TIIS (한국인터넷정보학회)
Current Result Document :
| 한글제목(Korean Title) |
Lightweight Intrusion Detection of Rootkit with VMI-Based Driver Separation Mechanism |
| 영문제목(English Title) |
Lightweight Intrusion Detection of Rootkit with VMI-Based Driver Separation Mechanism |
| 저자(Author) |
Chaoyuan Cui
Yun Wu
Yonggang Li
Bingyu Sun
|
| 원문수록처(Citation) |
VOL 11 NO. 03 PP. 1722 ~ 1741 (2017. 03) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
Intrusion detection techniques based on virtual machine introspection (VMI) provide high temper-resistance in comparison with traditional in-host anti-virus tools. However, the presence of semantic gap also leads to the performance and compatibility problems. In order to map raw bits of hardware to meaningful information of virtual machine, detailed knowledge of different guest OS is required. In this work, we present VDSM, a lightweight and general approach based on driver separation mechanism: divide semantic view reconstruction into online driver of view generation and offline driver of semantics extraction. We have developed a prototype of VDSM and used it to do intrusion detection on 13 operation systems. The evaluation results show VDSM is effective and practical with a small performance overhead.
|
| 키워드(Keyword) |
lightweight intrusion detection
introspection
semantic gap
driver separation mechanism
portability
|
| 파일첨부 |
PDF 다운로드
|
