(Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring
(Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring
复制标题
（短论文）具有虚拟机监控的证据收集和保存系统
DOI：
10.1007/978-3-030-85987-9_4
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Yamauchi Toshihiro
中科院分区：
文献类型：
--
作者：
Nakamura Toru;Ito Hiroshi;Kiyomoto Shinsaku;Yamauchi Toshihiro
在系统审计和验证中，安全地收集和保存执行环境、执行过程和程序执行结果的证据是很重要的。基于证据的程序进程验证可确保其真实性;例如，进程不包括被更改/感染的程序库。提出了一种基于虚拟机监视器（VMM）的程序库证据收集解决方案。该方案通过获取库文件路径名来解决语义鸿沟问题。本文还展示了一种从客户机操作系统中获取库文件哈希值的方法。此外，本文还提供了程序执行的证据和解决方案的开销的例子。
In a system audit and verification, it is important to securely collect and preserve evidence of execution environments, execution processes, and program execution results. Evidence-based verification of program processes ensures their authenticity; for example, the processes include no altered/infected program library. This paper proposes a solution for collection of evidence on program libraries based on Virtual Machine Monitor (VMM). The solution can solve semantic gap by obtaining library file path names. This paper also shows a way to obtain hash values of library files from a guest OS. Furthermore, this paper provides examples of evidence on program execution and the overhead of the solution.