Checking Function-Level Kernel Control Flow Integrity for Cloud Computing
With the advancement of cloud computing, the control flow integrity (CFI) of virtual machines' kernel becomes more and more important for the security of cloud services. Many CFI checking and protecting approaches have been proposed. Among them, dynamic analysis approaches have the best detecti...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2018-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8419756/ |
| _version_ | 1818557110834692096 |
|---|---|
| author | Lin Ye Xiangzhan Yu Lei Yu Bin Guo Dongyang Zhan Xiaojiang Du Mohsen Guizani |
| author_facet | Lin Ye Xiangzhan Yu Lei Yu Bin Guo Dongyang Zhan Xiaojiang Du Mohsen Guizani |
| author_sort | Lin Ye |
| collection | DOAJ |
| description | With the advancement of cloud computing, the control flow integrity (CFI) of virtual machines' kernel becomes more and more important for the security of cloud services. Many CFI checking and protecting approaches have been proposed. Among them, dynamic analysis approaches have the best detection capability, but they are rarely used because of the high overhead introduced to the virtual machines to be monitored. In this paper, we propose a function-level kernel CFI checking approach to meet the performance requirements in the cloud. By combining the static memory analysis and the dynamic tracing, our system can achieve high detection capability with low overhead. Since the analysis and tracing targets of our system are kernel functions, our system incurs lower overhead to the monitored virtual machines than the instruction-level monitors. We propose two models to describe the kernel control flows. After building the secure control flow database by learning the normal behaviors, we can detect abnormal control flows in real time. With the help of virtualization and virtual machine introspection techniques, we implement a prototype system in the hardware virtualization environment. From the evaluation, our system has high detection capability with reasonable overhead. |
| first_indexed | 2024-12-13T23:55:43Z |
| format | Article |
| id | doaj.art-19a8eadc66b14df9a10593edb7af427a |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-13T23:55:43Z |
| publishDate | 2018-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-19a8eadc66b14df9a10593edb7af427a2022-12-21T23:26:34ZengIEEEIEEE Access2169-35362018-01-016418564186510.1109/ACCESS.2018.28597678419756Checking Function-Level Kernel Control Flow Integrity for Cloud ComputingLin Ye0https://orcid.org/0000-0002-9647-0271Xiangzhan Yu1Lei Yu2Bin Guo3Dongyang Zhan4Xiaojiang Du5Mohsen Guizani6Harbin Institute of Technology, Harbin, ChinaHarbin Institute of Technology, Harbin, ChinaSchool of Computer Science, Georgia Institute of Technology, Atlanta, GA, USAHarbin Institute of Technology, Harbin, ChinaHarbin Institute of Technology, Harbin, ChinaDepartment of Computer and Information Sciences, Temple University, Philadelphia, PA, USADepartment of Electrical and Computer Engineering, University of Idaho, Moscow, ID, USAWith the advancement of cloud computing, the control flow integrity (CFI) of virtual machines' kernel becomes more and more important for the security of cloud services. Many CFI checking and protecting approaches have been proposed. Among them, dynamic analysis approaches have the best detection capability, but they are rarely used because of the high overhead introduced to the virtual machines to be monitored. In this paper, we propose a function-level kernel CFI checking approach to meet the performance requirements in the cloud. By combining the static memory analysis and the dynamic tracing, our system can achieve high detection capability with low overhead. Since the analysis and tracing targets of our system are kernel functions, our system incurs lower overhead to the monitored virtual machines than the instruction-level monitors. We propose two models to describe the kernel control flows. After building the secure control flow database by learning the normal behaviors, we can detect abnormal control flows in real time. With the help of virtualization and virtual machine introspection techniques, we implement a prototype system in the hardware virtualization environment. From the evaluation, our system has high detection capability with reasonable overhead.https://ieeexplore.ieee.org/document/8419756/Control flow integrityfunction-level analysisvirtual machine introspection |
| spellingShingle | Lin Ye Xiangzhan Yu Lei Yu Bin Guo Dongyang Zhan Xiaojiang Du Mohsen Guizani Checking Function-Level Kernel Control Flow Integrity for Cloud Computing IEEE Access Control flow integrity function-level analysis virtual machine introspection |
| title | Checking Function-Level Kernel Control Flow Integrity for Cloud Computing |
| title_full | Checking Function-Level Kernel Control Flow Integrity for Cloud Computing |
| title_fullStr | Checking Function-Level Kernel Control Flow Integrity for Cloud Computing |
| title_full_unstemmed | Checking Function-Level Kernel Control Flow Integrity for Cloud Computing |
| title_short | Checking Function-Level Kernel Control Flow Integrity for Cloud Computing |
| title_sort | checking function level kernel control flow integrity for cloud computing |
| topic | Control flow integrity function-level analysis virtual machine introspection |
| url | https://ieeexplore.ieee.org/document/8419756/ |
| work_keys_str_mv | AT linye checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT xiangzhanyu checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT leiyu checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT binguo checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT dongyangzhan checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT xiaojiangdu checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing AT mohsenguizani checkingfunctionlevelkernelcontrolflowintegrityforcloudcomputing |