An Intrusion Detection System for Cloud Environments Based on Hypervisor-Level Introspection

International Journal of Computer Science and Technology | Vol. 7, No. 6, June 2005 | pp. 41–48

DOI: 10.46882/2005/IJCST/070609

Research Article

Title: An Intrusion Detection System for Cloud Environments Based on Hypervisor-Level Introspection

Names of Authors: David Miller¹, Siti Aminah²

Authors’ Affiliations: ¹Department of Computer Science, Carnegie Mellon University, Pittsburgh, Pennsylvania, USA; ²School of Computing, Universiti Teknologi Malaysia, Johor Bahru, Malaysia

Abstract:
Traditional network-based intrusion detection frameworks are often unable to detect sophisticated attacks running inside virtualized cloud server nodes. This study details a host-level intrusion detection system (IDS) that operates via virtual machine introspection (VMI) at the hypervisor layer, completely isolated from the monitored guest operating systems. The software captures kernel data structures and memory allocations in real-time, matching changes against known malicious control-flow patterns. Testing within a Xen-hypervisor environment exposed to rootkit injection scripts demonstrated a true positive detection accuracy rate of 99.1%, while maintaining a low false alarm rate of 0.04%. Because the monitoring processes are decoupled from the target virtual machine, attackers cannot tamper with or disable the logging system. The hypervisor monitoring execution loop adds a minor performance penalty of just 2.3% on guest CPU workloads, ensuring the security model remains practical for enterprise cloud service provider deployment.

Keywords: Cloud Computing, Virtual Machine Introspection, Intrusion Detection, Hypervisor Security, Virtualization

Manuscript Timeline: Received March 14, 2005; Revised April 28, 2005; Accepted May 19, 2005; Published June 23, 2005

Citation: Miller, D., & Aminah, S. (2005). An Intrusion Detection System for Cloud Environments Based on Hypervisor-Level Introspection. International Journal of Computer Science and Technology, 7(6), 41–48.

Subscribe to read the full article: https://internationalscholarsjournals.org/subscribe-to-read