Overview
Virtual Machine Introspection (VMI) is the foundational technology for modern cloud security, enabling intrusion detection, live forensics, and auditing. However, current VMI deployments (like LibVMI) are inherently host-based, operating within the hypervisor or privileged management domains. This introduces significant operational and security bottlenecks: it exposes the hypervisor to sophisticated attack vectors and creates a fundamental conflict of interest regarding tenant privacy and cloud provider incentives.
Cross-VM Introspection and Operation (CVMI) is a paradigm-shifting virtual machine architecture that moves introspection off the host and into a dedicated Responder VM (RVM). By doing so, CVMI completely eliminates the security risks of host-anchored VMI, ensures strict tenant privacy, and grants VM owners the autonomy to deploy their own monitoring toolchains—all while operating at unprecedented native execution speeds.
Our Innovation
CVMI is built on a bundle of system and software innovations that create a unique Service Execution Environment (SEE) within the RVM. Through novel configurations of Extended Page Tables (EPT) and Guest Page Tables (GPT), CVMI maps an introspection agent’s memory alongside the target VM’s memory.
This constructs a unified address space that shifts the agent's Guest Physical Address (GPA) without overlapping with the target, preserving the agent’s virtual and physical addresses. A lightweight software stack (comprising a CVMI kernel module, shim, and hypervisor handler) acts as a trampoline, allowing the agent to transparently switch between the SEE and its home environment. As a result, the agent can "see" the virtual memory of a compromised or malfunctioning target VM natively, while continuing to receive standard kernel services from the RVM.
Three New Capabilities for Deep-Dive into Target VM
CVMI provisions three security capabilities:
- Introspection: The agent reads and interprets the virtual memory data in the same way as the target application and the kernel thread.
- Exported execution: The agent can dynamically analyze a runtime target thread.
- Injected execution: The agent can inject a piece of code to securely execute in the target kernel.
Technology Features & Competitive Advantages
CVMI dramatically outperforms existing open-source and patented VMI frameworks by offering:
Blazing Fast, Native-Speed Performance: By utilizing the target's page tables via the CPU's Memory Management Unit (MMU), CVMI achieves native virtual memory access speeds. It is 360 times faster than mainstream LibVMI for fine-grained memory acquisition, and 30 times faster for bulky memory extraction.
Minimized Attack Surface (Zero-Footprint Hypervisor): The hypervisor is only involved during the initial setup of the SEE. It is completely removed from the ongoing introspection data path, closing off severe vulnerabilities to attackers residing in the virtual machines.
Introspection-Analysis Synergy: Unlike conventional VMI that only retrieves static memory contents, CVMI augments read-only introspection with *exported execution*. Agents can export a user space thread from the target and dynamically analyze it, revealing hidden malware artifacts and interpreting deeper threat semantics.
Well-Resourced, Developer-Friendly Agents: Competing fast-VMI schemes (like ImEE) restrict agents to using CPU registers without kernel support. CVMI agents are fully equipped with standard application programming APIs and local memory, dramatically lowering the barrier for developers to build rich, complex security applications.
Decentralized, Flexible Deployment: Tenants and authorized third parties can securely deploy their own preferred introspection and forensics toolkits within the RVM, preserving data privacy without requiring direct action or intervention from the cloud provider.
Potential Commercial Applications
CVMI provides foundational infrastructure for next-generation cloud security, ideal for integration by major public cloud providers (like Google Cloud Platform), private enterprise clouds, and specialized cybersecurity firms.
Cloud Live Forensics & Incident Response: Enables immediate, high-fidelity live forensics on VMs actively under attack or involved in malicious activity, without halting the system or alerting the malware.
Proactive Cloud VM Monitoring & Intrusion Detection: Allows for the deployment of advanced, periodic scanning tools across clusters of virtual machines to inspect virtual memory for sophisticated rootkits and file-less malware.
Cloud VM Crash Diagnosis & Troubleshooting: Provides DevOps and SRE teams the ability to instantly identify crashing sites, debug the kernel, and analyze affected applications when a tenant’s VM hangs.
Offsite Forensics for Incompatible Clouds: Hypervisor snapshots can be exported to a localized CVMI-enabled desktop environment. Analysts can then conduct deep-dive investigations with the exact same capabilities as if they were in the cloud.
If you're interested in this technology, please contact KTC.