VM-based Architecture for Network Monitoring and Analysis

A single physical machine provides multiple network monitoring and analysis services (e.g., IDS, QoS) which are installed on the same operating system. Isolation between services is weak and it is difficult to decide the optimum allocation of resources for each service. This paper presents a virtual-machine-based architecture for network traffic monitoring and analysis. Through virtualization, a machine under the architecture logically is divided into one host, one virtual machine monitor (VMM) and multiple virtual machines. The host is responsible for capturing network traffic, and multiplexing it to multiple virtual machines. Each virtual machine hosts a service. VMM performs functions such as isolating services and resolving the conflict between services. Compared with Xen, KVM is chosen as a VMM to implement the architecture. Some network optimizations of the architecture are given. Our evaluation results show that these optimizations can multiplex network traffic received by...

• Type: Conference
• Year: 2008
• Where: ICYCS
• Authors: Qiang Li, Qinfen Hao, Limin Xiao, Zhoujun Li
• Keywords: ICYCS 2008, Multiple Virtual Machines, Network Traffic, Theoretical Computer Science, Virtual Machines