NEM: A NEW In-VM Monitoring with High Efficiency and Strong Isolation

Abstract

VMI technology is proposed to protect virtual machine and prevent it from attacking by malware. Although VMI technology can provide out-of-VM isolation to ensure the security of monitors, the overhead of context switching between the guest VMs and the hypervisor for each monitor point makes this approach wasteful in many application scenarios. On the other hand, semantic gap of extracting meaningful information from the guest is a problem need to be optimized for the VMI technology. In this paper, we present None-Exit Monitoring (NEM), a framework that can do the monitoring inside the guest to avoid overhead of VM-exit and VM-entry switching, and it can also provide strong isolation between the guest and the monitor tools. In NEM, we use two new hardware virtualization assistant features: Intel VT VMFUNC and #VE. NEM can provide isolated memory views and strict limits of privileges while using EPTP-switching to realize world-switches instead of root/non-root switching, which can reduce overhead of invocation of the monitor. On the other hand, IN-VM monitoring can achieve richer information on a virtual machine, which can enhance the capability of the monitor. To support EPTP-switching function of VMFUNC and #VE exception, we patch the open source KVM. We also implement NEM in KVM and evaluate its functionality and efficiency. Experimental result has shown that NEM can satisfy the security requirement of a virtual machine monitor and can greatly improve the efficiency.