论文标题
定制：虚拟机文件保护系统可针对零日攻击
ferify: A Virtual Machine File Protection System against Zero-Day Attacks
论文作者
论文摘要
保护VM的大多数现有解决方案都采用已知的攻击模式或签名，并专注于检测系统文件和内核级内存结构的恶意操纵。在这项研究中，我们开发了一个名为FIRIFY的系统，该系统利用VM内省（VMI）来保护托管在VM上的用户文件免受未经授权的访问，即使攻击者设法在VM上获得了根特权。 Fricify在“管理程序”域中保持阴影文件访问控制列表（SACL），该列表完全透明了VM。它使用SACL对可能在目标文件上操作的所有系统调用执行独立的访问控制。此外，FIRIFY可以防止内核修改，确保过程所有权的完整性并支持基于操纵程序的用户身份验证。我们已经开发了一个针对Linux的原型原型，并通过一组受控的实验表明，该系统能够减轻一系列零日攻击，否则这些攻击可能会逃避基于签名的解决方案。此外，我们分析了系统调用捕获的高处理开销的根本原因，并提出了一种可以将其开销降低一半的通用解决方案。
Most existing solutions for protecting VMs assume known attack patterns or signatures and focus on detecting malicious manipulations of system files and kernel level memory structures. In this research we develop a system called ferify, which leverages VM introspection (VMI) to protect user files hosted on a VM against unauthorized access even after an attacker has managed to obtain root privileges on the VM. ferify maintains in the hypervisor domain a shadow file access control list (SACL) that is totally transparent to the VM. It uses the SACL to perform independent access control on all system calls that may operate on the target files. Further, ferify prevents kernel modification, ensures the integrity of process ownership, and supports hypervisor based user authentication. We have developed a ferify prototype for Linux and through a set of controlled experiments we show that the system is able to mitigate a range of zero-day attacks that otherwise may evade signature-based solutions. In addition, we analyze the root cause of the observed high processing overhead from trapping of system calls, and propose a general solution that can potentially cut that overhead by half.
