Using Hardware Isolated Execution Environments for Securing Systems
Date
2015
Authors
Zhang, Fengwei
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
With the rapid proliferation of malware attacks on the Internet, malware detection and analysis play a critical role in crafting effective defenses. Advanced malware detection and analysis rely on virtualization and emulation technologies to introspect the malware in an isolated environment and analyze malicious activities by instrumenting code execution. Virtual Machine Introspection (VMI) systems have been widely adopted for malware detection and analysis. VMI systems use hypervisor technology to create an isolated execution environment for system introspection and to expose malicious activity. However, recent malware can detect the presence of virtualization or corrupt the hypervisor state and thus avoid detection and debugging.
Description
Keywords
Computer science, Debugging, Detection, Malware, SMM, Transparency