A Virtualization-Based Approach for Application Whitelisting

Donghai TIAN; Jingfeng XUE; Changzhen HU; Xuanya LI

doi:10.1587/transinf.E97.D.1648

A Virtualization-Based Approach for Application Whitelisting

Donghai TIAN, Jingfeng XUE, Changzhen HU, Xuanya LI

Full Text Views

0

Cite this

Summary :

A whitelisting approach is a promising solution to prevent unwanted processes (e.g., malware) getting executed. However, previous solutions suffer from limitations in that: 1) Most methods place the whitelist information in the kernel space, which could be tempered by attackers; 2) Most methods cannot prevent the execution of kernel processes. In this paper, we present VAW, a novel application whitelisting system by using the virtualization technology. Our system is able to block the execution of unauthorized user and kernel processes. Compared with the previous solutions, our approach can achieve stronger security guarantees. The experiments show that VAW can deny the execution of unwanted processes effectively with a little performance overhead.

Publication: IEICE TRANSACTIONS on Information Vol.E97-D No.6 pp.1648-1651

Publication Date: 2014/06/01

Publicized

Online ISSN: 1745-1361

DOI: 10.1587/transinf.E97.D.1648

Type of Manuscript: LETTER

Category: Software System

Authors

Donghai TIAN
  Beijing Institute of Technology,Chinese Academy of Sciences
Jingfeng XUE
  Beijing Institute of Technology
Changzhen HU
  Beijing Institute of Technology
Xuanya LI
  Institute of Information Engineering, Chinese Academy of Sciences

Keyword

whitelisting, virtualization technology

Cite this

Copy

Donghai TIAN, Jingfeng XUE, Changzhen HU, Xuanya LI, "A Virtualization-Based Approach for Application Whitelisting" in IEICE TRANSACTIONS on Information, vol. E97-D, no. 6, pp. 1648-1651, June 2014, doi: 10.1587/transinf.E97.D.1648.
Abstract: A whitelisting approach is a promising solution to prevent unwanted processes (e.g., malware) getting executed. However, previous solutions suffer from limitations in that: 1) Most methods place the whitelist information in the kernel space, which could be tempered by attackers; 2) Most methods cannot prevent the execution of kernel processes. In this paper, we present VAW, a novel application whitelisting system by using the virtualization technology. Our system is able to block the execution of unauthorized user and kernel processes. Compared with the previous solutions, our approach can achieve stronger security guarantees. The experiments show that VAW can deny the execution of unwanted processes effectively with a little performance overhead.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.E97.D.1648/_p

Copy

@ARTICLE{e97-d_6_1648,
author={Donghai TIAN, Jingfeng XUE, Changzhen HU, Xuanya LI, },
journal={IEICE TRANSACTIONS on Information},
title={A Virtualization-Based Approach for Application Whitelisting},
year={2014},
volume={E97-D},
number={6},
pages={1648-1651},
abstract={A whitelisting approach is a promising solution to prevent unwanted processes (e.g., malware) getting executed. However, previous solutions suffer from limitations in that: 1) Most methods place the whitelist information in the kernel space, which could be tempered by attackers; 2) Most methods cannot prevent the execution of kernel processes. In this paper, we present VAW, a novel application whitelisting system by using the virtualization technology. Our system is able to block the execution of unauthorized user and kernel processes. Compared with the previous solutions, our approach can achieve stronger security guarantees. The experiments show that VAW can deny the execution of unwanted processes effectively with a little performance overhead.},
keywords={},
doi={10.1587/transinf.E97.D.1648},
ISSN={1745-1361},
month={June},}

Copy

TY - JOUR
TI - A Virtualization-Based Approach for Application Whitelisting
T2 - IEICE TRANSACTIONS on Information
SP - 1648
EP - 1651
AU - Donghai TIAN
AU - Jingfeng XUE
AU - Changzhen HU
AU - Xuanya LI
PY - 2014
DO - 10.1587/transinf.E97.D.1648
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E97-D
IS - 6
JA - IEICE TRANSACTIONS on Information
Y1 - June 2014
AB - A whitelisting approach is a promising solution to prevent unwanted processes (e.g., malware) getting executed. However, previous solutions suffer from limitations in that: 1) Most methods place the whitelist information in the kernel space, which could be tempered by attackers; 2) Most methods cannot prevent the execution of kernel processes. In this paper, we present VAW, a novel application whitelisting system by using the virtualization technology. Our system is able to block the execution of unauthorized user and kernel processes. Compared with the previous solutions, our approach can achieve stronger security guarantees. The experiments show that VAW can deny the execution of unwanted processes effectively with a little performance overhead.
ER -