Hypervisor-based Memory Introspection at the Next Level: User-Mode Memory Introspection and Protection of Live VMs

No ratings

Presented at ATC 2015 by

Andrei Lutas

We are living in an era when advanced malware and APTs are trying day-by-day to steal our money, get away with our confidential data, or allow unknown foreign state-sponsored entities to take full control over our systems. With the growing ineffectiveness of traditional anti-malware solutions, it became more than obvious that the industry needs to employ game-changing technologies: we need to get security to a next level. While the support for hardware virtualization becomes generally available on a large variety of platforms, security software taking advantage of it still needs to evolve to be ready for wide scale adoption. While kernel memory introspection, capable of providing rootkit protection is well known in the academia, we've taken the idea beyond the current state-of-the-art providing synchronous, real-time protection for live-VMs against a wide scale of threats.