NDLI: A Real-time Integrity Monitor for Xen Virtual Machine

Content Provider	IEEE Xplore Digital Library
Author	Nguyen Anh Quynh Takefuji, Y.
Copyright Year	2006
Description	Author affiliation: Graduate Sch. of Media & Governance, Keio Univ., Fujisawa (Nguyen Anh Quynh; Takefuji, Y.)
Abstract	File-system integrity tools (FIT) are commonly deployed to assist forensic investigation after security incidents and as host-based intrusion detections (HIDS) tool to detect unauthorized file-system changes. Basically all the current solutions employ the same tactic: the administrator specifies a list of critical files and directories that needs to be monitored, then uses the FIT to create a base-line database that tracks general parameters about these files. The FIT is then re-run periodically, and if it detects the modifications of the file-system against the information stored in the database, the report on the changed file is generated. However, this strategy is far from perfect: the intrusion detection cannot be done in real-time, which might render the whole scheme useless if the attacker can somehow take over the system with privileged access in the time between. The administrator also has a lot of problems to keep the database updating. Besides, he must do everything he can to protect the database and the FIT itself from compromising by the attacker, which is not an easy task especially if the attacker gains local access. This paper presents a novel approach to address the outstanding problems of the current FIT. We propose a design and implementation of a tool named XenRIM for Xen virtual machines. XenRIM can monitor and fires alarms on intrusion in real-time manner, and our approach does not require to create and update the database like in the legacy methods. As a result, XenRIM is almost effortless to deploy and maintain. Thanks to the advantage introduced by Xen, the detection polices are centralized in a secure virtual machine and resistant to tampering. Even better, if deployed strictly, this tool is able to function very stealthily to avoid the suspect of the attacker. Our experimental result demonstrates that XenRIM incurs very low performance overhead (less than 4%), which makes the solution attractive and practical for production systems
Sponsorship	IEEE CPS
Starting Page	90
Ending Page	90
File Size	201521
Page Count	1
File Format	PDF
ISBN	0769526225
DOI	10.1109/ICNS.2006.13
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2006-07-16
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Condition monitoring Real time systems Virtual machine monitors Databases Forensics Data security Intrusion detection Fires Virtual machining Protection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

WinWizard: Expanding Xen with a LibVMI Intrusion Detection Tool

Hierarchical secure virtualization model for cloud

Building Trustworthy Intrusion Detection through VM Introspection

The new approach for inter-communication between guest domains on Virtual Machine Monitor

Security-Aware Real-Time Scheduling for Hypervisors

Security techniques for zero day attacks

Intrusion detection in virtual machine environments

A novel approach for a file-system integrity monitor tool of Xen virtual machine

XenTune: Detecting Xen Scheduling Bottlenecks for Media Applications

A Real-time Integrity Monitor for Xen Virtual Machine

Similar Documents

WinWizard: Expanding Xen with a LibVMI Intrusion Detection Tool

Hierarchical secure virtualization model for cloud

Building Trustworthy Intrusion Detection through VM Introspection

The new approach for inter-communication between guest domains on Virtual Machine Monitor

Security-Aware Real-Time Scheduling for Hypervisors

Security techniques for zero day attacks

Intrusion detection in virtual machine environments

A novel approach for a file-system integrity monitor tool of Xen virtual machine

XenTune: Detecting Xen Scheduling Bottlenecks for Media Applications

A Real-time Integrity Monitor for Xen Virtual Machine