A Virtual Machine Introspection Based Architecture for Intrusion Detection

By Tal Garfinkel, Mendel Rosenblum. Network and Distributed System Security Symposium, 2003

1,571 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4ab4a666f5e5ed34ac219a9fdc2f70bd1cab0922

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

The Evolution of Android Malware and Android Analysis Techniques (2017, methodology): “To overcome this weakness, there are several methods to ﬁll the semantic gap, that is, recreating OS/app semantics from a lower observation point such as the emulator [Garﬁnkel and R. 2003; Tam et al. 2015b].”
Secure and Flexible Monitoring of Virtual Machines (2007, methodology): “In the security space, we have seen innovative work in intrusion detection systems [10, 18, 15], workload isolation [21, 9], attack investigation and debugging [7], and system monitoring [13, 2].”
Intrusion detection system: A comprehensive review (2013, methodology): “For the intrusion detection inside VMs , Virtual Memory Introspection ( VMI ) ( Garfinkel and Rosenblum , 2003 ) is introduced to leverage virtual technology on the hypervisor , while HyperSpector ( Kourai and Chiba , 2005 ) provided a virtual distrib - uted monitoring environment .”
A survey on security issues and solutions at different layers of Cloud computing (2012, unknown): “Virtual machine introspection based IDS approach [18].”
Countering code-injection attacks with instruction-set randomization (2003, background): “Emulator-based approaches have also been proposed in the context of intrusion and anomaly detection [25, 32], as well as one way to retain backward compatibility with older processors(2) — often exhibiting better performance.”
XTRec: Secure Real-Time Execution Trace Recording on Commodity Platforms (2011, background): “VMIIDS [15] and Psyco-Virt [1] are some more examples of systems employing VM introspection for intrusion detection.”
Vigilante: end-to-end containment of internet worms (2005, background): “There is a large amount of work on host-based detection of vulnerabilities including [47, 10, 23, 21, 16, 2, 4].”
Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction (2007, background): “Speci.cally, the new technique casts semantic de.nitions of guest OS data structures and functions on virtual machine monitor (VMM)-level VM states, so that the semantic view can be reconstructed.”
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “Instead of real machines Dunlap and Garfinkel suggest virtual machines [19, 20].”
A survey on automated dynamic malware-analysis techniques and tools (2012, methodology): “However, by adding support for VM introspection techniques as proposed by Garfinkel and Rosenblum [2003], Ether could gain these capabilities as well.”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, methodology): “Garfinkel and Rosenblum [72] created Livewire, a proof of concept intrusion detection system residing at the hypervisor layer.”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, methodology): “In the second category, Livewire [6], based on a virtual machine monitor (VMM), aims at protecting the guest OS kernel code and critical kernel data structures from being modified.”
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis (2012, methodology): “The basic techniques for reconstructing the OS-level view have been well studied for the x86 architecture and are generally known as virtual machine introspection [16, 21, 24].”
The Turtles Project: Design and Implementation of Nested Virtualization (2010, methodology): “It also enables new approaches to computer security, such as honeypots capable of running hypervisor-level root-kits [43], hypervisor-level rootkit protection [39,44], and hypervisor-level intrusion detection [18, 25]—for both hypervisors and operating systems.”