CloudImmu: Transparent Protection of Binary Applications in the Cloud

As more organizations are moving their IT infrastructures from on-premises to the cloud, cloud security breaches have just surpassed on-premises breaches. There is a pressing need to develop practical and deployable cyber defense capabilities to protect the enormous amount of potentially vulnerable binary applications in the cloud from previously unseen cyberattacks. In this paper, we present CloudImmu, a practical cloud cyber defense system that is built upon a novel combination of binary rewriting and instrumentation techniques, virtual machine introspection and hypervisor level anomaly detection techniques. Our immunization tool has successfully “immunized” large real world binary applications such as bash, Snort, and our experiments with real world exploits have shown that CloudImmu can detect and block cyberattacks on properly immunized, otherwise vulnerable binary applications in virtual machines in real-time without using any prior knowledge of the attacks. Our benchmark experiments show that CloudImmu incurs less than 1.06% overall run-time performance overhead on typical applications with typical workloads.