cMonitor: VMI-Based Fine-Grained Monitoring Mechanism in Cloud

作     者：ZHANG Hao ZHAO Lei XU Lai WANG Lina 

作者机构：School of Computer/The Key Laboratory of Aerospace Information and Trusted Computing of Ministry of Education Wuhan University The State Key Laboratory for Novel Software Technology Nanjing University 

出 版 物：《Wuhan University Journal of Natural Sciences》 (武汉大学学报（自然科学英文版）)

年 卷 期：2014年第19卷第5期

页      面：393-397页

学科分类：12[管理学] 1201[管理学-管理科学与工程(可授管理学、工学学位)] 08[工学] 0805[工学-材料科学与工程（可授工学、理学学位）] 080502[工学-材料学] 081201[工学-计算机系统结构] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：Supported by the National Natural Science Foundation of China(61373169,61103219,61303213) the Program of National Development and Reform Commission(1309) the Ph.D.Programs Foundation of Ministry of Education of China(20110141130006) 

主　　题：transparent monitoring virtual machine introspection fine-grained semantics 

摘      要：For the lack of detailed semantic in prior works, a transparent fine-grained monitoring technique （cMonitor） is pro- posed. Deployed outside the virtual machines, the cMonitor util- izes the elevated privileges of the virtual machine monitor to monitor the network connection, the processes and the relationship between them in protected systems by reconstructing fine-grained system semantics. These semantics contain process states and corresponding network connection. Experimental results show that cMonitor not only can be rapidly deployed in realistic cloud, but also can effectively and universally obtain these fine-grained semantics to assist detection of some advanced network attack. Meanwhile, the network performance overhead is about 3%, which is acceptable.