EDU: Collaborative: Using Virtual Machine Introspection for Deep Cyber Security Education

网络安全是计算机科学中最具战略意义的领域之一，也是最难有效教学的学科之一。从历史上看，动手网络安全练习帮助学生加强基本概念，但大多数都集中在用户层面的攻击和防御。由于操作系统内核为应用程序提供了基础，因此对操作系统内核的任何妥协都将导致完全不可信的计算。因此，对学生进行内核级攻击与防御的实践教学势在必行。在过去的十年中，人们对使用虚拟化来分析、描述和观察内核事件（包括安全事件）产生了浓厚的兴趣。受虚拟机自省（VMI）巨大成功的启发，该项目旨在通过在虚拟化之上直接构建实用的VMI工具和库（或工具包），并将其应用于深度网络安全教育，从而提供一种进步。深度来自于对底层系统内部的研究，如操作系统内核。该项目将进一步提供一些种子内容，教授教师和学生如何利用该工具包，不仅用于研究传统的用户级攻击（如缓冲区溢出），还用于研究操作系统内核内部的防御。该项目的成果（即，工具包和网络安全演习）将有助于提高网络安全教育的先进水平，特别是有效执行实际操作的网络安全演习，从而为我们社会的健康、安全和经济福祉做出贡献。

Cybersecurity is one of the most strategically important areas in computer science, and also one of the most difficult disciplines to teach effectively. Historically, hands-on cyber security exercises helped students reinforce basic concepts, but most of them focused on user level attacks and defenses. Since OS kernels provide the foundations to the applications, any compromise to OS kernels will lead to an entirely untrusted computing. Therefore, it is imperative to teach students the practice of kernel level attacks and defenses.Over the past decade, there has been great interest in using virtualization to profile, characterize, and observe kernel events including the security incidents. Inspired by the great success from virtual machine introspection (VMI), this project aims to provide an advancement by directly building practical VMI tools and libraries (or toolkit) on top of virtualization, and applying them for deep cybersecurity education. The deepness comes from the study of the lower level system internals such as OS kernels. The project will further provide a number of seed contents to teach both instructors and students on utilizing the toolkit to be used for studying not only traditional user level attacks such as buffer overflow, but also defenses inside the OS kernels. The outcome of this project (i.e., the toolkit and the cybersecurity exercises) will contribute to the health, safety, and economic well-being of our society by helping to improve the state-of-the-art in cybersecurity education, especially for effectively performing hands-on cybersecurity exercises.