Selecting the correct inter-process communication method isan important aspect of ensuring effective inter-vm and inter-container process communication. We will conduct a study ofIPC methods which might be useful and fits the Qemu/KVMvirtual machine and Docker container environments, and se-lect those that fit our criteria. After implementing our chosenmethods we will benchmark them in a test suite to find theones with highest performance in terms of speed. Our resultsshow that, at the most common message sizes, Unix DomainSockets work best for containers and Transparent Inter Pro-cess Communication has the best performance between vir-tual machines out of the chosen methods.

[pt] Programar redes de sensores sem fio (RSSF) é uma tarefa difícil. O programador tem que lidar com várias atividades simultâneas em um ambiente com recursos extremamente limitados. Neste trabalho propomos um modelo de programação para facilitar essa tarefa. O modelo que propomos combina o uso de máquinas virtuais configuráveis baseadas em componentes com uma linguagem de script reativa que pode ser analisada estaticamente para evitar conitos de memória e execução de laços infinitos. Essa abordagem permite a exibilidade de carregamento remoto de código nos nós da rede combinado com um conjunto de garantias para o programador. A escolha de um conjunto específico de componentes numa configuração de máquina virtual define o nível de abstração visto pelo script da aplicação. Para avaliar esse modelo, construímos Terra, um sistema que combina a linguagem de script Céu-T com uma máquina virtual e uma biblioteca de componentes. Nós projetamos esta biblioteca considerando as funcionalidades comumente necessárias em aplicações de RSSF - tipicamente para sensoreamento e controle. Implementamos diferentes aplicações utilizando Terra e uma linguagem orientada a eventos baseados em C. Além disso discutimos as vantagens e desvantagens dessas implementações alternativas. Finalmente, também avaliamos Terra medindo o custo adicional em uma aplicação básica e discutimos sua utilização e custo em diferentes cenários de aplicações WSNs. / [en] Programming wireless sensors networks (WSN) is a difficult task. The programmer must deal with several concurrent activities in an environment with severely limited resources. In this work we propose a programming model to facilitate this task. The model we propose combines the use of configurable component-based virtual machines with a reactive scripting language which can be statically analyzed to avoid unbounded execution and memory conicts. This approach allows the exibility of remotely uploading code on motes to be combined with a set of guarantees for the programmer. The choice of the specific set of components in a virtual machine configuration defines the abstraction level seen by the application script. To evaluate this model, we built Terra, a system combining the scripting language Céu-T with the Terra virtual machine and a library of components. We designed this library taking into account the functionalities commonly needed in WSN applications - typically for sense and control. We implemented different applications using Terra and using an event-driven language based on C and we discuss the advantages and disadvantages of the alternative implementations. Finally, we also evaluate Terra by measuring its overhead in a basic application and discussing its use and cost in different WSN scenarios.

The advent of virtualization technologies has evolved the IT infrastructure and organizations are migrating to virtual platforms. Virtualization is also the foundation for cloud platform services. Virtualization is known to provide more security into the infrastructure apart from agility and flexibility. However security aspects of virtualization are often overlooked. Various attacks to the virtualization hypervisor and its administration component are desirable for adversaries. The threats to virtualization must be rigorously scrutinized to realize common breaches and knowing what is more attractive for attackers. In this thesis a current state of perimeter and operational threats along with taxonomy of virtualization security threats is provided. The common attacks based on vulnerability database are investigated. A distribution of the virtualization software vulnerabilities, mapped to the taxonomy is visualized. The famous industry best practices and standards are introduced and key features of each one are presented for safeguarding the virtualization environments. A discussion of other possible approaches to investigate the severity of threats based on automatic systems is presented.

Virtualization is a technique that allows several virtual machines (VMs) to run on a single physical machine (PM) by adding a virtualization layer above the physical host's hardware. Many virtualization products allow a VM be migrated from one PM to other PM without interrupting the services running on the VM. This is called live migration and offers many potential advantages like server consolidation, reduced energy consumption, disaster recovery, reliability, and efficient workflows such as "Follow-the-Sun''. At present, the advantages of VM live migration are limited to Local Area Networks (LANs) as migrations over Wide Area Networks (WAN) offer lower performance due to IP address changes in the migrating VMs and also due to large network latency. For scenarios which require migrations, shared storage solutions like iSCSI (block storage) and NFS (file storage) are used to store the VM's disk to avoid the high latencies associated with disk state migration when private storage is used. When using iSCSI or NFS, all the disk I/O operations generated by the VM are encapsulated and carried to the shared storage over the IP network. The underlying latency in WAN will effect the performance of application requesting the disk I/O from the VM. In this thesis our objective was to determine the performance of shared and private storage when VMs are live migrated in networks with high latency, with WANs as the typical case. To achieve this objective, we used Iometer, a disk benchmarking tool, to investigate the I/O performance of iSCSI and NFS when used as shared storage for live migrating Xen VMs over emulated WANs. In addition, we have configured the Distributed Replicated Block Device (DRBD) system to provide private storage for our VMs through incremental disk replication. Then, we have studied the I/O performance of the private storage solution in the context of live disk migration and compared it to the performance of shared storage based on iSCSI and NFS. The results from our testbed indicate that the DRBD-based solution should be preferred over the considered shared storage solutions because DRBD consumed less network bandwidth and has a lower maximum I/O response time.

This literature review seeks to identify the major security issues and their solutions in cloud computing security as well as identifying areas for future research. Utilising a modified version of the approach suggested by Okoli and Schabram (2010) 52 articles were considered for the review, of which 26 were included in the final product. Although many security issues and solutions were identified it has become apparent that much of the research being done only relates to the theoretical side. Thus this review shows that while plenty of issues have been identified future research should focus more on the practical implications of these security risks. / Denna litteraturundersökning identifierar de huvudsakliga säkerhetsbristerna och de lösningar som åtfinns inom litteraturen om datormolnsäkerhet. Undersökningen använder sig av en modifierad version av metoden för litteraturundersökningar som skrivits av Okoli och Schabram (2010). Efter en första litteratursökning identifierades 52 artiklar som relevanta för undersökningen, av dessa 52 användes 26 i slutprodukten. Trots att flera olika säkerhetsbrister och lösningar för dessa identifierades var det uppenbart att mycket av forskningen enbart har teoretiska svar på bristerna. Undersökningen visar således att även om många hot har upptäckts av forskare saknas det forskning av de praktiska konsekvenserna av dessa brister.

L’introspection de machine virtuelle (VM) consiste à superviser les états et les activités de celles-ci depuis la couche de virtualisation, tirant ainsi avantage de son emplacement qui offre à la fois une bonne visibilité des états et des activités des VMs ainsi qu’une bonne isolation de ces dernières. Cependant, les états et les activités des VMs à superviser sont vus par la couche de virtualisation comme une suite binaire de bits et d’octets en plus des états des ressources virtuelles. L’écart entre la vue brute disponible à la couche de virtualisation et celle nécessaire pour la supervision de sécurité des VMs constitue un challenge pour l’introspection appelé « le fossé sémantique ». Pour obtenir des informations sémantiques sur les états et les activités des VMs à fin de superviser leur sécurité, nous présentons dans cette thèse un ensemble de techniques basé sur l’analyse binaire et la réutilisation du code binaire du noyau d’une VM. Ces techniques permettent d’identifier les adresses et les noms de la plupart des fonctions noyau d’une VM puis de les instrumenter (intercepter, appeler et analyser) pour franchir le fossé sémantique de manière automatique et efficiente même dans les cas des optimisations du compilateur et de la randomisation de l’emplacement du code noyau dans la mémoire de la VM. / Virtual Machine Introspection (VMI) consists inmonitoring VMs security from the hypervisor layer which offers thanks to its location a strong visibility on their activities in addition to a strong isolation from them. However, hypervisor view of VMs is just raw bits and bytes in addition to hardware states. The semantic difference between this raw view and the one needed for VM security monitoring presents a significant challenge for VMI called “the semantic gap”. In order to obtain semantic information about VM states and activities for monitoring their security from the hypervisor layer, we present in this thesis a set of techniques based on analysis and reuse of VM kernel binary code. These techniques enable to identify addresses and names of most VM kernel functions then instrument (call, intercept and analyze) them to automatically bridge the semantic gap regardless of challenges presented by compiler optimizations and kernel base address randomization.

[pt] As linguagens multimídia de alto-nível atuais são limitadas. Suas limitações decorrem não da ausência de funcionalidades mas da complexidade causada pelo excesso delas e, especialmente, da sua definição não-estruturada. Linguagens como NCL, SMIL e HTML definem diversas construções para controlar a apresentação de dados audiovisuais, porém falham ao não descreverem precisamente como essas construções relacionam-se umas com as outras, particularmente em termos de comportamento. Não há uma separação clara entre construções básicas e construções derivadas; nem um princípio aparente de estruturação hierárquica na sua definição. Usuários dessas linguagens podem dispensar tal princípio, mas ele é imprescindível para as pessoas que definem e implementam essas linguagens: o princípio de estruturação hierárquica torna as especificações e implementações controláveis através da redução da linguagem a um conjunto de conceitos básicos (primitivos). Nesta tese, um conjunto de tais conceitos básicos é proposto e adotado como a linguagem de uma máquina virtual para apresentações multimídia. Mais precisamente, uma nova linguagem multimídia de alto-nível, chamada Smix (Synchronous Mixer), é apresentada e definida de forma a servir como camada de abstração adequada para a definição e implementação de linguagens multimídia de nível superior. Ao definir a linguagem Smix, isto é, ao escolher um conjunto de conceitos básicos, este trabalho visa o minimalismo mas ao mesmo tempo trata alguns dos principais problemas das linguagens multimídia de alto-nível atuais, a saber, os modelos semânticos inadequados de suas especificações e as abordagens não-sistemáticas de suas implementações. No lado da especificação, sustenta-se o uso de uma semântica síncrona simples porém expressiva, com uma noção temporal precisa. No lado da implementação, propõe-se uma arquitetura de duas camadas que facilita o mapeamento dos conceitos da especificação em primitivas de processamento digital de sinais. A camada superior (front end) é a realização da semântica e a camada inferior (back end) estrutura-se como um dataflow para processamento digital de sinais multimídia. / [en] Current high-level multimedia languages are limited. Their limitation stems not from the lack of features but from the complexity caused by the excess of them and, more importantly, by their unstructured definition. Languages such as NCL, SMIL, and HTML define innumerable constructs to control the presentation of audiovisual data, but they fail to describe how these constructs relate to each other, especially in terms of behavior. There is no clear separation between basic and derived constructs, and no apparent principle of hierarchical build-up in their definition. Users may not need such principle, but it is indispensable for the people who define and implement these languages: it makes specifications and implementations manageable by reducing the language to a set of basic (primitive) concepts. In this thesis, a set of such basic concepts is proposed and taken as the language of a virtual machine for multimedia presentations. More precisely, a novel high-level multimedia language, called Smix (Synchronous Mixer), is presented and defined to serve as an appropriate abstraction layer for the definition and implementation of higher level multimedia languages. In defining Smix, that is, choosing a set of basic concepts, this work strives for minimalism but also aims at tackling major problems of current high-level multimedia languages, namely, the inadequate semantic models of their specifications and unsystematic approaches of their implementations. On the specification side, the use of a simple but expressive synchronous semantics, with a precise notion of time, is advocated. On the implementation side, a two-layered architecture that eases the mapping of specification concepts into digital signal processing primitives is proposed. The top layer (front end) is the realization of the semantics, and the bottom layer (back end) is structured as a multimedia digital signal processing dataflow.

Operating Systems use fast, CPU-addressable main memory to maintain an application’s temporary data as anonymous data and to cache copies of persistent data stored in slower block-based storage devices. However, the use of this faster memory comes at a high cost. Therefore, several techniques have been implemented to use main memory more efficiently in the literature. In this dissertation we introduce three distinct approaches to improve overall system performance by optimizing main memory usage. First, DRAM and host-side caching of file system data are used for speeding up virtual machine performance in today’s virtualized data centers. The clustering of VM images that share identical pages, coupled with data deduplication, has the potential to optimize main memory usage, since it provides more opportunity for sharing resources across processes and across different VMs. In our first approach, we study the use of content and semantic similarity metrics and a new algorithm to cluster VM images and place them in hosts where through deduplication we improve main memory usage. Second, while careful VM placement can improve memory usage by eliminating duplicate data, caches in current systems employ complex machinery to manage the cached data. Writing data to a page not present in the file system page cache causes the operating system to synchronously fetch the page into memory, blocking the writing process. In this thesis, we address this limitation with a new approach to managing page writes involving buffering the written data elsewhere in memory and unblocking the writing process immediately. This buffering allows the system to service file writes faster and with less memory resources. In our last approach, we investigate the use of emerging byte-addressable persistent memory technology to extend main memory as a less costly alternative to exclusively using expensive DRAM. We motivate and build a tiered memory system wherein persistent memory and DRAM co-exist and provide improved application performance at lower cost and power consumption with the goal of placing the right data in the right memory tier at the right time. The proposed approach seamlessly performs page migration across memory tiers as access patterns change and/or to handle tier memory pressure.

High-level language virtual machines (HLL VMs) have been playing a key role as a mechanism for implementing programming languages. Languages that run on these execution environments have many advantages over languages that are compiled to native code. These advantages have led HLL VMs to gain broad acceptance in both academy and industry. However, much of the research in this area has been devoted to boosting the performance of these execution environments. Few eorts have attempted to introduce features that automate or facilitate some software engineering activities, including software testing. This research argues that HLL VMs provide a reasonable basis for building an integrated software testing environment. To this end, two software testing features that build on the characteristics of a Java virtual machine (JVM) were devised. The purpose of the rst feature is to automate weak mutation. Augmented with mutation support, the chosen JVM achieved speedups of as much as 95% in comparison to a strong mutation tool. To support the testing of concurrent programs, the second feature is concerned with enabling the deterministic re-execution of Java programs and exploration of new scheduling sequences / Máquinas virtuais de linguagens de programação têm desempenhado um papel importante como mecanismo para a implementação de linguagens de programação. Linguagens voltadas para esses ambientes de execução possuem várias vantagens em relação às linguagens compiladas. Essas vantagens fizeram com que tais ambientes de execução se tornassem amplamente utilizados pela indústria e academia. Entretanto, a maioria dos estudos nessa area têm se dedicado a aprimorar o desempenho desses ambientes de execução e poucos têm enfocado o desenvolvimento de funcionalidades que automatizem ou facilitem a condução de atividades de engenharia de software, incluindo atividades de teste de software. Este trabalho apresenta indícios de que máquinas virtuais de linguagens de programação podem apoiar a criação de ambientes de teste de software integrado. Para tal, duas funcionalidades que tiram proveito das características de uma máquina virtual Java foram desenvolvidas. O propósito da primeira funcionalidade e automatizar a condução de atividades de mutação fraca. Após a implementação de tal funcionalidade na máquina virtual Java selecionada, observou-se um desempenho até 95% melhor em relação a uma ferramenta de mutação forte. Afim de apoiar o teste de programas concorrentes, a segunda funcionalidade permite reexecutá-los de forma determinística além de automatizar a exploração de que novas sequências de escalonamento

Řada programovacích jazyků byla schopna zvýšit svoji rychlost výměnou běhových systémů stavěných na míru za obecné platformy, které pro optimalizaci používají just-in-time překlad, jako jsou GraalVM nebo RPython. V této práci vyhodnocuji, zda je použití takovýchto platforem vhodné i pro jazyky se závislymi typy nebo důkazovými systémy. Tato práce představuje koncepty -kalkulu a teorie typů potřebné pro úvod do závislých typů s relevantními algoritmy, specifikuje malý závisle typovaný jazyk založený na $\lambda\Pi$ kalkulu, a prezentuje dva interpretery tohoto jazyka. Tyto interpretery jsou psané v jazyce Kotlin, první je jednoduchý, psaný ve funkcionálním stylu a druhý používá platformu GraalVM a Truffle. GraalVM je platforma založená na virtuálním stroji Javy (JVM), která přidává just-in-time překladač založený na částečném vyhodnocení (partial evaluation) a Truffle je knihovna pro tvorbu programovacích jazyků využívající tento překladač. Závěr práce vyhodnocuje běhové charakteristiky těchto interpreterů na různých zátěžových testech.Závěry práce jsou ale silně negativní. Vliv JIT překladu není znatelný ani přes snahu optimalizovat běžné algoritmy z teorie typů, které jsou zjevně nevhodné pro platformu JVM. Práce končí návrhy několika navazujících projektů, které by lépe využily možnosti Truffle a které by byly vhodnější pro implementaci závisle typovaných jazyků.