Securing KVM-based Cloud Systems via Virtualization Introspection

Linux 核心虛擬機器 (KVM) 在雲端運算生態系統內的基礎建設即為服務平台(Infrastructure as a Service) 上是最熱門的虛擬化管理程序 (Hypervisor)。Linux 核心虛擬機器提供了全虛擬化的環境，包含虛擬化的 CPU，網路卡及主機板上的晶片，在 Linux 核心虛擬機器上面可以安裝異質的作業系統在虛擬主機裡面。我們提出了新的虛擬化偵察系統 (Virtualization Introspection System)，可以保護虛擬主機以及運作虛擬化管理程序的實體主機， 儘管虛擬主機是運作在各種不同的虛擬化管理程序， 虛擬化偵察系統可以保護虛擬主機與實體主機不被惡意的駭客攻擊。 虛擬化偵察系統蒐集虛擬主機的動態及靜態資料來偵測及攔截惡意攻擊。 我們使用了虛擬主機重現了各種不同的惡意攻擊， 然後使用非監督的人工智慧學習技術來產生偵測規則。 我們的虛擬化偵察系統也整合了雲端運算系統平台像是 OpenStack 和 OpenNebula。Linux Kernel Virtual Machine (KVM) is one of the most commonly deployed hypervisor drivers in the Infrastructure as a Service (IaaS) layer of cloud computing ecosystems. The KVM hypervisor provides a full-virtualized environment that virtualizes as much hardware as possible, including CPUs, network interfaces and chipsets with KVM, where heterogeneous operating systems can be installed by Virtual Machines (VMs) in an homogeneous environment. We have proposed a new Virtualization Introspection System (VIS) to protect the host as well as VMs running on various hypervisors of cloud computing structure from malicious attacks. VIS detects and intercepts attacks from VMs by collecting their static and dynamic status. We then replay the attacks on VMs and utilize artificial intelligence derived from unsupervised learning techniques to derive effective decision rules. VIS can be further integrated with common cloud middleware, such as OpenStack and OpenNebula