Virtual machine introspection (VMI) is a class of monitoring techniques used by malware analysis sandboxes to analyze the behavior of malware samples. VMI introduces execution pauses that can be detected within the virtualized environment, revealing the usage of a sandbox. Thus, many sandboxes implement countermeasures to conceal VMI pauses from the guest However, these countermeasures have limitations on multi-core guests. We propose several metrics to characterize the side effects caused by a VMI monitor in multi-core guests. We introduce a new strategy to conceal VMI pauses in multi-core guests, and assert its performance compared to the regular approaches used by sandboxes. Our results show that this new strategy improves the stealthiness of VMI pauses on a multi-core system for some metrics, but it still has shortcomings that should be addressed in future work.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Mitigation of the Impact of Virtual Machine Introspection Pauses on Multi-core Virtual Machines

  • Léo Cosseron,
  • Louis Rilling,
  • Martin Quinson

摘要

Virtual machine introspection (VMI) is a class of monitoring techniques used by malware analysis sandboxes to analyze the behavior of malware samples. VMI introduces execution pauses that can be detected within the virtualized environment, revealing the usage of a sandbox. Thus, many sandboxes implement countermeasures to conceal VMI pauses from the guest However, these countermeasures have limitations on multi-core guests. We propose several metrics to characterize the side effects caused by a VMI monitor in multi-core guests. We introduce a new strategy to conceal VMI pauses in multi-core guests, and assert its performance compared to the regular approaches used by sandboxes. Our results show that this new strategy improves the stealthiness of VMI pauses on a multi-core system for some metrics, but it still has shortcomings that should be addressed in future work.