Artifact Mitigation in High-Fidelity Hypervisors

Abstract

The use of hypervisors for cyber operations has increased significantly over the past decade, resulting in a concomitant increase in the demand for higher fidelity hypervisors that do not exhibit the markers, or artifacts that identify the execution platform type (virtualized or bare metal), prevalent in most currently available virtualization solutions. To address this need, we present an in-depth examination of a specific subset of virtualization artifacts in order to design and implement a method of mitigation that reduces the detectability of these artifacts. Our analysis compares the performance of a bare metal machine, a virtual machine without artifact mitigation, and a virtual machine with our proof-of-concept mitigation technique applied to a temperature sensor. Results of the implementation are analyzed to determine the potential impact on system performance and whether our mitigation technique is appropriate for extending high-fidelity hypervisors.