Understanding the impact of Denial of Service attacks on Virtual Machines | IEEE Conference Publication | IEEE Xplore

Understanding the impact of Denial of Service attacks on Virtual Machines


Abstract:

Virtualization, which allows multiple Virtual Machines (VMs) to reside on a single physical machine, has become an indispensable technology for today's IT infrastructure....Show More

Abstract:

Virtualization, which allows multiple Virtual Machines (VMs) to reside on a single physical machine, has become an indispensable technology for today's IT infrastructure. It is known that the overhead for virtualization affects system performance; yet it remains largely unknown whether VMs are more vulnerable to networked Denial of Service (DoS) attacks than conventional physical machines. A clear understanding here is obviously critical to such networked virtualization system as cloud computing platforms. In this paper, we present an initial study on the performance of modern virtualization solutions under DoS attacks. We experiment with the full spectrum of modern virtualization techniques, from paravirtualization, hardware virtualization, to container virtualization, with a comprehensive set of benchmarks. Our results reveal severe vulnerability of modern virtualization: even with relatively light attacks, the file system and memory access performance of VMs degrades at a much higher rate than their non-virtualized counterparts, and this is particularly true for hypervisor-based solutions. We further examine the root causes, with the goal of enhancing the robustness and security of these virtualization systems. Inspired by the findings, we implement a practical modification to the VirtIO drivers in the Linux KVM package, which effectively mitigates the overhead of a DoS attack by up to 40%.
Date of Conference: 04-05 June 2012
Date Added to IEEE Xplore: 23 July 2012
ISBN Information:

ISSN Information:

Conference Location: Coimbra, Portugal

Contact IEEE to Subscribe

References

References is not available for this document.