Observation or Interference?

A t one time, desktop computers were “one machine, one operating system, one application,” forcing users to close one application to open another—and often to spend more time waiting than doing as a result. The advent of “one machine, one operating system, many applications” let users run multiple programs simultaneously and introduced a major step forward in computational evolution. Today, virtualization lets users have “one machine, multiple operating systems, multiple applications” and switch between them at will. This not only lets developers easily test their programs on multiple OSs and enterprise users more effectively utilize hardware through server consolidation, it’s also useful to computer users in general. When virtual machines are distributed with a set of preconfigured applications, users can easily utilize complex applications. Further, the isolation offered by VMs provides some security benefit, such as allowing general Web browsing while reducing the risk of compromise to the underlying physical system. Although virtualization isn’t new, the recent development of x86 virtualization products has revived interest in the virtualization market. This has led to the evolution of virtual machine introspection (VMI) techniques and tools to monitor VM behavior. VMI tools inspect a VM from the outside to assess what’s happening on the inside. This makes it possible for security tools—such as virus scanners and intrusion detection systems—to observe and respond to VM events from a “safe” location outside the monitored machine. Here, we survey and categorize the current crop of VMI technologies, then offer a detailed description of the Virtual Introspection for Xen (VIX) tool suite, which addresses key VMI requirements.