A Virtual Machine Introspection Based Architecture for Intrusion Detection.

摘要: Today’s architectures for intrusion detection force the IDS designer to make a difficult choice. If resides on host, it has an excellent view of what is happening in that host’s software, but highly susceptible attack. On other hand, if network, more resistant attack, poor inside making evasion. In this paper we present architecture retains visibility host-based IDS, pulls outside host greater attack resistance. We achieve through use virtual machine monitor. Using approach allows us isolate from monitored still retain into state. The VMM also offers unique ability completely mediate interactions between software and underlying hardware. detailed study our architecture, including Livewire, prototype implementation. demonstrate Livewire by implementing suite simple policies using them detect real attacks.