Efficiently tracking application interactions using lightweight virtualization

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 19-27

  Huang, Yih ^a   Stavrou, Angelos ^a   Ghosh, Anup K ^a   Jajodia, Sushil ^a  

^a GEORGE MASON UNIVERSITY   (United States)

Author keywords

Applications; Interactions; Lightweight; Tracking; Virtualization

Indexed keywords

FILE SYSTEMS; INFORMATION TRACKING; INTERACTIONS; LIGHTWEIGHT; MALICIOUS ATTACK; OPERATING SYSTEMS; ORDER OF MAGNITUDE; PROOF OF CONCEPT; RECORDING SYSTEMS; SYSTEM INTEGRITY; SYSTEM RECOVERY; SYSTEM RESOURCES; TRACK APPLICATIONS; TRACKING; TRACKING APPLICATION; VIRTUALIZATION; VIRTUALIZATION TOOLS; VIRTUALIZATIONS; VIRTUALIZED ENVIRONMENT;

COMPUTER OPERATING SYSTEMS;

INTRUSION DETECTION;

EID: 70349260987     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1456482.1456486     Document Type: Conference Paper

References (38)

1. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci- Dusseau. "VMM-based hidden process detection and identification using Lycosid," In ACM Conference on Virtual Execution Environments (VEE), Seattle, WA, Mar. 2008.
2. X. Jiang, X. Wang, and D. Xu. "Stealthy malware detection through VMM-based 'out-of-the-box' semantic view," In 14th ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, Nov. 2007.
3. R. Sailer, T. Jaeger, E. Valdez, R. Caceres, R. Perez, S. Berger, J. L. Griffin, and L. van Doorn. "Building a MACbased security architecture for the Xen open-source hypervisor," In Annual Computer Security Applications Conference (ACSAC), Tucson, AZ, Dec. 2005.
4. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2003.
5. Dunlap, G. W., King, S. T., Cinar, S., Basrai, M. A., and Chen, P. M. 2002. ReVirt: enabling intrusion analysis through virtual-machine logging and replay. SIGOPS Oper. Syst. Rev. 36, SI (Dec. 2002), 211-224.
6. King, S. T. and Chen, P. M. 2005. Backtracking intrusions. ACM Trans. Comput. Syst. 23, 1 (Feb. 2005), 51-76.
7. Payne, B.D.; de Carbone, M.D.P.; Wenke Lee, "Secure and Flexible Monitoring of Virtual Machines," Annual Computer Security Applications Conference (ACSAC), 2007. pp.385-397, Dec. 2007.
8. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci- Dusseau. "Antfarm: Tracking processes in a virtual machine environment," In USENIX Annual Technical Conference, Boston, MA, June 2006.
9. T. Garnkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A virtual machine-based platform for trusted computing. In ACM Symposium on Operating Systems Principles (SOSP), Bolton Landing, NY, Oct. 2003.
10. Samuel T. King, George W. Dunlap, and Peter M. Chen. "Debugging operating systems with time-traveling virtual machines," In Proceedings of Unenix '05, Anaheim, CA, April 2005.
11. Laadan, O., Baratto, R. A., Phung, D. B., Potter, S., and Nieh, J. "DejaView: a personal virtual computer recorder" In Proceedings of Twenty-First ACM SIGOPS Symposium on Operating Systems Principles, Stevenson, Washington, USA, October 2007.
12. X. Jiang and X. Wang. "Out-of-the-box monitoring of VM-based high-interaction honeypots," In 10th International Symposium on Recent Advances in Intrusion Detection (RAID), Surfers Paradise, Australia, Sept. 2007.
13. Jiang, X. and Xu, D. 2004. "Collapsar: a VM-based architecture for network attack detention center," In Proceedings of the 13th Conference on USENIX Security Symposium, San Diego, CA, August 2004.
14. Vrable, M., Ma, J., Chen, J., Moore, D., Vandekieft, E., Snoeren, A. C., Voelker, G. M., and Savage, S. "Scalability, fidelity, and containment in the potemkin virtual honeyfarm," SIGOPS Oper. Syst. Rev. 39, 5 (Oct. 2005), 148-162.
15. Asrigo, K., Litty, L., and Lie, D. "Using VMM-based sensors to monitor honeypots," In Proceedings of the 2nd international Conference on Virtual Execution Environments, Ottawa, Ontario, Canada, June 2006).
16. Alexander Moshchuk, Tanya Bragin, Damien Deville, Steven D. Gribble, and Henry M. Levy. SpyProxy: Execution-based Detection of Malicious Web Content. In Proceeding of the 16th USENIX Security Symposium, August 2007.
17. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. "A sense of self for UNIX processes," In IEEE Symposium on Security and Privacy, Oakland, CA, May 1996.
18. Steven A. Hofmeyr, Stephanie Forrest, Anil Somayaji. Intrusion detection using sequences of system calls. Journal of Computer Security. Vol. 6, No. 3, 1998, Pages 151-180.
19. D. Mutz,W. Robertson, G. Vigna, and R. Kemmerer. "Exploiting execution context for the detection of anomalous system calls," In 10th International Symposium on Recent Advances in Intrusion Detection (RAID), Surfers Paradise, Australia, Sept. 2007.
20. J. T. Giffin, S. Jha, and B. P. Miller. "Efficient contextsensitive intrusion detection," In Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2004.
21. Sitaraman, S.; Venkatesan, S., "Forensic analysis of file system intrusions using improved backtracking," Information Assurance, Proceedings. Third IEEE International Workshop on, pp. 154-163, March 2005.
22. Goel, A.; Feng, W.-C.; Maier, D.; Walpole, J., "Forensix: a robust, high-performance reconstruction system," 25th IEEE International Conference on Distributed Computing Systems Workshops, pp. 155-162, June 2005.
23. Goel, A., Feng, W., Feng, W., and Maier, D. Automatic high-performance reconstruction and recovery. Computer Networks. 51, 5 (Apr. 2007), 1361-1377.
24. Goel, A., Po, K., Farhadi, K., Li, Z., and de Lara, E. "The taser intrusion recovery system," In Proceedings of the Twentieth ACM Symposium on Operating Systems Principles (SOSP '05). Brighton, United Kingdom, pp. 163-176., October, 2005.
25. Qin, F., J. Tucek, J. Sundaresan, and Y. Zhou, "Rx: treating bugs as allergies - a safe method to survive software failures," in Proceedings of the 20th ACM Symposium on Operating Systems Principles (SOSP), pp. 235-248, 2005.
26. R. J. Creasy. The origin of the VM/370 time-sharing system. IBM J. Research and Development, 25(5):483- 490, September 1981.
27. VMware, http://www.vmware.com.
28. Paul Barham , Boris Dragovic , Keir Fraser , Steven Hand , Tim Harris , Alex Ho , Rolf Neugebauer , Ian Pratt , Andrew Warfield, "Xen and the Art of Virtualization," Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA.
29. Jeff Dike, "A User-Mode Port of the Linux Kernel," Proceedings of the 2000 Linux Showcase and Conference, October 2000.
30. KVM (Kernel-based Virtual Machine). http://kvm.qumranet.com/kvmwiki/ Front-Page.
31. Jon Watson. VirtualBox: bits and bytes masquerading as machines. Linux Journal, Volume 2008 , Issue 166, February 2008.
32. Poul-Henning Kamp and Robert N. M. Watson. Jails: Confining the omnipotent root. In Proc. of 2nd Intl. SANE Conference, May 2000.
33. Soltesz, S., Pötzl, H., Fiuczynski, M. E., Bavier, A., and Peterson, L. "Container-based operating system virtualization: a scalable, high-performance alternative to hypervisors," In Proceedings of the ACM Sigops/Eurosys European Conference on Computer Systems (EuroSys '07), Lisbon, Portugal, March 2007.
34. Osman, S., Subhraveti, D., Su, G., and Nieh, J. 2002. The design and implementation of Zap: a system for migrating computing environments. In Proceedings of the 5th Symposium on Operating Systems Design and Implementation. (Boston, Massachusetts, December 09 - 11, 2002). OSDI '02.
35. Price, D. and Tucker, A. 2004. Solaris Zones: Operating System Support for Consolidating Commercial Workloads. In Proceedings of the 18th USENIX Conference on System Administration (Atlanta, GA, November 14 - 19, 2004).
36. http://openvz.org: OpenVZ server virtualization opensource project.
37. Wright, C. P., Dave, J., Gupta, P., Krishnan, H., Quigley, D. P., Zadok, E., and Zubair, M. N. 2006. Versatility and Unix semantics in namespace unification. Trans. Storage 2, 1 (Feb. 2006), 74-105.
38. Unionfs: http://www.am-utils.org/project-unionfs.html