in the computer laboratory after 6 months of usage. Performance test also shown that VM-based L3 function had higher transfer rates; physical-based router was about 23,4% slower for 1 routing load and 4,25% slower for 2 routings load. The characteristic of VM itself also add some benefits like VM snapshot and migration for recovery. The test also revealed that VM-based L3 function prone to performance penalties when more than one routing load performed compared with physical-based.

Enhance virtual-machine-based code obfuscation security through dynamic bytecode scheduling

Code virtualization built upon virtual machine (VM) technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed scheduling structure where the program always follows a single, deterministic execution path for the same input. Such approaches, however, are vulnerable in certain scenarios where the attacker can reuse knowledge extracted from previously seen software to crack applications protected with the same obfuscation scheme. This paper presents Dsvmp, a novel VM-based code obfuscation approach for software protection. Dsvmp brings together two techniques to provide stronger code protection than prior VM-based approaches. Firstly, it uses a dynamic instruction scheduler to randomly direct the program to execute different paths without violating the correctness across different runs. By randomly choosing the program execution path, the application exposes diverse behavior, making it much more difficult for an attacker to reuse the knowledge collected from previous runs or similar applications to launch an attack. Secondly, it employs multiple VMs to further obfuscate the mapping from VM opcode to native machine instructions, so that the same opcode could be mapped to different native instructions at runtime, making code analysis even harder. We have implemented Dsvmp in a prototype system and evaluated it using a set of widely used applications. Experimental results show that Dsvmp provides stronger protection with comparable runtime overhead and code size, when it is compared to two commercial VM-based code obfuscation tools.

Tapir

Kernel probes allow code to be inserted into a running operating system kernel to gather information for debugging or profiling. Inserting code into the kernel raises a number of safety issues. Current solutions follow one of the two paths: a VM-based approach, where safety properties are checked dynamically by an interpreter, or a static-analysis approach, where probe code is guaranteed to be safe statically. While more attractive, existing static solutions depend on ad-hoc and error-prone analysis. We propose to explore enforcing safety properties using a type system, thus building our analysis on top of the well-studied ground of type theory.