Cloud Security Is not (Just) Virtualization Security

Cloud infrastructure commonly relies on virtualization. Customers provide their own VMs, and the cloud provider runs them often without knowledge of the guest OSes or their configurations. How-ever, cloud customers also want effective and efficient security for their VMs. Cloud providers offering security-as-a-service based on VM introspection promise the best of both worlds: efficient central-ization and effective protection. Since customers can move images from one cloud to another, an effective solution requires learning what guest OS runs in each VM and securing the guest OS without relying on the guest OS functionality or an initially secure guest VM state. We present a solution that is highly scalable in that it (i) central-izes guest protection into a security VM, (ii) supports Linux and Windows operating systems and can be easily extended to support new operating systems, (iii) does not assume any a-priori semantic knowledge of the guest, (iv) does not require any a-priori trust as-sumptions into any state of the guest VM. While other introspection monitoring solutions exist, to our knowledge none of them moni-tor guests on the semantic level required to effectively support both white- and black-listing of kernel functions, or allows to start moni-toring VMs at any state during run-time, resumed from saved state, and cold-boot without the assumptions of a secure start state for monitoring