著者
Yoshihiro Oyama Yudai Kawasaki Kazushi Takahashi
出版者
一般社団法人 情報処理学会
雑誌
Journal of Information Processing (ISSN:18826652)
巻号頁・発行日
vol.23, no.2, pp.132-141, 2015 (Released:2015-03-15)
参考文献数
30

Many dynamic malware analysis systems based on hypervisors have been proposed. Although they support malware analysis effectively, many of them have a shortcoming that permits the malware to easily recognize the virtualized hardware and change its execution to prevent analysis. We contend that this drawback can be mitigated using a hypervisor that virtualizes the minimum number of hardware accesses. This paper proposes a hypervisor-based mechanism that can function as a building block for dynamic malware analysis systems. The mechanism provides the facility for checkpointing and restoring a guest OS. It is designed for a parapass-through hypervisor, that is, a hypervisor that runs directly on the hardware and does not execute a host OS or an administrative guest OS. The advantage of using a parapass-through hypervisor is that it provides a virtual machine whose hardware configuration and behavior is similar to the underlying physical machine, and hence, it can be stealthier than other hypervisors. We extend the parapass-through hypervisor BitVisor with the proposed mechanism, and demonstrate that the resulting system can successfully checkpoint and restore the states of Linux and Windows OSes. We confirm that hypervisor detectors running on the system cannot identify the virtualized hardware, and determine that they are executing on a physical machine. We also confirm that the system imposes minimal overhead on the execution times of the benchmark programs.

言及状況

外部データベース (DOI)

Twitter (8 users, 9 posts, 5 favorites)

Checkpointing an Operating System Using a Parapass-through Hypervisor http://t.co/ym8d2zVd6X は,ReVirtやXenLRとコンセプトが似ているのにCiteしてないのはなぜなんだぜ
Checkpointing an Operating System Using a Parapass-through Hypervisor https://t.co/qvcXpertuC

収集済み URL リスト