[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
10.1145/2591971.2592009acmconferencesArticle/Chapter ViewAbstractPublication PagesmetricsConference Proceedingsconference-collections
research-article

Non-intrusive, out-of-band and out-of-the-box systems monitoring in the cloud

Published: 16 June 2014 Publication History

Abstract

The dramatic proliferation of virtual machines (VMs) in datacenters and the highly-dynamic and transient nature of VM provisioning has revolutionized datacenter operations. However, the management of these environments is still carried out using re-purposed versions of traditional agents, originally developed for managing physical systems, or most recently via newer virtualization-aware alternatives that require guest cooperation and accessibility. We show that these existing approaches are a poor match for monitoring and managing (virtual) systems in the cloud due to their dependence on guest cooperation and operational health, and their growing lifecycle management overheads in the cloud.
In this work, we first present Near Field Monitoring (NFM), our non-intrusive, out-of-band cloud monitoring and analytics approach that is designed based on cloud operation principles and to address the limitations of existing techniques. NFM decouples system execution from monitoring and analytics functions by pushing monitoring out of the targets systems' scope. By leveraging and extending VM introspection techniques, our framework provides simple, standard interfaces to monitor running systems in the cloud that require no guest cooperation or modification, and have minimal effect on guest execution. By decoupling monitoring and analytics from target system context, NFM provides ``always-on'' monitoring, even when the target system is unresponsive. NFM also works ``out-of-the-box'' for any cloud instance as it eliminates any need for installing and maintaining agents or hooks in the monitored systems. We describe the end-to-end implementation of our framework with two real-system prototypes based on two virtualization platforms. We discuss the new cloud analytics opportunities enabled by our decoupled execution, monitoring and analytics architecture. We present four applications that are built on top of our framework and show their use for across-time and across-system analytics.

References

[1]
Adam Boileau. Hit by a Bus: Physical Access Attacks with Firewire. RuxCon 2006. http://www.security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf.
[2]
Amazon. CloudWatch. http://aws.amazon.com/cloudwatch/.
[3]
Amazon. Summary of the October 22,2012 AWS Service Event in the US-East Region. https://aws.amazon.com/message/680342/.
[4]
Anthony Desnos. Draugr - Live memory forensics on Linux. http://code.google.com/p/draugr/.
[5]
M. Auty, A. Case, M. Cohen, B. Dolan-Gavitt, M. H. Ligh, J. Levy, and A. Walters. Volatility - An advanced memory forensics framework. http://code.google.com/p/volatility.
[6]
S. Bahram, X. Jiang, Z. Wang, M. Grace, J. Li, D. Srinivasan, J. Rhee, and D. Xu. DKSM: Subverting Virtual Machine Introspection for Fun and Profit. In SRDS, pages 82--91, 2010.
[7]
P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In SOSP, pages 164--177, 2003.
[8]
Bryan Payne. Vmitools - An introduction to LibVMI. http://code.google.com/p/vmitools/wiki/LibVMIIntroduction.
[9]
B. D. Carrier and J. Grand. A hardware-based memory acquisition procedure for digital investigations. Digital Investigation, 1(1):50--60, 2004.
[10]
A. Case, L. Marziale, and G. G. RichardIII. Dynamic recreation of kernel data structures for live forensics. Digital Investigation, 7, Supplement(0):S32--S40, 2010.
[11]
ClamAV. Clam AntiVirus. http://www.clamav.net.
[12]
C. Colohan. The Scariest Outage Ever. Carnegie Mellon University SDI/ISTC Seminar Series, 2012.
[13]
David Anderson. White Paper: Red Hat Crash Utility. http://people.redhat.com/anderson/crash_whitepaper/.
[14]
Dell Quest/VKernel. Foglight for Virtualization. http://www. quest.com/foglight-for-virtualization-enterprise-edition/.
[15]
B. Dolan-Gavitt, T. Leek, M. Zhivich, J. Giffin, and W. Lee. Virtuoso: Narrowing the Semantic Gap in Virtual Machine Introspection. In IEEE Security and Privacy '11, pages 297--312.
[16]
B. Dolan-Gavitt, B. Payne, and W. Lee. Leveraging forensic tools for virtual machine introspection. Technical Report GT-CS-11-05, Georgia Institute of Technology, 2011.
[17]
Emilien Girault. Volatilitux- Memory forensics framework to help analyzing Linux physical memory dumps. http://code.google.com/p/volatilitux/.
[18]
M. F. Linux Rootkit Implementation. http://average-coder.blogspot.com/2011/12/linux-rootkit.html, 2011.
[19]
Y. Fu and Z. Lin. Space Traveling across VM: Automatically Bridging the Semantic Gap in Virtual Machine Introspection via Online Kernel Data Redirection. In IEEE Security&Privacy'12.
[20]
T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In NDSS, pages 191--206, 2003.
[21]
B. Hay and K. Nance. Forensics examination of volatile system data using virtual introspection. SIGOPS Oper. Syst. Rev., 42(3):74--82, 2008.
[22]
O. S. Hofmann, A. M. Dunn, S. Kim, I. Roy, and E. Witchel. Ensuring operating system kernel integrity with OSck. In ASPLOS, pages 279--290, 2011.
[23]
Hypertection. Hypervisor-Based Antivirus. hypertection.com.
[24]
Jack of all Clouds. Recounting EC2 One Year Later. www.jackofallclouds.com/2010/12/recounting-ec2/.
[25]
X. Jiang, X. Wang, and D. Xu. Stealthy malware detection through VMM-based out-of-the-box semantic view reconstruction. In CCS '07, pages 128--138.
[26]
A. Kivity, Y. Kamay, D. Laor, U. Lublin, and A. Liguori. KVM: the Linux Virtual Machine Monitor. In OLS '07: The 2007 Ottawa Linux Symposium, pages 225--230, 2007.
[27]
I. Kollar. Forensic RAM dump image analyser. Master's Thesis, Charles University in Prague, 2010. hysteria.sk/~niekt0/fmem/doc/foriana.pdf.
[28]
Z. Lin, J. Rhee, X. Zhang, D. Xu, and X. Jiang. SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In NDSS, 2011.
[29]
L. Litty and D. Lie. Patch auditing in infrastructure as a service clouds. In VEE '11.
[30]
Mariusz Burdach. Digital forensics of the physical memory. 2005. http://forensic.seccure.net/pdf/mburdach_digital_forensics_of_physical_memory.pdf.
[31]
N. Mavroyanopoulos and S. Schumann. Mhash. http://mhash.sourceforge.net.
[32]
Maximillian Dornseif. 0wned by an iPod. PacSec Applied Security Conference 2004. http://md.hudora.de/presentations/firewire/PacSec2004.pdf.
[33]
D. Mosberger and T. Jin. httperf - a tool for measuring web server performance. SIGMETRICS Perform. Eval. Rev., 26(3):31--37, 1998.
[34]
Nirsoft. Windows Vista Kernel Structures. http://www.nirsoft.net/kernel_struct/vista/.
[35]
OpenBenchmarking/Phoronix. x264 Test Profile. http://openbenchmarking.org/test/pts/x264-1.7.0.
[36]
Opscode. Chef. http://www.opscode.com/chef/.
[37]
Y. Padioleau, J. L. Lawall, and G. Muller. Understanding collateral evolution in linux device drivers. In EuroSys'06.
[38]
B. Payne, M. de Carbone, and W. Lee. Secure and Flexible Monitoring of Virtual Machines. In Twenty-Third Annual Computer Security Applications Conference, pages 385--397, 2007.
[39]
PHD Virtual. Virtual Monitoring http://www.phdvirtual.com/.
[40]
A. Ranadive, A. Gavrilovska, and K. Schwan. Ibmon: monitoring vmm-bypass capable infiniband devices using memory introspection. In HPCVirt, pages 25--32, 2009.
[41]
Reflex. vWatch Monitoring. http://www.reflexsystems.com/Products/vWatch.
[42]
Russell Coker. Bonnie++ http://www.coker.com.au/bonnie++/.
[43]
A. Srivastava and J. Giffin. Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections. In RAID, pages 39--58, 2008.
[44]
S. Thomas, K. Sherly, and S. Dija. Extraction of memory forensic artifacts from windows 7 ram image. In IEEE ICT '13, pages 937--942, April 2013.
[45]
VMware. vCenter Operations Management Suite. http://www.vmware.com/products/vcenter-operations-management/.
[46]
VMware. VIX API Documentation. http://www.vmware.com/support/developer/vix-api/.
[47]
VMware. VMCI Overview. http://pubs.vmware.com/vmci-sdk/.
[48]
VMware. VMWare Tools. http://kb.vmware.com/kb/340.
[49]
VMware. vShield Endpoint. http://www.vmware.com/products/vsphere/features-endpoint.
[50]
VMWare Inc. VMWare VMSafe security technology. http://www.vmware.com/company/news/releases/vmsafe_vmworld.html.
[51]
S. Vogl. A bottom-up Approach to VMI-based Kernel-level Rootkit Detection. PhD Thesis, Technische Unversitat Munchen., 2010.
[52]
C. A. Waldspurger. Memory resource management in VMware ESX server. SIGOPS Oper. Syst. Rev., 36(SI):181--194, 2002.

Cited By

View all
  • (2022)KubeRM: a distributed rule-based security management system in cloud native environmentInternational Conference on Cloud Computing, Internet of Things, and Computer Applications (CICA 2022)10.1117/12.2642849(128)Online publication date: 28-Jul-2022
  • (2019)Tenant-Oriented Monitoring for Customized Security Services in the CloudSymmetry10.3390/sym1102025211:2(252)Online publication date: 18-Feb-2019
  • (2019)Towards virtual machine introspection based security framework for cloudSādhanā10.1007/s12046-018-1016-644:2Online publication date: 25-Jan-2019
  • Show More Cited By

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences
SIGMETRICS '14: The 2014 ACM international conference on Measurement and modeling of computer systems
June 2014
614 pages
ISBN:9781450327893
DOI:10.1145/2591971
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 16 June 2014

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. agentless
  2. analytics
  3. cloud
  4. data center
  5. mon- itoring
  6. virtual machine
  7. virtualization
  8. vmi

Qualifiers

  • Research-article

Conference

SIGMETRICS '14
Sponsor:

Acceptance Rates

SIGMETRICS '14 Paper Acceptance Rate 40 of 237 submissions, 17%;
Overall Acceptance Rate 459 of 2,691 submissions, 17%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)13
  • Downloads (Last 6 weeks)4
Reflects downloads up to 10 Dec 2024

Other Metrics

Citations

Cited By

View all
  • (2022)KubeRM: a distributed rule-based security management system in cloud native environmentInternational Conference on Cloud Computing, Internet of Things, and Computer Applications (CICA 2022)10.1117/12.2642849(128)Online publication date: 28-Jul-2022
  • (2019)Tenant-Oriented Monitoring for Customized Security Services in the CloudSymmetry10.3390/sym1102025211:2(252)Online publication date: 18-Feb-2019
  • (2019)Towards virtual machine introspection based security framework for cloudSādhanā10.1007/s12046-018-1016-644:2Online publication date: 25-Jan-2019
  • (2018)DéjàVuProceedings of the 19th International Middleware Conference Industry10.1145/3284028.3284031(17-24)Online publication date: 10-Dec-2018
  • (2018)HyperagentsProceedings of the Eighth ACM Conference on Data and Application Security and Privacy10.1145/3176258.3176317(212-223)Online publication date: 13-Mar-2018
  • (2017)OpvisProceedings of the 18th ACM/IFIP/USENIX Middleware Conference: Industrial Track10.1145/3154448.3154455(43-49)Online publication date: 11-Dec-2017
  • (2017)Safe Inspection of Live Virtual MachinesACM SIGPLAN Notices10.1145/3140607.305076652:7(97-111)Online publication date: 8-Apr-2017
  • (2017)AravProceedings of the 12th Annual Conference on Cyber and Information Security Research10.1145/3064814.3064829(1-8)Online publication date: 4-Apr-2017
  • (2017)Safe Inspection of Live Virtual MachinesProceedings of the 13th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments10.1145/3050748.3050766(97-111)Online publication date: 8-Apr-2017
  • (2017)Agentless and Uniform Introspection for Various Security Services in IaaS Cloud2017 4th International Conference on Information Science and Control Engineering (ICISCE)10.1109/ICISCE.2017.39(140-144)Online publication date: Jul-2017
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media