VMM-based hidden process detection and identification using Lycosid

VEE'08 - Proceedings of the 4th International Conference on Virtual Execution Environments

Volumn , Issue , 2008, Pages 91-100

  Jones, Stephen T ^a   Arpaci Dusseau, Andrea C ^a   Arpaci Dusseau, Remzi H ^a  

^a University of Wisconsin Madison   (United States)

Author keywords

Inference; Security; Virtual machine

Indexed keywords

HYPOTHESIS TESTING; LOW QUALITIES; OPERATING SYSTEMS; PROCESS DETECTION; PROCESS INFORMATION; SECURITY ISSUES; SECURITY SERVICES; STATISTICAL INFERENCE; VIRTUAL MACHINES;

COMPUTER OPERATING SYSTEMS; DETECTORS;

INFORMATION USE;

EID: 77952336652     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1346256.1346269     Document Type: Conference Paper

References (30)

1. 90210. Bypassing klister 0.4 with no hooks or running a controlled thread scheduler, hi-tech.nsys.by/33/.
2. J. Butler, J. L. Undercoffer, and J. Pinkston. Hidden processes: The implication for intrusion detection. In Proceedings of the 2003 IEEE Workshop on Information Assurance, pages 116-121, June 2003.
3. J. Clemens. Knark: Linux kernel subversion, www.sans.org/ resources/ idfaq/ knark.php.
4. B. Cogswell and M. Russinovich. Pslist. www.sysinternals.com.
5. B. Cogswell and M. Russinovich. Rootkit revealer. www.sysinternals.com.
6. J. R. Douceur and W. J. Bolosky. Progress-based regulation of lowimportance processes. In Proceedings of the 17th ACM Symposium on Operating Systems Principles (SOSP '99), pages 247-260, Kiawah Island Resort, South Carolina, December 1999.
7. B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, I. Pratt, A. Warfield, P. Barham, and R. Neugebauer. Xen and the Art of Virtualization. In Proceedings of the 19th ACM Symposium on Operating Systems Principles (SOSP '03), Bolton Landing (Lake George), New York, October 2003.
8. G. W. Dunlap, S. T. King, S. Cinar, M. Basrai, and P. M. Chen. Revirt: Enabling intrusion analysis through virtual-machine logging and replay. In Proceedings of the 5th Symposium on Operating Systems Design and Implementation (OSDI 02), Boston, Massachusetts, December 2002.
9. fuzen-op. fu.exe and msdirectx.sys. www.rootkit.com/.
10. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. Network and Distributed Systems Security Symposium, February 2003.
11. M. Harchol-Balter and A. B. Downey. Exploiting process lifetime distributions for dynamic load balancing. ACM Trans. Comput. Syst., 15(3):253-285, 1997.
12. Holy Father. HackerDefender. hxdef.org.
13. Intel and Symantec Corp. Symantec virtual security solution and pes with intel vpro technology, http://www.intel.com/ business/ casestudies/symantec. solutions.brief.pdf.
14. Intel Corporation. Vtx specification, developer.intel.com, 2005.
15. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Antfarm: Tracking Processes in a Virtual Machine Environment. In Proceedings of the USENIX Annual Technical Conference (USENIX '06), Boston, Massachusetts, June 2006.
16. S. T. Jones, A. C. Arpaci-Dusseau, andR. H. Arpaci-Dusseau. Geiger: Monitoring the Buffer Cache in a Virtual Machine Environment. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS XII), San Jose, California, October 2006.
17. A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen. Detecting past and present intrusions through vulnerability-specific predicates. In SOSP '05: Proceedings of the twentieth ACM symposium on Operating systems principles, pages 91-104. ACM Press, 2005.
18. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004, Oakland, CA, May 2004.
19. P. Karger, M. Zurko, D. Bonin, A. Mason, and C. Kahn. A retrospective on the VAX VMM security kernel. In IEEE Transactions on Software Engineering, volume 17, pages 1147-1165, November 1991.
20. Microsoft. Windows malicious software removal tool, www.microsoft.com.
21. T. Miller. t0rn rootkit. www.ossec.net/ rootkits/ studies/ tOrn.txt.
22. R. Naraine. Microsoft: Stealth Rootkits Are Bombarding XP SP2 Boxes. www.eweek.com/article2/0,1895,1896605,00.asp.
23. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 13th USENIX Security Symposium, pages 179-194, August 2004.
24. R Development Core Team. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria, 2006. ISBN 3-900051-07-0.
25. F. L. Ramsey and D. W. Schafer. The Statistical Sleuth: A Course in Methods of Data Analysis. Duxbury Press, Boston, MA, 2nd edition, 2002.
26. J. Rutkowska. klister. www.invisiblethings.org/ tools/ klister-0.4.zip.
27. SANS Institute. Subseven trojan v 1.1. www.sans.org/ resources/ idfaq/ subseven.php.
28. sd and devik. Suckit. Phrack #58, article 0×07.
29. A. Wald. Sequential Analysis. John Wiley & Sons, Inc., New York, NY, 3rd edition, September 1952.
30. Y-M. Wang, D. Beck, B. Vo, R. Roussev, and C. Verbowski. Detecting stealth software with strider ghostbuster. In Proceedings of the International Conference on Dependable Systems and Networks (DSN 2005), pages 368-377, June 2005.