loading
Documents

Research.Publish.Connect.

Paper

Authors: Michael Kiperberg 1 ; Roee Leon 2 ; Amit Resh 3 ; Asaf Algawi 2 and Nezer Zaidenberg 4

Affiliations: 1 Faculty of Sciences, Holon Institute of Technology, Israel ; 2 Department of Mathematical IT, University of Jyväskylä, Finland ; 3 School of Computer Engineering, Shenkar College of Engineering, Design and Art, Israel ; 4 School of Computer Sciences, The College of Management, Academic Studies, Israel

ISBN: 978-989-758-359-9

Keyword(s): Live Forensics, Memory Forensics, Memory Acquisition, Virtualization, Reliability, Atomicity, Integrity of a Memory Snapshot, Forensic Soundness.

Abstract: Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method.

PDF ImageFull Text

Download
CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 18.206.15.215

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Kiperberg, M.; Leon, R.; Resh, A.; Algawi, A. and Zaidenberg, N. (2019). Hypervisor-assisted Atomic Memory Acquisition in Modern Systems.In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-359-9, pages 155-162. DOI: 10.5220/0007566101550162

@conference{icissp19,
author={Michael Kiperberg. and Roee Leon. and Amit Resh. and Asaf Algawi. and Nezer Zaidenberg.},
title={Hypervisor-assisted Atomic Memory Acquisition in Modern Systems},
booktitle={Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2019},
pages={155-162},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007566101550162},
isbn={978-989-758-359-9},
}

TY - CONF

JO - Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Hypervisor-assisted Atomic Memory Acquisition in Modern Systems
SN - 978-989-758-359-9
AU - Kiperberg, M.
AU - Leon, R.
AU - Resh, A.
AU - Algawi, A.
AU - Zaidenberg, N.
PY - 2019
SP - 155
EP - 162
DO - 10.5220/0007566101550162

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.