Follow the WhiteRabbit: Towards Consolidation of On-the-Fly Virtualization and Virtual Machine Introspection

摘要: The growing complexity of modern malware drives security applications to leverage Virtual Machine Introspection (VMI), which provides a complete and untainted view over the state. To benefit from this ability, VMI-aware Monitor (VMM) must be set up in advance underneath target system; constraint for massive application VMI. In paper, we present WhiteRabbit, VMI framework comprising microkernel-based VMM that transparently virtualizes running Operating System, on-the-fly, purpose forensic analysis. As result, systems analyzed do not have explicitly priori. After its deployment, our exposes services remote applications: WhiteRabbit implements LibVMI interface enables it engaged by popular remotely. Our prototype employs Intel as well ARM virtualization extensions take control Linux system. WhiteRabbit’s on-the-fly capability limited overhead constitute an effective solution detection