System Monitoring and Controlling Mechanism Based on Hypervisor

Abstract

Current commodity operating systems allow a privileged user to run some programs in kernel mode by installing a kernel module or a device driver, but there isn’t an available method to verify the reliability of these programs. As a result, malware leverages this way to corrupt system services, defeat anti-malware and even get control of the whole system. It makes operating-system-based security tools undergo all kinds of hardships in face of various attacks. Virtualization technology brings a new chance to protect operating systems out-of-box in hypervisors. This article proposes a system monitoring and controlling framework, named as BMCS, which monitors low-level states and hardware accessing events of operating system in a hypervisor. BMCS abstracts low-level states and events and profiles OS-level semantics with the help of a hosted daemon. Moreover, it can control the execution of operating system software through the hypervisor. Our out-of box method can collect real run-time operating system profile and control the execution of the OS according some defined rules. As a result, it makes the operating system stronger. We implement BMCS based on KVM and experiment results prove that BMCS performs well.