Virtuoso：Narrowing the Semantic Gap in Virtual Machine Introspection.pdfVIP

2011 IEEE Symposium on Security and Privacy Virtuoso: Narrowing the Semantic Gap in Virtual Machine Introspection * * * Brendan Dolan-Gavitt , Tim Leek , Michael Zhivich , Jonathon Giffin , and Wenke Lee * Georgia Institute of Technology School of Computer Science brendan,giffin,wenke@ MIT Lincoln Laboratory tleek,mzhivich@ Abstract—Introspection has featured prominently in many of running processes, open files, and active network con- recent security solutions, such as virtual machine-based in- nections. Even if the guest OS is compromised, the tools trusion detection, forensic memory analysis, and low-artifact using introspection will continue to report accurate results, malware analysis. Widespread adoption of these approaches, however, has been hampered by the semantic gap : in order so long as the underlying internal data structures used by to extract meaningful information about the current state of the operating system are intact. a virtual machine, detailed knowledge of the guest operating The creation and maintenance of introspection tools, system’s inner workings is required. In this paper, we present therefore, is dependent on detailed, up-to-date information a novel approach for automatically creating introspection about the