Leveraging Forensic Tools for Virtual Machine Introspection
Author(s)
Advisor(s)
Editor(s)
Collections
Supplementary to:
Permanent Link
Abstract
Virtual machine introspection (VMI) has formed the basis of a number of novel approaches to security in recent
years. Although the isolation provided by a virtualized environment provides improved security, software that makes
use of VMI must overcome the semantic gap, reconstructing high-level state information from low-level data sources
such as physical memory. The digital forensics community has likewise grappled with semantic gap problems in
the field of forensic memory analysis (FMA), which seeks to extract forensically relevant information from dumps
of physical memory. In this paper, we will show that work done by the forensic community is directly applicable
to the VMI problem, and that by providing an interface between the two worlds, the difficulty of developing new
virtualization security solutions can be significantly reduced.
Sponsor
Date
2011
Extent
Resource Type
Text
Resource Subtype
Technical Report