Lares: An architecture for secure active monitoring using virtualization

被引：178

作者：

Payne, Bryan D. ^{[1
]}

Carbone, Martim ^{[1
]}

Sharif, Monirul ^{[1
]}

Lee, Wenke ^{[1
]}

机构：

[1] Georgia Inst Technol, Sch Comp Sci, Atlanta, GA 30332 USA

来源：

PROCEEDINGS OF THE 2008 IEEE SYMPOSIUM ON SECURITY AND PRIVACY | 2008年

关键词：

D O I：

10.1109/SP.2008.24

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

Host-based security tools such as anti-virus and intrusion detection systems are not adequately protected on today's computers. Malware is often designed to immediately disable any security tools upon installation, rendering them useless. While current research has focused on moving these vulnerable security tools into an isolated virtual machine, this approach cripples security tools by preventing them from doing active monitoring. This paper describes an architecture that takes a hybrid approach, giving security tools the ability to do active monitoring while still benefiting from the increased security of an isolated virtual machine. We discuss the architecture and a prototype implementation that can process hooks from a virtual machine running Windows XP on Xen. We conclude with a security analysis and show the performance of a single hook to be 28 mu secs in the best case.

引用

页码：233 / 247

页数：15