Exploring VM Introspection

Sahil Suneja, Canturk Isci, Eyal de Lara, Vasanth Bala
<span title="2015-03-14">2015</span> <i title="Association for Computing Machinery (ACM)"> <a target="_blank" rel="noopener" href="https://fatcat.wiki/container/xu5bk2lj5rbdxlx6222nw7tsxi" style="color: black;">SIGPLAN notices</a> </i> &nbsp;
While there are a variety of existing virtual machine introspection (VMI) techniques, their latency, overhead, complexity and consistency trade-offs are not clear. In this work, we address this gap by first organizing the various existing VMI techniques into a taxonomy based upon their operational principles, so that they can be put into context. Next we perform a thorough exploration of their trade-offs both qualitatively and quantitatively. We present a comprehensive set of observations and
more &raquo; ... st practices for efficient, accurate and consistent VMI operation based on our experiences with these techniques. Our results show the stunning range of variations in performance, complexity and overhead with different VMI techniques. We further present a deep dive on VMI consistency aspects to understand the sources of inconsistency in observed VM state and show that, contrary to common expectation, pause-and-introspect based VMI techniques achieve very little to improve consistency despite their substantial performance impact.
<span class="external-identifiers"> <a target="_blank" rel="external noopener noreferrer" href="https://doi.org/10.1145/2817817.2731196">doi:10.1145/2817817.2731196</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/jkyulamqmbarpbyk3ybirtuhyq">fatcat:jkyulamqmbarpbyk3ybirtuhyq</a> </span>
<a target="_blank" rel="noopener" href="https://web.archive.org/web/20170813191153/http://www.cs.toronto.edu/~sahil/suneja-vee15.pdf" title="fulltext PDF download" data-goatcounter-click="serp-fulltext" data-goatcounter-title="serp-fulltext"> <button class="ui simple right pointing dropdown compact black labeled icon button serp-button"> <i class="icon ia-icon"></i> Web Archive [PDF] <div class="menu fulltext-thumbnail"> <img src="https://blobs.fatcat.wiki/thumbnail/pdf/90/e8/90e8d2cb71224ea54c8d347e2a6157baca34d5f8.180px.jpg" alt="fulltext thumbnail" loading="lazy"> </div> </button> </a> <a target="_blank" rel="external noopener noreferrer" href="https://doi.org/10.1145/2817817.2731196"> <button class="ui left aligned compact blue labeled icon button serp-button"> <i class="external alternate icon"></i> acm.org </button> </a>