Prof. Hans P. Reiser
Stewart Sentanoe
Benjamin Taubmann
Noëlle Rakotondravony
Virtual machine introspection (VMI) is a technique to analyze the internal state of a target virtual machine from the outside. It is well-established for tasks such as intrusion detection, malware analysis, and forensics. Compared to approaches that analyze the internal state from inside the target, VMI-based data acquisition benefits from the strong isolation provided by the hypervisor and is significantly more stealthy and tamper-proof.
This project will significantly advance the state of the art of VMI. The main objectives are as follows:
In summary, the over-all goal of this project is to enable VMI on systems on which introspection is not feasible with today's tools and libraries, to enable the acquisition of significantly more detailed information using in-depth memory introspection and a variety of VMI-based tracing mechanisms, and to enable a human operator to better control these mechanisms and visualize the resulting data.
We plan to integrate our innovative algorithms and strategies into an open-source prototype for enhanced virtual machine introspection, which also supports the development of high-level tools for attack detection, analysis and prevention.
Deutsche Forschungsgemeinschaft
S. Sentanoe, T. Dangl and H. P. Reiser, "KVMIveggur: Flexible, secure, and efficient support for self-service virtual machine introspection" , Forensic Science International: Digital Investigation , vol. Volume 42 S, 2022. Elsevier.
S. Sentanoe and H. P. Reiser, "SSHkex: Leveraging virtual machine introspection for extracting SSH keys and decrypting SSH network traffic" , Forensic Science International: Digital Investigation , vol. 40, 2022.
DOI: https://doi.org/10.1016/j.fsidi.2022.301337
File: https://www.sciencedirect.com/science/article/pii/S2666281722000063
T. Dangl, S. Sentanoe and H. P. Reiser, "VMIFresh: Efficient and Fresh Caches for Virtual Machine Introspection" in Proceedings of the 17th International Conference on Availability, Reliability and Security , New York, NY, USA: Association for Computing Machinery, 2022.
ISBN: 9781450396707
A. Abdelraoof, H. P. Reiser and B. Taubmann, "Introspect Virtual Machines Like It Is the Linux Kernel!" in 18th Int. Conf. on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA'2021) , 2021.
T. Dangl, B. Taubmann and H. P. Reiser, "RapidVMI: Fast and multi-core aware active virtual machine introspection" in Proc. of the 16th International Conference on Availability, Reliability and Security (ARES 2021) , 2021.
T. Dangl, B. Taubmann and H. P. Reiser, "Agent-based file extraction using virtual machine introspection" in Proc. of the 25th Nordic Conference on Secure IT Systems (NordSec) , 2020.
B. Taubmann and H. P. Reiser, "Towards Hypervisor Support for Enhancing the Performance of Virtual Machine Introspection" in Proc. of the 20th Int. Conf. on Distributed Applications and Interoperable Systems (DAIS) , Cham: Springer International Publishing, 2020. pp. 41--54.
DOI: 10.1007/978-3-030-50323-9_3
ISBN: 978-3-030-50323-9
N. Rakotondravony, B. Taubmann, S. Sentanoe and H. P. Reiser, "Poster: Reconfigurable monitoring and performance awareness in VMI-based SIEM systems" in 2019 {IEEE} Security and Privacy Poster, San Francisco, CA, USA, May 20-22 , 2019.
B. Taubmann, A. Böhm and H. P. Reiser, "TwinPorter - An Architecture For Enabling the Live Migration of VMI-based Monitored Virtual Machines" in The 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom'19) , 2019.
S. Sentanoe, B. Taubmann and H. P. Reiser, "VMIGuard: Detecting and Preventing Service Integrity Violations by Malicious Insiders Using Virtual Machine Introspection" in Proc. of the 24th Nordic Conference on Secure IT Systems (NordSec) , 2019. pp. 271--282.
M. Guerra, B. Taubmann, H. P. Reiser, S. Yalew and M. Correia, "Introspection for ARM TrustZone with the ITZ Library" in Proc. of the 18th IEEE Int. Conf. on Software Quality, Reliability, and Security , 2018.
S. Sentanoe, B. Taubmann and H. P. Reiser, "Sarracenia: Enhancing the Performance and Stealthiness of SSH Honeypots using Virtual Machine Introspection" in Proc. of the 23. Nordic Conference on Secure IT Systems , 2018.
