Hypervisor-assisted atomic memory acquisition in modern systems

Michael Kiperberg; Roee Leon; Amit Resh; Asaf Algawi; Nezer Zaidenberg

doi:10.5220/0007566101550162

Hypervisor-assisted atomic memory acquisition in modern systems

Michael Kiperberg, Roee Leon, Amit Resh, Asaf Algawi, Nezer Zaidenberg

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

15 Scopus citations

Abstract

Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method.

Original language	English
Title of host publication	ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy
Editors	Paolo Mori, Steven Furnell, Olivier Camp
Publisher	Science and Technology Publications, Lda
Pages	155-162
Number of pages	8
ISBN (Print)	9789897583599
DOIs	https://doi.org/10.5220/0007566101550162
State	Published - 2019
Externally published	Yes
Event	5th International Conference on Information Systems Security and Privacy , ICISSP 2019 - Prague, Czech Republic Duration: 23 Feb 2019 → 25 Feb 2019

Publication series

Name	ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy

Conference

Conference	5th International Conference on Information Systems Security and Privacy , ICISSP 2019
Country/Territory	Czech Republic
City	Prague
Period	23/02/19 → 25/02/19

Keywords

Atomicity
Forensic Soundness
Integrity of a Memory Snapshot
Live Forensics
Memory Acquisition
Memory Forensics
Reliability
Virtualization

Access to Document

10.5220/0007566101550162

Cite this

Kiperberg, M., Leon, R., Resh, A., Algawi, A., & Zaidenberg, N. (2019). Hypervisor-assisted atomic memory acquisition in modern systems. In P. Mori, S. Furnell, & O. Camp (Eds.), ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy (pp. 155-162). (ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy). Science and Technology Publications, Lda. https://doi.org/10.5220/0007566101550162

Kiperberg, Michael ; Leon, Roee ; Resh, Amit et al. / Hypervisor-assisted atomic memory acquisition in modern systems. ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy. editor / Paolo Mori ; Steven Furnell ; Olivier Camp. Science and Technology Publications, Lda, 2019. pp. 155-162 (ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy).

@inproceedings{ef862179700f4a5e957e6e8895412d7c,

title = "Hypervisor-assisted atomic memory acquisition in modern systems",

abstract = "Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method.",

keywords = "Atomicity, Forensic Soundness, Integrity of a Memory Snapshot, Live Forensics, Memory Acquisition, Memory Forensics, Reliability, Virtualization",

author = "Michael Kiperberg and Roee Leon and Amit Resh and Asaf Algawi and Nezer Zaidenberg",

note = "Publisher Copyright: {\textcopyright} 2019 by SCITEPRESS-Science and Technology Publications, Lda. All rights reserved.; 5th International Conference on Information Systems Security and Privacy , ICISSP 2019 ; Conference date: 23-02-2019 Through 25-02-2019",

year = "2019",

doi = "10.5220/0007566101550162",

language = "אנגלית",

isbn = "9789897583599",

series = "ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy",

publisher = "Science and Technology Publications, Lda",

pages = "155--162",

editor = "Paolo Mori and Steven Furnell and Olivier Camp",

booktitle = "ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy",

}

Kiperberg, M, Leon, R, Resh, A, Algawi, A & Zaidenberg, N 2019, Hypervisor-assisted atomic memory acquisition in modern systems. in P Mori, S Furnell & O Camp (eds), ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy. ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy, Science and Technology Publications, Lda, pp. 155-162, 5th International Conference on Information Systems Security and Privacy , ICISSP 2019, Prague, Czech Republic, 23/02/19. https://doi.org/10.5220/0007566101550162

Hypervisor-assisted atomic memory acquisition in modern systems. / Kiperberg, Michael; Leon, Roee; Resh, Amit et al.
ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy. ed. / Paolo Mori; Steven Furnell; Olivier Camp. Science and Technology Publications, Lda, 2019. p. 155-162 (ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Hypervisor-assisted atomic memory acquisition in modern systems

AU - Kiperberg, Michael

AU - Leon, Roee

AU - Resh, Amit

AU - Algawi, Asaf

AU - Zaidenberg, Nezer

PY - 2019

Y1 - 2019

N2 - Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method.

AB - Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method.

KW - Atomicity

KW - Forensic Soundness

KW - Integrity of a Memory Snapshot

KW - Live Forensics

KW - Memory Acquisition

KW - Memory Forensics

KW - Reliability

KW - Virtualization

UR - http://www.scopus.com/inward/record.url?scp=85064642291&partnerID=8YFLogxK

U2 - 10.5220/0007566101550162

DO - 10.5220/0007566101550162

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85064642291

SN - 9789897583599

T3 - ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy

SP - 155

EP - 162

BT - ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy

A2 - Mori, Paolo

A2 - Furnell, Steven

A2 - Camp, Olivier

PB - Science and Technology Publications, Lda

T2 - 5th International Conference on Information Systems Security and Privacy , ICISSP 2019

Y2 - 23 February 2019 through 25 February 2019

ER -

Kiperberg M, Leon R, Resh A, Algawi A, Zaidenberg N. Hypervisor-assisted atomic memory acquisition in modern systems. In Mori P, Furnell S, Camp O, editors, ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy. Science and Technology Publications, Lda. 2019. p. 155-162. (ICISSP 2019 - Proceedings of the 5th International Conference on Information Systems Security and Privacy). doi: 10.5220/0007566101550162

Hypervisor-assisted atomic memory acquisition in modern systems

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this