EDU: Collaborative: Using Virtual Machine Introspection for Deep Cyber Security Education

网络安全是计算机科学中最具战略意义的领域之一，也是最难有效教学的学科之一。从历史上看，网络安全实践练习可以帮助学生强化基本概念，但大多数都侧重于用户级攻击和防御。由于操作系统内核为应用程序提供了基础，因此对操作系统内核的任何妥协都将导致完全不可信的计算。因此，教授学生内核级攻击和防御的实践势在必行。在过去的十年中，人们对使用虚拟化来分析、表征和观察包括安全事件在内的内核事件产生了极大的兴趣。受到虚拟机自省（VMI）巨大成功的启发，该项目旨在通过在虚拟化之上直接构建实用的 VMI 工具和库（或工具包）并将其应用于深度网络安全教育来提供进步。深度来自于对操作系统内核等较低层系统内部结构的研究。该项目还将提供一些种子内容，教教师和学生如何利用该工具包，不仅可以研究缓冲区溢出等传统的用户级攻击，还可以研究操作系统内核内部的防御。该项目的成果（即工具包和网络安全练习）将有助于提高网络安全教育的最新水平，特别是有效进行网络安全实践练习，从而为我们社会的健康、安全和经济福祉做出贡献。

Cybersecurity is one of the most strategically important areas in computer science, and also one of the most difficult disciplines to teach effectively. Historically, hands-on cyber security exercises helped students reinforce basic concepts, but most of them focused on user level attacks and defenses. Since OS kernels provide the foundations to the applications, any compromise to OS kernels will lead to an entirely untrusted computing. Therefore, it is imperative to teach students the practice of kernel level attacks and defenses.Over the past decade, there has been great interest in using virtualization to profile, characterize, and observe kernel events including the security incidents. Inspired by the great success from virtual machine introspection (VMI), this project aims to provide an advancement by directly building practical VMI tools and libraries (or toolkit) on top of virtualization, and applying them for deep cybersecurity education. The deepness comes from the study of the lower level system internals such as OS kernels. The project will further provide a number of seed contents to teach both instructors and students on utilizing the toolkit to be used for studying not only traditional user level attacks such as buffer overflow, but also defenses inside the OS kernels. The outcome of this project (i.e., the toolkit and the cybersecurity exercises) will contribute to the health, safety, and economic well-being of our society by helping to improve the state-of-the-art in cybersecurity education, especially for effectively performing hands-on cybersecurity exercises.