Dynamic and transparent analysis of commodity production systems

Fattori, Aristide; Paleari, Roberto; Martignoni, Lorenzo; Monga, Mattia

doi:10.1145/1858996.1859085

Cited by 36 publications

(31 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An alternative VMI approach leverages advanced CPU features to interpose the security functions between the OS and the hardware [28], [29]. However, this kind of hypervisor does not have the control over all the machine components.…”

Section: Architecturementioning

confidence: 99%

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Pietro¹,

Franzoni²,

Lombardi³

2017

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Abstract-Effectively protecting the Windows OS is a challenging task, since most implementation details are not publicly known. Windows has always been the main target of malwares that have exploited numerous bugs and vulnerabilities. Recent trusted boot and additional integrity checks have rendered the Windows OS less vulnerable to kernel-level rootkits. Nevertheless, guest Windows Virtual Machines are becoming an increasingly interesting attack target. In this work we introduce and analyze a novel Hypervisor-Based Introspection System (HyBIS) we developed for protecting Windows OSes from malware and rootkits. The HyBIS architecture is motivated and detailed, while targeted experimental results show its effectiveness. Comparison with related work highlights main HyBIS advantages such as: effective semantic introspection, support for 64-bit architectures and for latest Windows (8.x and 10), advanced malware disabling capabilities. We believe the research effort reported here will pave the way to further advances in the security of Windows OSes.

show abstract

Section: Architecturementioning

confidence: 99%

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Pietro¹,

Franzoni²,

Lombardi³

2017

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

show abstract

“…While this will not allow for preventing successful attacks, it can still be used for detection. Another approach, which is being more similar to our work, is called HyperDbg [4]. It allows for the live installation of an analysis framework under a running OS using hardware virtualization.…”

Section: Related Workmentioning

confidence: 99%

Towards the automated detection of unknown malware on live systems

Pék

Buttyán

2014

2014 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Abstract-In this paper, we propose a new system monitoring framework that can serve as an enabler for automated malware detection on live systems. Our approach takes advantage of the increased availability of hardware assisted virtualization capabilities of modern CPUs, and its basic novelty consists in launching a hypervisor layer on the live system without stopping and restarting it. This hypervisor runs at a higher privilege level than the OS itself, thus, it can be used to observe the behavior of the analyzed system in a transparent manner. For this purpose, we also propose a novel system call tracing method that is designed to be configurable in terms of transparency and granularity.

show abstract

“…Actaeon consists of three components: a standalone VMCS layout Extractor derived from HyperDbg [15], an hypervisor Memory Analysis plugin for the Volatility framework, and a patch for the Volatility core to provide a transparent mechanism to analyze the virtual machines address spaces. The tool, along with a number of datasets and usage examples, can be downloaded from http://s3.eurecom.fr/tools/actaeon.…”

Section: System Implementationmentioning

confidence: 99%

“…The number of commodity hypervisors is limited and, given enough time, it would be possible to analyze all of them and reverse engineer their most relevant data structures, following the same approach used to perform memory forensics of known operating systems. However, custom hypervisors are easy to develop and they are already adopted by many security-related tools [15,22,28,29]. Moreover, malicious hypervisors (so far only proposed as research prototypes [12,19,26,33]) could soon become a reality -thus increasing the urgency of developing the area of virtualization memory forensics.…”

Section: Introductionmentioning

confidence: 99%

Hypervisor Memory Forensics

Graziano

Lanzi

Balzarotti

2013

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

Abstract. Memory forensics is the branch of computer forensics that aims at extracting artifacts from memory snapshots taken from a running system. Even though it is a relatively recent field, it is rapidly growing and it is attracting considerable attention from both industrial and academic researchers. In this paper, we present a set of techniques to extend the field of memory forensics toward the analysis of hypervisors and virtual machines. With the increasing adoption of virtualization techniques (both as part of the cloud and in normal desktop environments), we believe that memory forensics will soon play a very important role in many investigations that involve virtual environments. Our approach, implemented in an open source tool as an extension of the Volatility framework, is designed to detect both the existence and the characteristics of any hypervisor that uses the Intel VT-x technology. It also supports the analysis of nested virtualization and it is able to infer the hierarchy of multiple hypervisors and virtual machines. Finally, by exploiting the techniques presented in this paper, our tool can reconstruct the address space of a virtual machine in order to transparently support any existing Volatility plugin -allowing analysts to reuse their code for the analysis of virtual environments.

show abstract

Dynamic and transparent analysis of commodity production systems

Cited by 36 publications

References 13 publications

HyBIS: Advanced Introspection for Effective Windows Guest Protection

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Towards the automated detection of unknown malware on live systems

Hypervisor Memory Forensics

Contact Info

Product

Resources

About