A Real-time Integrity Monitor for Xen Virtual Machine

摘要: File-system integrity tools (FIT) are commonly deployed to assist forensic investigation after security incidents and as host-based intrusion detections (HIDS) tool detect unauthorized file-system changes. Basically all the current solutions employ same tactic: administrator specifies a list of critical files directories that needs be monitored, then uses FIT create base-line database tracks general parameters about these files. The is re-run periodically, if it detects modifications against information stored in database, report on changed file generated. However, this strategy far from perfect: detection cannot done real-time, which might render whole scheme useless attacker can somehow take over system with privileged access time between. also has lot problems keep updating. Besides, he must do everything protect itself compromising by attacker, not an easy task especially gains local access. This paper presents novel approach address outstanding FIT. We propose design implementation named XenRIM for Xen virtual machines. monitor fires alarms real-time manner, our does require update like legacy methods. As result, almost effortless deploy maintain. Thanks advantage introduced Xen, polices centralized secure machine resistant tampering. Even better, strictly, able function very stealthily avoid suspect attacker. Our experimental result demonstrates incurs low performance overhead (less than 4%), makes solution attractive practical production systems