Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
VMI-PL: A monitoring language for virtual platforms using virtual machine introspection
Blekinge Institute of Technology, Faculty of Computing, Department of Computer Science and Engineering.
2014 (English)In: Digital Investigation. The International Journal of Digital Forensics and Incident Response, ISSN 1742-2876, E-ISSN 1873-202X, Vol. 11, no Supplement 2Article in journal (Refereed) Published
Abstract [en]

With the growth of virtualization and cloud computing, more and more forensic investigations rely on being able to perform live forensics on a virtual machine using virtual machine introspection (VMI). Inspecting a virtual machine through its hypervisor enables investigation without risking contamination of the evidence, crashing the computer, etc. To further access to these techniques for the investigator/researcher we have developed a new VMI monitoring language. This language is based on a review of the most commonly used VMI-techniques to date, and it enables the user to monitor the virtual machine's memory, events and data streams. A prototype implementation of our monitoring system was implemented in KVM, though implementation on any hypervisor that uses the common x86 virtualization hardware assistance support should be straightforward. Our prototype outperforms the proprietary VMWare VProbes in many cases, with a maximum performance loss of 18% for a realistic test case, which we consider acceptable. Our implementation is freely available under a liberal software distribution license.

Place, publisher, year, edition, pages
Elsevier , 2014. Vol. 11, no Supplement 2
Keyword [en]
Virtualization, Security, Monitoring language, Live forensics, Introspection, Classification
National Category
Computer Science
Identifiers
URN: urn:nbn:se:bth-6500DOI: 10.1016/j.diin.2014.05.016Local ID: oai:bth.se:forskinfo506A2393A07FE42FC1257DA20041D51COAI: oai:DiVA.org:bth-6500DiVA: diva2:834018
Note

http://www.sciencedirect.com/science/article/pii/S1742287614000590

Available from: 2014-12-05 Created: 2014-12-02 Last updated: 2017-12-04Bibliographically approved

Open Access in DiVA

fulltext(329 kB)132 downloads
File information
File name FULLTEXT01.pdfFile size 329 kBChecksum SHA-512
a6aed9a7e2f63fbf711176b869f6d76429c5302ac4a93f74ba51f6ddf7e0eebe8e5af01d78ef6f3ec00c453a45b75f825d8f2d51ea84b13d1a6bc1877b978c3d
Type fulltextMimetype application/pdf

Other links

Publisher's full text

Authority records BETA

Axelsson, Stefan

Search in DiVA

By author/editor
Axelsson, Stefan
By organisation
Department of Computer Science and Engineering
In the same journal
Digital Investigation. The International Journal of Digital Forensics and Incident Response
Computer Science

Search outside of DiVA

GoogleGoogle Scholar
Total: 132 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 169 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf