A novel approach for a file-system integrity monitor tool of Xen virtual machine

Nguyen Anh Quynh, Yoshiyasu Takefuji

研究成果: Conference contribution

35 被引用数 (Scopus)

抄録

File-system integrity tools (FIT) are commonly deployed host-based intrusion detections (HIDS) tool to detect unauthorized file-system changes. While FIT are widely used, this kind of HIDS has many drawbacks: the intrusion detection is not done in real-time manner, which might render the whole scheme useless if the attacker can somehow take over the system with privileged access in the time between. The administrator also has a lot of problems to keep the base-line database updating. Besides, the database and the FIT itself are vulnerable if the attacker gains local privileged access.This paper presents a novel approach to address the outstanding problems of the current FIT. We propose a design and implementation of a tool named XenFIT for Xen virtual machines. XenFIT can monitor and fires alarms on intrusion in real-time manner, and our approach does not require to create and update the database like in the legacy methods. XenFIT works by dynamically patching memory of the protected machine, so it is not necessary to install any kernel code or user-space application into the protected machines. As a result, XenFIT is almost effortless to deploy and maintain. In addition, thanks to the advantage introduced by Xen, the security polices as well as the detection process are put in a secure machine, so XenFIT is tamper-resistant with attack, even in case the attacker takes over the whole VM he is penetrating in. Finally, if deploying strictly, XenFIT is able to function very stealthily to avoid the suspect of the intruder.

本文言語English
ホスト出版物のタイトルProceedings of the 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07
ページ194-202
ページ数9
DOI
出版ステータスPublished - 2007 10 1
イベント2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07 - Singapore, Singapore
継続期間: 2007 3 202007 3 22

出版物シリーズ

名前Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07

Other

Other2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS '07
CountrySingapore
CitySingapore
Period07/3/2007/3/22

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software

フィンガープリント 「A novel approach for a file-system integrity monitor tool of Xen virtual machine」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル