Asynchronous pseudo physical memory snapshot and forensics on paravirtualized VMM using split kernel module

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4817 LNCS, Issue , 2007, Pages 131-143

  Ando, Ruo ^a   Kadobayashi, Youki ^a   Shinoda, Youichi ^a  

^a NATIONAL INSTITUTE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY   (Japan)

Author keywords

Asynchronous snapshot; Memory forensics; Paravirtualized VMM; Split kernel module; Virtualized interruption

Indexed keywords

COMPUTER OPERATING SYSTEMS; SECURITY OF DATA; VIRTUAL REALITY;

ASYNCHRONOUS SNAPSHOT; MEMORY FORENSICS; SPLIT KERNEL MODULES; VIRTUALIZED INTERRUPTION;

DATA STORAGE EQUIPMENT;

EID: 38149024127     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-76788-6_11     Document Type: Conference Paper

References (16)

1. Hand, S., Warfield, A., Fraser, K., Kotsovinos, E., Magenheimer, D.: Are Virtual Machine Monitors Microkernels Done Right? In: Proceedings of the Tenth Workshop on Hot Topics in Operating Systems (HotOS-X) (June 2005)
2. Goth, G.: Virtualization: Old Technology Offers Huge New Potential. IEEE Distributed Systems Online 8(2) (2007)
3. Karger, P.A., Zurko, M.E., Bonin, D.W., Mason, A.H., Kahn, C.E.: A Retrospective on the VAX VMM Security Kernel. IEEE Trans. Software Eng. 17(11), 1147-1165 (1991)
4. Karger, P.A., Zurko, M.E., Bonin, D.W., Mason, A.H., Kahn, C.E.: A Retrospective on the VAX VMM Security Kernel. IEEE Trans. Software Eng. 17(11), 1147-1165 (1991)
5. XEN virtual machine monitor, http://www.cl.cam.ac.uk/Research/SRG/netos/ xen/
6. Barham, P., Dragovic, B., Fraser, K., Hand, S., Harris, T., Ho, A., Neugebauer, R., Pratt, I., Warfield, A.: Xen and the art of virtualization. In: SOSP 2003. Proceedings of the 19th Symposium on Operating System Principles, Bolton Landing, NY (October 2003)
7. KVM: Kernel-based virtualization driver, available at: http://kvm.qumranet.com/
8. Garfinkel, T., Rosenblum, M.: A Virtual Machine Introspection Based Architecture for Intrusion Detection. In: NDSS 2003. Proceedings of Network and Distributed System Security, pp. 191-206 (February 2003)
9. Quynh, N.A., Ando, R., Takefuji, Y.: Centralized Security Policy Support for Virtual Machine. In: LISA 2007. Proceedings of USENIX, 20th Large Installation System Administration Conference (December 2006)
10. Sailer, R., Jaeger, T., Valdez, E., Caceres, R., Perez, R., Berger, S., Griffin, J.L., van Doom, L.: Building a MAC-Based Security Architecture for the Xen Opensource Hypervisor. In: Srikanthan, T., Xue, J., Chang, C.-H. (eds.) ACSAC 2005. LNCS, vol. 3740, Springer, Heidelberg (2005)
11. Xu, M., Malyugin, V., Sheldon, J., Venkitachalam, G., Weissman, B.: ReTrace: Collecting Execution Trace with Virtual Machine Deterministic Replay. In: MoBS 2007. Proceedings of Third Annual Workshop on Modeling, Benchmarking and Simulation (June 2007)
12. Bhansali, S., Chen, W.-K., De Jong, S., Edwards, A., Drinic, M.: Framework for Instruction-level Tracing and Analysis of Programs. In: VEE 2006. Proceedings of Second International Conference on Virtual Execution Environments (June 2006)
13. Dunlap, G.W., King, S.T., Cinar, S., Basrai, M., Chen, P.M.: ReVirt: Enabling intrusion analysis through virtual-machine logging and replay. In: OSDI 2002. Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (December 2002)
14. King, S.T., Chen, P.M., Wang, Y.-M., Verbowski, C., Wang, H.J., Lorch, J.R.: SubVirt: Implementing malware with virtual machines. In: Proceedings of IEEE Symp. on Security and Privacy (the Oakland Conference) (May 2006)
15. LIDS: Linux Intrusion Detection System, available at http://www.lids.org/
16. Uhlig, R., Neiger, G., Rodgers, D., Santoni, A.L., Martins, F.C.M., Anderson, A.V., Bennett, S.M., Kagi, A., Leung, F.H., Smith, L.: Intel Virtualization Technology. IEEE Computer 38(5), 48-56 (2005)