Abstract:Live forensics is an important technique in cloud security but is facing the challenge of reliability. Most of the live forensic tools in cloud computing run either in the target Operating System (OS), or as an extra hypervisor. The tools in the target OS are not reliable, since they might be deceived by the compromised OS. Furthermore, traditional general purpose hypervisors are vulnerable due to their huge code size. However, some modules of a general purpose hypervisor, such as device drivers, are indeed unnecessary for forensics. In this paper, we propose a special purpose hypervisor, called ForenVisor, which is dedicated to reliable live forensics. The reliability is improved in three ways: reducing Trusted Computing Base (TCB) size by leveraging a lightweight architecture, collecting evidence directly from the hardware, and protecting the evidence and other sensitive files with Filesafe module. We have implemented a proof-of-concept prototype on the Windows platform, which can acquire the process data, raw memory, and I/O data, such as keystrokes and network traffic. Furthermore, we evaluate ForenVisor in terms of code size, functionality, and performance. The experiment results show that ForenVisor has a relatively small TCB size of about 13 KLOC, and only causes less than 10 percent performance reduction to the target system. In particular, our experiments verify that ForenVisor can guarantee that the protected files remain untampered, even when the guest OS is compromised by viruses, such as ‘ILOVEYOU’ and Worm.WhBoy. Also, our system can be loaded as a hypervisor without needing to pause the target OS. This allows it to not only avoid destructing but also to gather the live evidence of the target OS. We also posted the source code of ForenVisor on Github.

Investigating the Hooking Behavior: A Page-Level Memory Monitoring Method for Live Forensics

A Lightweight Live Memory Forensic Approach Based on Hardware Virtualization.

Vmmf: Virtual Machine Memory Forensics Based on Event Trigger Mechanism

Applying Memory Forensics to Rootkit Detection

Self-adaptive Mechanism of Dynamic Forensics

A Virtualization Based Monitoring System for Mini-intrusive Live Forensics

A Methodology for Hook-Based Kernel Level Rootkits.

Catch You with Cache: Out-of-VM Introspection to Trace Malicious Executions.

Integrity Checking of Function Pointers in Kernel Pools via Virtual Machine Introspection

Modeling and Analyzing Dynamic Forensics System Based on Intrusion Tolerance

Dynamic Forensics Based on Intrusion Tolerance.

Linux Memory Forensics : Searching For Processes

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

Research on Machine-Code Level Injection and HOOK Technique

Data Correlation-Based Analysis Methods for Automatic Memory Forensic

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

A New Method of Live Tracking of Process Memory.

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

ForenVisor: A Tool for Acquiring and Preserving Reliable Data in Cloud Live Forensics

Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios Via DLLs

Study of Memory Forensics Technology Oriented to Windows Operating System