NDLI: Virtual machine monitor-based lightweight intrusion detection

Please wait, while we are loading the content...

Virtual machine monitor-based lightweight intrusion detection

Content Provider	ACM Digital Library
Author	Moffie, Micha Alshawabkeh, Malak Azmandian, Fatemeh Dy, Jennifer Aslam, Javed Kaeli, David
Abstract	As virtualization technology gains in popularity, so do attempts to compromise the security and integrity of virtualized computing resources. Anti-virus software and firewall programs are typically deployed in the guest virtual machine to detect malicious software. These security measures are effective in detecting known malware, but do little to protect against new variants of intrusions. Intrusion detection systems (IDSs) can be used to detect malicious behavior. Most intrusion detection systems for virtual execution environments track behavior at the application or operating system level, using virtualization as a means to isolate themselves from a compromised virtual machine. In this paper, we present a novel approach to intrusion detection of virtual server environments which utilizes only information available from the perspective of the virtual machine monitor (VMM). Such an IDS can harness the ability of the VMM to isolate and manage several virtual machines (VMs), making it possible to provide monitoring of intrusions at a common level across VMs. It also offers unique advantages over recent advances in intrusion detection for virtual machine environments. By working purely at the VMM-level, the IDS does not depend on structures or abstractions visible to the OS (e.g., file systems), which are susceptible to attacks and can be modified by malware to contain corrupted information (e.g., the Windows registry). In addition, being situated within the VMM provides ease of deployment as the IDS is not tied to a specific OS and can be deployed transparently below different operating systems. Due to the semantic gap between the information available to the VMM and the actual application behavior, we employ the power of data mining techniques to extract useful nuggets of knowledge from the raw, low-level architectural data. We show in this paper that by working entirely at the VMM-level, we are able to capture enough information to characterize normal executions and identify the presence of abnormal malicious behavior. Our experiments on over 300 real-world malware and exploits illustrate that there is sufficient information embedded within the VMM-level data to allow accurate detection of malicious attacks, with an acceptable false alarm rate.
Starting Page	38
Ending Page	53
Page Count	16
File Format	PDF
ISSN	01635980
DOI	10.1145/2007183.2007189
Journal	ACM SIGOPS Operating Systems Review (OPSR)
Volume Number	45
Issue Number	2
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1975-04-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Virtual machine monitor Intrusion detection Virtual machine Data mining Virtualization System
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Hardware and Architecture Information Systems

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Data mining aided signature discovery in network-based intrusion detection system

Virtual machine file system

The evolution of an x86 virtual machine monitor

A Bare-Metal and Asymmetric Partitioning Approach to Client Virtualization

Sharing data and services in a virtual machine system

Forensics examination of volatile system data using virtual introspection

Formal properties of recursive Virtual Machine architectures.

Terra:a virtual machine-based platform for trusted computing

ReVirt:enabling intrusion analysis through virtual-machine logging and replay

Virtual machine monitor-based lightweight intrusion detection

Similar Documents

Data mining aided signature discovery in network-based intrusion detection system

Virtual machine file system

The evolution of an x86 virtual machine monitor

A Bare-Metal and Asymmetric Partitioning Approach to Client Virtualization

Sharing data and services in a virtual machine system

Forensics examination of volatile system data using virtual introspection

Formal properties of recursive Virtual Machine architectures.

Terra:a virtual machine-based platform for trusted computing

ReVirt:enabling intrusion analysis through virtual-machine logging and replay

Virtual machine monitor-based lightweight intrusion detection