Entry Fu:2013:BSG from tissec.bib
Last update: Sun Oct 15 02:58:48 MDT 2017
Top |
Symbols |
Numbers |
Math |
A |
B |
C |
D |
E |
F |
G |
H |
I |
J |
K |
L |
M |
N |
O |
P |
Q |
R |
S |
T |
U |
V |
W |
X |
Y |
Z
BibTeX entry
@Article{Fu:2013:BSG,
author = "Yangchun Fu and Zhiqiang Lin",
title = "Bridging the Semantic Gap in Virtual Machine
Introspection via Online Kernel Data Redirection",
journal = j-TISSEC,
volume = "16",
number = "2",
pages = "7:1--7:??",
month = sep,
year = "2013",
CODEN = "ATISBQ",
DOI = "https://doi.org/10.1145/2505124",
ISSN = "1094-9224 (print), 1557-7406 (electronic)",
ISSN-L = "1094-9224",
bibdate = "Mon Sep 23 17:04:07 MDT 2013",
bibsource = "http://portal.acm.org/;
http://www.math.utah.edu/pub/tex/bib/tissec.bib;
http://www.math.utah.edu/pub/tex/bib/virtual-machines.bib",
abstract = "It is generally believed to be a tedious,
time-consuming, and error-prone process to develop a
virtual machine introspection (VMI) tool because of the
semantic gap. Recent advance shows that the
semantic-gap can be largely narrowed by reusing the
executed code from a trusted OS kernel. However, the
limitation for such an approach is that it only reuses
the exercised code through a training process, which
suffers the code coverage issues. Thus, in this
article, we present Vmst, a new technique that can
seamlessly bridge the semantic gap and automatically
generate the VMI tools. The key idea is that, through
system wide instruction monitoring, Vmst automatically
identifies the introspection related data from a
secure-VM and online redirects these data accesses to
the kernel memory of a product-VM, without any
training. Vmst offers a number of new features and
capabilities. Particularly, it enables an in-VM
inspection program (e.g., ps) to automatically become
an out-of-VM introspection program. We have tested Vmst
with over 25 commonly used utilities on top of a number
of different OS kernels including Linux and Microsoft
Windows. The experimental results show that our
technique is general (largely OS-independent), and it
introduces 9.3X overhead for Linux utilities and 19.6X
overhead for Windows utilities on average for the
introspected program compared to the native in-VM
execution without data redirection.",
acknowledgement = ack-nhfb,
articleno = "7",
fjournal = "ACM Transactions on Information and System Security",
journal-URL = "http://portal.acm.org/browse_dl.cfm?idx=J789",
}
Related entries
- advance,
11(4)22,
14(1)2,
18(3)9
- any,
1(1)66,
1(1)93,
2(4)390,
9(4)461,
10(3)10,
10(3)12,
10(4)1,
10(4)4,
11(2)4,
11(2)6,
11(3)13,
11(3)16,
11(4)20,
12(1)3,
12(1)5,
12(1)6,
12(2)8,
12(2)9,
12(2)10,
12(3)14,
12(3)18,
12(3)19,
12(4)20,
13(1)10,
13(3)28,
13(4)33,
13(4)39,
14(1)6,
14(1)8,
14(1)9,
14(4)32,
15(1)2,
15(2)9,
15(2)10,
15(4)17,
16(2)6,
16(3)12,
16(4)13,
16(4)15,
17(2)8,
17(3)9,
17(3)11,
18(1)1
- approach,
1(1)3,
1(1)26,
2(1)34,
2(2)138,
2(3)269,
2(3)295,
5(2)119,
5(3)203,
6(1)128,
7(3)392,
9(4)391,
9(4)421,
10(1)2,
10(1)4,
10(3)11,
10(3)12,
10(4)4,
11(1)3,
11(3)15,
11(3)16,
11(4)17,
11(4)19,
12(1)1,
12(1)4,
12(2)11,
12(3)14,
13(3)20,
13(3)24,
13(4)31,
13(4)35,
13(4)36,
14(1)8,
14(3)23,
14(4)29,
15(1)4,
15(3)12,
15(3)13,
15(4)15,
15(4)17,
15(4)18,
16(2)5,
16(2)8,
16(4)15,
16(4)16,
17(3)12,
17(4)14,
18(2)5,
18(2)7,
18(3)11
- article,
10(1)3,
11(1)3,
11(1)4,
11(2)5,
11(3)12,
11(3)14,
11(3)15,
11(3)16,
11(4)20,
11(4)22,
11(4)23,
12(1)1,
12(1)2,
12(1)4,
12(1)6,
12(2)8,
12(2)10,
12(2)13,
12(3)14,
12(3)16,
12(3)17,
12(3)19,
12(4)21,
12(4)22,
13(3)22,
13(3)24,
13(3)25,
13(3)27,
13(3)28,
13(4)29,
13(4)31,
13(4)32,
13(4)34,
13(4)36,
13(4)41,
14(1)2,
14(1)3,
14(1)4,
14(1)10,
14(1)13,
14(1)14,
14(3)23,
14(3)25,
14(4)30,
15(2)9,
15(2)10,
15(3)11,
15(3)12,
15(3)13,
15(4)15,
15(4)16,
15(4)17,
16(1)1,
16(1)4,
16(2)6,
16(2)8,
16(3)10,
16(4)14,
16(4)15,
17(2)8,
17(3)9,
17(3)11,
17(3)12,
17(4)13,
17(4)16,
18(1)3,
18(2)5,
18(2)7,
18(3)9,
18(3)10,
18(3)11,
18(4)12,
18(4)14
- automatically,
10(2)8,
12(2)10,
13(3)24,
14(1)2,
15(2)6,
15(4)18,
16(2)5,
17(2)7,
17(4)13,
18(3)9
- average,
13(4)35,
16(3)10
- because,
1(1)66,
2(3)269,
10(4)5,
11(4)18,
11(4)21,
12(1)2,
12(2)10,
14(1)3,
14(4)29,
17(1)1,
17(1)4,
17(3)10
- become,
11(2)2,
11(3)14,
12(3)14,
12(4)21,
13(4)36,
14(1)3,
14(3)25,
15(1)4,
17(2)6,
17(4)15,
18(1)2
- believed,
10(2)5
- bridge,
15(3)13
- bridging,
14(4)31
- capability,
10(1)4,
10(4)2,
11(1)3,
11(2)2,
11(3)14,
16(4)13,
17(2)7,
17(3)9,
17(3)10
- code,
5(3)238,
6(2)258,
11(4)23,
12(2)10,
12(2)11,
12(3)14,
12(3)19,
13(1)10,
13(2)17,
13(3)21,
15(1)2,
15(1)3,
15(2)10,
16(1)1,
16(2)6,
16(3)9,
18(4)12
- commonly,
11(3)14,
11(3)16,
13(1)10,
13(3)21,
18(4)13
- compared,
2(3)269,
11(3)14,
12(1)3,
12(3)18,
15(4)17,
17(3)10
- consuming, time-,
11(1)2
- coverage,
10(4)6,
12(1)4,
16(4)17
- develop,
2(2)138,
10(2)8,
10(3)9,
11(3)12,
12(1)4,
12(1)6,
12(3)14,
13(3)22,
13(3)27,
14(1)9,
14(4)32,
15(1)3,
15(2)9,
15(2)10,
16(3)10,
17(1)2
- different,
1(1)26,
1(1)93,
2(1)105,
2(2)138,
2(3)269,
10(1)2,
10(1)4,
10(4)4,
12(1)3,
12(3)14,
13(1)10,
13(3)27,
13(3)28,
14(1)4,
14(4)28,
15(1)2,
15(2)7,
15(2)10,
16(1)3,
16(3)9,
16(4)15,
17(2)7,
17(4)14,
18(1)1,
18(3)11
- e.g.,
1(1)66,
2(2)177,
2(3)230,
2(4)354,
2(4)390,
10(4)1,
11(4)22,
12(1)1,
12(2)10,
12(2)12,
14(1)2,
15(2)6,
16(4)14,
17(1)1,
17(3)12,
17(4)15,
18(3)9
- enable,
2(2)177,
2(3)230,
2(4)354,
9(4)461,
10(2)5,
11(1)3,
11(4)17,
11(4)23,
12(1)1,
12(1)6,
12(3)14,
13(3)25,
13(4)31,
14(1)3,
14(1)8,
14(4)32,
15(2)7,
16(1)2,
17(2)5,
17(2)8,
17(3)10,
17(4)16,
18(1)2
- executed,
13(3)28,
16(1)4
- execution,
1(1)26,
10(4)3,
12(2)10,
12(2)11,
12(3)14,
14(1)6,
14(2)15,
14(4)32,
15(1)2,
15(2)10,
15(3)13,
16(1)3,
16(2)6,
18(1)2,
18(1)4
- experimental,
1(1)3,
1(1)26,
10(1)3,
10(1)4,
11(1)3,
11(4)22,
11(4)23,
12(1)4,
12(3)16,
13(3)22,
15(3)12,
15(4)16,
16(3)10,
16(4)17,
18(3)11,
18(4)12
- feature,
2(1)34,
2(2)177,
2(3)295,
3(4)227,
10(1)2,
10(3)12,
11(4)22,
13(3)24,
13(4)32,
13(4)35,
13(4)41,
16(2)5,
16(4)13,
16(4)14,
17(3)10,
17(4)16,
18(2)5,
18(3)11
- gap,
14(4)31,
15(1)3,
15(3)13,
17(1)2
- general,
1(1)66,
2(1)65,
2(1)105,
2(2)159,
2(3)230,
2(3)269,
9(2)181,
9(4)391,
10(1)2,
10(4)1,
11(1)3,
12(1)2,
12(1)5,
12(3)18,
12(4)20,
13(3)28,
15(1)2,
15(3)13,
16(1)2,
16(1)4,
17(1)3,
17(1)4,
18(1)3,
18(3)10,
18(4)12
- generally,
10(3)9
- generate,
2(4)390,
10(2)5,
10(4)2,
11(4)18,
12(2)10,
12(2)11,
13(3)24,
14(1)6,
14(1)12,
16(2)8,
18(3)9
- have,
1(1)66,
1(1)93,
2(1)65,
2(2)138,
2(3)230,
2(3)269,
10(1)2,
10(1)4,
10(2)5,
10(3)10,
10(3)12,
10(4)4,
10(4)5,
10(4)6,
11(1)2,
11(2)1,
11(2)5,
11(3)15,
11(3)16,
11(4)17,
11(4)18,
11(4)21,
12(1)1,
12(1)2,
12(2)10,
12(2)13,
12(3)15,
12(3)16,
12(3)17,
12(4)20,
13(3)20,
13(3)26,
13(3)27,
13(3)28,
13(4)32,
13(4)36,
13(4)39,
13(4)40,
14(1)6,
14(1)7,
14(1)10,
14(1)13,
14(1)14,
14(3)27,
14(4)28,
14(4)29,
15(2)7,
15(2)9,
15(2)10,
15(3)12,
15(4)18,
16(2)8,
16(3)10,
16(4)15,
16(4)16,
17(1)3,
17(3)11,
17(3)12,
17(4)13,
17(4)15,
18(1)1,
18(1)3,
18(2)5,
18(2)7,
18(4)13
- however,
2(3)269,
10(2)5,
10(2)8,
11(2)6,
11(3)15,
11(4)18,
11(4)20,
11(4)22,
13(3)20,
13(3)22,
13(4)35,
13(4)38,
13(4)39,
14(1)14,
14(3)24,
14(4)28,
14(4)29,
15(2)10,
16(3)11,
17(1)2,
17(1)4,
17(3)12,
17(4)15,
18(1)1,
18(2)7,
18(4)13
- idea,
1(1)93,
10(3)9,
12(1)2,
12(2)11,
14(1)4,
15(1)4,
16(1)1
- identify,
11(2)2,
11(3)12,
11(3)15,
11(3)16,
11(4)18,
11(4)20,
12(1)4,
12(4)20,
12(4)22,
13(4)35,
14(1)13,
15(4)18,
17(4)13,
18(4)13
- including,
2(2)177,
2(3)295,
10(2)6,
10(3)11,
10(4)1,
11(2)2,
11(3)14,
11(4)20,
11(4)22,
12(2)12,
12(3)14,
12(3)19,
13(4)32,
14(1)13,
15(2)6,
15(3)12,
16(2)5,
16(4)17,
18(1)1,
18(1)4
- inspection,
11(4)20
- instruction,
8(1)3,
15(1)2
- introduce,
1(1)66,
1(1)93,
2(3)230,
2(4)390,
9(2)162,
10(1)2,
10(1)3,
10(4)2,
11(2)5,
11(3)12,
11(4)17,
12(1)1,
12(1)3,
12(1)5,
12(2)13,
12(3)14,
12(3)15,
12(4)20,
13(3)24,
13(3)27,
13(4)32,
14(1)3,
14(1)12,
15(1)2,
16(3)9,
16(3)12,
16(4)17,
17(2)7,
17(3)9
- issue,
1(1)66,
2(1)65,
2(4)354,
8(4)349,
10(1)1,
10(3)12,
11(1)2,
12(1)5,
12(2)7,
12(3)15,
12(4)22,
13(1)1,
13(2)11,
13(3)22,
13(3)26,
13(4)32,
15(1)1,
15(2)7,
16(3)12,
17(1)1,
17(1)2
- kernel,
12(3)14,
13(1)10,
15(4)16,
16(2)6
- limitation,
9(3)259,
10(2)8,
10(3)9,
11(1)4,
14(3)27,
14(4)30,
15(1)4,
16(1)3,
17(4)14
- Linux,
7(2)175,
12(2)10,
15(4)16
- machine,
2(2)159,
2(2)177,
2(3)230,
2(3)295,
12(2)12,
14(1)6,
14(1)10,
14(2)18,
14(2)21,
15(2)9,
15(3)12,
16(3)9,
16(4)13,
16(4)14,
17(2)8,
18(2)6,
18(3)11
- memory,
2(4)390,
10(4)5,
12(2)8,
12(2)10,
15(2)8,
17(3)10,
18(1)4
- Microsoft,
13(1)10,
15(1)2,
17(4)14
- monitoring,
11(2)2,
12(2)13,
12(3)19,
13(2)12,
13(4)38,
14(1)13,
15(2)10,
16(1)3,
16(4)14
- native,
16(1)1,
16(3)9
- new,
1(1)3,
1(1)93,
2(1)105,
2(2)138,
2(3)295,
9(2)181,
9(4)461,
10(1)3,
10(2)6,
10(4)6,
11(4)17,
12(1)2,
12(1)3,
12(2)11,
12(3)14,
12(3)15,
12(3)16,
12(4)21,
12(4)22,
13(2)15,
13(4)29,
13(4)34,
14(1)4,
14(1)5,
14(1)6,
14(1)13,
14(3)23,
14(3)27,
14(4)30,
15(1)3,
15(2)7,
15(2)9,
15(2)10,
15(3)12,
15(4)15,
16(2)5,
16(3)12,
16(4)16,
16(4)17,
17(1)4,
17(2)7,
17(3)10,
17(4)15,
18(1)1,
18(1)2,
18(3)10,
18(3)11
- number,
7(2)319,
9(2)181,
10(1)4,
10(2)5,
10(3)11,
10(3)12,
10(4)5,
11(1)2,
11(2)5,
11(3)12,
11(3)14,
11(3)15,
12(1)1,
12(1)2,
12(1)5,
12(1)6,
12(2)8,
12(2)9,
12(2)13,
12(3)16,
12(3)18,
12(4)21,
13(1)10,
13(3)20,
13(3)22,
13(3)25,
13(4)32,
13(4)34,
14(1)11,
14(3)26,
14(4)31,
15(1)4,
15(2)7,
15(2)8,
15(4)15,
16(1)4,
16(4)14,
16(4)16,
17(3)10,
17(4)16,
18(2)8
- offer,
1(1)93,
9(4)461,
10(4)1,
10(4)6,
12(1)3,
13(4)29,
13(4)31,
17(1)4,
18(1)3
- online,
1(1)3,
9(3)235,
11(2)5,
11(4)19,
12(2)13,
12(4)22,
13(4)41,
14(1)11,
14(4)32,
15(2)9,
16(4)14,
17(4)14,
18(1)1,
18(4)13
- only,
2(3)230,
2(3)295,
10(4)3,
11(1)3,
11(2)4,
11(3)13,
11(4)20,
12(1)2,
12(1)3,
12(2)13,
12(3)19,
12(4)21,
13(1)10,
13(3)25,
13(3)28,
13(4)35,
13(4)37,
13(4)39,
14(1)5,
14(1)11,
14(3)26,
14(4)31,
15(2)9,
15(4)16,
15(4)18,
16(1)3,
16(2)6,
16(3)9,
16(3)10,
16(4)13,
17(3)9,
17(4)15,
18(2)5,
18(2)8
- OS,
12(3)14
- overhead,
2(3)269,
11(2)5,
11(4)18,
11(4)23,
12(2)8,
12(3)14,
13(3)25,
14(1)5,
15(2)6,
15(2)9,
16(1)1,
16(2)6,
16(3)9,
16(3)11,
17(3)10,
17(4)15,
18(3)11,
18(4)12
- particularly,
11(3)16,
14(1)7,
14(4)28,
18(3)10
- present,
1(1)26,
2(1)3,
2(1)65,
2(2)177,
2(3)230,
2(3)269,
2(3)295,
2(4)354,
7(2)319,
9(2)181,
9(4)461,
10(1)2,
10(2)7,
10(3)10,
10(3)11,
10(3)12,
10(4)2,
10(4)3,
11(1)2,
11(1)4,
11(2)2,
11(2)5,
11(3)14,
11(4)22,
12(1)2,
12(1)4,
12(2)10,
12(2)11,
12(3)14,
12(3)15,
12(3)16,
12(3)17,
12(4)22,
13(1)10,
13(3)20,
13(3)22,
13(3)25,
13(3)28,
13(4)29,
13(4)41,
14(1)4,
14(1)5,
14(1)6,
15(1)2,
15(2)6,
15(2)8,
15(2)10,
15(3)12,
15(3)13,
15(4)16,
15(4)18,
16(2)6,
16(4)13,
16(4)14,
17(1)4,
17(2)6,
17(2)7,
17(2)8,
17(3)9,
17(3)12,
17(4)14,
17(4)15,
17(4)16,
18(1)3,
18(1)4,
18(2)7,
18(3)9,
18(3)10,
18(3)11,
18(4)12,
18(4)14
- process,
1(1)26,
2(1)65,
9(4)421,
10(3)9,
10(4)4,
11(1)2,
11(1)4,
11(4)18,
11(4)20,
12(2)11,
12(3)14,
13(1)10,
13(3)25,
13(4)36,
15(3)13,
16(2)5,
17(2)6,
17(4)14,
18(1)3
- program,
2(1)65,
2(3)332,
11(3)14,
12(1)1,
12(2)10,
12(2)11,
12(3)16,
12(3)19,
13(3)21,
14(3)24,
15(1)2,
15(2)10,
17(1)2,
17(3)11,
18(1)4
- recent,
2(1)65,
2(2)138,
10(2)8,
10(3)9,
11(1)2,
11(4)22,
12(1)2,
12(2)12,
14(1)7,
14(1)14,
14(4)29,
15(1)3,
16(3)10,
18(1)1,
18(2)5,
18(2)7,
18(4)13
- related,
9(4)421,
10(2)5,
10(4)2,
13(3)27,
15(2)7,
15(3)11
- result,
1(1)3,
1(1)26,
2(3)230,
2(4)390,
9(2)162,
10(1)3,
10(1)4,
10(2)5,
10(2)6,
10(3)9,
10(3)11,
10(4)2,
10(4)5,
11(2)3,
11(2)5,
11(3)13,
11(3)15,
11(4)18,
11(4)20,
11(4)21,
11(4)22,
12(1)4,
12(2)9,
12(3)14,
12(3)17,
13(1)10,
13(3)22,
13(3)24,
13(3)25,
13(4)33,
13(4)35,
14(1)2,
14(1)14,
14(2)19,
15(1)5,
15(2)7,
15(2)8,
15(3)12,
15(3)13,
15(3)14,
15(4)15,
16(1)2,
16(1)3,
16(2)5,
16(2)6,
16(3)10,
16(3)11,
16(4)14,
16(4)17,
17(2)7,
17(3)9,
17(3)10,
17(3)12,
17(4)14,
18(1)4,
18(2)5,
18(2)6,
18(3)9,
18(3)11,
18(4)12,
18(4)13
- reuse,
12(4)21,
14(1)3,
16(4)15
- semantic,
1(1)93,
10(2)8,
10(4)2,
11(4)21,
12(2)13,
12(3)14,
13(2)12,
13(3)21,
13(4)36,
14(3)25,
15(3)13,
16(1)1,
17(1)2,
17(1)3,
17(2)7
- suffer,
10(4)4,
15(1)4,
17(1)2,
18(4)12
- technique,
1(1)3,
2(2)138,
2(3)230,
2(3)295,
2(4)416,
7(2)274,
9(4)391,
9(4)461,
10(2)6,
10(3)9,
10(4)6,
11(2)2,
11(3)12,
11(3)16,
11(4)17,
11(4)18,
11(4)22,
12(1)4,
12(2)11,
12(2)13,
12(3)16,
12(3)18,
13(3)22,
13(3)25,
13(3)28,
13(4)32,
13(4)33,
13(4)35,
13(4)36,
13(4)39,
14(1)3,
14(1)5,
14(1)6,
14(1)13,
14(3)24,
14(4)32,
15(1)2,
15(1)5,
15(2)7,
15(2)8,
15(3)12,
15(4)17,
15(4)18,
16(1)2,
16(2)6,
16(3)11,
16(4)13,
16(4)14,
17(3)9,
17(3)12,
17(4)16,
18(1)2,
18(2)6,
18(3)11
- tested,
11(4)23
- through,
5(4)367,
6(1)1,
9(2)162,
10(3)12,
10(4)2,
10(4)6,
11(2)2,
11(3)12,
11(4)22,
11(4)23,
12(2)8,
12(2)13,
13(2)12,
13(3)25,
14(1)13,
15(3)12,
15(4)16,
16(2)5,
16(3)9,
17(4)14,
18(1)2,
18(2)7,
18(3)11
- thus,
2(2)138,
10(3)12,
10(4)5,
13(3)20,
14(1)12,
14(3)26,
14(3)27,
15(1)4,
17(3)10,
17(3)11,
18(1)1,
18(4)13
- time-consuming,
11(1)2
- tool,
1(1)66,
2(3)332,
2(4)390,
7(2)274,
9(2)181,
10(4)2,
12(2)10,
13(3)24,
13(3)26,
13(4)30,
13(4)40,
14(1)6,
15(1)3,
15(4)18,
16(1)4,
17(2)7,
18(1)1,
18(1)4
- top,
11(4)18
- training,
1(1)3
- trusted,
2(2)138,
2(3)269,
8(2)153,
10(4)3,
11(2)6,
11(3)14,
12(1)3,
13(4)39,
14(1)8,
14(3)27,
14(4)29,
15(2)9,
16(2)5,
16(4)15,
17(2)6,
18(2)8
- used,
1(1)3,
2(1)65,
2(4)416,
7(2)319,
9(2)181,
10(1)2,
10(2)5,
10(2)7,
10(2)8,
10(4)2,
11(1)2,
11(1)3,
11(2)3,
11(3)14,
11(3)15,
11(3)16,
11(4)21,
11(4)22,
12(2)8,
12(3)15,
13(1)10,
13(3)22,
13(3)25,
13(4)29,
13(4)34,
14(1)3,
14(1)12,
14(1)13,
14(3)27,
15(1)3,
15(1)5,
15(3)12,
15(4)17,
15(4)18,
16(2)8,
16(3)10,
17(1)1,
17(2)7,
17(3)9,
17(4)13,
18(1)3,
18(2)5,
18(2)6,
18(3)9,
18(4)13,
18(4)14
- utility,
11(1)2,
18(2)7
- via,
2(3)295,
2(4)390,
9(4)461,
11(3)13,
12(3)14,
12(3)18,
14(1)9,
16(4)17,
17(2)5
- virtual,
4(2)103,
11(1)3,
11(1)4,
13(4)38,
14(3)27,
14(4)30,
16(3)9,
17(2)8,
17(4)13,
18(2)6
- wide,
11(4)19,
12(3)14,
13(3)21,
14(1)10,
15(1)2,
15(4)15,
16(2)5,
16(4)14,
16(4)17,
17(4)16
- Windows,
5(4)398,
13(1)10,
15(4)16,
17(4)14