Multiple attacks on virtualization-based security monitoring

Three kinds of vulnerabilities that may exist in some of current virtualization-based security monitoring systems were proposed: page mapping problem, lack of overall protection, and inherent limitations. Aiming at these vulnerabilities, relative attack methods were presented in detail. Our experiments show that the attack methods, such as page mapping attack, data attack, and non-behavior detection attack, can attack simulated or original security monitors successfully. Defenders, who need to effectively strengthen their security monitors, can get an inspiration from these attack methods and find some appropriate solutions.