Enhancing virtual machine introspection-based memory analysis with event triggers

Abstract

Virtual Machine Introspection (VMI) has the potential to provide secure cloud monitoring, but its hardware level monitoring gives rise to the 'semantic gap', where software-level behaviour loses its meaning. Memory forensics tools can offer a deployment-ready solution as compared to automated semantics derivation techniques, in the form of an integrated VMI-memory forensics architecture. A pending issue concerns the appropriate points in time at which to execute memory analysis routines. Analysis is required to execute in a manner not to overwhelm virtual machines but neither to lose out on short-lived in-memory data structures. This paper presents an on-going study to address what we call the 'event semantic gap', or rather the lost semantics of software-level events associated with the monitored behaviour. As opposed to deriving these events directly from the hardware level, we argue that translating them at the software level to recognizable events at the hardware level is more pragmatic, thus providing a fully integrated VMI-memory forensics architecture. Dynamic binary instrumentation (DBI) is a key enabler and promising results are demonstrated for the Xen hypervisor.