Mitigation of the Impact of Virtual Machine Introspection Pauses on Multi-core Virtual Machines
摘要
Virtual machine introspection (VMI) is a class of monitoring techniques used by malware analysis sandboxes to analyze the behavior of malware samples. VMI introduces execution pauses that can be detected within the virtualized environment, revealing the usage of a sandbox. Thus, many sandboxes implement countermeasures to conceal VMI pauses from the guest However, these countermeasures have limitations on multi-core guests. We propose several metrics to characterize the side effects caused by a VMI monitor in multi-core guests. We introduce a new strategy to conceal VMI pauses in multi-core guests, and assert its performance compared to the regular approaches used by sandboxes. Our results show that this new strategy improves the stealthiness of VMI pauses on a multi-core system for some metrics, but it still has shortcomings that should be addressed in future work.