TWC: Small: Securing Cloud Infrastructure: Unobtrusive Techniques for Detecting Hypervisor Compromise

管理程序是云计算的构建块。它们托管着可持续提供高度可扩展、无处不在服务的虚拟操作系统和应用程序。这些薄层裸机操作系统是攻击的主要目标。受损的管理程序授予对托管的虚拟机和数据存储的访问权限。它的计算资源可能被用于恶意目的，包括发动额外的攻击。为了避免被发现，带根的管理程序不仅必须避免触发内部警报，还必须让外部监视器相信它们运行正常。为了掩盖非法活动，他们可能会少报业绩指标。尽管Rootkit可以通过低估系统负载来隐藏未经授权的活动，但它们不能篡改外部用电量测量。这项研究开发了一种新的方法来识别受攻击的虚拟机管理程序，该方法整合了能源使用统计数据。此方法将服务器能源使用的独立测量与系统状态的管理程序报告相关联，以创建功耗模型。根据已报告的性能指标，检测过程将重点放在使用的电源似乎比预期更多的虚拟机管理程序上。三种用于检测危害的带外测试正在进行测试和改进。这项研究的结果将表明能量相关方法在识别根式管理程序方面的有效性。如果成功，该项目将为云管理监控器提供一种平台中立的方法来识别受损的管理程序。它降低了组织和云服务个人用户的采用风险。此外，它还将为研究生和本科生提供发展云和数据中心安全方面的高级技能的机会。

Hypervisors are the building blocks of cloud computing. They host the virtualized operating systems and applications which provide highly-scalable, pervasive services on a continuous basis. These thin-layer, bare-metal operating systems create a prime target for attack. A compromised hypervisor grants access to hosted virtual machines and data stores. Its computing resources can be used for malicious purposes, including mounting additional attacks. To avoid detection, rooted hypervisors must not only avoid tripping internal alarms, but also convince external monitors that they are operating normally. To conceal illicit activities, they may underreport performance metrics. Although rootkits can hide unauthorized activity by understating system load, they cannot tamper with external measures of power usage. This research develops a new method for identifying compromised hypervisors which integrates energy usage statistics. This method correlates independent measures of server energy usage with hypervisor reports of system state to create models of power consumption. The detection process focuses on hypervisors which appear to use more power than expected, given reported performance metrics. Three out-of-band tests for detecting compromise are undergoing testing and refinement. The results of this research will indicate the effectiveness of energy correlation-approaches at identifying rooted hypervisors. If successful, this project will provide a platform-neutral method for cloud management monitors to identify compromised hypervisors. It reduces adoption risks for organizations and individual users of cloud services. In addition, it will provide opportunities for graduate and undergraduate students to developed advanced skills in cloud and data center security.