Scalability, fidelity, and containment in the potemkin virtual honeyfarm

By Michael Vrable, Justin Ma, Jay Chen, David Moore, Erik Vandekieft, Alex C. Snoeren, Geoffrey M. Voelker, Stefan Savage. Symposium on Operating Systems Principles, 2005

407 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/2f48f56e14f105441433ef15e47a3d2af8affa3e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Catalyzer: Sub-millisecond Startup for Serverless Computing with Initialization-less Booting (2020, methodology): “Besides the systems mentioned in Section 2, there are other systems [30, 42, 43] that have tried to leverage the check-point/restore mechanism for instantiation.”
Difference engine (2008, unknown): “We build upon earlier work onflash cloning[23] of VMs, which allows new VMs to be cloned from an existing VM in milliseconds; as the newly created VM writes to its memory, it is given private copies of the shared pages.”
An Inside Look at Botnets (2007, background): “Finally, the virtual honeyfarm capabilities described in [38] could prove to be very useful for botnet tracking in the future.”
A Survey of Botnet and Botnet Detection (2009, background): “In addition, many papers [2, 6, 7, 13, 19, 20, 21, 22, 23] discussed how to use honeynets for botnet tracking and measurement.”
My VM is Lighter (and Safer) than your Container (2017, methodology): “Earlier work [48] implemented JIT instantiation of honeypots through the use of image cloning; unlike the work there, we do not require the VMs on the system to run the same application in order to achieve scalability.”
SubVirt: implementing malware with virtual machines (2006, background): “Researchers have used virtual machines to detect intrusions [18] [8] [27], isolate services [33], encrypt network traffic [33], analyze intrusions [14], and implement honeypots [26] [46].”
A multifaceted approach to understanding the botnet phenomenon (2006, methodology): “Our system design and implementation dr aw on experience learned from earlier work [1, 2, 10, 19, 20, 23] but include several additions that are unique to our goals.”
Renovo: a hidden code extractor for packed executables (2007, background): “For example, the malicious code may measure elapsed time for certain instructions, because emulating these instructions incurs high overhead [30], or check the results of certain instructions (e.g., sidt ), because the results they generate are diﬀerent under real and emulated environments (e.g.,…”
The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, methodology): “In [20], the authors give only results for a representative 10 minutes period.”