NDLI: SPECTRE: A dependable introspection framework via System Management Mode

Content Provider	IEEE Xplore Digital Library
Author	Fengwei Zhang Leach, K. Kun Sun Stavrou, A.
Copyright Year	2013
Description	Author affiliation: Center for Secure Inf. Syst., George Mason Univ., Fairfax, VA, USA (Fengwei Zhang; Leach, K.; Kun Sun; Stavrou, A.)
Abstract	Virtual Machine Introspection (VMI) systems have been widely adopted for malware detection and analysis. VMI systems use hypervisor technology for system introspection and to expose malicious activity. However, recent malware can detect the presence of virtualization or corrupt the hypervisor state thus avoiding detection. We introduce SPECTRE, a hardware-assisted dependability framework that leverages System Management Mode (SMM) to inspect the state of a system. Contrary to VMI, our trusted code base is limited to BIOS and the SMM implementations. SPECTRE is capable of transparently and quickly examining all layers of running system code including a hypervisor, the OS, and user level applications. We demonstrate several use cases of SPECTRE including heap spray, heap overflow, and rootkit detection using real-world attacks on Windows and Linux platforms. In our experiments, full inspection with SPECTRE is 100 times faster than similar VMI systems because there is no performance overhead due to virtualization.
Sponsorship	IEEE Comput. Soc.
Starting Page	1
Ending Page	12
File Size	293120
Page Count	12
File Format	PDF
ISBN	9781467364713
ISSN	15300889
e-ISBN	9781467364720
DOI	10.1109/DSN.2013.6575343
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2013-06-24
Publisher Place	Hungary
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Malware Kernel Hardware Monitoring Biomedical monitoring Linux memory attacks SMM introspection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Spectre: a dependable introspection framework via system management mode.

Virtual Machine Introspection: Techniques and Applications

A VMM-Based System Call Interposition Framework for Program Monitoring

Impact of the x86 System Management Mode in Real-Time Systems

Hardware-Assisted Application Integrity Monitor

SMM rootkits: a new breed of OS independent malware

Space Traveling across VM: Automatically Bridging the Semantic Gap in Virtual Machine Introspection via Online Kernel Data Redirection

POSTER: Introducing pathogen: a real-time virtualmachine introspection framework

Kernel malware.

SPECTRE: A dependable introspection framework via System Management Mode

Similar Documents

Spectre: a dependable introspection framework via system management mode.

Virtual Machine Introspection: Techniques and Applications

A VMM-Based System Call Interposition Framework for Program Monitoring

Impact of the x86 System Management Mode in Real-Time Systems

Hardware-Assisted Application Integrity Monitor

SMM rootkits: a new breed of OS independent malware

Space Traveling across VM: Automatically Bridging the Semantic Gap in Virtual Machine Introspection via Online Kernel Data Redirection

POSTER: Introducing pathogen: a real-time virtualmachine introspection framework

Kernel malware.

SPECTRE: A dependable introspection framework via System Management Mode