The Experts below are selected from a list of 147 Experts worldwide ranked by ideXlab platform
Hagimont Daniel - One of the best experts on this subject based on the ideXlab platform.
-
Cacol: a zero overhead and non-intrusive double caching mitigation System
'Elsevier BV', 2020Co-Authors: Todeschi Grégoire, Djomgwe Teabe Boris, Tchana Alain, Hagimont DanielAbstract:In a virtualized server, a page cache (which caches I/O data) is managed in both the hypervisor and the Guest Operating System (OS). This leads to a well-known issue called double caching. Double caching is the presence of the same data in both the hypervisor page cache and Guest OS page caches. Some experiments we performed show that almost 64% of the hypervisor page cache content is also present in Guest page caches. Therefore, double caching is a huge source of memory waste in virtualized servers, particularly when I/O disk-intensive workloads are executed (which is common in today’s data centers). Knowing that memory is the limiting resource for workload consolidation, double caching is a critical issue. This paper presents a novel solution (called Cacol) to avoid double caching. Unlike existing solutions, Cacol is not intrusive as it does not require Guest OS modification and induces very little performance overhead for user applications. We implemented Cacol in KVM hypervisor, a very popular virtualization System. We evaluated Cacol and compared it with Linux default solutions. The results confirm the advantages (no Guest modification and no overhead) of Cacol against existing solutions
-
Cacol: a zero overhead and non-intrusive double caching mitigation System
'Elsevier BV', 2020Co-Authors: Todeschi Grégoire, Djomgwe Teabe Boris, Tchana Alain, Hagimont DanielAbstract:International audienceIn a virtualized server, a page cache (which caches I/O data) is managed in both the hypervisor and the Guest Operating System (OS). This leads to a well-known issue called double caching. Double caching is the presence of the same data in both the hypervisor page cache and Guest OS page caches. Some experiments we performed show that almost 64% of the hypervisor page cache content is also present in Guest page caches.Therefore, double caching is a huge source of memory waste in virtualized servers, particularly when I/O disk-intensive workloads are executed (which is common in today’s data centers). Knowing that memory is the limiting resource for workload consolidation, double caching is a critical issue.This paper presents a novel solution (called Cacol) to avoid double caching. Unlike existing solutions, Cacol is not intrusive as it does not require Guest OS modification and induces very little performance overhead for user applications. We implemented Cacol in KVM hypervisor, a very popular virtualization System. We evaluated Cacol and compared it with Linux default solutions. The results confirm the advantages (no Guest modification and no overhead) of Cacol against existing solutions
Kazuhiko Kato - One of the best experts on this subject based on the ideXlab platform.
-
detecting malware signatures in a thin hypervisor
ACM Symposium on Applied Computing, 2012Co-Authors: Yoshihiro Oyama, Tran Truong Duc Giang, Yosuke Chubachi, Takahiro Shinagawa, Kazuhiko KatoAbstract:Enhancement of security using hypervisors is an effective approach that has been extensively studied. This paper is concerned with hypervisors using the parapass-through architecture, in which most of the I/O accesses from the Operating System are passed through the hypervisor, while the minimum accesses necessary to implement security functionality are mediated by the hypervisor. Parapass-through hypervisors can provide various security functionalities such as encryption of storage data and creation of virtual private networks. Although a previous study has detailed a method for protecting privacy with a parapass-through hypervisor, it has not yet clarified a method for detecting malware. In this paper, we propose a scheme for incorporating malware detection functionality into a parapass-through hypervisor. Using this scheme, we implemented BVMD, an extension of a parapass-through hypervisor BitVisor, for malware detection. BVMD detects malware by comparing the contents of the data I/O with the malware signatures. A major advantage of BVMD is that its detection depends only slightly on the Guest Operating System. We confirmed through experiments that BVMD could detect many in-the-wild malware.
Wenke Lee - One of the best experts on this subject based on the ideXlab platform.
-
Ether: malware analysis via hardware virtualization extensions
Ccs, 2008Co-Authors: Artem Dinaburg, Monirul Sharif, Paul Royal, Wenke LeeAbstract:Malware has become the centerpiece of most security threats on the Internet. Malware analysis is an essential technology that extracts the runtime behavior of malware, and supplies signatures to detection Systems and provides evidence for recovery and cleanup. The focal point in the malware analysis battle is how to detect versus how to hide a malware analyzer from malware during runtime. State-of-the-art analyzers reside in or emulate part of the Guest Operating System and its underlying hardware, making them easy to detect and evade. In this paper, we propose a transparent and external approach to malware analysis, which is motivated by the intuition that for a malware analyzer to be transparent, it must not induce any side-effects that are unconditionally detectable by malware. Our analyzer, Ether, is based on a novel application of hardware virtualization extensions such as Intel VT, and resides completely outside of the target OS environment. Thus, there are no in-Guest software components vulnerable to detection, and there are no shortcomings that arise from incomplete or inaccurate System emulation. Our experiments are based on our study of obfuscation techniques used to create 25,000 recent malware samples. The results show that Ether remains transparent and defeats the obfuscation tools that evade existing approaches.
Carlos Luna - One of the best experts on this subject based on the ideXlab platform.
-
cache leakage resilient os isolation in an idealized model of virtualization
IEEE Computer Security Foundations Symposium, 2012Co-Authors: Gilles Barthe, Gustavo Betarte, Juan Diego Campo, Carlos LunaAbstract:Virtualization platforms allow multiple Operating Systems to run on the same hardware. One of their central goal is to provide strong isolation between Guest Operating Systems, unfortunately, they are often vulnerable to practical side-channel attacks. Cache attacks are a common class of side-channel attacks that use the cache as a side channel. We formalize an idealized model of virtualization that features the cache and the Translation Look aside Buffer (TLB), and that provides an abstract treatment of cache-based side-channels. We then use the model for reasoning about cache-based attacks and countermeasures, and for proving that isolation between Guest Operating Systems can be enforced by flushing the cache upon context switch. In addition, we show that virtualized platforms are transparent, i.e. a Guest Operating System cannot distinguish whether it executes alone or together with other Guest Operating Systems on the platform. The models and proofs have been machine-checked in the Coqproof assistant.
Yoshihiro Oyama - One of the best experts on this subject based on the ideXlab platform.
-
detecting malware signatures in a thin hypervisor
ACM Symposium on Applied Computing, 2012Co-Authors: Yoshihiro Oyama, Tran Truong Duc Giang, Yosuke Chubachi, Takahiro Shinagawa, Kazuhiko KatoAbstract:Enhancement of security using hypervisors is an effective approach that has been extensively studied. This paper is concerned with hypervisors using the parapass-through architecture, in which most of the I/O accesses from the Operating System are passed through the hypervisor, while the minimum accesses necessary to implement security functionality are mediated by the hypervisor. Parapass-through hypervisors can provide various security functionalities such as encryption of storage data and creation of virtual private networks. Although a previous study has detailed a method for protecting privacy with a parapass-through hypervisor, it has not yet clarified a method for detecting malware. In this paper, we propose a scheme for incorporating malware detection functionality into a parapass-through hypervisor. Using this scheme, we implemented BVMD, an extension of a parapass-through hypervisor BitVisor, for malware detection. BVMD detects malware by comparing the contents of the data I/O with the malware signatures. A major advantage of BVMD is that its detection depends only slightly on the Guest Operating System. We confirmed through experiments that BVMD could detect many in-the-wild malware.
-
bitvisor a thin hypervisor for enforcing i o device security
Virtual Execution Environments, 2009Co-Authors: Takahiro Shinagawa, Yoshihiro Oyama, Hideki Eiraku, Kouichi Tanimoto, Kazumasa Omote, Shoichi Hasegawa, Takashi Horie, Manabu Hirano, Kenichi Kourai, Eiji KawaiAbstract:Virtual machine monitors (VMMs), including hypervisors, are a popular platform for implementing various security functionalities. However, traditional VMMs require numerous components for providing virtual hardware devices and for sharing and protecting System resources among virtual machines (VMs), enlarging the code size of and reducing the reliability of the VMMs. This paper introduces a hypervisor architecture, called parapass-through, designed to minimize the code size of hypervisors by allowing most of the I/O access from the Guest Operating System (OS) to pass-through the hypervisor, while the minimum access necessary to implement security functionalities is completely mediated by the hypervisor. This architecture uses device drivers of the Guest OS to handle devices, thereby reducing the size of components in the hypervisor to provide virtual devices. This architecture also allows to run only single VM on it, eliminating the components for sharing and protecting System resources among VMs. We implemented a hypervisor called BitVisor and a parapass-through driver for enforcing storage encryption of ATA devices based on the parapass-through architecture. The experimental result reveals that the hypervisor and ATA driver require approximately 20 kilo lines of code (KLOC) and 1.4 KLOC respectively.