Abstract: |
Cloud computing has become a paradigm of our time. It is not only a technical solution, but a business model to sell and rent computing power and servers. Virtual machines (VMs) are used to allow a dynamic and transparent server utilization, which is made possible by VM live migration. VM live migration allows to move VMs within and out of data centers while the VM is still running. Thus, resource usage becomes more efficient. However, VM live migration also provides an opportunity for new attack vectors, which can be used by malicious attackers. They can compromise hypervisors and afterwards steal VMs from data centers to gain control over resources. In the worst case scenario, the theft remains undetected by both system administrators and customers. In this paper, we present the first taxonomy of possible VM live migration detection approaches. There are two different monitoring approaches, i.e., internal or external monitoring, as well as different detection approaches, which correspond to the different approaches to detect migration. Moreover, we propose a hybrid external approach using delay measurement with ICMP ping and time-lag detection with the network time protocol (NTP) to detect VMlive migration. We show that VM live migration can be detected by using a prototype of our hybrid external approach. |