Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines

Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference

Volumn , Issue , 2011, Pages

  Owens, Rodney ^a   Wang, Weichao ^a  

^a UNIVERSITY OF NORTH CAROLINA AT CHARLOTTE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS DELAY; HYPERVISOR; INTRUSION DETECTION SYSTEMS; LINUX OS; MEMORY PAGES; NETWORK PACKETS; NON-INTERACTIVE; OR-NETWORKS; SPECIAL PROPERTIES; SYSTEM-BASED; VIRTUAL MACHINES;

COMPUTER OPERATING SYSTEMS; COMPUTER SIMULATION; COMPUTER SOFTWARE SELECTION AND EVALUATION;

INTRUSION DETECTION;

EID: 84862955479     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PCCC.2011.6108094     Document Type: Conference Paper

References (24)

1. P. Auffret, "Sinfp, unification of active and passive operating system fingerprinting," Jour. Comp. Virology, vol. 6, no. 3, pp. 197-205, 2010.
2. Fyodor, "Remote os detection via tcp/ip stack fingerprinting, "http://www.insecure.org/nmap/nmap-fingerprinting-article.html, 1999.
3. L. G. Greenwald and T. J. Thomas, "Toward undetected operating system fingerprinting," in Proceedings of the first USENIX workshop on Offensive Technologies, 2007, pp. 6:1-6:10.
4. D. Richardson, S. Gribble, and T. Kohno, "The limits of automatic os fingerprint generation," in ACM workshop on Artificial intelligence and security (AISec), 2010, pp. 24-34.
5. G. Taleck, "Ambiguity resolution via passive os fingerprinting, " in International Symposium on Recent Advances in Intrusion Detection (RAID), 2003, pp. 192-206.
6. M. Armbrust, A. Fox, R. Griffith, A. D. Joseph, R. Katz, A. Konwinski, G. Lee, D. Patterson, A. Rabkin, I. Stoica, and M. Zaharia, "A view of cloud computing," Commun. ACM, vol. 53, pp. 50-58, April 2010.
7. A. Verma, P. Ahuja, and A. Neogi, "Power-aware dynamic placement of hpc applications," in Proceedings of the annual international conference on Supercomputing, 2008, pp. 175-184.
8. A. Aviram, S. Hu, B. Ford, and R. Gummadi, "Determinating timing channels in compute clouds," in Proceedings of ACM workshop on Cloud computing security workshop, 2010, pp. 103-108.
9. T. Ristenpart, E. Tromer, H. Shacham, and S. Savage, "Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds," in Proc. of ACM Conference on Computer and Communications Security (CCS), 2009.
10. K. Okamura and Y. Oyama, "Load-based covert channels between xen virtual machines," in Proceedings of the ACM Symposium on Applied Computing, 2010, pp. 173-180.
11. VMWare, "Esxi configuration guide," VMware vSphere 4.1 Documentation, 2010.
12. D. Gupta, S. Lee, M. Vrable, S. Savage, A. Snoeren, G. Varghese, G. Voelker, and A. Vahdat, "Difference engine: harnessing memory redundancy in virtual machines," Commun. ACM, vol. 53, no. 10, pp. 85-93, 2010.
13. X. Zhang, Z. Huo, J. Ma, and D. Meng, "Exploiting data deduplication to accelerate live virtual machine migration," in IEEE International Conference on Cluster Computing, 2010, pp. 88-96.
14. A. Arcangeli, I. Eidus, and C. Wright, "Increasing memory density by using ksm," in Linux Symposium, 2009, pp. 19-28.
15. K. Suzaki, K. Iijima, T. Yagi, and C. Artho, "Memory deduplication as a threat to the guest os," in Proceedings of the Fourth European Workshop on System Security, 2011, pp. 1:1-1:6.
16. VMWare, "Understanding memory resource management in vmware esx 4.1," VMware vSphere 4.1 Documentation, 2010.
17. Microsoft Developer Network, "timegettime," http://msdn.microsoft.com/en-us/library/ms713418(VS.85).aspx, 2010.
18. VMWare, "Timekeeping in vmware virtual machines," http://www.vmware.com/files/pdf/Timekeeping-In-VirtualMachines.pdf, 2010.
19. Symantec, "An analysis of address space layout randomization on windows vista," http://www.symantec.com/avcenter/reference/Address-Space- Layout-Randomization.pdf, Tech. Rep., 2007.
20. Eurosoft, "Qa+win32-diagnostic software," http://www.eurosoft- uk.com/qawin32.html, 2010.
21. G. Woltman, "Prime95," a component of Great Internet Mersenne Prime Search (GIMPS), http://www.mersenne.org/, 2009.
22. H. Raj, R. Nathuji, A. Singh, and P. England, "Resource management for isolation enhanced cloud services," in ACM Cloud Computing Security Workshop, 2009, pp. 77-84.
23. B. Stone and A. Vance, "Companies slowly join cloud computing,"New York Times, 18 April, 2010.
24. Y. Zhang, A. Juels, A. Oprea, and M. K. Reiter, "Homealone: Co-residency detection in the cloud via side-channel analysis,"in Proceedings of the IEEE Symposium on Security and Privacy (Oakland), 2011, pp. 313-328.