.png){kind=icon}
返回
Detecting Hardware-Assisted Virtualization With Inconspicuous Features
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2020.3004264.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Recent years have witnessed the proliferation of the deployment of virtualization techniques. Virtualization is designed to be transparent, that is, unprivileged users should not be able to detect whether a system is virtualized. Such detection can result in serious security threats such as evading virtual machine (VM)-based malware dynamic analysis and exploiting vulnerabilities for cross-VM attacks. The traditional software-based virtualization leaves numerous artifacts/fingerprints, which can be exploited without much effort to detect the virtualization. In contrast, current mainstream hardware-assisted virtualization significantly enhances the virtualization transparency, making itself more transparent and difficult to be detected. Nonetheless, we showcase three new identified low-level inconspicuous features, which can be leveraged by an unprivileged adversary to effectively and stealthily detect the hardware-assisted virtualization. All three features come from the chipset fingerprints, rather than the traces of software-based virtualization implementations (e.g., Xen or KVM). The identified features include i) Translation-Lookaside Buffer (TLB) stores an extra layer of address translations; ii) Last-Level Cache (LLC) caches one more layer of page-table entries; and iii) Level-1 Data (L1D) Cache is unstable. Based on the above features, we develop three corresponding virtualization detection techniques, which are then comprehensively evaluated on three native environments and three popular cloud providers: i) Amazon Elastic Compute Cloud, ii) Google Compute Engine and iii) Microsoft Azure. Experimental results validate that these three adversarial detection techniques are effective (with no false positive) and stealthy (without triggering suspicious system events, e.g., VM-exit) in detecting the above commodity virtualized environments.
Keyword:
Virtualization-based malware analysis
microarchitectural timing
virtual machine-based rootkit
virtualization detection
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
Protocatechuate 3,4-dioxygenase: comparative study of inhibition and active-site interactions of pyridine N-oxides.png)
Biochemistry
BiochemistryIF0
PREAI
分享收藏Structural Changes in Lumirhodopsin and Metarhodopsin I Studied by Their Photoreactions at 77 KBiochemistry
BiochemistryIF0
PREAI
分享收藏Comparative study between pulsed and continuous wave lasers for Photofrin® photodynamic therapy
PREAI
分享收藏
查看更多内容