Determining the Forensic Data Requirements for Investigating Hypervisor Attacks - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2019

Determining the Forensic Data Requirements for Investigating Hypervisor Attacks

Résumé

Hardware/server virtualization is commonly employed in cloud computing to enable ubiquitous access to shared system resources and provide sophisticated services. The virtualization is typically performed by a hypervisor, which provides mechanisms that abstract hardware and system resources from the operating system. However, hypervisors are complex software systems with many vulnerabilities. This chapter analyzes recently-discovered vulnerabilities associated with the Xen and KVM open-source hypervisors, and develops their attack profiles in terms of hypervisor functionality (attack vectors), attack types and attack sources. Based on the large number of vulnerabilities related to hypervisor functionality, two sample attacks leveraging key attack vectors are investigated. The investigation clarifies the evidence coverage for detecting attacks and the missing evidence needed to reconstruct attacks.
Fichier principal
Vignette du fichier
488399_1_En_14_Chapter.pdf (282.96 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-02534598 , version 1 (07-04-2020)

Licence

Paternité

Identifiants

Citer

Changwei Liu, Anoop Singhal, Ramaswamy Chandramouli, Duminda Wijesekera. Determining the Forensic Data Requirements for Investigating Hypervisor Attacks. 15th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2019, Orlando, FL, United States. pp.253-272, ⟨10.1007/978-3-030-28752-8_14⟩. ⟨hal-02534598⟩
33 Consultations
76 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More