Detecting malware signatures in a thin hypervisor

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2012, Pages 1807-1814

  Oyama, Yoshihiro ^a   Giang, Tran Truong Duc ^a   Chubachi, Yosuke ^b   Shinagawa, Takahiro ^c   Kato, Kazuhiko ^b  

^a UNIVERSITY OF ELECTRO COMMUNICATIONS   (Japan)

^b UNIVERSITY OF TSUKUBA   (Japan)

^c UNIVERSITY OF TOKYO   (Japan)

Author keywords

hypervisors; malware; virtual machine monitors

Indexed keywords

HYPERVISOR; HYPERVISORS; MALWARE DETECTION; MALWARES; VIRTUAL MACHINE MONITORS;

NETWORK SECURITY; SOFTWARE TESTING; VIRTUAL PRIVATE NETWORKS;

COMPUTER CRIME;

EID: 84863577442     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2245276.2232070     Document Type: Conference Paper

References (19)

1. A. V. Aho and M. J. Corasick. Efficient String Matching: An Aid to Bibliographic Search. Communications of the ACM, 18(6):333-340, 1975.
2. BitLocker Drive Encryption. http://windows.microsoft.com/en-US/windows7/ products/features/bitlocker.
3. Y. Chubachi, T. Shinagawa, and K. Kato. Hypervisor-Based Prevention of Persistent Rootkits. In Proceedings of the 25th Annual ACM Symposium on Applied Computing (SAC 2010), pages 214-220, 2010.
4. Clam AntiVirus. http://www.clamav.net/.
5. T. Gar nkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 10th Annual Network and Distributed System Security Symposium, 2003.
6. M. Hanaoka, M. Shimamura, and K. Kono. TCP Reassembler for Layer7-Aware Network Intrusion Detection/Prevention Systems. IEICE Transactions on Information and Systems, E90-D(12):2019-2032, 2007.
7. X. Jiang, X. Wang, and D. Xu. Stealthy Malware Detection and Monitoring through VMM-Based "Out-of-the-Box" Semantic View Reconstruction. ACM Transactions on Information and System Security, 13(2):12:1-12:28, 2010.
8. LMbench. http://www.bitmover.com/lmbench/.
9. J. M. McCune, Y. Li, N. Qu, Z. Zhou, A. Datta, V. Gligor, and A. Perrig. TrustVisor: Efficient TCB Reduction and Attestation. In Proceedings of the 2010 IEEE Symposium on Security and Privacy, pages 143-158, 2010.
10. A. M. Nguyen, N. Schear, H. Jung, A. Godiyal, S. T. King, and H. D. Nguyen. MAVMM: Lightweight and Purpose Built VMM for Malware Analysis. In Proceedings of the 2009 Annual Computer Security Applications Conference, pages 441-450, 2009.
11. B. D. Payne, M. Carbone, M. Sharif, and W. Lee. Lares: An Architecture for Secure Active Monitoring Using Virtualization. In Proceedings of the 2008 IEEE Symposium on Security and Privacy, pages 233-247, 2008.
12. A. G. Pennington, J. D. Strunk, J. L. Griffin, C. A. Soules, G. R. Goodson, and G. R. Ganger. Storage-based Intrusion Detection: Watching storage activity for suspicious behavior. In Proceedings of the 12th USENIX Security Symposium, pages 137-152, 2003.
13. R. Riley, X. Jiang, and D. Xu. Guest-Transparent Prevention of Kernel Rootkits with VMM-based Memory Shadowing. In Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 2008), volume 5230 of Lecture Notes in Computer Science, pages 1-20, 2008.
14. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes. In Proceedings of the 21st ACM Symposium on Operating Systems Principles, pages 335-350, 2007.
15. T. Shinagawa, H. Eiraku, K. Tanimoto, K. Omote, S. Hasegawa, T. Horie, M. Hirano, K. Kourai, Y. Oyama, E. Kawai, K. Kono, S. Chiba, Y. Shinjo, and K. Kato. BitVisor: A Thin Hypervisor for Enforcing I/O Device Security. In Proceedings of the 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE 2009), pages 121-130, 2009.
16. Trend Micro. Deep Security. http://emea.trendmicro.com/emea/products/ enterprise/deep-security/.
17. Trend Micro. Threat Encyclopedia: TROJ SHADOW.AF. http://about-threats. trendmicro.com/Malware. aspx?name=TROJ-shadow.af.
18. VMware. VMsafe. http://www.vmware.com/.
19. Y. Zhang, Y. Gu, H. Wang, and D. Wang. Virtual-Machine-based Intrusion Detection on File-aware Block Level Storage. In Proceedings of the 18th International Symposium on Computer Architecture and High Performance Computing (SBAC-PAD '06), pages 185-192, 2006.