VMDriver: A driver-based monitoring mechanism for virtualization

Proceedings of the IEEE Symposium on Reliable Distributed Systems

Volumn , Issue , 2010, Pages 72-81

  Xiang, Guofu ^a   Jin, Hai ^a   Zou, Deqing ^a   Zhang, Xinwen ^b   Wen, Sha ^a   Zhao, Feng ^a  

^a HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

^b SAMSUNG INFORMATION SYSTEMS AMERICA   (United States)

Author keywords

Driver based monitroing; Event interception; Generality; Semantic reconstruction; Virtualization; VM monitoring

Indexed keywords

DRIVER-BASED MONITROING; EVENT INTERCEPTION; GENERALITY; VIRTUALIZATIONS; VM MONITORING;

COMPUTER OPERATING SYSTEMS; COMPUTER SIMULATION; SEMANTICS;

MONITORING;

EID: 78650529700     PISSN: 10609857     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SRDS.2010.38     Document Type: Conference Paper

References (24)

1. S. Nanda and T. Chiueh, "A Survey on Virtualization Technologies", Technical Report ECSL-TR-129, SUNY at Stony Brook, 2005.
2. J. E. Smith and R. Nair, "The Architecture of Virtual Machines", IEEE Computer, Vol.38, No.5, pp.32-38, 2005.
3. M. Rosenblum and T. Garfinkel, "Virtual Machine Monitors: Current Technology and Future Trends", IEEE Computer, Vol.38, No.5, pp.39-47, 2005.
4. P. Barham, B. Dragovic, K. Fraser, S. H. T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield, "Xen and the Art of Virtualization", In Proceedings of the 19th ACM Symposium on Operating Systems Principles, pp.164-177, 2003.
5. B. Clark, T. Deshane, E. Dow, S. Evanchik, M. Finlayson, J. Herne, and J. N. Matthews, "Xen and the Art of Repeated Research", In Proceedings of the 2004 USENIX Annual Technical Conference, pp.135-144, 2004.
6. I. Pratt, K. Fraser, S. Hand, C. Limpach, A. Warfield, D. Magenheimer, J. Nakajima, and A. Mallick, "Xen 3.0 and the Art of Virtualization", In Proceedings of the 2005 Linux Symposium, pp.65-77, 2005.
7. T. Garfinkel and M. Rosenblum, "A Virtual Machine Introspection based Architecture for Intrusion Detection", In Proceedings of the 10th Network and Distributed System Symposium, pp.191-206, 2003.
8. X. Jiang and X. Wang. "Out-of-the-Box Monitoring of VM-Based High-Interaction Honeypots", In Proceedings of the 10th International Symposium on Recent Advances in Intrusion Detection, pp.198-218, 2007.
9. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau, "VMM-based Hidden Process Detection and Identification using Lycosid", In Proceedings of the 4th ACM/USENIX International Conference on Virtual Execution Environments, pp.91-100, 2008.
10. X. Jiang, X. Wang, and D. Xu, "Stealthy Malware Detection through VMM-Based Out-of-the-Box Semantic View Reconstruction", In Proceedings of the 14th ACM Conference on Computer and Communications Security, pp.128-138, 2007.
11. A. Dinaburg, P. Royal, M. Sharif, and W. Lee, "Ether: Malware Analysis via Hardware Virtualization Extensions", In Proceedings of the 15th ACM Conference on Computer and Communications Security, pp.51-62, 2008.
12. A. Lanzi, M. Sharif, and W. Lee, "K-Tracer: A System for Extracting Kernel Malware Behavior", In Proceedings of the 16th Annual Network and Distributed System Security Symposium, 2009.
13. C. Xuan, J. Copeland, and R. Beyah, "Toward Revealing Kernel Malware Behavior in Virtual Execution Environments", In Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection, pp.304-325, 2009.
14. B. D. Payne, M. Carbone, M. Sharif, and W. Lee, "Lares: An Architecture for Secure Active Monitoring Using Virtualization", In Proceedings of the 2008 IEEE Symposium on Security and Privacy, pp.233-247, 2008.
15. VMware homepage, http://www.vmware.com/.
16. Virtual PC homepage, http://www.microsoft.-com/windows/virtualpc/
17. VMsafe homepage, http://www.vmware.com/technicalresourcces/security/ vmsafe.html.
18. B. D. Payne, M. D. P. A. Carbone, and W. Lee, "Secure and Flexible Monitoring of Virtual Machines", In Proceedings of the 23rd Annual Computer Security Applications Conference, pp.385-397, 2007.
19. A. Srivastava, K. Singh, and J. Giffin, "Secure Observation of Kernel Behavior", Georgia Institute of Technology Report, 2008.
20. D. P. Bovet and M. Cesati, Understanding the Linux Kernel, 3rd Edition, O'Reilly, 2005.
21. J. Corbet, G. Kroah-Hartman, and A. Rubini. Linux Device Driver, 3rd Edition. O'Reilly, 2005.
22. S. A. Hofmeyr, S. Forrest, and A. Somayaji, "Intrusion Detection using Sequences of System Calls", Journal of Computer Security, Vol.6, No.3, pp.151-180, 1998.
23. Adore-ng, http://lwn.net/Articles/75991/
24. FU, http://rapiddigger.com/search/download-fu-rootkit/