goodkit
Date
Formats
Categories
Content
Current tools for monitoring virtual machines in the cloud either severely degrade the service being inspected, or rely on in-guest agents, that an attacker could disable.
goodkit observes the machine’s kernel up close, yet from the outside, with a near-imperceptible impact, and no changes to the existing infrastructure.
Cloud services run on virtual machines, that must be monitored continuously, to detect attacks, and ensure availability. However, existing approaches face a dilemma: pause the machine to inspect it, at the cost of a severe slowdown of the service, or install an agent inside it, which any attacker, who has compromised the system, can disable, or mislead. This is the crux of the matter: once an intruder has breached a virtual machine, for instance a virtualized network function, the infrastructure’s defences have already been circumvented.
goodkit takes a different stance. Monitoring runs in small, isolated virtual machines, placed alongside the machine to be protected, directly reading selected regions of its memory, under a strict access policy. Data consistency is ensured, by relying on the observed kernel’s own internal mechanisms, rather than by suspending the machine, making the performance impact nearly imperceptible. And since the solution modifies neither the hypervisor, nor the customer’s machine, it can be deployed through a simple software update.
Validated on real-world use cases, from detecting rootkits, and ransomware, including WannaCry, to monitoring service liveness, this approach builds on Orange’s earlier work on cloud security monitoring, notably NoGap. It paves the way for efficient, shareable monitoring services for virtualized infrastructures.
This framework for live virtual machine introspection, developed with academic partners in Grenoble, Toulouse, and Vancouver, was designed during a doctorate at Orange Research, in collaboration with the LIG laboratory (Université Grenoble Alpes), and presented by Dufy Teguia — under Orange Research affiliation —, this summer, in Seattle, at the 20th OSDI edition.
A prototype is released on GitHub, under the BSD 3-Clause licence.