VMInsight: Hardware virtualization-based process security monitoring system

  • Xianxian Li*
  • , Changhui Jiang
  • , Jianxin Li
  • , Bo Li
  • *Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Malicious software is one of the primary threats to information system on Internet, while the traditional host-based and network-based monitoring systems are vulnerable to prevent the malicious behavior of software because most current malicious software is capable of resisting security monitoring. Virtualization technology gives an impactful approach to monitoring the behavior of malicious software since it can provide an abstraction layer between the operating system and the hardware. In this paper, we propose a hardware-virtualization-based security monitor system named VMInsight, which can provide load-time and run-time monitoring for processes. VMInsight intercepts system calls and process behaviors by monitoring changes in the virtual machine CPU register, and it is implemented in the hyper visor, thus is completely transparent to the software and operating system running in the virtual machine. The experimental results show that the performance overhead of VMInsight is less than 10, and it can be easily applied to the third-party security monitoring system.

Original languageEnglish
Title of host publicationProceedings - 2011 International Conference on Network Computing and Information Security, NCIS 2011
Pages62-66
Number of pages5
DOIs
StatePublished - 2011
Event2011 International Conference on Network Computing and Information Security, NCIS 2011 - Guilin, Guangxi, China
Duration: 14 May 201115 May 2011

Publication series

NameProceedings - 2011 International Conference on Network Computing and Information Security, NCIS 2011
Volume1

Conference

Conference2011 International Conference on Network Computing and Information Security, NCIS 2011
Country/TerritoryChina
CityGuilin, Guangxi
Period14/05/1115/05/11

Keywords

  • security monitoring
  • syetem security
  • virtualization

Fingerprint

Dive into the research topics of 'VMInsight: Hardware virtualization-based process security monitoring system'. Together they form a unique fingerprint.

Cite this