VICI-Virtual Machine Introspection for cognitive immunity

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2008, Pages 87-96

  Fraser, Timothy ^a   Evenson, Matthew R ^a   Arbaugh, William A ^a  

^a MICROSOFT   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION PERFORMANCE; AUTOMATED REASONINGS; CURRENT SITUATIONS; INFECTED SYSTEMS; MALWARE; MANUAL INTERVENTIONS; REPAIR TECHNIQUES; VIRTUAL MACHINE INTROSPECTIONS;

APPLICATIONS; COMPUTER CRIME; DATA STORAGE EQUIPMENT; RESTORATION; SECURITY SYSTEMS;

AUTOMATA THEORY;

EID: 60649112256     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2008.33     Document Type: Conference Paper

References (31)

1. J. A. Ambros-Ingerson and S. Steel. Integrating planning, execution and monitoring. In Proc. of the Seventh National Conference on Artificial Intelligence, 1988.
2. K. Asrigo, L. Litty, and D. Lie. Using vmm-based sensors to monitor honeypots. In 2nd International Conference on Virtual Execution Environments, 2006.
3. A. Baliga, P. Kamat, and L. Iftode. Lurking in the Shadows: Identifying Systemic Threats to Kernel Data (Short Paper). In Proc. of the 2007 IEEE Symposium on Security and Privacy, 2007.
4. R. A. Brooks. A robust layered control system for a mobile robot. IEEE Journal of Robotics and Automation, (2), 1986.
5. R. A. Brooks. Engineering approach to building complete, intelligent beings. Proc. of the SPIE - the International Society for Optical Engineering, (1002), 1989.
6. R. A. Brooks. Intelligence without representation. Artificial Intelligence, 47(1-3), 1991.
7. D. Brumley. invisible intruders: rootkits in practice. ;login: The Magazine of USENIX and SAGE, Sept. 1999.
8. J. Dean and S. Ghemawat. MapReduce: Simplified Data Processing in Large Clusters. In 6th USENIX Symposium on Operating System Design and Implementation, 2004.
9. A. K. Dewdney. In the game called Core War hostile programs engage in a battle of bits, Computer Recreations. Scientific American, May 1984.
10. B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, I. Pratt, A. Warfield, P. Barham, and R. Neugebauer. Xen and the Art of Virtualization. In Proc. of the ACM Symposium on Operating Systems Principles, 2003.
11. T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proc. of the 10th Annual Network and Distributed System Security Symposium, 2003.
12. M. P. Georgeff and A. L. Lansky. Reactive Reasoning and Planning. In Proceedings of the Sixth National Conference on Artificial Intelligence, 1987.
13. J. B. Grizzard. Towards self-healing systems: re-establishing trust in compromised systems. PhD thesis, Atlanta, GA, USA, 2006. Adviser-Henry L. Owen, III.
14. G. Hoglund and J. Butler. Rootkits: Subverting the Windows Kernel. Addison-Wesley Professional, 2005.
15. D. Hollingworth and T. Redmond. Enhancing operating system resistance to information warfare. In MILCOM 2000. 21st Century Military Communications Conference Proceedings, volume 2, 2000.
16. X. Jiang, X. Wang, and D. Xu. Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction. In Proc. of the 14th ACM conference on Computer and communications security, 2007.
17. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Vmm-based hidden process detection and identification using lycosid. In Proc. of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments, 2008.
18. L. Litty and D. Lie. Manitou: a layer-below approach to fighting malware. In Proc. of the 1st workshop on Architectural and system support for improving software dependability, 2006.
19. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In 13th USENIX Security Symposium, 2004.
20. N. L. Petroni, T. Fraser, A. Walters, and W. A. Arbaugh. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In Proc. of the 15th USENIX Security Symposium, 2006.
21. N. L. Petroni and M. Hicks. Automated detection of persistent kernel control-flow attacks. In 14th ACM conference on Computer and communications security, 2007.
22. N. A. Quynh and Y. Takefuji. Towards a tamper-resistant kernel rootkit detector. In Proc. of the 2007 ACM symposium on Applied computing, 2007.
23. S. regenerative Systems (SRS) Program Phase II. Cognitive immunity and self-healing. In BAA 06-35 Proposer Information Pamphlet. Defense Advanced Research Projects Agency, 2006.
24. R. Rivest. The MD5 Message-Digest Algorithm. Technical Report Request For Comments 1321, Network Working Group, April 1992.
25. S. J. Russell and P. Norvig. Artificial Intelligence A Modern Approach. Prentice Hall, 2nd edition, 2002.
26. A. Seshadri, M. Luk, N. Qu, and A. Perrig. Secvisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity oses. In 21st ACM symposium on Operating systems principles, 2007.
27. A. Seshadri, M. Luk, E. Shi, A. Perrig, L. van Doorn, and P. Khosla. Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems. In 20th ACM symposium on Operating systems principles, 2005.
28. I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrishnan. Chord: A scalable peer-to-peer lookup service for internet applications. SIGCOMM Comput. Commun. Rev., 31(4), 2001.
29. Y.-M. Wang, D. Beck, B. Vo, R. Roussev, and C. Verbowski. Detecting stealth software with Strider Ghost-Buster. In Proc. of the International Conference on Dependable Systems and Networks, 2005.
30. M. Xu, X. Jiang, R. Sandhu, and X. Zhang. Towards a vmm-based usage control framework for os kernel integrity protection. In Proc. of the 12th ACM symposium on Access control models and technologies, 2007.
31. X. Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer. Secure Coprocessor-based Intrusion Detection. In 10th ACM SIGOPS European Workshop, 2002.