Authors:
Lukas Beierlieb
1
;
Nicolas Bellmann
1
;
Lukas Iffländer
2
and
Samuel Kounev
1
Affiliations:
1
Institute of Computer Science, University of Würzburg, Würzburg, Germany
;
2
Faculty of Informatics, University of Applied Sciences, Dresden, Germany
Keyword(s):
Hypervisor, Hyper-V, Hypercall, Logging, Monitoring.
Abstract:
Hypervisors such as Xen, VMware ESXi, or Microsoft Hyper-V provide virtual machines used in data centers and cloud computing, making them a popular attack target. One potential attack vector is the hypercall interface, which exposes privileged operations as hypercalls. We present a hypercall logger for the Hyper-V hypercall interface that logs the inputs, outputs, and sequence of hypercalls. The logs should improve the testability of the hypercall interface by helping to construct test cases for the hypercall handlers. Related works in hypercall monitoring analyze less detailed hypercall invocation data with intrusion detection systems. Our logger extends the WinDbg debugger by adding additional commands to set software breakpoints on the hyper-call handler entry and exit within a debugging session with the Hyper-V hypervisor. The evaluation confirmed that the logs are correct and that the breakpoints slow hypercall execution by 100,000 to 200,000. A case study with the hypercall han
dler logger helps create test cases for evaluation and demonstrates the logger’s suitability.
(More)