Enabling internet worms and malware investigation and defense using virtualization

摘要: Internet worms and malware remain a threat to the Internet, as demonstrated by number of large-scale worm outbreaks, such MSBlast in 2003 Sasser 2004. Moreover, every new wave outbreak reveals rapid evolution terms infection speed, virulence, sophistication. Unfortunately, our capability investigate defend against has not seen same pace advancement. In this dissertation, we present an integrated, virtualization-based framework for capture, investigation defense. This integrated consists front-end back-end. The is honeyfarm architecture, called Collapsar, attract capture real-world instances from Internet. Collapsar first that virtualizes full systems enables centralized management honeypots while preserving their distributed presence. back-end virtual "playground," vGround, perform destruction-oriented experiments with captured or worms, which were previously expensive, inefficient, even impossible conduct. On top framework, have developed defense mechanisms various perspectives. More specifically, based on unique behavior each run define behavioral footprinting model profiling identification, complements state-of-the-art content-based signature approach. We also develop provenance-aware logging mechanism, process coloring, achieves higher efficiency accuracy than existing revealing break-ins contaminations.