A formal model for virtual machine introspection

摘要: Virtual machine introspection (VMI) describes the method of monitoring and analyzing state a virtual from hypervisor level. In this paper, we present formal discussion development VMI-based security applications. We begin by identifying three major challenges that all applications must overcome. The main contribution our work is definition model for describing VMI techniques. This broken down in such way allows thorough any approach with regard to each challenges. Then, specify design patterns interpreting information using model. argue these are complete, is, they cover possible methods interpretation. properties thoroughly discussed so pros cons their application may be fully understood. Finally, describe discuss an ideal intrusion detection system detail practical implications building system.