NDLI: WinWizard: Expanding Xen with a LibVMI Intrusion Detection Tool

Content Provider	IEEE Xplore Digital Library
Author	Lamps, J. Palmer, I. Sprabery, R.
Copyright Year	2014
Description	Author affiliation: Comput. Sci., Univ. of Illinois at Urbana-Champaign, Urbana, IL, USA (Lamps, J.; Palmer, I.; Sprabery, R.)
Abstract	Virtual machine introspection (VMI) has grown into a number of novel security measures in recent years. Virtualized environments provide isolation, which gives way to better security. This paper presents an extension, WinWizard, of LibVMI that creates a VMI-based intrusion detection system (IDS) with emphasis on memory introspection. WinWizard is able to detect rootkits that attempts to hide processes from the administrator. Rootkits are able to subvert traditional virus scanning services because they are able to run at the kernel level. Rootkit detection becomes difficult because if the operating system has been subverted, especially at the kernel level, then it is difficult to find unauthorized changes to itself or its components. Most anti-viruses and other rootkit detectors that work on infected systems are usually only effective against rookits that have a defect in their hiding techniques. Rootkit detection through VMI is one way to effectively detect rookits. VMI detection tools will also be useful in industry. Industry is beginning to advance in its usage of cloud based workspaces. Examples of companies include Amazons Workspaces and Citrix XenDesktop. They offer remote desktops for small and medium sized businesses. These workspaces offer a fully managed cloud-based desktop experience where users can access their work resources from a variety of devices. Many universities and small businesses use services like these to reduce the number of IT staff and ease administration of a large number of desktops. As this field becomes more accessible, rootkits are going to drastically affect the performance and security of not only one users desktop, but on entire cloud infrastructures. The main way to detect a rootkit inside of these workspaces would be through virtual machine introspection. WinWinzard has demonstrated to be successful in detecting these types of rootkits, while causing little additional overhead to other virtual machines being hosted on the same hypervisor.
Starting Page	849
Ending Page	856
File Size	355058
Page Count	8
File Format	PDF
ISSN	21596190
e-ISBN	9781479950638
DOI	10.1109/CLOUD.2014.117
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-06-27
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Xen Virtual machine monitors Instruction sets Virtual machining Virtualized-based security Security Intrusion Detection Systems Kernel Virtualization
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Vulnerability analysis on virtualized environment using FPVA

Characterizing SMP Virtual Machine Scheduling in Virtualization Environment

Benefits of the virtualization technologies with intrusion detection and prevention systems

Hypervisor and virtual machine dependent Intrusion Detection and Prevention System for virtualized cloud environment

A Virtual Machine Replay System Based on Para-virtualized Xen

Libvmi: A Library for Bridging the Semantic Gap between Guest OS and VMM

A Real-time Integrity Monitor for Xen Virtual Machine

Forensic Virtual Machines: Dynamic Defence in the Cloud via Introspection

Embedded Hypervisor Xvisor: A Comparative Analysis

WinWizard: Expanding Xen with a LibVMI Intrusion Detection Tool

Similar Documents

Vulnerability analysis on virtualized environment using FPVA

Characterizing SMP Virtual Machine Scheduling in Virtualization Environment

Benefits of the virtualization technologies with intrusion detection and prevention systems

Hypervisor and virtual machine dependent Intrusion Detection and Prevention System for virtualized cloud environment

A Virtual Machine Replay System Based on Para-virtualized Xen

Libvmi: A Library for Bridging the Semantic Gap between Guest OS and VMM

A Real-time Integrity Monitor for Xen Virtual Machine

Forensic Virtual Machines: Dynamic Defence in the Cloud via Introspection

Embedded Hypervisor Xvisor: A Comparative Analysis

WinWizard: Expanding Xen with a LibVMI Intrusion Detection Tool