Abstract
We propose security architecture based on virtual machine monitor to efficiently deal with attacks on virtual machines. We will show that our model is capable of detecting suspicious processes running in the virtual machine, can detect and prevent different types of attacks including zero day attacks by monitoring the virtual machine traffic and the processes that are generating or receiving the traffic. The architecture also makes use of sharing information about the suspicious behaviour among multiple Intrusion detection systems deployed in different virtual machine monitors. We describe the implementation of the proposed architecture and present a detailed analysis of how our architecture can be used to detect zero day attacks.
The authors would like to thank Departments of the Prime Minister and Cabinet (PM&C) and Defence Signals Directorate (DSD), Australia, for their financial support of the research project on Secure Virtualization Systems. The PM&C and DSD funding should not be taken to imply endorsement of the content or conclusions of the research project.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the Slammer worm. IEEE, Security & Privacy 1(4), 33–39 (2003)
Shin, S., Gu, G.: Conficker and Beyond: A Large-Scale Empirical Study. In: 26th Annual Computer Security Applications Conference, Austin, Texas, USA, December 6-10, pp. 151–160. ACM, New York (2010)
Smith, J.E., Nair, R.: The architecture of virtual machines. Computer 38(5), 32–38 (2005)
Garfinkel, T., Rosenblum, M.: A Virtual Machine Introspection Based Architecture for Intrusion Detection. In: 10th Network and Distributed System Security Symposium, California. Internet Society, USA (2003)
Jones, S., Arpaci-Dusseau, A., Arpaci-Dusseau, R.: VMM-based Hidden Process Detection and Identification using Lycosid. In: 4th International Conference on Virtual execution environments, Seattle, WA, March 5-7, pp. 91–100. ACM SIGPLAN/SIGOPS, USA (2008)
Costa, M., Crowcroft, J., Castro, M., Rowstron, A., Zhou, L., Zhang, L., Barham, P.: Vigilante: End-to-End containment of Internet Worms. In: Proceedings of the 20th ACM symposium on Operating systems principles, SOSP 2005, Brighton, UK, October 23-26, pp. 133–147. ACM, New York (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Tupakula, U., Varadharajan, V., Bichhawat, A. (2011). Security Architecture for Virtual Machines. In: Xiang, Y., Cuzzocrea, A., Hobbs, M., Zhou, W. (eds) Algorithms and Architectures for Parallel Processing. ICA3PP 2011. Lecture Notes in Computer Science, vol 7016. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-24650-0_19
Download citation
DOI: https://doi.org/10.1007/978-3-642-24650-0_19
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-24649-4
Online ISBN: 978-3-642-24650-0
eBook Packages: Computer ScienceComputer Science (R0)