Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot

Nezer Jacob Zaidenberg; Michael Kiperberg; Raz Ben Yehuda; Roee Leon; Asaf Algawi; Amit Resh

doi:10.1007/978-3-030-49443-8_15

Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot

Nezer Jacob Zaidenberg, Michael Kiperberg, Raz Ben Yehuda, Roee Leon, Asaf Algawi, Amit Resh

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

Memory acquisition is a tool used in advanced forensics and malware analysis. Various methods of memory acquisition exist. Such solutions are ranging from tools based on dedicated hardware to software-only solutions. We proposed a hypervisor based memory acquisition tool. [22]. Our method supports ASLR and Modern operating systems which is an innovation compared to past methods [27, 36]. We extend the hypervisor assisted memory acquisition by adding mass storage device honeypots for the malware to cross and propose hiding the hypervisor using bluepill technology.

Original language	English
Title of host publication	Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers
Editors	Paolo Mori, Steven Furnell, Olivier Camp
Pages	317-334
Number of pages	18
DOIs	https://doi.org/10.1007/978-3-030-49443-8_15
State	Published - 2020
Externally published	Yes
Event	5th International Conference on Information Systems Security and Privacy, ICISSP 2019 - Prague, Czech Republic Duration: 23 Feb 2019 → 25 Feb 2019

Publication series

Name	Communications in Computer and Information Science
Volume	1221 CCIS
ISSN (Print)	1865-0929
ISSN (Electronic)	1865-0937

Conference

Conference	5th International Conference on Information Systems Security and Privacy, ICISSP 2019
Country/Territory	Czech Republic
City	Prague
Period	23/02/19 → 25/02/19

Keywords

Atomicity
Forensic soundness
Integrity of a memory snapshot
Live forensics
Memory acquisition
Memory forensics
Reliability
Virtualization

Access to Document

10.1007/978-3-030-49443-8_15

Cite this

Zaidenberg, N. J., Kiperberg, M., Yehuda, R. B., Leon, R., Algawi, A., & Resh, A. (2020). Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot. In P. Mori, S. Furnell, & O. Camp (Eds.), Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers (pp. 317-334). (Communications in Computer and Information Science; Vol. 1221 CCIS). https://doi.org/10.1007/978-3-030-49443-8_15

Zaidenberg, Nezer Jacob ; Kiperberg, Michael ; Yehuda, Raz Ben et al. / Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot. Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers. editor / Paolo Mori ; Steven Furnell ; Olivier Camp. 2020. pp. 317-334 (Communications in Computer and Information Science).

@inproceedings{073ed74a0abd4691a354deec4e0ef6f5,

title = "Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot",

abstract = "Memory acquisition is a tool used in advanced forensics and malware analysis. Various methods of memory acquisition exist. Such solutions are ranging from tools based on dedicated hardware to software-only solutions. We proposed a hypervisor based memory acquisition tool. [22]. Our method supports ASLR and Modern operating systems which is an innovation compared to past methods [27, 36]. We extend the hypervisor assisted memory acquisition by adding mass storage device honeypots for the malware to cross and propose hiding the hypervisor using bluepill technology.",

keywords = "Atomicity, Forensic soundness, Integrity of a memory snapshot, Live forensics, Memory acquisition, Memory forensics, Reliability, Virtualization",

author = "Zaidenberg, {Nezer Jacob} and Michael Kiperberg and Yehuda, {Raz Ben} and Roee Leon and Asaf Algawi and Amit Resh",

note = "Publisher Copyright: {\textcopyright} 2020, Springer Nature Switzerland AG.; 5th International Conference on Information Systems Security and Privacy, ICISSP 2019 ; Conference date: 23-02-2019 Through 25-02-2019",

year = "2020",

doi = "10.1007/978-3-030-49443-8_15",

language = "אנגלית",

isbn = "9783030494421",

series = "Communications in Computer and Information Science",

pages = "317--334",

editor = "Paolo Mori and Steven Furnell and Olivier Camp",

booktitle = "Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers",

}

Zaidenberg, NJ, Kiperberg, M, Yehuda, RB, Leon, R, Algawi, A & Resh, A 2020, Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot. in P Mori, S Furnell & O Camp (eds), Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers. Communications in Computer and Information Science, vol. 1221 CCIS, pp. 317-334, 5th International Conference on Information Systems Security and Privacy, ICISSP 2019, Prague, Czech Republic, 23/02/19. https://doi.org/10.1007/978-3-030-49443-8_15

Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot. / Zaidenberg, Nezer Jacob; Kiperberg, Michael; Yehuda, Raz Ben et al.
Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers. ed. / Paolo Mori; Steven Furnell; Olivier Camp. 2020. p. 317-334 (Communications in Computer and Information Science; Vol. 1221 CCIS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot

AU - Zaidenberg, Nezer Jacob

AU - Kiperberg, Michael

AU - Yehuda, Raz Ben

AU - Leon, Roee

AU - Algawi, Asaf

AU - Resh, Amit

PY - 2020

Y1 - 2020

N2 - Memory acquisition is a tool used in advanced forensics and malware analysis. Various methods of memory acquisition exist. Such solutions are ranging from tools based on dedicated hardware to software-only solutions. We proposed a hypervisor based memory acquisition tool. [22]. Our method supports ASLR and Modern operating systems which is an innovation compared to past methods [27, 36]. We extend the hypervisor assisted memory acquisition by adding mass storage device honeypots for the malware to cross and propose hiding the hypervisor using bluepill technology.

AB - Memory acquisition is a tool used in advanced forensics and malware analysis. Various methods of memory acquisition exist. Such solutions are ranging from tools based on dedicated hardware to software-only solutions. We proposed a hypervisor based memory acquisition tool. [22]. Our method supports ASLR and Modern operating systems which is an innovation compared to past methods [27, 36]. We extend the hypervisor assisted memory acquisition by adding mass storage device honeypots for the malware to cross and propose hiding the hypervisor using bluepill technology.

KW - Atomicity

KW - Forensic soundness

KW - Integrity of a memory snapshot

KW - Live forensics

KW - Memory acquisition

KW - Memory forensics

KW - Reliability

KW - Virtualization

UR - http://www.scopus.com/inward/record.url?scp=85088260230&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-49443-8_15

DO - 10.1007/978-3-030-49443-8_15

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85088260230

SN - 9783030494421

T3 - Communications in Computer and Information Science

SP - 317

EP - 334

BT - Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers

A2 - Mori, Paolo

A2 - Furnell, Steven

A2 - Camp, Olivier

T2 - 5th International Conference on Information Systems Security and Privacy, ICISSP 2019

Y2 - 23 February 2019 through 25 February 2019

ER -

Zaidenberg NJ, Kiperberg M, Yehuda RB, Leon R, Algawi A, Resh A. Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot. In Mori P, Furnell S, Camp O, editors, Information Systems Security and Privacy - 5th International Conference, ICISSP 2019, Revised Selected Papers. 2020. p. 317-334. (Communications in Computer and Information Science). doi: 10.1007/978-3-030-49443-8_15

Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this