Maitland: Lighter-Weight VM Introspection to Support Cyber-security in the Cloud

Benninger, Chris; Neville, Stephen W.; Yazir, Yagiz Onat; Matthews, Chris; Coady, Yvonne

doi:10.1109/cloud.2012.145

Cited by 29 publications

(24 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The detection of encrypted malware is very challenging. Maitland [28] is a VMI-based development effort to detect encrypted malware. There is a new breed of malware, which successfully hides itself, when it becomes aware of malware detection code running on the system.…”

Section: Malware Detectionmentioning

confidence: 99%

See 1 more Smart Citation

Virtual machine introspection: towards bridging the semantic gap

Tapaswi

2014

J Cloud Comp

View full text Add to dashboard Cite

Virtual machine introspection is a technique used to inspect and analyse the code running on a given virtual machine. Virtual machine introspection has gained considerable attention in the field of computer security research. In recent years, it has been applied in various areas, ranging from intrusion detection and malware analysis to complete cloud monitoring platforms. A survey of existing virtual machine introspection tools is necessary to address various possible research gaps and to focus on key features required for wide application of virtual machine introspection techniques. In this paper, we focus on the evolution of virtual machine introspection tools and their ability to address the semantic gap problem.

show abstract

Section: Malware Detectionmentioning

confidence: 99%

“…Maitland [28] uses the Xen store utility and page flags for accessing NX flags. Maitland observes each page fault and makes these pages accessible to a security VM.…”

Section: Introspection Using Page Flag Inspectionmentioning

confidence: 99%

Virtual machine introspection: towards bridging the semantic gap

Tapaswi

2014

J Cloud Comp

View full text Add to dashboard Cite

show abstract

“…The architecture runs in between software and hardware layer. Benninger and Neville [49] have presented a prototype that performs detection of malwares. The faster outcome of the intrusion detection proved quite effective system.…”

Section: International Journal Of Computer Applications (0975 -8887) mentioning

confidence: 99%

An Investigation towards Paradigm Shift of Cloud Computing Approach and Need of New Security Protocol

Veena¹,

Pujeri²,

Indiramma³

2015

IJCA

View full text Add to dashboard Cite

Today cloud computing platform is de-facto and strategic component of corporate and end user applications usage in pervasive and ubiquitous manner. The level based services makes the higher possibilities of availability, scalability, collaborative in most cost effective way. However integration of various service layers into cloud stack also invites intrinsic threats, risk and vulnerabilities, thus security become prime concern for the adaptabilities. This paper mainly focus on understanding the changing trends of usage of cloud computing platform for various services, fundamental research approaches towards cloud security and finally need of requirements for strengthening the security protocol. The facts, concept and statistics illustrated in this paper is of extensive use to the researchers, industries and academicians towards developing new mechanisms and protocol for future secured cloud framework.

show abstract

“…They implement Renovo's generic unpacking algorithm on Ether. Benninger et al [22] and Deng et al [23] independently propose that type of analysis environments by customizing Xen and KVM, respectively. Kawakoya et al [10] focus on memory access 'write', 'read', and 'execute' of packed programs to detect the OEP, and Jeong et al [24] focus on entropy scores in each section of a packed program on the memory to do so.…”

Section: Related Workmentioning

confidence: 99%

An Original Entry Point Detection Method with Candidate-Sorting for More Effective Generic Unpacking

Isawa

Inoue

Nakao

2015

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYMany malware programs emerging from the Internet are compressed and/or encrypted by a wide variety of packers to deter code analysis, thus making it necessary to perform unpacking first. To do this task efficiently, Guo et al. proposed a generic unpacking system named Justin that provides original entry point (OEP) candidates. Justin executes a packed program, and then it extracts written-and-executed points caused by the decryption of the original binary until it determines the OEP has appeared, taking those points as candidates. However, for several types of packers, the system can provide comparatively large sets of candidates or fail to capture the OEP. For more effective generic unpacking, this paper presents a novel OEP detection method featuring two mechanisms. One identifies the decrypting routine by tracking relations between writing instructions and written areas. This is based on the fact that the decrypting routine is the generator for the original binary. In case our method fails to detect the OEP, the other mechanism sorts candidates based on the most likely candidate so that analysts can reach the correct one quickly. With experiments using a dataset of 753 samples packed by 25 packers, we confirm that our method can be more effective than Justin's heuristics, in terms of detecting OEPs and reducing candidates. After that, we also propose a method combining our method with one of Justin's heuristics.

show abstract

Maitland: Lighter-Weight VM Introspection to Support Cyber-security in the Cloud

Cited by 29 publications

References 13 publications

Virtual machine introspection: towards bridging the semantic gap

Virtual machine introspection: towards bridging the semantic gap

An Investigation towards Paradigm Shift of Cloud Computing Approach and Need of New Security Protocol

An Original Entry Point Detection Method with Candidate-Sorting for More Effective Generic Unpacking

Contact Info

Product

Resources

About