![](bg7.png)
analyzes the program memory in order to detect pos-
sible anomalies. Moreover PsycoTrace is not trans-
parent, since it requires a module to be installed on
the monitored machines. The same issue affects the
solution proposed by (Payne et al., 2008), where an
active monitoring for Xen is implemented by a spe-
cific “security driver” to be loaded in the kernel of
monitored machines. However, (Bahram et al., 2010)
have shown that approaches based on virtual memory
introspection can be fooled by the “DKSM attack”
On the other hand, VMScope (Jiang and Wang,
2007) only logs system calls and their arguments (on
QEMU), without any memory inspection. However,
VMScope is used only for a posteriori trace analysis
and attack reconstruction, since it lacks a real IDS.
Finally, the work closest to ours is (Laureano
et al., 2007), which adopts a mechanism for sys-
tem call logging similar to ours (but for User-Mode
Linux). Their intrusion detection methodology in-
tegrates Stide with access control lists: “sensible”
(i.e., possibly dangerous) system calls can be exe-
cuted only by some pre-determined programs; for
each process, the path of the corresponding program
is obtained by direct memory introspection. There-
fore, this approach is not as strictly “black-box” as
ours. Moreover, the DKSM attack could be used for
obfuscating the program names, thus misleading the
IDS.
Future Developments. Although the experimental
evaluation carried out in this paper is encouraging,
keeping the sequences from all programs in a single
database may not scale up as the number of programs
and guest OSs will increase. A possible approach is
to create a separate database for each program (i.e.,
profile), but this raises the issue of how to identify a
program just by its trace of system calls. To this end,
one could use an Hamming distance between a given
process syscall trace, and the profiles (i.e., programs)
present in the database; the profile associated with the
process will be the one with the lowest Hamming dis-
tance. Alternatively, one could create statistical pro-
files based on the distributions of system calls of each
program, and classify processes accordingly.
Finally, it is interesting to investigate whether the
interception mechanism could be detected by means
of some “side channel”. In particular, the intercep-
tion process necessarily introduces some overhead,
increasing the time of system call execution. An at-
tacker could detect this extra delay and use it to distin-
guish an observed system from a non-observed one.
However, this seems unlikely, because virtualization
itself introduces a similar delay, which can be also
quite varying according to several parameters (e.g.
system load, number of virtualized systems, etc.).
REFERENCES
Bahram, S., Jiang, X., Wang, Z., Grace, M., Li, J., Srini-
vasan, D., Rhee, J., and Xu, D. (2010). DKSM:
Subverting virtual machine introspection for fun and
profit. Symp. Reliable Distributed Systems, 82–91.
Baiardi, F., Maggiari, D., Sgandurra, D., and Tamberi, F.
(2009). Transparent process monitoring in a virtual
environment. ENTCS, 85–100.
Barham, P., Dragovic, B., Fraser, K., Hand, S., Harris, T. L.,
Ho, A., Neugebauer, R., Pratt, I., and Warfield, A.
(2003). Xen and the art of virtualization. In Proc.
SOSP, 164–177.
Cohen, W. W. (1995). Fast effective rule induction. In Ma-
chine Learning: the 12th International Conference.
Forrest, S., Hofmeyr, S., and Somayaji, A. (1997). Com-
puter immunology. Comm. ACM, 40(10), 88–96.
Forrest, S., Hofmeyr, S., Somayaji, A., and Longstaff, T.
(1996). A sense of self for UNIX process. Proc. IEEE
Symp. on Security and Privacy, 120–128.
Garfinkel, T. and Rosenblum, M. (2003). A virtual machine
introspection based architecture for intrusion detec-
tion. In Proc. NDSS. The Internet Society.
Helman, P. and Bangoo, J. (1997). A statistically based
system for prioritizing information exploration under
uncertainty. IEEE Transaction on System, Man and
Cybernetics, 27(4), 449–466.
Hofmeyr, S., Somayaji, A., and Forrest, S. (1998). Intrusion
detection using sequences of system calls. Journal of
computer security 6(3), 151–180.
Hofmeyr, S., Somayaji, A., and Forrest, S. (1999). Com-
puter immune systems.
Jiang, X. and Wang, X. (2007). Out-of-the-box mon-
itoring of VM-based high-interaction honeypots.
Proc. RAID’07, 198–218.
Laureano, M., Maziero, C., and Jamhour, E. (2007). Pro-
tecting host-based intrusion detectors through virtual
machines. Computer Networks 51, 1275–1283.
Lee, W. and Stolfo, J. (1998). Data mining approaches for
intrusion detection. Proc. 7th USENIX Security Symp.
Lee, W., Stolfo, J., and Chan, P. (1997). Learning patterns
from UNIX process execution traces for intrusion de-
tection. AAAI Workshop on AI Approaches to Fraud
Detection and Risk Management, 50–56.
Payne, B. D., Carbone, M., Sharif, M., and Lee, W. (2008).
Lares: An architecture for secure active monitoring
using virtualization. Proc. IEEE Symp. on Security
and Privacy, 233–247.
Warrender, C., Forrest, S., and Pearlmutter, B. (1999). De-
tecting intrusions using system calls: Alternative data
models. Proc. IEEE Symposium on Security and Pri-
vacy, 133–145.
Zhang, X., J. Li, Z. J., and Feng, H. (2007). Black-box ex-
traction of funtional structures from system call traces
for intrusion detection. Advanced Intelligent Comput-
ing Theories and Application, 135–144.
SECRYPT 2011 - International Conference on Security and Cryptography
306