Lares: An architecture for secure active monitoring using virtualization

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2008, Pages 233-247

  Payne, Bryan D ^a   Carbone, Martim ^a   Sharif, Monirul ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; COMPUTER SOFTWARE; HEALTH; INTRUSION DETECTION; MACHINE TOOLS; SECURITY OF DATA; SENSORS; WEIGHT CONTROL;

ACTIVE MONITORING; ANTI-VIRUS; HOST-BASED; HYBRID APPROACHES; INTRUSION DETECTION SYSTEMS; MALWARE; PROTOTYPE IMPLEMENTATIONS; SECURITY ANALYSIS; SECURITY AND PRIVACY; SECURITY TOOLS; VIRTUAL MACHINE; VIRTUALIZATION; WINDOWS XP;

COMPUTER VIRUSES;

EID: 50249101677     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2008.24     Document Type: Conference Paper

References (40)

1. M. Abadi, M. Budiu, and U. E. J. Ligatti. Control-Flow Integrity. In Proceedings of the ACM Conference on Computer and Communications Security, 2005.
2. Advanced Micro Devices. Amd64 architecture programmer's manual volume 2: System programming, 2007.
3. W. A. Arbaugh, D. J. Farber, and J. M. Smith. A secure and reliable bootstrap architecture. In Proceedings of the IEEE Symposium on Computer Security and Privacy, 1997.
4. F. Bellard. QEMU, a Fast and Portable Dynamic Translator. In Proceedings of the 2005 USENIX Annual Technical Conference, 2005.
5. G. Coker. Xen security modules (XSM). Presented at the 2007 Xen Summit.
6. G. W. Dunlap, S. T. King, S. Cinar, M. Basrai, and P. M. Chen. Revirt: Enabling intrusion analysis through virtual-machine logging and replay. In Proceedings of the Symposium on Operating Systems Design and Implementation, 2002.
7. S. Forrest, A. S. Perelson, L. Allen, and R. Cherukuri. Self-nonself discrimination in a computer. In Proceedings of the IEEE Symposium on Research in Security and Privacy, Los Alamitos, CA, USA, 1994.
8. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A virtual machine-based platform for trusted computing. In Proceedings of ACM Symposium on Operating Systems Principles, 2003.
9. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proceedings of the Network and Distributed Systems Security Symposium, 2003.
10. G. Hoglund. Rootkits: Subverting the Windows Kernel. Addison Wesley, 2005.
11. Intel Corporation. Intel trusted execution technology, 2007.
12. X. Jiang and X. Wang. "Out-of-the-Box" monitoring of VM-based high-interaction honeypots. In Proceedings of the International Symposium on Recent Advances in Intrusion Detection, 2007.
13. X. Jiang, D. Xu, and X. Wang. Stealthy malware detection through VMM-based "Out-of-the-Box" semantic view reconstruction. In Proceedings of the ACM Conference on Computer and Communications Security, 2007.
14. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Antfarm: Tracking processes in a virtual machine environment. In Proceedings of the USENIX Annual Technical Conference, June 2006.
15. A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen. Detecting past and present intrusions through vulnerability-specific predicates. In Proceedings of ACM Symposium on Operating Systems Principles (SOSP), 2005.
16. N. L. Kelem and R. J. Feiertag. A separation model for virtual machine monitors. In Proceedings of the IEEE Symposium on Research in Security and Privacy, 1991.
17. S. T. King, P. M. Chen, Y.-M. Wang, C. Verbowski, H. J. Wang, and J. R. Lorch. SubVirt: Implementing malware with virtual machines. In IEEE Symposium on Security and Privacy, 2006.
18. K. Kourai and S. Chiba. Hyperspector: Virtual distributed monitoring environments for secure intrusion detection. In Proceedings of the ACM/USENIX International Conference on Virtual Execution Environments, 2005.
19. S. E. Madnick and J. J. Donovan. Application and analysis of the virtual machine approach to information system security and isolation. In Proceedings of theWorkshop on Virtual Computer Systems, 1973.
20. Microsoft Corporation. Kernel patch protection: Frequently asked questions. http://www.microsoft.com/whdc/driver/kernel/64bitpatch FAQ.mspx.
21. A. Moser, C. Kruegel, and E. Kirda. Exploring multiple execution paths for malware analysis. In Proceedings of the IEEE Symposium of Security and Privacy, 2007.
22. B. D. Payne, M. Carbone, and W. Lee. Secure and flexible monitoring of virtual machines. In Proceedings of the Annual Computer Security Applications Conference, 2007.
23. N. L. Petroni, Jr., T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 13th USENIX Security Symposium, August 2004.
24. N. L. Petroni, Jr., T. Fraser, A. Walters, and W. A. Arbaugh. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In Proceedings of the USENIX Security Symposium, 2006.
25. N. L. Petroni, Jr. and M. Hicks. Automated detection of persistent kernel control-flow attacks. In Proceedings of the ACM Conference on Computer and Communications Security, 2007.
26. N. Provos. Improving host security with system call policies. In Proceedings of the 12th USENIX Security Symposium, 2003.
27. N. A. Quynh and K. Suzaki. Xenprobe: A lightweight user-space probing framework for xen virtual machine. In Proceedings of the USENIX Annual Technical Conference, 2007.
28. J. M. Rushby. Proof of separability: A verification technique for a class of security kernels. Lecture Notes in Computer Science, 137:352-357, April 1982.
29. J. Rutkowska. Rootkit hunting vs. compromise detection. In Proceedings of Black Hat Federal, 2006.
30. J. Rutkowska. Subverting vista kernel for fun and profit. In Proceedings of Black Hat USA, 2006.
31. R. Sailer, T. Jaeger, E. Valdez, R. Caceres, R. Perez, S. Berger, J. Griffin, and L. van Doorn. Building a mac-based security architecture for the xen opensource hypervisor. In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC), December 2005.
32. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. In Proceedings of the ACM Symposium on Operating System Principles, 2007.
33. A. Seshadri, M. Luk, E. Shi, A. Perrig, L. van Doorn, and P. Khosla. Pioneer: Verifying integrity and guaranteeing execution of code on legacy platforms. In Proceedings of ACM Symposium on Operating Systems Principles, 2005.
34. Symantec Corporation. Symantec Virtual Security Solution and PCs with Intel vPro Technology, 2007.
35. P. Szor. The Art of Computer Virus Research and Defense. Symantec Press, 2005.
36. R. Ta-Min, L. Litty, and D. Lie. Splitting Interfaces: Making Trust Between Applications and Operating Systems Configurable. In Proceedings of the Symposium on Operating Systems Design and Implementation, 2006.
37. E. Witchel, J. Rhee, and K. Asanovic. Mondrix: Memory Isolation for Linux using Mondriaan Memory Protection. In Proceedings of the ACM Symposium on Operating Systems Principles, 2005.
38. M. Xu, X. Jiang, R. Sandhu, and X. Zhang. Towards a vmm-based usage control framework for os kernel integrity protection. In Proceedings of the Symposium on Access control Models and Technologies, 2007.
39. H. Yin, Z. Liang, and D. Song. HookFinder: Identifying and understanding malware hooking behaviors. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS), February 2008.
40. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Capturing system-wide information flow for malware detection and analysis. In Proceedings of the ACM Conference of Computer and Communication Security, 2007.