The Experts below are selected from a list of 360 Experts worldwide ranked by ideXlab platform

Yiorgos Makris - One of the best experts on this subject based on the ideXlab platform.

  • Hardware-based on-line intrusion detection via system call routine fingerprinting
    Design Automation & Test in Europe Conference & Exhibition (DATE) 2017, 2017
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing on-line intrusion detection in microprocessors. The proposed method extracts fingerprints from the basic blocks of the routine executed in response to a system call and examines their validity using a Bloom filter. Implementation in hardware renders spoofing attacks, to which operating system or Hypervisor-Level intrusion detection methods are vulnerable, ineffective. The proposed method is evaluated using kernel rootkits which covertly modify the system call service routines of a Linux operating system running on a 32-bit x86 architecture, implemented in the Simics simulation environment, while hardware overhead is evaluated using a predictive 45nm PDK.

  • DATE - Hardware-based on-line intrusion detection via system call routine fingerprinting
    Design Automation & Test in Europe Conference & Exhibition (DATE) 2017, 2017
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing on-line intrusion detection in microprocessors. The proposed method extracts fingerprints from the basic blocks of the routine executed in response to a system call and examines their validity using a Bloom filter. Implementation in hardware renders spoofing attacks, to which operating system or Hypervisor-Level intrusion detection methods are vulnerable, ineffective. The proposed method is evaluated using kernel rootkits which covertly modify the system call service routines of a Linux operating system running on a 32-bit x86 architecture, implemented in the Simics simulation environment, while hardware overhead is evaluated using a predictive 45nm PDK.

  • MTV - Hardware-Based Workload Forensics and Malware Detection in Microprocessors
    2016 17th International Workshop on Microprocessor and SOC Test and Verification (MTV), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We investigate the possibility of performing workload forensics and/or malware detection in microprocessors through exclusively hardware-based methodologies. Specifically, we first introduce a general architecture which a hardware-based forensics or malware detection method would need to follow, as well as the various processor-Level information which could potentially be harnessed to ensure system security and/or integrity. In contrast to traditional forensics and/or malware detection methods implemented at the operating system (OS) and/or the Hypervisor Level, whose data logging and monitoring systems are vulnerable to spoofing attacks at the same Level, moving implementation to hardware ensures immunity to such attacks. This work focuses on two recent incarnations of this general concept, illustrating the effectiveness of hardware-based forensics and/or malware detection. Several other recent methods related to this topic are also discussed. Experimental results corroborate that even a low-cost hardware implementation can facilitate highly successful forensics analysis and/or malware detection, while taking advantage of its innate immunity to software-based attacks.

  • Hardware-based workload forensics: Process reconstruction via TLB monitoring
    2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing workload execution forensics in microprocessors. More specifically, we discuss the on-chip instrumentation required for capturing the operational profile of the Translation Lookaside Buffer (TLB), as well as an off-line machine learning approach which uses this information to identify the executed processes and reconstruct the workload. Unlike workload forensics methods implemented at the operating system (OS) and/or Hypervisor Level, whose data logging and monitoring mechanisms may be compromised through software attacks, this approach is implemented directly in hardware and is, therefore, immune to such attacks. The proposed method is demonstrated on an experimentation platform which consists of a 32-bit x86 architecture running Linux operating system, implemented in the Simics simulation environment. Experimental results using the Mibench workload benchmark suite reveal an overall workload identification accuracy of 96.97% at an estimated logging rate of only 5.17 KB/sec.

  • HOST - Hardware-based workload forensics: Process reconstruction via TLB monitoring
    2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing workload execution forensics in microprocessors. More specifically, we discuss the on-chip instrumentation required for capturing the operational profile of the Translation Lookaside Buffer (TLB), as well as an off-line machine learning approach which uses this information to identify the executed processes and reconstruct the workload. Unlike workload forensics methods implemented at the operating system (OS) and/or Hypervisor Level, whose data logging and monitoring mechanisms may be compromised through software attacks, this approach is implemented directly in hardware and is, therefore, immune to such attacks. The proposed method is demonstrated on an experimentation platform which consists of a 32-bit x86 architecture running Linux operating system, implemented in the Simics simulation environment. Experimental results using the Mibench workload benchmark suite reveal an overall workload identification accuracy of 96.97% at an estimated logging rate of only 5.17 KB/sec.

Claudia Eckert - One of the best experts on this subject based on the ideXlab platform.

  • nitro hardware based system call tracing for virtual machines
    International Workshop on Security, 2011
    Co-Authors: Jonas Pfoh, Christian Schneider, Claudia Eckert
    Abstract:

    Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the Hypervisor Level. This lends itself well to security applications, though the hardware virtualization support from Intel and AMD was not designed with VMI in mind. This results in many challenges for developers of hardware-supported VMI systems. This paper describes the design and implementation of our prototype framework, Nitro, for system call tracing and monitoring. Since Nitro is a purely VMI-based system, it remains isolated from attacks originating within the guest operating system and is not directly visible from within the guest. Nitro is extremely flexible as it supports all three system call mechanisms provided by the Intel ×86 architecture and has been proven to work in Windows, Linux, 32-bit, and 64-bit environments. The high performance of our system allows for real-time capturing and dissemination of data without hindering usability. This is supported by extensive testing with various guest operating systems. In addition, Nitro is resistant to circumvention attempts due to a construction called hardware rooting. Finally, Nitro surpasses similar systems in both performance and functionality.

  • IWSEC - Nitro: hardware-based system call tracing for virtual machines
    Advances in Information and Computer Security, 2011
    Co-Authors: Jonas Pfoh, Christian Schneider, Claudia Eckert
    Abstract:

    Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the Hypervisor Level. This lends itself well to security applications, though the hardware virtualization support from Intel and AMD was not designed with VMI in mind. This results in many challenges for developers of hardware-supported VMI systems. This paper describes the design and implementation of our prototype framework, Nitro, for system call tracing and monitoring. Since Nitro is a purely VMI-based system, it remains isolated from attacks originating within the guest operating system and is not directly visible from within the guest. Nitro is extremely flexible as it supports all three system call mechanisms provided by the Intel ×86 architecture and has been proven to work in Windows, Linux, 32-bit, and 64-bit environments. The high performance of our system allows for real-time capturing and dissemination of data without hindering usability. This is supported by extensive testing with various guest operating systems. In addition, Nitro is resistant to circumvention attempts due to a construction called hardware rooting. Finally, Nitro surpasses similar systems in both performance and functionality.

  • Exploiting the x86 Architecture to Derive Virtual Machine State Information
    2010 Fourth International Conference on Emerging Security Information Systems and Technologies, 2010
    Co-Authors: Jonas Pfoh, Christian Schneider, Claudia Eckert
    Abstract:

    Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the Hypervisor Level. Using knowledge of the virtual hardware architecture, it is possible to derive information about a guest operating system's state from the virtual machine state. We argue that by deriving this information it is possible to build VMI applications which are more robust against circumvention techniques than applications that do not rely on hardware knowledge. In this paper, we present various ways to leverage Intel's x86 architecture as well as the virtualization extensions from both Intel (VT-x) and AMD (SVM) to derive such information. Additionally, we describe how this derived information may be used in VMI-based security applications and against which threats they are most applicable.

  • SECURWARE - Exploiting the x86 Architecture to Derive Virtual Machine State Information
    2010 Fourth International Conference on Emerging Security Information Systems and Technologies, 2010
    Co-Authors: Jonas Pfoh, Christian Schneider, Claudia Eckert
    Abstract:

    Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the Hypervisor Level. Using knowledge of the virtual hardware architecture, it is possible to derive information about a guest operating system's state from the virtual machine state. We argue that by deriving this information it is possible to build VMI applications which are more robust against circumvention techniques than applications that do not rely on hardware knowledge. In this paper, we present various ways to leverage Intel's x86 architecture as well as the virtualization extensions from both Intel (VT-x) and AMD (SVM) to derive such information. Additionally, we describe how this derived information may be used in VMI-based security applications and against which threats they are most applicable.

  • A formal model for virtual machine introspection
    Proceedings of the 1st ACM workshop on Virtual machine security SE - VMSec '09, 2009
    Co-Authors: Jonas Pfoh, Christian Schneider, Claudia Eckert
    Abstract:

    Virtual machine introspection (VMI) describes the method of monitoring and analyzing the state of a virtual machine from the Hypervisor Level. In this paper, we present a formal discussion of the development of VMI-based security applications. We begin by identifying three major challenges that all VMI-based security applications must overcome. The main contribution of our work is the definition of a formal model for describing VMI techniques. This model is broken down in such a way that allows for thorough discussion of any VMI approach with regard to each of the three challenges. Then, we specify three design patterns for interpreting state information using our model. We argue that these patterns are complete, that is, they cover all possible methods for state interpretation. The properties of all patterns are thoroughly discussed so that the pros and cons of their application may be fully understood. Finally, we describe and discuss an ideal VMI-based intrusion detection system using our model and begin to detail the practical implications in building such a system.

Liwei Zhou - One of the best experts on this subject based on the ideXlab platform.

  • Hardware-based on-line intrusion detection via system call routine fingerprinting
    Design Automation & Test in Europe Conference & Exhibition (DATE) 2017, 2017
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing on-line intrusion detection in microprocessors. The proposed method extracts fingerprints from the basic blocks of the routine executed in response to a system call and examines their validity using a Bloom filter. Implementation in hardware renders spoofing attacks, to which operating system or Hypervisor-Level intrusion detection methods are vulnerable, ineffective. The proposed method is evaluated using kernel rootkits which covertly modify the system call service routines of a Linux operating system running on a 32-bit x86 architecture, implemented in the Simics simulation environment, while hardware overhead is evaluated using a predictive 45nm PDK.

  • DATE - Hardware-based on-line intrusion detection via system call routine fingerprinting
    Design Automation & Test in Europe Conference & Exhibition (DATE) 2017, 2017
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing on-line intrusion detection in microprocessors. The proposed method extracts fingerprints from the basic blocks of the routine executed in response to a system call and examines their validity using a Bloom filter. Implementation in hardware renders spoofing attacks, to which operating system or Hypervisor-Level intrusion detection methods are vulnerable, ineffective. The proposed method is evaluated using kernel rootkits which covertly modify the system call service routines of a Linux operating system running on a 32-bit x86 architecture, implemented in the Simics simulation environment, while hardware overhead is evaluated using a predictive 45nm PDK.

  • MTV - Hardware-Based Workload Forensics and Malware Detection in Microprocessors
    2016 17th International Workshop on Microprocessor and SOC Test and Verification (MTV), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We investigate the possibility of performing workload forensics and/or malware detection in microprocessors through exclusively hardware-based methodologies. Specifically, we first introduce a general architecture which a hardware-based forensics or malware detection method would need to follow, as well as the various processor-Level information which could potentially be harnessed to ensure system security and/or integrity. In contrast to traditional forensics and/or malware detection methods implemented at the operating system (OS) and/or the Hypervisor Level, whose data logging and monitoring systems are vulnerable to spoofing attacks at the same Level, moving implementation to hardware ensures immunity to such attacks. This work focuses on two recent incarnations of this general concept, illustrating the effectiveness of hardware-based forensics and/or malware detection. Several other recent methods related to this topic are also discussed. Experimental results corroborate that even a low-cost hardware implementation can facilitate highly successful forensics analysis and/or malware detection, while taking advantage of its innate immunity to software-based attacks.

  • Hardware-based workload forensics: Process reconstruction via TLB monitoring
    2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing workload execution forensics in microprocessors. More specifically, we discuss the on-chip instrumentation required for capturing the operational profile of the Translation Lookaside Buffer (TLB), as well as an off-line machine learning approach which uses this information to identify the executed processes and reconstruct the workload. Unlike workload forensics methods implemented at the operating system (OS) and/or Hypervisor Level, whose data logging and monitoring mechanisms may be compromised through software attacks, this approach is implemented directly in hardware and is, therefore, immune to such attacks. The proposed method is demonstrated on an experimentation platform which consists of a 32-bit x86 architecture running Linux operating system, implemented in the Simics simulation environment. Experimental results using the Mibench workload benchmark suite reveal an overall workload identification accuracy of 96.97% at an estimated logging rate of only 5.17 KB/sec.

  • HOST - Hardware-based workload forensics: Process reconstruction via TLB monitoring
    2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2016
    Co-Authors: Liwei Zhou, Yiorgos Makris
    Abstract:

    We introduce a hardware-based methodology for performing workload execution forensics in microprocessors. More specifically, we discuss the on-chip instrumentation required for capturing the operational profile of the Translation Lookaside Buffer (TLB), as well as an off-line machine learning approach which uses this information to identify the executed processes and reconstruct the workload. Unlike workload forensics methods implemented at the operating system (OS) and/or Hypervisor Level, whose data logging and monitoring mechanisms may be compromised through software attacks, this approach is implemented directly in hardware and is, therefore, immune to such attacks. The proposed method is demonstrated on an experimentation platform which consists of a 32-bit x86 architecture running Linux operating system, implemented in the Simics simulation environment. Experimental results using the Mibench workload benchmark suite reveal an overall workload identification accuracy of 96.97% at an estimated logging rate of only 5.17 KB/sec.

Haiyang Wang - One of the best experts on this subject based on the ideXlab platform.

  • INFOCOM - A deep investigation into network performance in virtual machine based cloud environments
    IEEE INFOCOM 2014 - IEEE Conference on Computer Communications, 2014
    Co-Authors: Ryan Shea, Feng Wang, Haiyang Wang
    Abstract:

    Existing research on cloud network (in)stability has primarily focused on communications between Virtual Machines (VMs) inside a cloud, leaving that of VM communications over higher-latency wide-area networks largely unexplored. Through measurement in real-world cloud platforms, we find that there are prevalent and significant degradation and variation for such VM communications with both TCP and UDP traffic, even over lightly utilized networks. Our in-depth measurement and detailed system analysis reveal that the performance variation and degradation are mainly due to the dual-role of the CPU in both computation and network communication in a VM, and they can be dramatically affected by the CPU's scheduling policy. We provide strong evidence that such issues can be addressed in the Hypervisor Level and present concrete solutions. Such remedies have been implemented and evaluated in our cloud testbed, showing noticeable improvement for long-haul network communications with VMs.

  • A deep investigation into network performance in virtual machine based cloud environments
    IEEE INFOCOM 2014 - IEEE Conference on Computer Communications, 2014
    Co-Authors: Ryan Shea, Feng Wang, Haiyang Wang
    Abstract:

    Existing research on cloud network (in)stability has primarily focused on communications between Virtual Machines (VMs) inside a cloud, leaving that of VM communications over higher-latency wide-area networks largely unexplored. Through measurement in real-world cloud platforms, we find that there are prevalent and significant degradation and variation for such VM communications with both TCP and UDP traffic, even over lightly utilized networks. Our in-depth measurement and detailed system analysis reveal that the performance variation and degradation are mainly due to the dual-role of the CPU in both computation and network communication in a VM, and they can be dramatically affected by the CPU's scheduling policy. We provide strong evidence that such issues can be addressed in the Hypervisor Level and present concrete solutions. Such remedies have been implemented and evaluated in our cloud testbed, showing noticeable improvement for long-haul network communications with VMs.

  • Enhancing Performance and Energy Efficiency for Hybrid Workloads in Virtualized Cloud Environment
    IEEE Transactions on Cloud Computing, 1
    Co-Authors: Chi Xu, Ryan Shea, Haiyang Wang
    Abstract:

    Virtualization has attained mainstream status in enterprise IT industry. Despite its widespread adoption, it is known that virtualization also introduces non-trivial overhead when executing tasks on a virtual machine (VM). In particular, a combined effect from device virtualization overhead and CPU scheduling latency can cause performance degradation when computation intensive tasks and I/O intensive tasks are co-located on a VM. Such an interference causes extra energy consumption, as well. In this paper, we present Hylics, a novel solution that enables efficient data traverse paths for both I/O and computation intensive workloads. This is achieved with the provision of in-memory file system and network service at the Hypervisor Level. Several important design issues are pinpointed and addressed during our prototype implementation, including efficient intermediate data sharing, network service offloading, and QoS-aware memory usage management. Based on our real-world deployment on KVM, Hylics can significantly improve computation and I/O performance for hybrid workloads. Moreover, this design also alleviates the existing virtualization overhead and naturally optimizes the overall energy efficiency.

Junghwan Rhee - One of the best experts on this subject based on the ideXlab platform.

  • a Hypervisor Level provenance system to reconstruct attack story caused by kernel malware
    International Conference on Security and Privacy in Communication Systems, 2019
    Co-Authors: Chonghua Wang, Xiangyu Zhang, Junghwan Rhee
    Abstract:

    Provenance of system subjects (e.g., processes) and objects (e.g., files) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable to kernel Level malware. To address this problem, we present HProve, a Hypervisor Level provenance tracing system to reconstruct kernel malware attack story. It monitors the execution of kernel functions and sensitive objects, and correlates the system subjects and objects to form the causality dependencies for the attacks. We evaluated our prototype on 12 real world kernel malware samples, and the results show that it can correctly identify the provenance behaviors of the kernel malware.

  • SecureComm - A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware
    Lecture Notes of the Institute for Computer Sciences Social Informatics and Telecommunications Engineering, 2018
    Co-Authors: Chonghua Wang, Xiangyu Zhang, Shiqing Ma, Junghwan Rhee
    Abstract:

    Provenance of system subjects (e.g., processes) and objects (e.g., files) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable to kernel Level malware. To address this problem, we present HProve, a Hypervisor Level provenance tracing system to reconstruct kernel malware attack story. It monitors the execution of kernel functions and sensitive objects, and correlates the system subjects and objects to form the causality dependencies for the attacks. We evaluated our prototype on 12 real world kernel malware samples, and the results show that it can correctly identify the provenance behaviors of the kernel malware.

  • cafe a virtualization based approach to protecting sensitive cloud application logic confidentiality
    IEEE Transactions on Dependable and Secure Computing, 2018
    Co-Authors: Sungjin Park, Junghwan Rhee, Dongyan Xu
    Abstract:

    Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on Hypervisor-Level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead. The results demonstrate the effectiveness and practicality of CAFE in cloud marketplaces.

  • cafe a virtualization based approach to protecting sensitive cloud application logic confidentiality
    Computer and Communications Security, 2015
    Co-Authors: Sungjin Park, Junghwan Rhee, Dongyan Xu
    Abstract:

    Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on Hypervisor-Level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead.

  • AsiaCCS - CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic Confidentiality
    Proceedings of the 10th ACM Symposium on Information Computer and Communications Security - ASIA CCS '15, 2015
    Co-Authors: Sungjin Park, Junghwan Rhee, Dongyan Xu
    Abstract:

    Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on Hypervisor-Level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead.