Classifying Virtual Machine Managers by Overhead

Even though Virtual Machine Managers (VMMs) are meant to be transparent, a program may still need to know what VMM is virtualizing their environment. Developers may want to ensure their software only works in particular virtual environments, and users may want to know whether they are the victim of some virtualization-based rootkit. Various methods have been developed for programs to discover whether or not they are executing inside a virtual machine (VM), but current methods for identifying specific VMMs rely entirely on basic heuristics. This work presents a methodology for identifying VMMs based on their usage of shared resources. It has the potential to identify VMMs to the extent that they have unique shared resource usage profiles. A prototype implementation is presented that collects testing routines from existing work on VMM detection and CPU side-channel attacks. Each routine takes a measurement that is sensitive to a VMM's use of some shared resource. Results are presented that show it is possible to observe differences between several VMMs and even between some versions of the same VMM.