Towards Non-Intrusive Software Introspection and beyond
Apoorve Mohan, Shripad Nadgowda, et al.
IC2E 2020
While there are a variety of existing virtual machine introspection (VMI) techniques, their latency, overhead, complexity and consistency trade-offs are not clear. In this work, we address this gap by first organizing the various existing VMI techniques into a taxonomy based upon their operational principles, so that they can be put into context. Next we perform a thorough exploration of their trade-offs both qualitatively and quantitatively. We present a comprehensive set of observations and best practices for efficient, accurate and consistent VMI operation based on our experiences with these techniques. Our results show the stunning range of variations in performance, complexity and overhead with different VMI techniques. We further present a deep dive on VMI consistency aspects to understand the sources of inconsistency in observed VM state and show that, contrary to common expectation, pause-And-introspect based VMI techniques achieve very little to improve consistency despite their substantial performance impact.
Apoorve Mohan, Shripad Nadgowda, et al.
IC2E 2020
Yangruibo Ding, Sahil Suneja, et al.
SANER 2022
Xiaoqiao Meng, Canturk Isci, et al.
ICAC 2010
Wolfgang Richter, Glenn Ammons, et al.
HotCloud 2011