Please use this identifier to cite or link to this item:
Title: Enhancing virtual machine introspection-based memory analysis with event triggers
Authors: Muscat, Matthew
Vella, Mark Joseph
Keywords: Virtual computer systems
Cloud computing
Computer security
Computer engineering
Natural language processing (Computer science)
Electrical engineering
Data structures (Computer science)
Issue Date: 2018
Publisher: IEEE
Citation: Muscat, M., & Vella, M. (2018, December). Enhancing virtual machine introspection-based memory analysis with event triggers. In 2018 IEEE International Conference on Cloud Computing Technology and Science (CloudCom). 133-136
Abstract: Virtual Machine Introspection (VMI) has the potential to provide secure cloud monitoring, but its hardware level monitoring gives rise to the 'semantic gap', where software-level behaviour loses its meaning. Memory forensics tools can offer a deployment-ready solution as compared to automated semantics derivation techniques, in the form of an integrated VMI-memory forensics architecture. A pending issue concerns the appropriate points in time at which to execute memory analysis routines. Analysis is required to execute in a manner not to overwhelm virtual machines but neither to lose out on short-lived in-memory data structures. This paper presents an on-going study to address what we call the 'event semantic gap', or rather the lost semantics of software-level events associated with the monitored behaviour. As opposed to deriving these events directly from the hardware level, we argue that translating them at the software level to recognizable events at the hardware level is more pragmatic, thus providing a fully integrated VMI-memory forensics architecture. Dynamic binary instrumentation (DBI) is a key enabler and promising results are demonstrated for the Xen hypervisor.
Appears in Collections:Scholarly Works - FacICTCS

Files in This Item:
File Description SizeFormat 
  Restricted Access
1.02 MBAdobe PDFView/Open Request a copy

Items in OAR@UM are protected by copyright, with all rights reserved, unless otherwise indicated.