NDLI: Implicit detection of stealth software with a local-booted virtual machine

Content Provider	IEEE Xplore Digital Library
Author	Yan Wen Minhuan Huang Jinjing Zhao Xiaohui Kuang
Copyright Year	2010
Description	Author affiliation: Beijing Institute of System, Engineering, Beijing, China (Yan Wen; Minhuan Huang; Jinjing Zhao; Xiaohui Kuang)
Abstract	Resource hiding is commonly used by stealth malware to evade detection by anti-malware scanners. In this paper, we present the design, implementation, and evaluation of Libra, a new VM-based anti-stealth-malware approach. By introducing the novel local-booting technology of our previous work called Secure Virtual Execution Environment, Libra VM just boots from the underlying host OS but not a newly installed OS image. Consequently, Libra accurately reproduces the software environment of the underlying preinstalled OS within the Libra VM. In addition, with proposing a set of unique techniques to implicitly construct the trusted OS-level semantic view of resource from within the virtualized hardware layer, Libra is decoupled with the guest information which is subvertable to the privileged guest malware. Thus, Libra provides a promising way to detect the existing stealth malware in the host OS. We have implemented a prototype of Libra on Windows platforms and our evaluation results with real-world rootkits demonstrate the practicality and effectiveness of our approach.
Starting Page	152
Ending Page	157
File Size	355205
Page Count	6
File Format	PDF
ISBN	9781424473847
e-ISBN	9781424473861
DOI	10.1109/ICICIS.2010.5534733
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2010-06-23
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer science Laboratories Information security Virtual machine Detectors Stealth malware Virtual machining Hardware Virtual manufacturing Computer security Resource virtualization Information systems
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in