NDLI: Execution Time Measurement of Virtual Machine Volatile Artifacts Analyzers

Content Provider	IEEE Xplore Digital Library
Author	Ajay Kumara, M.A. Jaidhar, C.D.
Copyright Year	2015
Description	Author affiliation: Dept. of Inf. Technol., Nat. Inst. of Technol. Karnataka, Mangalore, India (Ajay Kumara, M.A.; Jaidhar, C.D.)
Abstract	Due to a rapid revaluation in a virtualization environment, Virtual Machines (VMs) are target point for an attacker to gain privileged access of the virtual infrastructure. The Advanced Persistent Threats (APTs) such as malware, rootkit, spyware, etc. are more potent to bypass the existing defense mechanisms designed for VM. To address this issue, Virtual Machine Introspection (VMI) emerged as a promising approach that monitors run state of the VM externally from hypervisor. However, limitation of VMI lies with semantic gap. An open source tool called LibVMI address the semantic gap. Memory Forensic Analysis (MFA) tool such as Volatility can also be used to address the semantic gap. But, it needs to capture a memory dump (RAM) as input. Memory dump acquires time and its analysis time is highly crucial if Intrusion Detection System IDS (IDS) depends on the data supplied by FAM or VMI tool. In this work, live virtual machine RAM dump acquire time of LibVMI is measured. In addition, captured memory dump analysis time consumed by Volatility is measured and compared with other memory analyzer such as Rekall. It is observed through experimental results that, Rekall takes more execution time as compared to Volatility for most of the plugins. Further, Volatility and Rekall are compared with LibVMI. It is noticed that examining the volatile data through LibVMI is faster as it eliminates memory dump acquire time.
Starting Page	314
Ending Page	319
File Size	3403186
Page Count	6
File Format	PDF
ISSN	15219097
e-ISBN	9780769557854
DOI	10.1109/ICPADS.2015.47
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-12-14
Publisher Place	Australia
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Virtual machining Random access memory Semantics Kernel Virtual machine monitors Malware Virtual Machine Introspection Hypervisor Semantic gap Intrusion Detection System Memory Forensic Analysis Rootkit
Content Type	Text
Resource Type	Article
Subject	Hardware and Architecture

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Virtual Machine Introspection: Techniques and Applications

Detecting Malware and Rootkit via Memory Forensics

Exploiting the x86 Architecture to Derive Virtual Machine State Information

Rootkit detection on virtual machines through deep information extraction at hypervisor-level

Hypervisor and virtual machine dependent Intrusion Detection and Prevention System for virtualized cloud environment

Monitoring of malefactor's activity in virtualized honeypots on the base of semantic transformation in Qemu hypervisor

A universal semantic bridge for virtual machine introspection.

A forensic hypervisor for process tracking and exploit discovery

Execution Time Measurement of Virtual Machine Volatile Artifacts Analyzers

Similar Documents

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Virtual Machine Introspection: Techniques and Applications

Detecting Malware and Rootkit via Memory Forensics

Exploiting the x86 Architecture to Derive Virtual Machine State Information

Rootkit detection on virtual machines through deep information extraction at hypervisor-level

Hypervisor and virtual machine dependent Intrusion Detection and Prevention System for virtualized cloud environment

Monitoring of malefactor's activity in virtualized honeypots on the base of semantic transformation in Qemu hypervisor

A universal semantic bridge for virtual machine introspection.

A forensic hypervisor for process tracking and exploit discovery

Execution Time Measurement of Virtual Machine Volatile Artifacts Analyzers