Repository logo
  • Log In
    New user? Click here to register.Have you forgotten your password?
University College Dublin
    Colleges & Schools
    Statistics
    All of DSpace
  • Log In
    New user? Click here to register.Have you forgotten your password?
  1. Home
  2. Institutes and Centres
  3. Insight Centre for Data Analytics
  4. Insight Research Collection
  5. Virtual Machine Forensics by means of Introspection and Kernel Code Injection
 
  • Details
Options

Virtual Machine Forensics by means of Introspection and Kernel Code Injection

Author(s)
Tobin, Patrick  
Kechadi, Tahar  
Uri
http://hdl.handle.net/10197/6478
Date Issued
2014-03-24
Date Available
2015-04-14T09:50:21Z
Abstract
Virtual Machine Introspection offers the ability to access a virtual machine remotely and extract informationfrom it. Virtual machine introspection allows all processes, local data, and network traffic to be tracked andmade available to the investigation process. These properties offer the possibility to monitor a suspect virtualmachine (VM). Moreover, the access to a VM data is far from being trivial; there are various complex tasks tobe dealt with. For instance the returned data is in a raw format, and it is necessary to remap into a userfriendly representation (canonical representation). In this paper we propose a method of bridging thissemantic gap, and provide a graphical reconstruction of events. This proposal is essentially, the recreation ofa virtual machine at a remote location and the subsequent recreation of all processes, data, network traffic ina virtual machine as they occur in the original. This should be achieved in real-time, which will give anopportunity to quickly make decisions based on the evidence as we collect them in real-time. Our approachinvolves recreating a virtual machine and injecting into it all code and data within the original virtual machine,presenting an identical copy for examination. The approach proposed also has another advantage byallowing all data to be saved for further analysis and verification.
Sponsorship
Science Foundation Ireland
Type of Material
Conference Publication
Copyright (Published Version)
2014 the Author
Subjects

Machine learning

Statistics

Virtualisation

Digital forensics

Kernel injection

Virtual Machine intro...

Web versions
http://academic-conferences.org/iciw/iciw2014/iciw14-home.htm
Language
English
Status of Item
Peer reviewed
Conference Details
9th International Conference on Cyber Warfare and Security, Purdue University, West Lafayette, Indiana, United States, 24-25 March 2014
This item is made available under a Creative Commons License
https://creativecommons.org/licenses/by-nc-nd/3.0/ie/
File(s)
Loading...
Thumbnail Image
Name

insight_publication.pdf

Size

150.52 KB

Format

Adobe PDF

Checksum (MD5)

8fb1f52631ebdf754a03df8b2c8c0828

Owning collection
Insight Research Collection
Mapped collections
Computer Science Research Collection

Item descriptive metadata is released under a CC-0 (public domain) license: https://creativecommons.org/public-domain/cc0/.
All other content is subject to copyright.

For all queries please contact research.repository@ucd.ie.

Built with DSpace-CRIS software - Extension maintained and optimized by 4Science

  • Cookie settings
  • Privacy policy
  • End User Agreement