Fanglu Guo
Stony Brook University
USA

Yang Yu
Stony Brook University
USA

Tzi-cker Chiueh
Stony Brook University
USA

As the number of system vulnerabilities multiplies in recent
years, vulnerability assessment has emerged as a powerful system
security administration tool that can identify vulnerabilities in
existing systems before they are exploited. Although there are
many commercial vulnerability assessment tools in the market, none
of them can formally guarantee that the assessment process never
compromises the computer systems being tested. This paper proposes
a feather-weight virtual machine (FVM) technology to address the
safety issue associated with vulnerability testing. Compared with
other virtual machine technologies, FVM is designed to facilitate
sharing between virtual machines but still provides strong
protection between them. The FVM technology allows a vulnerability
assessment tool to test an exact replica of a production-mode
network service, including both hardware and system software
components, while guaranteeing that the production-mode network
service is fully isolated from the testing process. In addition to
safety, the vulnerability assessment support system described in
this paper can also automate the entire process of vulnerability
testing and thus for the first time makes it feasible to run
vulnerability testing autonomously and frequently. Experiments on
a Windows-based prototype show that Nessus assessment results
against an FVM virtual machine are identical to those against a
real machine. Furthermore, modifications to the file system and
registry state made by vulnerability assessment runs are
completely isolated from the host machine. Finally, the
performance impacts of vulnerability assessment runs on production
network services is as low as 3%.

Keywords: safe vulnerability assessment, virtual machine

Read Paper (in PDF)