Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment
Sensitive files in computer systems such as executable programs, configuration, and authorization information have a great importance of their own, in terms of both confidentiality and functionality. To protect sensitive files, an effective approach named as file integrity monitoring is proposed to...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2018-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8398204/ |
| _version_ | 1818329658857357312 |
|---|---|
| author | Bin Shi Bo Li Lei Cui Liu Ouyang |
| author_facet | Bin Shi Bo Li Lei Cui Liu Ouyang |
| author_sort | Bin Shi |
| collection | DOAJ |
| description | Sensitive files in computer systems such as executable programs, configuration, and authorization information have a great importance of their own, in terms of both confidentiality and functionality. To protect sensitive files, an effective approach named as file integrity monitoring is proposed to detect aggressive behaviors by verifying all the actions on these sensitive files. However, due to semantic gap problems, current file integrity monitoring tools are incapable of monitoring files in memory, so that an illegal modification of a file may bypass the detection by deliberately hiding itself inside the cache without actually committing to the disk. In this paper, we propose a runtime sensitive file integrity monitoring system named Vanguard, to satisfy the requirement of cache-level file protection. It can monitor both IO operations and cache operations, thereby deterring the illegal file accesses. To achieve the cache-level monitoring, we explore the techniques to detect when sensitive files are loaded into and swapped out from the operating system page cache. Vanguard is isolated from the monitored system so it is hard to be subverted. We implement Vanguard on QEMU/KVM platform, and both Linux and Windows guest operating systems are supported. We conduct several experiments, and the experimental results show the effectiveness of Vanguard and imply that our method incurs acceptable overhead. |
| first_indexed | 2024-12-13T12:51:34Z |
| format | Article |
| id | doaj.art-c1e0b50cbcfe47fdbbe87470a9dd0cb4 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-13T12:51:34Z |
| publishDate | 2018-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-c1e0b50cbcfe47fdbbe87470a9dd0cb42022-12-21T23:45:19ZengIEEEIEEE Access2169-35362018-01-016385673857710.1109/ACCESS.2018.28511928398204Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine EnvironmentBin Shi0Bo Li1https://orcid.org/0000-0002-6297-712XLei Cui2Liu Ouyang3School of Computer Science and Engineering, Beihang University, Beijing, ChinaSchool of Computer Science and Engineering, Beihang University, Beijing, ChinaInstitute of Information Engineering, Chinese Academy of Sciences, Beijing, ChinaMarketing Department, State Grid Zhejiang Electric Power Co., Ltd, Hangzhou, ChinaSensitive files in computer systems such as executable programs, configuration, and authorization information have a great importance of their own, in terms of both confidentiality and functionality. To protect sensitive files, an effective approach named as file integrity monitoring is proposed to detect aggressive behaviors by verifying all the actions on these sensitive files. However, due to semantic gap problems, current file integrity monitoring tools are incapable of monitoring files in memory, so that an illegal modification of a file may bypass the detection by deliberately hiding itself inside the cache without actually committing to the disk. In this paper, we propose a runtime sensitive file integrity monitoring system named Vanguard, to satisfy the requirement of cache-level file protection. It can monitor both IO operations and cache operations, thereby deterring the illegal file accesses. To achieve the cache-level monitoring, we explore the techniques to detect when sensitive files are loaded into and swapped out from the operating system page cache. Vanguard is isolated from the monitored system so it is hard to be subverted. We implement Vanguard on QEMU/KVM platform, and both Linux and Windows guest operating systems are supported. We conduct several experiments, and the experimental results show the effectiveness of Vanguard and imply that our method incurs acceptable overhead.https://ieeexplore.ieee.org/document/8398204/Page cachefile integrityreal-timeintrospectionvirtualizationcloud environment |
| spellingShingle | Bin Shi Bo Li Lei Cui Liu Ouyang Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment IEEE Access Page cache file integrity real-time introspection virtualization cloud environment |
| title | Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment |
| title_full | Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment |
| title_fullStr | Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment |
| title_full_unstemmed | Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment |
| title_short | Vanguard: A Cache-Level Sensitive File Integrity Monitoring System in Virtual Machine Environment |
| title_sort | vanguard a cache level sensitive file integrity monitoring system in virtual machine environment |
| topic | Page cache file integrity real-time introspection virtualization cloud environment |
| url | https://ieeexplore.ieee.org/document/8398204/ |
| work_keys_str_mv | AT binshi vanguardacachelevelsensitivefileintegritymonitoringsysteminvirtualmachineenvironment AT boli vanguardacachelevelsensitivefileintegritymonitoringsysteminvirtualmachineenvironment AT leicui vanguardacachelevelsensitivefileintegritymonitoringsysteminvirtualmachineenvironment AT liuouyang vanguardacachelevelsensitivefileintegritymonitoringsysteminvirtualmachineenvironment |