Agentless Inspection of Virtual Hosts Configuration by Interaction Through The Virtual Hardware

Abstract

In this thesis the possibility to interact with the virtual machine without traversing the network or using monitoring agents are explored. Instead of using this traditional approach the intention are to exploit the possibilities which are present when a System Administrator does control the hardware that host the virtual machine. In the research community this has been discussed under the topic of introspection, and there has been considerable research in this area. The contribution don by this thesis is the creation of tool that can analyze the memory of a targeted virtual machine from the virtual machine monitor. The focus of this analyzes is to determine if the targeted virtual machine is compliant according to a predefined configuration stored in more secure location. In addition to the development of the tool, the performance impact on the targeted virtual machine is investigated. One of the intentions of the development of the tool in this thesis is to remove the load caused by a traditional agent. Instead these workloads are transferred to server that has privileged access to the targeted virtual machines hardware. In the end the results are discussed and it is concluded that a prototype is developed and the performance impact on the targeted virtual machine are acceptable. Because there is only a prototype that is developed improvements are suggested in additions to future work.