A novel approach for a file-system integrity monitor tool of Xen virtual machine

Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07

Volumn , Issue , 2007, Pages 194-202

  Quynh, Nguyen Anh ^a   Takefuji, Yoshiyasu ^a  

^a KEIO UNIVERSITY   (Japan)

Author keywords

Intrusion detection; Linux; Rootkit; Xen virtual machine

Indexed keywords

CODES (SYMBOLS); COMPUTER OPERATING SYSTEMS; DATABASE SYSTEMS; INTRUSION DETECTION; VIRTUAL REALITY;

COMPUTER OPERATING SYSTEMS - LINUX; FILE SYSTEM INTEGRITY TOOLS (FIT); FILE SYSTEMS;

FILE ORGANIZATION;

EID: 34748834684     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1229285.1229313     Document Type: Conference Paper

References (24)

1. N. A.Kamble, J. Nakajima, and A. K.Mallick. Evolution in kernel debugging using hardware virtualization with xen. In Proceedings of the 2006 Ottawa Linux Symposium, Ottawa, Canada, July 2006.
2. K. Asrigo, L. Litty, and D. Lie. Virtual machine-based honeypot monitoring. In Proceedings of the 2nd international conference on Virtual Execution Environments, New York, NY, USA, June 2006. ACM Press.
3. T. Atkins. SWATCH: The Simple WATCHer of Logfiles. http: //swatch, sourceforge.net/, July 2004.
4. CERT Coordination Center. CERT/CC Overview Incident and Vulnerability Trends. Technical report, Carnegie Mellon Software Engineering Institute, May 2003.
5. CMN. SAdoor: A non listening remote shell and execution server.http://cmn. listprojects.darklab.org/, 2002.
6. B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, I. Pratt, A. Warfield, P. Barham, and R. Neugebauer. Xen and the art of virtualization. In Proceedings of the ACM Symposium on Operating Systems Principles, October 2003.
7. DWARF Workgroup. DWARF Debugging Format Standard. http://dwarf. freestandards.org/Home.php, January 2006.
8. R. Hock. Dica rootkit. http://packetstormsecurity.ni/UNIX/ penetration/rootkits/dica.tgz, 2002.
9. Intersect Alliance. System iNtrusion Analysis and Reporting Environment, http://www.intersectalliance. com/pro jects/Snare/, January 2005.
10. G. H. Kim and E. H. Spafford. The Design and Implementation of Tripwire: A File System Integrity Checker. In ACM Conference on Computer and Communications Security, pages 18-29, 1994.
11. T. Miller. Analysis of the Knark rootkit. www.ossec.net/rootkits/studies/ knark.txt, 2001.
12. T. Miller. Analysis of the T0rn rootkit. http://www.sans.org/y2k/t0rn. htm, 2002.
13. S. Patil, A. Kashyap, G. Sivathanu, and E. Zadok. I3FS: An In-Kernel Integrity Checker and Intrusion Detection File System. In Proceedings of the 18th USENIX Large Installation System Administration Conference (LISA 2004), pages 69-79, Atlanta, GA, November 2004.
14. H. Pomeranz. File Integrity Assessment via SSH. http://www.samag.com/ documents/s=9950/ sam0602a/0602a.htm, February 2006.
15. I. Pratt, K. Fraser, S. Hand, C. Limpach, A. Warfield, D. Magenheimer, J. Nakajima, and A. Mallick. Xen 3.0 and the art of virtualization. In Proceedings of the 2005 Ottawa Linux Symposium, Ottawa, Canada, July 2005.
16. sd. Linux on-the-fly kernel patching. http://www.phrack.org/show.php?p= 58&a=7, July 2002.
17. SGI Inc. LKCD - Linux Kernel Crash Dump. http://lkcd.sf.net,April 2006.
18. L. Somer. Linux Rootkit 5. http://packetstormsecurity.nl/UNIX/ penetration/rootkits/lrk5.src.tar.gz, 2000.
19. The AIDE team. AIDE: Advanced Intrusion Detection Environment. http://sourceforge.net/projects/aide, November 2005.
20. The Osiris team. Osiris host integrity monitoring. http://www. hostintegrity.com/osiris/, September 2005.
21. The Samhain Labs. Samhain manual, http://la-samhna.de/samhain/manual/ index.html, 2004.
22. The Samhain Labs. The SAMHAIN file integrity/intrusion detection system, http://la-samhna.de/samhain/, January 2006.
23. The Snort team. Snort - the de-facto standard for intrusion detection/prevention, http://www.snort.org, January 2006.
24. Xen project. Xen interface manual, http: //www.cl.cam.ac.uk/Research/SRG/ netos/ xen/readmes/interface/interface.html, August 2006.