Loading...
Please wait, while we are loading the content...
A formal model for virtual machine introspection
| Content Provider | ACM Digital Library |
|---|---|
| Author | Eckert, Claudia Pfoh, Jonas Schneider, Christian |
| Abstract | Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the hypervisor level. In this paper, we present a formal discussion of the development of VMI-based security applications. We begin by identifying three major challenges that all VMI-based security applications must overcome. The main contribution of our work is the definition of a formal model for describing VMI techniques. This model is broken down in such a way that allows for thorough discussion of any VMI approach with regard to each of the three challenges. Then, we specify three design patterns for interpreting state information using our model. We argue that these patterns are complete, that is, they cover all possible methods for state interpretation. The properties of all patterns are thoroughly discussed so that the pros and cons of their application may be fully understood. Finally, we describe and discuss an ideal VMI-based intrusion detection system using our model and begin to detail the practical implications in building such a system. |
| Starting Page | 1 |
| Ending Page | 10 |
| Page Count | 10 |
| File Format | |
| ISBN | 9781605587806 |
| DOI | 10.1145/1655148.1655150 |
| Language | English |
| Publisher | Association for Computing Machinery (ACM) |
| Publisher Date | 2009-11-09 |
| Publisher Place | New York |
| Access Restriction | Subscribed |
| Subject Keyword | Intrusion detection Formalization Introspection Security Virtualization |
| Content Type | Text |
| Resource Type | Article |
