Simplifying virtual machine introspection using LibVMI

Abstract

Ensuring the security of a computer system requires the careful integration of many components. Key among these is security monitoring. Recent research trends show an increasing acceptance of external host-based monitoring techniques such as virtual machine introspection (VMI), a technique for viewing the runtime state of a virtual machine (VM). VMI’s primary drawbacks include performance and the semantic gap problem (i.e., understanding the low-level information available through VMI). This report describes work performed under an Early Career Laboratory Directed Research and Development (LDRD) project that aimed to address these two key challenges. Our results are promising, with significant performance improvements and a much more usable VMI programming environment. This work resulted in the creation and release of LibVMI, an open source software project based on the author’s previous work with the XenAccess library.