Investigating the Implications of Virtual Machine Introspection for Digital Forensics

Nance, Kara; Bishop, Matt; Hay, Brian

doi:10.1109/ares.2009.173

Cited by 25 publications

(8 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the latter case, it is not possible for the researchers to obtain information and activity regarding the device of the hypervisor [19]. And that is an issue for research [20]. On the other hand, even if you do not turn off the virtual machines, which we remind you are a small file, they have a so-called snapshot technology that allows you to roll back to the system.…”

Section: Main Problemsmentioning

confidence: 99%

“…That is, I can create a virtual machine on a hypervisor, at first use create a snapshot of the entire system, then establish an encrypted communication with a weapons purchase site, buy the weapons, and then roll back to the initial picture and I turn off the snapshot, all the information about the crime of buying weapons literally disappears. It is effortless to perceive the problem that is generated for a digital criminal investigation [20].…”

Section: Main Problemsmentioning

confidence: 99%

See 1 more Smart Citation

Forensics and Digital Criminal Investigation Challenges in Cloud Computing and Virtualization

Brandao¹

2019

AJNC

View full text Add to dashboard Cite

I'll address the fundamentals of Cloud Computing and Virtualization. The types of cloud computing deployment models and their relationship with the responsibility of the users are developed. The fundamentals of digital criminal investigation applied to Cloud Computing are discussed, and the most significant challenges are presented to criminal investigation and forensic sciences in this type and digital environment. The implications of Virtualization used in Cloud Computing in Criminal Investigation and Forensic Science are discussed. The paradigm case of Nested Virtualization technology is presented as an obstacle to Criminal investigation and forensic investigation. In cases of criminal investigations in traditional environments, it is common practice for computer expertise to turn off the equipment and make a copy of the disks that will be analysed later in the laboratory. This is unfeasible in a cloud computing environment, due to the large storage capacity, legal issues, geographic distribution and data control, which may vary depending on the model of service contracted. In addition, lack of physical access to data collection and lack of control over the system make information acquisition a challenging task for cloud expertise. Therefore, forensic computing has been restructured, bringing new techniques, solutions and research methods, giving rise to cloud forensics or expertise in the cloud. Thus, the so-called Forensic as a Service (FaaS) is dedicated to solving the security challenges inherent in the cloud environment. In this paper we will analyse some of these challenges.

show abstract

Section: Main Problemsmentioning

confidence: 99%

Section: Main Problemsmentioning

confidence: 99%

Forensics and Digital Criminal Investigation Challenges in Cloud Computing and Virtualization

Brandao¹

2019

AJNC

View full text Add to dashboard Cite

show abstract

“…They used VMI to develop an Intrusion Detection System (IDS), called Livewire, for a customized version of VMWare Workstation for Linux. VMI techniques have also been used in Digital Forensics [13] and [15]. Hyperspector [16] implemented another Intrusion Detection System for distributed computer systems using VMI to isolate the IDS from the servers that they monitor.…”

Section: A Virtual Machine Introspectionmentioning

confidence: 99%

A Framework for Detecting Malware in Cloud by Identifying Symptoms

Harrison

Bordbar

Ali

et al. 2012

2012 IEEE 16th International Enterprise Distributed Object Computing Conference

View full text Add to dashboard Cite

Abstract-Security is seen as one of the major challenges of the Cloud computing. Recent malware are not only becoming more sophisticated, but has also demonstrated a trend to make use of components, which can easily be distributed through the Internet to develop newer and better malware. As a result, the key problem facing Cloud security is to cope with identifying diverse set of malwares. This paper presents a method of detecting malware by identifying the symptoms of malicious behaviour as opposed to looking for the malware itself. This can be compared to the use of symptoms in human pathology, in which study of symptoms direct physicians to diagnosis of a disease or possible causes of illnesses. The main advantage of shifting the attention to the symptoms is that a wide range of malicious behaviour can result in the same set of symptoms. We propose the creation of Forensic Virtual Machines (FVM), which are mini Virtual Machines (VM) that can monitor other VMs to discover the symptoms. In this paper, we shall present a framework to support the FVMs so that they collaborate with each other in identifying symptoms by exchanging messages via secure channels. The FVMs report to a Command & Control module that collects and correlates the information so that suitable remedial actions can take place in real-time. The Command & Control can be compared to the physician who infers possibility of an illness from the occurring symptoms. In addition, as FVMs make use of the computational resources of the system we will present an algorithm for sharing of the FVMs so that they can be guided to search for the symptoms in the VMs with higher priority.

show abstract

“…Acquiring data through VMI increases the probability of obtaining forensically sound evidence while introduces semantic gap [9] at the same time. Although bridging the semantic gap is challenging, out-of-box VMI does not need to modify the VMs so that malware is unaware of the monitoring, which enables more secure monitoring and manifests true situation of VMs [10].…”

Section: Virtualization and Vmimentioning

confidence: 99%

“…VMI depends on reconstructing high-level understandable information from low-level raw data which is provided through inspecting the hardware components of virtual machines under a trustworthy external circumstance [5]. VMI can demonstrate excellent view of details in virtual machine so it rapidly gains popularity among researchers.…”

Section: Introductionmentioning

confidence: 99%

A Digital Forensic Framework for Cloud Based on VMI

Yang¹,

Ren²,

Bai³

et al. 2017

dtcse

View full text Add to dashboard Cite

Abstract. Traditional digital forensic methods become exceedingly feeble in cloud due to the fact that the basic infrastructure turns to virtualized environment. Leveraging properties of virtualization, virtual machine introspection has showed potential for cloud forensic. In this paper, we propose a novel framework, which contains a trustworthy independent agency, to provide memory digital forensic analysis (DFA) for virtual machines (VMs) in cloud. With the assistance of cloud platform, memory dump files can be obtained and transferred to the agency for further DFA, where information of VMs can be extracted using the proper tools. We described the constructional design of the framework. Test results showed the versatility of DFA and ability of malware detection. The framework indicates DFA can be purchased as a service only when there is a need in order to reduce the expenditures on maintaining exclusive facility and furnish standard procedure to multiple cloud platforms.

show abstract

Investigating the Implications of Virtual Machine Introspection for Digital Forensics

Cited by 25 publications

References 13 publications

Forensics and Digital Criminal Investigation Challenges in Cloud Computing and Virtualization

Forensics and Digital Criminal Investigation Challenges in Cloud Computing and Virtualization

A Framework for Detecting Malware in Cloud by Identifying Symptoms

A Digital Forensic Framework for Cloud Based on VMI

Contact Info

Product

Resources

About