IEICE TRANSACTIONS on Information
Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach
Summary :
Protecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.
- Publication
- IEICE TRANSACTIONS on Information Vol.E100-D No.10 pp.2307-2318
- Publication Date
- 2017/10/01
- Publicized
- 2017/07/21
- Online ISSN
- 1745-1361
- DOI
- 10.1587/transinf.2016INP0009
- Type of Manuscript
- Special Section PAPER (Special Section on Security, Privacy and Anonymity in Computation, Communication and Storage Systems)
- Category
- Operating system and network Security
Authors
Dongyang ZHAN
Harbin Institute of Technology
Lin YE
Harbin Institute of Technology
Binxing FANG
Harbin Institute of Technology
Xiaojiang DU
Temple University
Zhikai XU
Harbin Institute of Technology
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Dongyang ZHAN, Lin YE, Binxing FANG, Xiaojiang DU, Zhikai XU, "Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach" in IEICE TRANSACTIONS on Information,
vol. E100-D, no. 10, pp. 2307-2318, October 2017, doi: 10.1587/transinf.2016INP0009.
Abstract: Protecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2016INP0009/_p
Copy
@ARTICLE{e100-d_10_2307,
author={Dongyang ZHAN, Lin YE, Binxing FANG, Xiaojiang DU, Zhikai XU, },
journal={IEICE TRANSACTIONS on Information},
title={Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach},
year={2017},
volume={E100-D},
number={10},
pages={2307-2318},
abstract={Protecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.},
keywords={},
doi={10.1587/transinf.2016INP0009},
ISSN={1745-1361},
month={October},}
Copy
TY - JOUR
TI - Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach
T2 - IEICE TRANSACTIONS on Information
SP - 2307
EP - 2318
AU - Dongyang ZHAN
AU - Lin YE
AU - Binxing FANG
AU - Xiaojiang DU
AU - Zhikai XU
PY - 2017
DO - 10.1587/transinf.2016INP0009
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E100-D
IS - 10
JA - IEICE TRANSACTIONS on Information
Y1 - October 2017
AB - Protecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.
ER -
English
