Nitro: Hardware-Based System Call Tracing for Virtual Machines
نویسندگان
چکیده
Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the hypervisor level. This lends itself well to security applications, though the hardware virtualization support from Intel and AMD was not designed with VMI in mind. This results in many challenges for developers of hardware-supported VMI systems. This paper describes the design and implementation of our prototype framework, Nitro, for system call tracing and monitoring. Since Nitro is a purely VMI-based system, it remains isolated from attacks originating within the guest operating system and is not directly visible from within the guest. Nitro is extremely flexible as it supports all three system call mechanisms provided by the Intel x86 architecture and has been proven to work in Windows, Linux, 32-bit, and 64-bit environments. The high performance of our system allows for real-time capturing and dissemination of data without hindering usability. This is supported by extensive testing with various guest operating systems. In addition, Nitro is resistant to circumvention attempts due to a construction called hardware rooting. Finally, Nitro surpasses similar systems in both performance and functionality.
منابع مشابه
A Genetic Based Resource Management Algorithm Considering Energy Efficiency in Cloud Computing Systems
Cloud computing is a result of the continuing progress made in the areas of hardware, technologies related to the Internet, distributed computing and automated management. The Increasing demand has led to an increase in services resulting in the establishment of large-scale computing and data centers, in addition to high operating costs and huge amounts of electrical power consumption. Insuffic...
متن کاملDevelopment of hardware system using temperature and vibration maintenance models integration concepts for conventional machines monitoring: a case study
This article describes the integration of temperature and vibration models for maintenance monitoring of conventional machinery parts in which their optimal and best functionalities are affected by abnormal changes in temperature and vibration values thereby resulting in machine failures, machines breakdown, poor quality of products, inability to meeting customers’ demand, poor inventory contro...
متن کاملFreeing your Computer from the Hardware
In this paper we propose an alternative software model for modern computing environments. The new model features the decoupling of software execution from the computer hardware by encapsulating all software execution in an abstraction we call capsules. We treat capsules as first class objects that can be named, controlled, migrated, and replicated. We argue that by putting software execution in...
متن کاملThe Changing Virtual Machine Environment: Interfaces to Real Hardware, Virtual Hardware, and Other Virtual Machines
a survey of changes to virtual machine interfaces, implementation, architecture, and simulation techniques as they affect IBM System1370 and 303X (3031, 3032, 3033) processors, the system control program to which virtual machines interface, and other virtual machines executing on the same real computing system or elsewhere. The paper seeks to summarize such changes and provide a perspective on ...
متن کاملMemory-Savvy Distributed Interactive Ray Tracing
Interactive ray tracing in a cluster environment requires paying close attention to the constraints of a loosely coupled distributed system. To render large scenes interactively, memory limits and network latency must be addressed efficiently. In this paper, we improve previous systems by moving to a page-based distributed shared memory layer, resulting in faster and easier access to a shared m...
متن کامل