Abstract:Protecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.

Croth: Effective Process Protection and Monitoring with Hardware Virtualization

Protecting Kernel Data Through Virtualization Technology

A Highly Reliable In-VM Hidden Process Detection Countermeasure

KEcruiser: A Novel Control Flow Protection for Kernel Extensions

VMInsight: Hardware Virtualization-Based Process Security Monitoring System

Secure Virtualization-Based Fine-Grained Process Execution Monitoring

On the effectiveness of virtualization-based security

Transparent Protection of Commodity OS Kernels Using Hardware Virtualization

Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach

A Multi-Protection Domains Process Model and Its Implementation

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

KVM-Based Windows Virtual Machine User Process Protection

Approach of Kernel Integrity Monitoring Using Hardware Virtualization

Kernel Code Integrity Protection Based on a Virtualized Memory Architecture.

A Protective Mechanism for the Access Control System in the Virtual Domain

Vcerberus: A DRTM System Based on Virtualization Technology

Using An In-Kernel Hypervisor To Protect The Integrity Of Operating System

Novel process-protecting method using camouflage techniques based on direct kernel object manipulation

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

A Virtualized Harvard Architectural Approach to Protect Kernel Code

VMDetector: A VMM-based Platform to Detect Hidden Process by Multi-view Comparison